fix(scheme): align PSA/CCA with CoRIM profiles by abhiraj-ku · Pull Request #401 · veraison/services

abhiraj-ku · 2026-03-19T18:07:31Z

Migrate PSA-IoT and ARM-CCA scheme handling to latest profile APIs and string measurement keys.

Regenerate PSA and ARM-CCA CoRIM test vectors and update negative cases to match new profile validation behavior.

yogeshbdeshpande · 2026-03-23T19:13:49Z

@abhiraj-ku Please check why integration tests are failing, the simple clue could be that the expected test vectors have not been modified to match the changes

setrofim

CoRIM validation in scheme/arm-cca/corim.go and scheme/psa-iot/corim.go should now be redundant, as that the updated profile code should handle that.

It should be sufficient for the scheme to import the corresponding CoRIM profile package, so that the profile gets registered, and the corim.go files here can be removed.

scheme/arm-cca/scheme.go

setrofim

LGTM!

thomas-fossati

Thanks for all the work! I have left a couple of comments inline.

thomas-fossati · 2026-04-07T09:22:33Z

end-to-end/input/src/comid-cca-refval.json

-              ]
+                "sha-256:BwYFBAMCAQAPDg0MCwoJCBcWFRQTEhEQHx4dHBsaGRg="
+              ],
+              "name": "BL"


Please, add version too. (Here and below; also, for PSA.)

thomas-fossati · 2026-04-07T09:30:11Z

end-to-end/input/src/comid-cca-refval.json

+              "value": "cca.platform-config"
            },
            "value": {
              "raw-value": {


This seems to use separate codepoints to encode the raw value and the associated mask. However, https://www.ietf.org/archive/id/draft-ydb-rats-cca-endorsements-03.html#section-3.1.3.2 specifies a single codepoint for both, which is consistent with the deprecation of codepoint 5 in upstream CoRIM.

should it be changed to match the draft’s single tagged-masked-raw-value representation?

thomas-fossati · 2026-04-07T09:32:03Z

integration-tests/data/endorsements/comid-cca-platform-refval.json

+              "raw-value": {
+                "type": "bytes",
+                "value": "AQID"
+              },
+              "raw-value-mask": "AQID"


yogeshbdeshpande · 2026-04-07T12:48:36Z

@abhiraj-ku : I checked the scheme parsec-cca, still uses OLD Measurement and Implementation ID:

Please check: https://github.com/veraison/services/blob/main/scheme/parsec-cca/test/corim/src/comid-parsec-cca-refval.json

We need to fix this also, either here OR via a separate PR.

yogeshbdeshpande

Left some comments for you to look at!

yogeshbdeshpande · 2026-04-07T13:06:03Z

integration-tests/data/results/psa.freshness-fail.json

    },
    "ear.veraison.policy-claims": {
-      "problem": "integrity validation failed: bad evidence: freshness: psa-nonce (414a7c174141b3d0e9a1d28af31520f0d42299feac4007ded89d68ae6cd92f19) does not match session nonce (75e69d6de79f75e69d6de79f75e69d6de79f75e69d6de79f75e69d6de79f75e6)"
+      "problem": "no trust anchor for evidence"


This does not seems correct to me, can you please double check, why this has been modified??

The error MUST be failure of Evidence Integrity due to mis-match of PSA Nonce.

yogeshbdeshpande · 2026-04-07T13:32:23Z

scheme/arm-cca/test/corim/src/comid-cca-platform-bad-refval-cryptokeys.json

+              "digests": [
+                "sha-256:BwYFBAMCAQAPDg0MCwoJCBcWFRQTEhEQHx4dHBsaGRg="
+              ],
+              "name": "BL"


Need to apply the Version comment by checking all the test files

yogeshbdeshpande · 2026-04-07T13:39:36Z

scheme/arm-cca/scheme.go

-				return false, false, err
-			}
-
+			// Not a platform-config entry. Treat any digest-bearing measurement as


We should check here for MKey corresponding to CCA SW Component and fail, if there is a mis-match in MKey value

yogeshbdeshpande · 2026-04-07T13:42:04Z

scheme/arm-cca/scheme.go

 			encoded := base64.StdEncoding.EncodeToString((*measurement.Val.Digests)[0].HashValue)
-			referenceValues[encoded] = [2]string{*refValID.Label, *refValID.Version}
+			// Extract label (mtype) and version from measurement value
+			label := ""


This and line 487, can be best written as
var label, version string

abhiraj-ku · 2026-04-08T03:45:04Z

@abhiraj-ku : I checked the scheme parsec-cca, still uses OLD Measurement and Implementation ID:

Please check: https://github.com/veraison/services/blob/main/scheme/parsec-cca/test/corim/src/comid-parsec-cca-refval.json

We need to fix this also, either here OR via a separate PR.

ARM CCA does the same model/thing and the same extraction and mapping pattern exists in ARM CCA and that class ID is exactly what implementation ID maps into during lookup in the json file you have referenced here

Migrate PSA-IoT and ARM-CCA scheme handling to latest profile APIs and string measurement keys. Regenerate PSA and ARM-CCA CoRIM test vectors and update negative cases to match new profile validation behavior. Signed-off-by: Abhishek kumar <abhirajabhi312@gmail.com>

thomas-fossati

LGTM, thanks!

As discussed, we will update veraison/corim to support $raw-value-type-choice and then return here with the necessary changes to ensure full alignment with the CCA profile.

🚢 it!

abhiraj-ku force-pushed the refresh-corim-profiles branch from 9777357 to 68a8817 Compare March 21, 2026 11:14

abhiraj-ku changed the title ~~[RFC]fix(scheme): align PSA/CCA with CoRIM profiles~~ fix(scheme): align PSA/CCA with CoRIM profiles Mar 21, 2026

abhiraj-ku marked this pull request as ready for review March 21, 2026 11:16

abhiraj-ku force-pushed the refresh-corim-profiles branch from 68a8817 to 9c2ea92 Compare March 26, 2026 09:33

setrofim requested changes Mar 31, 2026

View reviewed changes

abhiraj-ku force-pushed the refresh-corim-profiles branch 3 times, most recently from b29d634 to fd23c00 Compare April 1, 2026 13:23

setrofim reviewed Apr 1, 2026

View reviewed changes

scheme/arm-cca/scheme.go Outdated Show resolved Hide resolved

setrofim requested a review from thomas-fossati April 1, 2026 13:45

abhiraj-ku force-pushed the refresh-corim-profiles branch 2 times, most recently from b265db6 to ecb1369 Compare April 1, 2026 14:30

setrofim approved these changes Apr 1, 2026

View reviewed changes

thomas-fossati reviewed Apr 7, 2026

View reviewed changes

yogeshbdeshpande reviewed Apr 7, 2026

View reviewed changes

abhiraj-ku force-pushed the refresh-corim-profiles branch from ecb1369 to d4c39f7 Compare April 8, 2026 16:24

thomas-fossati approved these changes Apr 8, 2026

View reviewed changes

Conversation

abhiraj-ku commented Mar 19, 2026

Uh oh!

yogeshbdeshpande commented Mar 23, 2026

Uh oh!

setrofim left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

setrofim left a comment

Choose a reason for hiding this comment

Uh oh!

thomas-fossati left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

yogeshbdeshpande commented Apr 7, 2026

Uh oh!

yogeshbdeshpande left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

abhiraj-ku commented Apr 8, 2026

Uh oh!

thomas-fossati left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants