feat: add move entry function for verify attestation

[joyqvq]

Description

Describe the changes or additions included in this PR.

Test plan

───────────────────────────────────────────────────────────────────────────────────────────────────╮
│ Transaction Effects                                                                               │
├───────────────────────────────────────────────────────────────────────────────────────────────────┤
│ Digest: EKi3SxAAXzXUTn56MoKKDtXtYdbkcXY94LsWsEZ4o5ZN                                              │
│ Status: Success                                                                                   │
│ Executed Epoch: 6                                                                                 │
│ Mutated Objects:                                                                                  │
│  ┌──                                                                                              │
│  │ ID: 0x101c1e40e8f59302bc8673f3acf71066dcce5939b10c6accb3b4cd6036f46e04                         │
│  │ Owner: Account Address ( 0xfa469d15a399f7a000214f4630712c6e6207430499278e1c2e19a63d5dd821e5 )  │
│  │ Version: 4806                                                                                  │
│  │ Digest: HnMUEn3UmuLoL9Ph1kiNuec1XByvgmKFv6CuBKGi8Eez                                           │
│  └──                                                                                              │
│ Shared Objects:                                                                                   │
│  ┌──                                                                                              │
│  │ ID: 0x0000000000000000000000000000000000000000000000000000000000000006                         │
│  │ Version: 4805                                                                                  │
│  │ Digest: 3kSQomS162h2h3DWAqjhbmMeHjtokVA3kewaYV66zdiA                                           │
│  └──                                                                                              │
│ Gas Object:                                                                                       │
│  ┌──                                                                                              │
│  │ ID: 0x101c1e40e8f59302bc8673f3acf71066dcce5939b10c6accb3b4cd6036f46e04                         │
│  │ Owner: Account Address ( 0xfa469d15a399f7a000214f4630712c6e6207430499278e1c2e19a63d5dd821e5 )  │
│  │ Version: 4806                                                                                  │
│  │ Digest: HnMUEn3UmuLoL9Ph1kiNuec1XByvgmKFv6CuBKGi8Eez                                           │
│  └──                                                                                              │
│ Gas Cost Summary:                                                                                 │
│    Storage Cost: 988000 MIST                                                                      │
│    Computation Cost: 1000000 MIST                                                                 │
│    Storage Rebate: 978120 MIST                                                                    │
│    Non-refundable Storage Fee: 9880 MIST                                                          │
│                                                                                                   │
│ Transaction Dependencies:                                                                         │
│    ogFZK8yeyj8aW65KfjpydBxQza1DDEMaUorTVAk3FGT                                                    │
│    8HLYAqCnZ4FhfPcAFaWAXwjL6f8bzmkgqJDySoEotAsm                                                   │
│    E78irqocBhce6W6cqontHowPRRdAwCdNRak75tMPh4MK                                                   │
╰───────────────────────────────────────────────────────────────────────────────────────────────────╯
╭─────────────────────────────╮
│ No transaction block events │
╰─────────────────────────────╯

╭──────────────────────────────────────────────────────────────────────────────────────────────────╮
│ Object Changes                                                                                   │
├──────────────────────────────────────────────────────────────────────────────────────────────────┤
│ Mutated Objects:                                                                                 │
│  ┌──                                                                                             │
│  │ ObjectID: 0x101c1e40e8f59302bc8673f3acf71066dcce5939b10c6accb3b4cd6036f46e04                  │
│  │ Sender: 0xfa469d15a399f7a000214f4630712c6e6207430499278e1c2e19a63d5dd821e5                    │
│  │ Owner: Account Address ( 0xfa469d15a399f7a000214f4630712c6e6207430499278e1c2e19a63d5dd821e5 ) │
│  │ ObjectType: 0x2::coin::Coin<0x2::sui::SUI>                                                    │
│  │ Version: 4806                                                                                 │
│  │ Digest: HnMUEn3UmuLoL9Ph1kiNuec1XByvgmKFv6CuBKGi8Eez                                          │
│  └──                                                                                             │
╰──────────────────────────────────────────────────────────────────────────────────────────────────╯
╭───────────────────────────────────────────────────────────────────────────────────────────────────╮
│ Balance Changes                                                                                   │
├───────────────────────────────────────────────────────────────────────────────────────────────────┤
│  ┌──                                                                                              │
│  │ Owner: Account Address ( 0xfa469d15a399f7a000214f4630712c6e6207430499278e1c2e19a63d5dd821e5 )  │
│  │ CoinType: 0x2::sui::SUI                                                                        │
│  │ Amount: -1009880                                                                               │
│  └──                                                                                              │
╰───────────────────────────────────────────────────────────────────────────────────────────────────╯

sui replay:

     Running `target/debug/sui-tool replay --cfg-path /Users/joy/.sui/sui_config/client.yaml --rpc 'http://127.0.0.1:9000' tx --tx-digest EKi3SxAAXzXUTn56MoKKDtXtYdbkcXY94LsWsEZ4o5ZN`
2025-01-14T02:24:05.515413Z  INFO sui_replay: Executing tx: EKi3SxAAXzXUTn56MoKKDtXtYdbkcXY94LsWsEZ4o5ZN
2025-01-14T02:24:05.515867Z  INFO sui_replay::replay: Using RPC URL: http://127.0.0.1:9000
Execution finished successfully. Local and on-chain effects match.

