From cb6e3048c28a215f6575a8737732351948e7cca7 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 28 Aug 2026 15:41:23 +0000 Subject: [PATCH 1/2] Bump sha2 from 0.9.9 to 0.10.9 Bumps [sha2](https://github.com/RustCrypto/hashes) from 0.9.9 to 0.10.9. - [Commits](https://github.com/RustCrypto/hashes/compare/sha2-v0.9.9...sha2-v0.10.9) --- updated-dependencies: - dependency-name: sha2 dependency-version: 0.10.9 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] --- Cargo.lock | 2 +- crates/ev-enclave/Cargo.toml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 6bf1d815..3e44aca6 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -1355,7 +1355,7 @@ dependencies = [ "serde_cbor", "serde_json", "serial_test", - "sha2 0.9.9", + "sha2 0.10.9", "tempfile", "thiserror 2.0.19", "tokio", diff --git a/crates/ev-enclave/Cargo.toml b/crates/ev-enclave/Cargo.toml index 58f9e7a7..ed11ff0b 100644 --- a/crates/ev-enclave/Cargo.toml +++ b/crates/ev-enclave/Cargo.toml @@ -39,7 +39,7 @@ axum = "0.5.16" serde_cbor = "0.11" base64 = "0.22.1" aws-nitro-enclaves-image-format = "0.2.0" -sha2 = "0.9.9" +sha2 = "0.10.9" git2 = "0.21" version-compare = "0.2.1" regex = "1.8.1" From 738b3bf50d124b448de2fe545d7a333c161678a8 Mon Sep 17 00:00:00 2001 From: Matt Paletta Date: Fri, 28 Aug 2026 16:52:07 +0100 Subject: [PATCH 2/2] Compute PCR8 with sha2 0.10 directly aws-nitro-enclaves-image-format 0.2.0 pins sha2 0.9, so its EifHasher would not accept a sha2 0.10 Sha384. Versions of that crate which take sha2 0.10 (0.6.0+) force aws-nitro-enclaves-cose/key_kms, pulling in the AWS KMS SDK and breaking attestation-doc-validation 0.7.4. EifHasher::new_without_cache + write_all + tpm_extend_finalize_reset is just SHA384(0u8 * 48 || SHA384(cert)), so compute that inline and drop the dependency. Verified byte-identical output against the old code path for empty, short, 256-byte and 100KB inputs. Co-Authored-By: Claude Opus 5 --- Cargo.lock | 176 ++++-------------------------- crates/ev-enclave/Cargo.toml | 1 - crates/ev-enclave/src/cert/mod.rs | 19 ++-- 3 files changed, 30 insertions(+), 166 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 3e44aca6..5e806076 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -274,7 +274,7 @@ dependencies = [ "serde_bytes", "serde_cbor", "serde_with 2.3.3", - "sha2 0.10.9", + "sha2", "thiserror 1.0.69", "webpki", "x509-parser 0.14.0", @@ -303,7 +303,6 @@ version = "0.5.2" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "b8a94047bd9c3717c6ca3a145504c0e26b64a5e2d9eb9559b187748433fbc382" dependencies = [ - "openssl", "serde", "serde_bytes", "serde_cbor", @@ -311,27 +310,6 @@ dependencies = [ "serde_with 3.12.0", ] -[[package]] -name = "aws-nitro-enclaves-image-format" -version = "0.2.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c24e2101441ce8f8dd0799ce7e36c68571ecf5e3731190b277c63765aaed8c1c" -dependencies = [ - "aws-nitro-enclaves-cose", - "byteorder", - "chrono", - "clap 3.2.25", - "crc 1.8.1", - "hex", - "num-derive", - "num-traits", - "openssl", - "serde", - "serde_cbor", - "serde_json", - "sha2 0.9.9", -] - [[package]] name = "aws-nitro-enclaves-nsm-api" version = "0.4.0" @@ -470,15 +448,6 @@ version = "2.8.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "8f68f53c83ab957f72c32642f3868eec03eb974d1fb82e453128456482613d36" -[[package]] -name = "block-buffer" -version = "0.9.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "4152116fd6e9dadb291ae18fc1ec3575ed6d84c29642d97890f4b4a3417297e4" -dependencies = [ - "generic-array", -] - [[package]] name = "block-buffer" version = "0.10.4" @@ -488,12 +457,6 @@ dependencies = [ "generic-array", ] -[[package]] -name = "build_const" -version = "0.2.