How to provision client assets into JWT token in Azure CVM?

Joey 40

Hi~

This question is related to this FAQ.

Currently, I am using an Azure SNP-CVM:

Image: Ubuntu Server 20.04 LTS (Confidential VM - SEV-SNP Only)

VMsize: DCa series

Enabled features: SecureBoot, Trusted Launch Feature, and EncOSdisk.

To do attestation, I have successfully installed the AttestationClient{cvm-platform-checker-exe} and acquired the JWT response.

My question is, how can I provision client assets into the JWT token generated by Azure attestation in SNP-CVM?

The official AMD SEV-SNP hardware offers this ability that allows the attester to provide 512-bit <REPORT_DATA>, like a public key, into the AMD-generated attestation report.

Sai Krishna Katakam 340 Reputation points Microsoft Vendor

2024-09-30T08:41:47.19+00:00

Hi Joey,

Welcome to the Microsoft Q&A Platform! Thank you for asking your question here.

To provision client assets into the JWT token generated by Azure attestation in SNP-CVM, follow these steps:

Make sure you have the AttestationClient installed and configured on your Confidential VM (CVM). This client will help you interact with the Azure Attestation service. Use the AttestationClient to generate an attestation report, which will include the necessary details about the VM’s state and configuration.

The AMD SEV-SNP hardware allows you to include a 512-bit REPORT_DATA in the attestation report. This can be a public key or any other client-specific data. You can set this REPORT_DATA using the AttestationClient before generating the attestation report.

Once the attestation report is generated, use it to acquire a JWT token from the Azure Attestation service. This token will include the REPORT_DATA you provided. The JWT token can now be used to authenticate and authorize access to your resources, containing the client assets you provisioned in the REPORT_DATA.

For detailed steps and examples, please refer to the documentation on Secure Key Release with Confidential VMs How To Guide.

If you have any further queries, do let us know. If the comment is helpful, please click "Upvote".
Sai Krishna Katakam 340 Reputation points Microsoft Vendor

2024-10-01T01:27:10.24+00:00

Hi Joey,

Just checking in to see if you had a chance to review my comment on your question. Please let us know if it was helpful and feel free to reach out if you have any further queries.

If you found the information useful, please click "Upvote" on the post to let us know.

Thank You.
Joey 40 Reputation points

2024-10-01T05:36:11.84+00:00

Hi Sai Krishna Katakam,

The document you referred to above, Secure Key Release with Confidential VMs How To Guide, mainly introduces the prerequisites of service Seucre Key Release (SKU). To perform the SKU release, it should use the Microsoft Azure Attestation service (MAA).

Are there samples or documents that tell me how to use MAA to achieve the SKU?

Another question: As I mentioned above, the original SNP Attestation offers a 512-bit REPORT_DATA field for customization. If I just want to provision some user data ( don't rely on Azure Key Vault/SKR) directly in the SNP attestation / JWT token, how can I do that?

Thank you for your help!
Joey 40 Reputation points

2024-10-01T05:45:04.9033333+00:00

Hi Sai Krishna Katakam,

The document you provided, Secure Key Release with Confidential VMs How To Guide, mainly introduces the prerequisites of using the SKR service. In this case, it should be achieved by using Microsoft Azure Attestation service (MAA). Are there specific samples/documents that can tell me how to perform MAA with SKR?

Another question is, if I just want to provide some user data directly in the SNP Attestation Report /Azure JWT that does not rely on the SKR service, how can I do that?
Joey 40 Reputation points

2024-10-01T05:47:19.2066667+00:00

Hi Sai Krishna Katakam,

The document you provided, Secure Key Release with Confidential VMs How To Guide, mainly introduces the prerequisites of using the SKR service. In this case, it should be achieved by using Microsoft Azure Attestation service (MAA) together with SKR. Are there samples/documents that can tell me how to perform MAA with SKR?

Another question is, if I just want to provide some user data directly in the SNP Attestation Report /Azure JWT that does not rely on the SKR service, how can I do that?

Thank you for your help!
Sai Krishna Katakam 340 Reputation points Microsoft Vendor

2024-10-01T08:31:45.5333333+00:00

Hi Joey,

Based on your latest comment for using the Microsoft Azure Attestation (MAA) service together with Secure Key Release (SKR), you can refer to the following resources:

Secure Key Release feature with AKV and Azure Confidential Computing (ACC): This document provides a detailed guide on how to perform SKR using MAA. It includes steps for setting up Azure Key Vault, creating a secure key release policy, and performing the release operation.

Azure Attestation Overview: This document offers an overview of Azure Attestation, including its integration with SKR.

Quickstart Set up Azure Attestation by using the Azure portal: This quickstart guide helps you set up and configure an attestation provider using the Azure portal.

Regarding your second question about providing user data directly in the SNP Attestation Report or Azure JWT without relying on the SKR service, you can customize the 512-bit REPORT_DATA field in the SNP attestation report. This field can be used to include user-specific data, which will then be part of the attestation token.

For more detailed guidance, you can refer to the Azure Attestation documentation and the specific sections on customizing attestation policies.
Secure Key Release with Confidential VMs How To Guide
Examples of an attestation token

If you have any further queries, do let us know. If the comment is helpful, please click "Upvote".

joeyjoy 0

Hi Sai Krishna Katakam,

I will go through the links you provided to figure out how to provision SKR and user data in JWT.

Here, I want to ask another question. As the initial question posted, I have installed the Attestation Client and can obtain the JWT token.

station_client$ sudo ./AttestationClient -o token
eyJhbGiLCJraWQiOiJKMHBBUGRmWFhIcVdXaW1nckg4NTN3TUlkaDUvZkxlMXo2dVNYWVBYQ2EwPSIsInR5cCI6IkpXVC
...
...
iI6IjEuMCJ9.uIGgXtjMswlHNhXiR27riErCU6fgCmvIvf3LtpiAFDyFMe_UitM4Zmkx_SGA_lgOtm9-uL2T45BUKmKlKv6VpUVIjHj2NPqXRi3eOjGmhGW6doiFlXyNN3td3gEbY16qobM6BiBAEMhxUrpQUQPF07GnX8KWGqZGvpy6UDtgmyOVK5Ztu9fUYinDd3Nnj6OssQI0dZk5jU87avzRtNinLTxKdREiRw00gyfJdYfpdUfSDMEGMcVv-S-LU4iydYaIHrfccgoaqJT3ukK74VgjbcwT2n5Dze54cgCGTnws9wqKt9G8zFF6amwrcouNLCsvxYDUNMp-r4BjA4-anw2XFg

With the parser, I can obtain the following info.:

{
  "alg": "RS256",
  "jku": "https://sharedeus2.eus2.attest.azure.net/certs",
  "kid": "J0pAPdfXXHqWWimgrH853wMIdh5/fLe1z6uSXYPXCa0=",
  "typ": "JWT"
}.{
  "exp": 1727800337,
  "iat": 1727771537,
  "iss": "https://sharedeus2.eus2.attest.azure.net",
  "jti": "9ce7081d108f631cf73b39b4cae5549d0a5bd5f946ea30c46ae9dead15e0b928",
  "nbf": 1727771537,
  "secureboot": true,
  "x-ms-attestation-type": "azurevm",
  "x-ms-azurevm-attestation-protocol-ver": "2.0",
  "x-ms-azurevm-attested-pcrs": [
...
...
} ] }, "x-ms-ver": "1.0" }.[Signature]

After searching some documents, I found that the signing certs and the JWT signature should be :

Signing certs:
"jku": "https://sharedeus2.eus2.attest.azure.net/certs"

Signature:
iI6IjEuMCJ9.uIGgXtjMswlHNhXiR27riErCU6fgCmvIvf3LtpiAFDyFMe_UitM4Zmkx_SGA_lgOtm9-uL2T45BUKmKlKv6VpUVIjHj2NPqXRi3eOjGmhGW6doiFlXyNN3td3gEbY16qobM6BiBAEMhxUrpQUQPF07GnX8KWGqZGvpy6UDtgmyOVK5Ztu9fUYinDd3Nnj6OssQI0dZk5jU87avzRtNinLTxKdREiRw00gyfJdYfpdUfSDMEGMcVv-S-LU4iydYaIHrfccgoaqJT3ukK74VgjbcwT2n5Dze54cgCGTnws9wqKt9G8zFF6amwrcouNLCsvxYDUNMp-r4BjA4-anw2XFg

If correct, my question is, how can I verify the JWT signature with the signing certs? I think there should be a code of practice.

I have searched some documents, and I found this document (https://learn.microsoft.com/en-us/azure/attestation/overview) and the code samples (https://github.com/Azure-Samples/microsoft-azure-attestation/blob/e7f296ee2ca1dd93b75acdc6bab0cc9a6a20c17c/sgx.attest.sample.oe.sdk/validatequotes.net/MaaQuoteValidator.cs#L62-L65) it given is not so clear.

joeyjoy 0 Reputation points

2024-10-01T12:10:27.47+00:00

Hi Sai Krishna Katakam,

I looked up some JWT standards, and now I know how they should be verified.
Sai Krishna Katakam 340 Reputation points Microsoft Vendor

2024-10-04T06:21:29.3566667+00:00

Hi Joey,

Base on your reply we assume that now you are able to verify the JWT signature with the signing certs.

If yes, please confirm on same.

Thank you.
joeyjoy 0 Reputation points

2024-10-04T09:32:33.1033333+00:00

Yes, it is a standard JWT validation process.

1 answer

Rachid Labiëd 0 Reputation points

2024-10-04T09:36:16.7133333+00:00
To provisiion client assets into the JWT token generated by Azure Attestation in an SNP-CVM, you can follow these steps:

Use the Azure Attestation API**:** Utilize the Azure Attestation service to create a custom attestation policy that allows you to include client assets.

Prepare Your Attestation Request: When sending an attestation request, include your REPORT_DATA in the request body. This REPORT_DATA can include the public key or other assets you wish to provision.

Modify the AttestationClient: If you're using the AttestationClient, ensure it's configured to send the custom REPORT_DATA in the request.

Process the JWT Response**:** After the attestation is processed, the JWT token will include your client assets as part of its claims, which can then be used by your application.
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

How to provision client assets into JWT token in Azure CVM?

1 answer

Your answer