---

Release notes

Check each box that your changes affect. If none of the boxes relate to your changes, release notes aren't required.

For each box you select, include information after the relevant heading that describes the impact of your changes that a user might notice and any actions they must take to implement updates.

• Protocol: Add a new native function to verify aws nitro enclave attestation in Devnet.
• Nodes (Validators and Full nodes):
• gRPC:
• JSON-RPC:
• GraphQL:
• CLI:
• Rust SDK:

[vercel]

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name	Status	Preview	Comments	Updated (UTC)
sui-docs	✅ Ready (Inspect)	Visit Preview	💬 Add feedback	Jan 24, 2025 8:17pm

2 Skipped Deployments

Name	Status	Preview	Comments	Updated (UTC)
multisig-toolkit	⬜️ Ignored (Inspect)	Visit Preview		Jan 24, 2025 8:17pm
sui-kiosk	⬜️ Ignored (Inspect)	Visit Preview		Jan 24, 2025 8:17pm

[benr-ml]

there is some meaning to the order, no? if simple, let's document it, else let's define this type explicitly

[joyqvq]

added

[benr-ml]

are we sure that PCR6 for example won't be added in the future? if not, should we store a vector of PCR { index: u8, data: vector}

[joyqvq]

        let pcrs = match document_map
            .iter()
            .find(|(k, _)| matches!(k, ciborium::value::Value::Text(s) if s == "pcrs"))
        {
            Some((_, ciborium::value::Value::Map(pcr_map))) => {
                let mut pcr_vec = Vec::new();
                // Valid PCR indices are 0, 1, 2, 3, 4, 8 for AWS.
                for i in [0, 1, 2, 3, 4, 8] {
                    if let Some((_, ciborium::value::Value::Bytes(val))) = pcr_map.iter().find(
                        |(k, _)| matches!(k, ciborium::value::Value::Integer(n) if *n == i.into()),
                    ) {
                        pcr_vec.push(val.clone());
                    } else {
                        return Err(NitroAttestationVerifyError::InvalidAttestationDoc(
                            "invalid PCR format".to_string(),
                        ));
                    }
                }
                pcr_vec
            }
            _ => {
                return Err(NitroAttestationVerifyError::InvalidAttestationDoc(
                    "cannot parse PCRs".to_string(),
                ))
            }
        };

we currently hardcode the index for 0, 1, 2, 3, 4, 8. there are all zero values in other indices and there are 26 of them. while we can parse all of them and return, this will be a quadratic lookup to look at all pcr values, my worry is that there is no limit on the number of pcr values.

[benr-ml]

Suggested change

	public fun verify_nitro_attestation(
	entry fun load_nitro_attestation(

[joyqvq]

iiuc this forbids other move module to call this? i would think its useful to expose it?

[benr-ml]

yes, other modules cannot call it, but in which use case do we need that? it's a user provided data.

as an entry function we have the flexibility to change the interface later if we like

[joyqvq]

its user provided data, but the output are consumed by the caller module which should check the rest like verifying the public key == user data and the signature verifies, and all pcrs match the registry?

https://github.com/MystenLabs/enclave-twitter/blob/main/move/sources/twitter.move#L25

[benr-ml]

that function could receive NitroAttestationDocument as an output a previous PTB command

[benr-ml]

also document the errors in case of expired cert, etc

[joyqvq]

all verify error is currently casted to a generic VerifyError. any reason this should be more specific?

[benr-ml]

sounds ok, let's have that error documented here

[benr-ml]

once we stabilize the move interface, let's test also:

• old cert
• invalid structs
• invalid cert sig

[joyqvq]

a related question, do you think the tests should exist twice in both move and sui-type? or we should port all sui-types tests here? agreed to add more tests. it will be quite involved (i need a mock signer in cert) so good to do it in a separate pr

[benr-ml]

I see, if we cover those cases in the Rust tests then indeed it's enough. Let's only test here the flows of the native call, i.e.,:

• parsing fails (with a hardcoded string)
• parsing succeeds, verification fails
• everything is good

[benr-ml]

@tzakian please review the conversions here

[benr-ml]

are we sure that PCR6 for example won't be added in the future? if not, should we store a vector of PCR { index: u8, data: vector}

[benr-ml]

should this (and below) be ref?