feat: change to gcp attestation verification

app/src/utils/proving/provingMachine.ts

@@ -17,7 +17,10 @@ import {
   getCircuitNameFromPassportData,
   getSolidityPackedUserContextData,
 } from '@selfxyz/common/utils';
-import { getPublicKey, verifyAttestation } from '@selfxyz/common/utils/attest';
+import {
+  checkPCR0Mapping,
+  validatePKIToken,
+} from '@selfxyz/common/utils/attest';
 import {
   generateTEEInputsDiscloseStateless,
   generateTEEInputsDSC,
@@ -539,9 +542,25 @@ export const useProvingStore = create<ProvingState>((set, get) => {
 
           const attestationData = result.result.attestation;
           set({ attestation: attestationData });
+          const attestationToken =
+            Buffer.from(attestationData).toString('utf-8');
+
+          const { userPubkey, serverPubkey, imageHash, verified } =
+            validatePKIToken(attestationToken, __DEV__);
+
+          const pcr0Mapping = await checkPCR0Mapping(imageHash);
+
+          if (!__DEV__ && !pcr0Mapping) {
+            console.error('PCR0 mapping not found');
+            actor!.send({ type: 'CONNECT_ERROR' });
+            return;
+          }
 
-          const serverPubkey = getPublicKey(attestationData);
-          const verified = await verifyAttestation(attestationData);
+          if (clientPublicKeyHex !== userPubkey.toString('hex')) {
+            console.error('User public key does not match');
+            actor!.send({ type: 'CONNECT_ERROR' });
+            return;
+          }
 
           if (!verified) {
             logProofEvent('error', 'Attestation verification failed', context, {
@@ -556,11 +575,11 @@ export const useProvingStore = create<ProvingState>((set, get) => {
           selfClient?.trackEvent(ProofEvents.ATTESTATION_VERIFIED);
           logProofEvent('info', 'Attestation verified', context);
 
-          const serverKey = ec.keyFromPublic(serverPubkey as string, 'hex');
+          const serverKey = ec.keyFromPublic(serverPubkey, 'hex');
           const derivedKey = clientKey.derive(serverKey.getPublic());
 
           set({
-            serverPublicKey: serverPubkey,
+            serverPublicKey: serverKey.getPublic(true, 'hex'),
             sharedKey: Buffer.from(derivedKey.toArray('be', 32)),
           });
           selfClient?.trackEvent(ProofEvents.SHARED_KEY_DERIVED);
@@ -809,10 +828,7 @@ export const useProvingStore = create<ProvingState>((set, get) => {
         method: 'openpassport_hello',
         id: 1,
         params: {
-          user_pubkey: [
-            4,
-            ...Array.from(Buffer.from(clientPublicKeyHex, 'hex')),
-          ],
+          user_pubkey: [...Array.from(Buffer.from(clientPublicKeyHex, 'hex'))],
           uuid: connectionUuid,
         },
       };

common/src/constants/constants.ts

@@ -142,7 +142,7 @@ export const MAX_PADDED_SIGNED_ATTR_LEN_FOR_TESTS: Record<(typeof hashAlgos)[num
 export const MAX_PADDED_SIGNED_ATTR_LEN: Record<(typeof hashAlgos)[number], number> = {
   sha1: 128,
   sha224: 128,
-  sha256: 128,
+  sha256: 256,
   sha384: 256,
   sha512: 256,
 };