draft-ietf-teep-protocol.cddl

; DO NOT EDIT this cddl file manually.
; This cddl file is Auto-generated file from md file.
; Edit the md file and run make for generating this cddl file.
; Please do not forget to commit and push this cddl file to git repo
; every time you have revised the md file.

teep-message = $teep-message-type .within teep-message-framework

teep-message-framework = [
  type: $teep-type / $teep-type-extension,
  options: { * teep-option },
  * any; further elements, e.g., for data-item-requested
]

teep-option = (uint => any)

; messages defined below:
$teep-message-type /= query-request
$teep-message-type /= query-response
$teep-message-type /= update
$teep-message-type /= teep-success
$teep-message-type /= teep-error

; message type numbers, in one byte which could take a number from 0 to 23
$teep-type = (0..23)
TEEP-TYPE-query-request = 1
TEEP-TYPE-query-response = 2
TEEP-TYPE-update = 3
TEEP-TYPE-teep-success = 5
TEEP-TYPE-teep-error = 6

query-request = [
  type: TEEP-TYPE-query-request,
  options: {
    ? token => bstr .size (8..64),
    ? supported-freshness-mechanisms => [ + $freshness-mechanism ],
    ? challenge => bstr .size (8..512),
    ? versions => [ + version ],
    ? attestation-payload-format => text,
    ? attestation-payload => bstr,
    ? suit-reports => [ + bstr ],
    * $$query-request-extensions,
    * $$teep-option-extensions
  },
  supported-teep-cipher-suites: [ + $teep-cipher-suite ],
  supported-suit-cose-profiles: [ + $suit-cose-profile ],
  data-item-requested: uint .bits data-item-requested
]

version = uint .size 4
ext-info = uint .size 4

; data items as bitmaps
data-item-requested = &(
  attestation: 0,
  trusted-components: 1,
  extensions: 2,
  suit-reports: 3,
)

; teep-cipher-suites
$teep-cipher-suite /= teep-cipher-suite-sign1-eddsa
$teep-cipher-suite /= teep-cipher-suite-sign1-es256

;The following two cipher suites have only a single operation each.
;Other cipher suites may be defined to have multiple operations.
;MANDATORY for TAM to support them, and OPTIONAL
;to support any additional ones that use COSE_Sign_Tagged, or other
;signing, encryption, or MAC algorithms.

teep-operation-sign1-eddsa = [ cose-sign1, cose-alg-eddsa ]
teep-operation-sign1-es256 = [ cose-sign1, cose-alg-es256 ]

teep-cipher-suite-sign1-eddsa = [ teep-operation-sign1-eddsa ]
teep-cipher-suite-sign1-es256 = [ teep-operation-sign1-es256 ]

;MANDATORY for TAM and TEEP Agent to support the following COSE
;operations, and OPTIONAL to support additional ones such as
;COSE_Sign_Tagged, COSE_Encrypt0_Tagged, etc.

cose-sign1 = 18      ; CoAP Content-Format value

;MANDATORY for TAM to support the following, and OPTIONAL to implement
;any additional algorithms from the IANA COSE Algorithms registry.

cose-alg-es256 = -7  ; ECDSA w/ SHA-256
cose-alg-eddsa = -8  ; EdDSA

; suit-cose-profile
$suit-cose-profile /= suit-sha256-es256-ecdh-a128ctr
$suit-cose-profile /= suit-sha256-eddsa-ecdh-a128ctr
$suit-cose-profile /= suit-sha256-es256-ecdh-a128gcm
$suit-cose-profile /= suit-sha256-eddsa-ecdh-chacha-poly

; freshness-mechanisms
FRESHNESS_NONCE = 0
FRESHNESS_TIMESTAMP = 1

$freshness-mechanism /= FRESHNESS_NONCE
$freshness-mechanism /= FRESHNESS_TIMESTAMP

query-response = [
  type: TEEP-TYPE-query-response,
  options: {
    ? token => bstr .size (8..64),
    ? selected-version => version,
    ? attestation-payload-format => text,
    ? attestation-payload => bstr,
    ? suit-reports => [ + bstr ],
    ? tc-list => [ + system-property-claims ],
    ? requested-tc-list => [ + requested-tc-info ],
    ? unneeded-manifest-list => [ + SUIT_Component_Identifier ],
    ? ext-list => [ + ext-info ],
    * $$query-response-extensions,
    * $$teep-option-extensions
  }
]

requested-tc-info = {
  component-id => SUIT_Component_Identifier,
  ? tc-manifest-sequence-number => uint .size 8,
  ? have-binary => bool
}

update = [
  type: TEEP-TYPE-update,
  options: {
    ? token => bstr .size (8..64),
    ? unneeded-manifest-list => [ + SUIT_Component_Identifier ],
    ? manifest-list => [ + bstr .cbor SUIT_Envelope ],
    ? attestation-payload-format => text,
    ? attestation-payload => bstr,
    ? err-code => (0..23),
    ? err-msg => text .size (1..128),
    * $$update-extensions,
    * $$teep-option-extensions
  }
]

teep-success = [
  type: TEEP-TYPE-teep-success,
  options: {
    ? token => bstr .size (8..64),
    ? msg => text .size (1..128),
    ? suit-reports => [ + SUIT_Report ],
    * $$teep-success-extensions,
    * $$teep-option-extensions
  }
]

teep-error = [
  type: TEEP-TYPE-teep-error,
  options: {
     ? token => bstr .size (8..64),
     ? err-msg => text .size (1..128),
     ? supported-teep-cipher-suites => [ + $teep-cipher-suite ],
     ? supported-freshness-mechanisms => [ + $freshness-mechanism ],
     ? supported-suit-cose-profiles: [ + $suit-cose-profile ],
     ? challenge => bstr .size (8..512),
     ? versions => [ + version ],
     ? suit-reports => [ + SUIT_Report ],
     * $$teep-error-extensions,
     * $$teep-option-extensions
  },
  err-code: (0..23)
]

; The err-code parameter, uint (0..23)
ERR_PERMANENT_ERROR = 1
ERR_UNSUPPORTED_EXTENSION = 2
ERR_UNSUPPORTED_FRESHNESS_MECHANISMS = 3
ERR_UNSUPPORTED_MSG_VERSION = 4
ERR_UNSUPPORTED_CIPHER_SUITES = 5
ERR_BAD_CERTIFICATE = 6
ERR_ATTESTATION_REQUIRED = 7
ERR_UNSUPPORTED_SUIT_REPORT = 8
ERR_CERTIFICATE_EXPIRED = 9
ERR_TEMPORARY_ERROR = 10
ERR_MANIFEST_PROCESSING_FAILED = 17

; labels of mapkey for teep message parameters, uint (0..23)
supported-teep-cipher-suites = 1
challenge = 2
versions = 3
supported-suit-cose-profiles = 4
selected-version = 6
attestation-payload = 7
tc-list = 8
ext-list = 9
manifest-list = 10
msg = 11
err-msg = 12
attestation-payload-format = 13
requested-tc-list = 14
unneeded-manifest-list = 15
component-id = 16
tc-manifest-sequence-number = 17
have-binary = 18
suit-reports = 19
token = 20
supported-freshness-mechanisms = 21
err-code = 23