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b4ae4235e6dac0694637c763029ecea1a2ec9e4e06ec2729bd21ba4d9c863eb7" - [[package]] name = "bumpalo" version = "3.17.0" @@ -563,21 +526,6 @@ dependencies = [ "inout", ] -[[package]] -name = "clap" -version = "3.2.25" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "4ea181bf566f71cb9a5d17a59e1871af638180a18fb0035c92ae62b705207123" -dependencies = [ - "atty", - "bitflags 1.3.2", - "clap_lex 0.2.4", - "indexmap 1.9.3", - "strsim 0.10.0", - "termcolor", - "textwrap", -] - [[package]] name = "clap" version = "4.5.38" @@ -596,8 +544,8 @@ checksum = "379026ff283facf611b0ea629334361c4211d1b12ee01024eec1591133b04120" dependencies = [ "anstream", "anstyle", - "clap_lex 0.7.4", - "strsim 0.11.1", + "clap_lex", + "strsim", ] [[package]] @@ -612,15 +560,6 @@ dependencies = [ "syn 2.0.98", ] -[[package]] -name = "clap_lex" -version = "0.2.4" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2850f2f5a82cbf437dd5af4d49848fbdfc27c157c3d010345776f952765261c5" -dependencies = [ - "os_str_bytes", -] - [[package]] name = "clap_lex" version = "0.7.4" @@ -732,15 +671,6 @@ dependencies = [ "libc", ] -[[package]] -name = "crc" -version = "1.8.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d663548de7f5cca343f1e0a48d14dcfb0e9eb4e079ec58883b7251539fa10aeb" -dependencies = [ - "build_const", -] - [[package]] name = "crc" version = "3.3.0" @@ -904,7 +834,7 @@ dependencies = [ "ident_case", "proc-macro2", "quote", - "strsim 0.11.1", + "strsim", "syn 2.0.98", ] @@ -1097,22 +1027,13 @@ version = "0.4.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "6184e33543162437515c2e2b48714794e37845ec9851711914eec9d308f6ebe8" -[[package]] -name = "digest" -version = "0.9.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d3dd60d1080a57a05ab032377049e0591415d2b31afd7028356dbf3cc6dcb066" -dependencies = [ - "generic-array", -] - [[package]] name = "digest" version = "0.10.7" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292" dependencies = [ - "block-buffer 0.10.4", + "block-buffer", "const-oid 0.9.6", "crypto-common 0.1.6", "subtle", @@ -1154,7 +1075,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "ee27f32b5c5292967d2d4a9d7f1e0b0aed2c15daded5a60300e4abb9d8020bca" dependencies = [ "der 0.7.9", - "digest 0.10.7", + "digest", "elliptic-curve 0.13.8", "rfc6979 0.4.0", "signature", @@ -1176,7 +1097,7 @@ dependencies = [ "base16ct 0.1.1", "crypto-bigint 0.4.9", "der 0.6.1", - "digest 0.10.7", + "digest", "ff 0.12.1", "generic-array", "group 0.12.1", @@ -1197,7 +1118,7 @@ checksum = "b5e6043086bf7973472e0c7dff2142ea0b680d30e18d9cc40f267efbf222bd47" dependencies = [ "base16ct 0.2.0", "crypto-bigint 0.5.5", - "digest 0.10.7", + "digest", "ff 0.13.0", "generic-array", "group 0.13.0", @@ -1291,7 +1212,7 @@ dependencies = [ "attestation-doc-validation", "atty", "chrono", - "clap 4.5.38", + "clap", "common", "dialoguer", "env_logger", @@ -1325,12 +1246,11 @@ dependencies = [ "async-trait", "attestation-doc-validation", "atty", - "aws-nitro-enclaves-image-format", "axum", "base64 0.22.1", "bytes", "chrono", - "clap 4.5.38", + "clap", "common", "dialoguer", "elliptic-curve 0.14.1", @@ -1355,7 +1275,7 @@ dependencies = [ "serde_cbor", "serde_json", "serial_test", - "sha2 0.10.9", + "sha2", "tempfile", "thiserror 2.0.19", "tokio", @@ -1742,7 +1662,7 @@ version = "0.12.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "6c49c37c09c17a53d937dfbb742eb3a961d65a994e6bcdcf37e7399d0cc8ab5e" dependencies = [ - "digest 0.10.7", + "digest", ] [[package]] @@ -2344,8 +2264,8 @@ version = "0.13.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "c60a23ffb90d527e23192f1246b14746e2f7f071cb84476dd879071696c18a4a" dependencies = [ - "crc 3.3.0", - "sha2 0.10.9", + "crc", + "sha2", ] [[package]] @@ -2495,17 +2415,6 @@ version = "0.2.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "c6673768db2d862beb9b39a78fdcb1a69439615d5794a1be50caa9bc92c81967" -[[package]] -name = "num-derive" -version = "0.3.3" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "876a53fff98e03a936a674b29568b0e605f06b29372c2489ff4de23f1949743d" -dependencies = [ - "proc-macro2", - "quote", - "syn 1.0.109", -] - [[package]] name = "num-integer" version = "0.1.46" @@ -2636,12 +2545,6 @@ dependencies = [ "windows-sys 0.52.0", ] -[[package]] -name = "os_str_bytes" -version = "6.6.