Skip to content

Commit

Permalink
docs: Correct image signing manual
Browse files Browse the repository at this point in the history
As recent article https://blog.trailofbits.com/2024/02/16/a-few-notes-on-aws-nitro-enclaves-images-and-attestation
properly mentions we need to verify the signature of PCR0 rather then decrypt it
in the last step of our Image Signing manual

Signed-off-by: Eugene Koira <[email protected]>
  • Loading branch information
eugkoira committed Mar 1, 2024
1 parent bc9c0b8 commit 392df46
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion docs/image_signing.md
Original file line number Diff line number Diff line change
Expand Up @@ -58,7 +58,7 @@ contains an `EifSectionType`. You can find more details about these
headers in the [eif-defs](https://github.com/aws/aws-nitro-enclaves-image-format/) crate.

2. For each PCR Signature use the public key from the signing
certificate to decrypt the payload from the `COSESign1` object
certificate to verify the payload from the `COSESign1` object
(this can be done using the following crate:
[aws-nitro-enclaves-cose](https://github.com/awslabs/aws-nitro-enclaves-cose))
and check that the PCR's value is the same as the one computed by
Expand Down

0 comments on commit 392df46

Please sign in to comment.