rust-regl

RATS Evidence Generation Library (REGL) - collects attestation evidence from TEE platforms.

Attesters

Attester	Struct	Backend	Description
cca-tsm	CcaTsmAttester	Linux TSM (/sys/kernel/config/tsm)	Talks directly to the kernel TSM interface on Arm CCA hardware. Requires root.
cca-ratsd	CcaRatsdAttester	RATSD daemon	Posts a challenge to a RATSD daemon and extracts the CCA attestation token from its CMW collection.
cca-sim	CcaSimulatedAttester	Pure Rust	Builds a CCA token from JSON claims and JWK keys with ES384 COSE_Sign1 signatures. No hardware needed.
ratsd	RatsdAttester	RATSD daemon	Posts a challenge to a RATSD daemon and returns the raw token bytes (COSE_Sign1-wrapped CMW collection, CBOR). No TEE-specific parsing.

Note: The cca-ratsd and ratsd attesters require RATSD v0.0.1 or later, which introduced the RATSD v2 token (COSE-signed EAT evidence, CBOR-only). Earlier RATSD versions are not supported.

Usage

use regl::attesters::{cca, ratsd, Attester};

// Generic RATSD - returns the raw token bytes, no TEE-specific parsing
let attester = ratsd::RatsdAttester::with_url("http://localhost:8895").unwrap();
let response: Vec<u8> = attester.get_evidence(&challenge).unwrap();

// CCA-specific RATSD - parses the CMW collection, returns CCA token bytes
let attester = cca::CcaRatsdAttester::with_url("http://localhost:8895").unwrap();
let evidence = attester.get_evidence(&challenge).unwrap();

// TSM-backed attester (requires Linux CCA TSM hardware and root/sudo)
let attester = cca::CcaTsmAttester::default();
let evidence = attester.get_evidence(&challenge).unwrap();

// Simulated attester - builds a token from JSON claims and JWK keys (no hardware needed)
let claims_json = std::fs::read_to_string("test-data/cca-claims.json").unwrap();
let iak_jwk = std::fs::read_to_string("test-data/iak.jwk").unwrap();
let rak_jwk = std::fs::read_to_string("test-data/rak.jwk").unwrap();
let attester = cca::CcaSimulatedAttester::new(&claims_json, &iak_jwk, Some(&rak_jwk)).unwrap();
let evidence = attester.get_evidence(&challenge).unwrap();

Note: The library itself does not read environment variables. The RATSD_URL env var is resolved only in the example binaries (examples/attester.rs) for convenience - they fall back to http://localhost:8895 if the variable is not set. Production code should pass an explicit URL string to with_url().

Note: If a system HTTP proxy is configured, set NO_PROXY=localhost to prevent requests to the local RATSD daemon from being routed through the proxy.

Prerequisites

RATSD (for cca-ratsd and ratsd attesters)

A running RATSD daemon (v0.0.1 or later) is required.

1. Clone and build RATSD:

   git clone https://github.com/veraison/ratsd.git
   cd ratsd
   make build

2. Start RATSD (requires root for configfs-tsm access):

   sudo ./ratsd --config config.yaml

   RATSD listens on http://localhost:8895 by default.

Note: RATSD must be running on a machine with TSM hardware support (Arm CCA-capable platform with /sys/kernel/config/tsm/report). The RATSD daemon dispatches evidence requests to its TSM plugin, which talks to the Linux kernel TSM interface. Without CCA hardware, the TSM plugin will fail and REGL will receive an HTTP 500 error from RATSD.

TSM (for cca-tsm attester)

The cca-tsm attester talks directly to /sys/kernel/config/tsm/report and requires root privileges (or write access granted via udev rules).

Examples

# CCA evidence via RATSD (requires a running RATSD daemon)
NO_PROXY=localhost RATSD_URL=http://localhost:8895 \
  cargo run --example attester -- --attester cca-ratsd --out evidence.cbor

# CCA evidence via RATSD and pretty-print the decoded token
NO_PROXY=localhost RATSD_URL=http://localhost:8895 \
  cargo run --example attester -- --attester cca-ratsd --out evidence.cbor --print

# CCA simulated evidence (no hardware needed)
cargo run --example attester -- --attester cca-sim --out evidence.cbor

# CCA evidence via TSM (requires CCA hardware and root)
sudo cargo run --example tsm -- --out tsm-evidence.cbor

Note: sudo cargo run can fail with "command not found" if cargo was installed via rustup, since ~/.cargo/bin is usually not on root's PATH under sudo. Build as your normal user first, then run the compiled binary with sudo:

cargo build --example tsm
sudo ./target/debug/examples/tsm --out tsm-evidence.cbor

Set RUST_LOG=info to see progress logs from the attester.

Utilities

regl::attesters::cca::utils provides CCA evidence encoding, decoding, and pretty-printing:

• regl::attesters::cca::utils::encode_cca_token() - build a CCA token (CBOR tag 399) from typed claims and signing keys
• regl::attesters::cca::utils::decode_cca_token() - decode raw CBOR evidence to typed Rust structs (CcaToken, PlatformClaims, RealmClaims, SwComponent)
• regl::attesters::cca::utils::pretty_print_token() - decode and serialize a CCA token as indented JSON
• CcaToken, PlatformClaims, RealmClaims, SwComponent - serde-enabled CCA evidence structs with human-readable field names

License

Apache-2.0