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e2355d85b9a3786f481747ced0e0ff2ba35213a1f9bd406ed906554d7af805a1" - [[package]] name = "p256" version = "0.12.0" @@ -2651,7 +2554,7 @@ dependencies = [ "ecdsa 0.15.1", "elliptic-curve 0.12.3", "primeorder 0.12.1", - "sha2 0.10.9", + "sha2", ] [[package]] @@ -2663,7 +2566,7 @@ dependencies = [ "ecdsa 0.15.1", "elliptic-curve 0.12.3", "primeorder 0.12.1", - "sha2 0.10.9", + "sha2", ] [[package]] @@ -2675,7 +2578,7 @@ dependencies = [ "ecdsa 0.16.9", "elliptic-curve 0.13.8", "primeorder 0.13.6", - "sha2 0.10.9", + "sha2", ] [[package]] @@ -2707,7 +2610,7 @@ version = "0.12.2" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "f8ed6a7761f76e3b9f92dfb0a60a6a6477c61024b775147ff0973a02653abaf2" dependencies = [ - "digest 0.10.7", + "digest", "hmac", ] @@ -3636,20 +3539,7 @@ checksum = "e3bf829a2d51ab4a5ddf1352d8470c140cadc8301b2ae1789db023f01cedd6ba" dependencies = [ "cfg-if", "cpufeatures", - "digest 0.10.7", -] - -[[package]] -name = "sha2" -version = "0.9.9" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "4d58a1e1bf39749807d89cf2d98ac2dfa0ff1cb3faa38fbb64dd88ac8013d800" -dependencies = [ - "block-buffer 0.9.0", - "cfg-if", - "cpufeatures", - "digest 0.9.0", - "opaque-debug", + "digest", ] [[package]] @@ -3660,7 +3550,7 @@ checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283" dependencies = [ "cfg-if", "cpufeatures", - "digest 0.10.7", + "digest", ] [[package]] @@ -3711,7 +3601,7 @@ version = "2.0.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "8fe458c98333f9c8152221191a77e2a44e8325d0193484af2e9421a53019e57d" dependencies = [ - "digest 0.10.7", + "digest", "rand_core 0.6.4", ] @@ -3791,12 +3681,6 @@ version = "1.2.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "a8f112729512f8e442d81f95a8a7ddf2b7c6b8a1a6f509a95864142b30cab2d3" -[[package]] -name = "strsim" -version = "0.10.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "73473c0e59e6d5812c5dfe2a064a6444949f089e20eec9a2e5506596494e4623" - [[package]] name = "strsim" version = "0.11.1" @@ -3949,15 +3833,6 @@ dependencies = [ "windows-sys 0.59.0", ] -[[package]] -name = "termcolor" -version = "1.4.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "06794f8f6c5c898b3275aebefa6b8a1cb24cd2c6c79397ab15774837a0bc5755" -dependencies = [ - "winapi-util", -] - [[package]] name = "termtree" version = "0.5.1" @@ -4614,15 +4489,6 @@ version = "0.4.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6" -[[package]] -name = "winapi-util" -version = "0.1.9" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "cf221c93e13a30d793f7645a0e7762c55d169dbb0a49671918a2319d289b10bb" -dependencies = [ - "windows-sys 0.59.0", -] - [[package]] name = "winapi-x86_64-pc-windows-gnu" version = "0.4.0" diff --git a/crates/ev-enclave/Cargo.toml b/crates/ev-enclave/Cargo.toml index ed11ff0b..5c3bb91a 100644 --- a/crates/ev-enclave/Cargo.toml +++ b/crates/ev-enclave/Cargo.toml @@ -38,7 +38,6 @@ hex = "0.4.3" axum = "0.5.16" serde_cbor = "0.11" base64 = "0.22.1" -aws-nitro-enclaves-image-format = "0.2.0" sha2 = "0.10.9" git2 = "0.21" version-compare = "0.2.1" diff --git a/crates/ev-enclave/src/cert/mod.rs b/crates/ev-enclave/src/cert/mod.rs index 70806f3a..655134ee 100644 --- a/crates/ev-enclave/src/cert/mod.rs +++ b/crates/ev-enclave/src/cert/mod.rs @@ -1,4 +1,3 @@ -use aws_nitro_enclaves_image_format::defs::eif_hasher::EifHasher; use chrono::{DateTime, Datelike, Local, TimeZone, Utc}; use dialoguer::{Confirm, MultiSelect}; use itertools::Itertools; @@ -110,17 +109,17 @@ pub fn get_cert_pcr(cert_path: &Path) -> Result { let cert_contents = read_cert_bytes_from_fs(cert_path)?; let (_, pem) = parse_x509_pem(&cert_contents).map_err(CertError::PEMError)?; - let mut hasher = EifHasher::new_without_cache(Sha384::new()).map_err(CertError::HashError)?; + // PCR8 is a TPM-style extend of the cert digest into a zeroed register: + // SHA384(0u8 * 48 || SHA384(cert)). + let mut hasher = Sha384::new(); + hasher.update(&pem.contents); + let cert_digest = hasher.finalize(); - hasher - .write_all(&pem.contents) - .map_err(|err| CertError::HashError(err.to_string()))?; + let mut hasher = Sha384::new(); + hasher.update([0u8; 48]); + hasher.update(cert_digest); - let hash_bytes = hasher - .tpm_extend_finalize_reset() - .map_err(|err| CertError::HashError(err.to_string()))?; - - let hash = hex::encode(hash_bytes); + let hash = hex::encode(hasher.finalize()); Ok(hash) }