search

Verifying attestations

After requesting a signed attestation, it can be used to verify against a set of PCRs to check whether it matches those of the enclave image built from the intended codebase. Additionally, the attestation should be signed by the right root key. DeepWorm uses Marlin's ZK verifierarrow-up-right to verify attestations before it allows an enclave key to be registered on its contract.

Users can also verify attestations themselves using the oyster-verifier tool which can be obtained from the links below:

Linux (amd64) - https://artifacts.marlin.org/oyster/binaries/verifier_6e1f6f06_linux_amd64
Linux (arm64) - https://artifacts.marlin.org/oyster/binaries/verifier_6e1f6f06_linux_arm64
Mac (amd64) - https://artifacts.marlin.org/oyster/binaries/verifier_6e1f6f06_darwin_amd64
Mac (arm64) - https://artifacts.marlin.org/oyster/binaries/verifier_6e1f6f06_darwin_arm64

oyster-verifier can also be built from code using:

$ git clone https://github.com/marlinprotocol/oyster-monorepo
$ cd oyster-monorepo/sdks/rs
$ cargo build --release

Once installed, extract the PCR values and root key by using the following command:

$ ./verifier --endpoint http://<enclave_domain>/attestation/raw
# The enclave_domain is available in the Contracts & IP Addresses section under the heading "WORM Brain Coprocessor".

The output should look something like:

verification successful: AttestationDecoded { timestamp: 1735045632258, pcrs: [[155, 69, 7, 32, 48, 171, 41, 104, 63, 71, 153, 67, 40, 240, 169, 212, 49, 45, 229, 3, 76, 164, 252, 150, 235, 170, 223, 199, 166, 50, 169, 56, 239, 188, 3, 72, 241, 189, 243
, 229, 60, 130, 95, 133, 43, 9, 235, 134], [60, 157, 48, 63, 137, 133, 110, 195, 65, 9, 19, 56, 28, 50, 131, 80, 195, 45, 20, 210, 248, 106, 43, 74, 119, 135, 153, 139, 214, 215, 109, 143, 96, 252, 136, 254, 160, 148, 191, 90, 2, 178, 194, 223, 27, 122,
 216, 50], [169, 62, 110, 65, 215, 188, 17, 195, 120, 32, 167, 76, 171, 28, 248, 146, 172, 221, 2, 190, 244, 15, 70, 34, 218, 30, 16, 60, 251, 145, 150, 177, 149, 166, 42, 54, 122, 252, 18, 41, 103, 226, 101, 235, 152, 80, 225, 86]], root_public_key: [2
52, 2, 84, 235, 166, 8, 193, 243, 104, 112, 226, 154, 218, 144, 190, 70, 56, 50, 146, 115, 110, 137, 75, 255, 246, 114, 217, 137, 68, 75, 80, 81, 229, 52, 164, 177, 246, 219, 227, 192, 188, 88, 26, 50, 183, 177, 118, 7, 14, 222, 18, 214, 154, 63, 234, 3
3, 27, 102, 231, 82, 207, 125, 209, 221, 9, 95, 111, 19, 112, 244, 23, 8, 67, 217, 220, 16, 1, 33, 228, 207, 99, 1, 40, 9, 102, 68, 135, 201, 121, 98, 132, 48, 77, 197, 63, 244], public_key: [194, 58, 170, 237, 155, 126, 83, 158, 127, 162, 151, 158, 80,
 225, 59, 3, 186, 202, 149, 26, 25, 19, 151, 73, 99, 96, 175, 168, 78, 157, 154, 96, 144, 72, 161, 240, 250, 131, 152, 165, 139, 127, 59, 187, 157, 61, 43, 227, 141, 77, 192, 194, 254, 106, 86, 126, 35, 158, 128, 45, 110, 239, 113, 0] }
pcr0: 9b45072030ab29683f47994328f0a9d4312de5034ca4fc96ebaadfc7a632a938efbc0348f1bdf3e53c825f852b09eb86
pcr1: 3c9d303f89856ec3410913381c328350c32d14d2f86a2b4a7787998bd6d76d8f60fc88fea094bf5a02b2c2df1b7ad832
pcr2: a93e6e41d7bc11c37820a74cab1cf892acdd02bef40f4622da1e103cfb9196b195a62a367afc122967e265eb9850e156
root pubkey: fc0254eba608c1f36870e29ada90be46383292736e894bfff672d989444b5051e534a4b1f6dbe3c0bc581a32b7b176070ede12d69a3fea211b66e752cf7dd1dd095f6f1370f4170843d9dc100121e4cf63012809664487c9796284304dc53ff4
enclave pubkey: c23aaaed9b7e539e7fa2979e50e13b03baca951a191397496360afa84e9d9a609048a1f0fa8398a58b7f3bbb9d3d2be38d4dc0c2fe6a567e239e802d6eef7100

These values can then be matched against the expected PCRs of the DeepWorm enclave posted at https://github.com/BrainsOnChain/DeepWorm/releases/tag/v1.0.0arrow-up-right. The root key should match AWS's root key which can be extracted from AWS' root certificate using the following:

  • Download and unzip https://aws-nitro-enclaves.amazonaws.com/AWS_NitroEnclaves_Root-G1.zip

  • It contains a file named root.pem. Execute the following command:

  • The root key can be found next the field with the heading `pub`

PreviousRequesting an attestationNextAPI Reference

Last updated