module ietf-rats-attestation-stream {
yang-version 1.1;
namespace
"urn:ietf:params:xml:ns:yang:ietf-rats-attestation-stream";
prefix ats;
import ietf-subscribed-notifications {
prefix sn;
reference
"RFC 8639: Subscription to YANG Notifications";
}
import ietf-tpm-remote-attestation {
prefix yang-brat;
reference
"draft-ietf-rats-yang-tpm-charra-00";
}
import ietf-yang-types {
prefix yang;
reference
"RFC 6991: Common YANG Data Types";
}
organization "IETF";
contact
"WG Web:
WG List:
Editor: Eric Voit
";
description
"This module contains conceptual YANG specifications for
subscribing to attestation streams being generated from TPM chips.
Copyright (c) 2020 IETF Trust and the persons identified as authors
of the code. All rights reserved.
Redistribution and use in source and binary forms, with or without
modification, is permitted pursuant to, and subject to the license
terms contained in, the Simplified BSD License set forth in Section
4.c of the IETF Trust's Legal Provisions Relating to IETF Documents
(https://trustee.ietf.org/license-info).
This version of this YANG module is part of RFC XXXX; see the RFC
itself for full legal notices.";
revision 2020-02-24 {
description
"Initial version.";
reference
"draft-voit-rats-trusted-path-routing";
}
/*
* FEATURES
*/
feature passport {
description
"This feature indicates that an Attester supports passports.";
}
/*
* IDENTITIES
*/
identity trustworthiness-level {
if-feature "passport";
description
"Base identity for a verifier assessed trustworthiness level.";
}
identity compromised {
base trustworthiness-level;
description
"A Verifier has appraised an Attester as compromised.";
}
identity unverified {
base trustworthiness-level;
description
"There is no recent Verifier appraisal of an Attester.";
}
identity boot-verified {
base trustworthiness-level;
description
"A Verifier has appraised an Attester as Boot Integrity Verified.";
}
/*
* Groupings
*/
grouping tpm-name {
description
"Name of a TPM.";
leaf tpm_name {
type string;
description
"Name of the TPM or All";
}
}
grouping tpm12-attestation {
description
"Contains an instance of TPM1.2 style signed cryptoprocessor
measurements. It is supplemented by unsigned Attester information.
The vast majority of the YANG objects in the YANG tree are defined
within [RATS-YANG].";
uses tpm-name;
uses yang-brat:node-uptime;
uses yang-brat:compute-node;
uses yang-brat:tpm12-quote-info-common;
choice tpm12-quote {
mandatory true;
description
"Either a tpm12-quote-info or tpm12-quote-info2, depending
on whether TPM_Quote or TPM_Quote2 was used
(cf. input field add-verson).";
case tpm12-quote1 {
description
"BIOS/UEFI event logs";
uses yang-brat:tpm12-quote-info;
uses yang-brat:tpm12-pcr-composite;
}
case tpm12-quote2 {
description
"BIOS/UEFI event logs";
uses yang-brat:tpm12-quote-info2;
}
}
}
/*
* RPCs
*/
augment "/sn:establish-subscription/sn:input" {
description
"This augmentation adds a nonce to as a subscription parameters
that apply specifically to datastore updates to RPC input.";
leaf nonce-value {
type binary;
description
"This nonce should be generated via a registered
cryptographic-strength algorithm. In consequence, the length
of the nonce depends on the hash algorithm used. The algorithm
used in this case is independent from the hash algorithm used to
create the hash-value in the response of the attestor.";
reference
"draft-ietf-rats-yang-tpm-charra";
}
}
augment "/sn:establish-subscription/sn:output" {
description
"This augmentation allows a subscriber/verifier to understand the
state of the Attester at time of subscription.";
container latest-attestation {
description
"provides the current PCR values of a TPM.";
uses tpm12-attestation;
/* Awaiting WG progress on draft-ietf-rats-yang-tpm-charra
before completing for TPM2.0 style. */
}
}
/*
* NOTIFICATIONS
*/
notification tpm-extend {
description
"This notification indicates that a PCR has extended within a TPM 1.x
or 2.0 cryptoprocessor. Within a small number of seconds, it should be
followed with a tpm12-attestation or tpm20-attestation.";
uses yang-brat:tpm-name;
leaf pcr-index-changed {
type uint8;
mandatory true;
description
"The number of the PCR extended.";
}
leaf-list extended-with {
type binary;
ordered-by user;
description
"Includes the one or more elements extending the PCR. The sequence of
elements represented in list must match the sequence entered into the
TPM.";
}
}
notification tpm12-attestation {
description
"Contains an instance of TPM1.2 style signed cryptoprocessor
measurements. It is supplemented by unsigned Attester information.
The vast majority of the YANG objects in the YANG tree are defined
within [RATS-YANG].";
uses tpm12-attestation;
}
/* Awaiting WG progress on draft-ietf-rats-yang-tpm-charra before completing
notification tpm20-attestation {
description
"We still need to define the majority of the YANG objects in
within [RATS-YANG]. Redefining them here would just result in lots of
unnecessary churn.";
}
*/
/*
* DATA NODES
*/
container attestation-config {
description
"This allows an Attester to determine which TPMs and PCRs are evaluated
and included within the Attestation Stream.";
container tpm12-stream {
description
"Configuration elements for a TPM1.2 event stream. This includes
all of the TPM1.2s which are available on an Attester.";
list tpm12-stream-config {
key tpm_name;
description
"Allows the stream to be configured for the inclusion of TPM1.2
quotes and evidence.";
uses tpm-name;
uses yang-brat:tpm12-pcr-selection;
uses yang-brat:tpm12-attestation-key-identifier;
}
uses yang-brat:tpm12-signature-scheme;
}
container tpm20-stream {
description
"Configuration elements for a TPM2.0 event stream. This includes
all of the TPM2.0s which are available on an Attester.";
list tpm20-stream-config {
key tpm_name;
description
"Allows the stream to be configured for the inclusion of TPM2.0
quotes and evidence.";
uses tpm-name;
list pcr-list {
description
"For each PCR in this list an individual list of banks
(hash-algo) can be requested.";
key pcr-index;
leaf pcr-index {
type uint8;
description
"The number of the PCR. At the moment this is limited 32";
}
uses yang-brat:hash-algo;
}
uses yang-brat:tpm20-attestation-key-identifier;
}
uses yang-brat:tpm20-signature-scheme;
leaf tpm2-heartbeat {
type uint8;
description
"Number of seconds before the Attestation stream should send a new
Notification which with a fresh quote. This allows confirmation
that the PCR values haven't changed since the last
tpm20-attestation.";
}
}
}
container attestation-results {
if-feature "passport";
description
"Latest Verifier appraisal of an Attester.";
leaf-list trustworthiness-level {
type identityref {
base trustworthiness-level;
}
min-elements 1;
description
"One or more Trustworthiness Levels assigned.";
}
leaf timestamp {
type yang:date-and-time;
mandatory true;
description
"The timestamp of the Verifier's appraisal.";
}
leaf tpmt-signature {
type binary;
description
"Must match a recent tpmt-signature sent in a notification to
a Verifier. This allows correlation of the Attestation Results to
a recent PCR change.";
}
leaf verifier-signature {
type binary;
description
"Signature of the Verifier across all the current objects in the
attestation-results container.";
}
leaf verifier-signature-key-name {
type binary;
description
"Name of the key the Verifier used to sign the results.";
}
}
}