Re: [DISCUSSION] svsm: attestation + CocoonFs:

Hi Nicolai,

Apologies for the late response.

On 3/11/26 12:29 AM, Nicolai Stange wrote:
> Hi Tyler,
> 
> I've been told in one of the svsm devel calls that a capability for
> storing some info in plaintext in CocoonFs would be helpful for your
> attestation efforts.
> 

Correct!

> Before I go and implement something, let me ask about the nature of that
> data.
> - What exactly are you planning to store there?

Here's a rough outline of our plans:

The CocoonFS images will be encrypted. Within the CocoonFS headers, we'd 
like to include the *wrapped* key used for decrypting the image.

Once SVSM will attest, it will read the wrapped key from CocoonFS and 
forward it to an attestation server and receive it back unwrapped. Since 
SVSM is now itself measured, we can ensure that it will not do anything 
nefarious with the unwrapped key, which is sensitive data and cannot be 
leaked.

With this, we don't have to worry about storing different keys on 
attestation servers and identifying which key belongs to which CocoonFS 
image. The image will carry its key alongside it, yet it will be 
wrapped, and attestation will be required for any unwrapping.

> - Presumably the filesystem salt from the image header, supposed to also
>    serve as a filesystem ID ([1]), is not sufficient.

Not for this purpose.

> - Is the data considered immutable over the lifetime of the FS?

Yes, the key is immutable.

> - Is it Ok if that data is not authenticated?
> 

I'd say it likely *should* be authenticated to ensure tampering didn't 
take place? I'm open to discussion on this, however.


Tyler