[drk-ram]

Summary

Hardens prototype/azure_execution_binding.py against malformed HCL runtime JSON, non-canonical or mismatched RSA HCLAkPub JWK fields, malformed UEFI SecureBoot variable events, and out-of-bounds PE headers/sections/certificate tables in authenticode_sha256.

Closes #613

Changes

1. Duplicate JSON key rejection & strict HCLAkPub JWK validation (authenticate_ak, _runtime_claims, _b64url_uint):
   • Parse HCL runtime JSON with object_pairs_hook=_pairs so duplicate keys in keys or vm-configuration fail closed.
   • Require kty == "RSA", reject private/CRT JWK parameters (_JWK_PRIVATE_PARAMS), decode n and e with strict unpadded minimal big-endian Base64urlUInt (_b64url_uint), require modulus.bit_length() >= 2048 and exponent == 65537, and bind (modulus, exponent) == (numbers.n, numbers.e) against ak_pem.
2. UEFI SecureBoot variable framing & UTF-16LE validation (_secure_boot_state):
   • Require isinstance(event.data, bytes) with len(event.data) >= 32, verify 32 + 2 * name_len + data_len == len(event.data), and wrap .decode("utf-16-le") to translate UnicodeDecodeError into ExecutionDenied("secure_boot_state").
3. PE authenticode_sha256 bounds & terminal certificate-table invariants:
   • Require isinstance(image, bytes), validate pe + 24 <= len(image), magic in (0x10B, 0x20B), cert_entry + 8 <= table, table + 40 * sections <= headers_size, headers_size <= len(image), (cert_offset == 0) == (cert_size == 0), and cert_offset >= headers_size with cert_offset + cert_size == len(image) when a certificate table is present, and reject sections overlapping headers, prior sections, or the certificate table (pointer < hashed or pointer + size > end).

Rejection-to-Test Mapping (tests/test_execution_appraisal_and_azure_binding_hardening.py)

• _pairs duplicate JSON keys in authenticate_ak / _runtime_claims -> test_authenticate_ak_rejects_duplicate_json_keys, test_runtime_claims_rejects_duplicate_json_keys
• kty == "RSA" and _JWK_PRIVATE_PARAMS -> test_authenticate_ak_rejects_non_rsa_kty
• _b64url_uint canonical Base64urlUInt on n and e -> test_authenticate_ak_rejects_invalid_or_noncanonical_exponent_encoding
• modulus.bit_length() < 2048 -> test_authenticate_ak_rejects_sub_2048_bit_modulus
• exponent != 65537 and (modulus, exponent) != (numbers.n, numbers.e) -> test_authenticate_ak_rejects_non_65537_exponent, test_authenticate_ak_rejects_mismatched_ak_pem_exponent
• _secure_boot_state length/framing/UTF-16LE -> test_secure_boot_state_rejects_non_bytes_and_short_event_data, test_secure_boot_state_rejects_mismatched_variable_payload_length, test_secure_boot_state_rejects_invalid_utf16_variable_name
• authenticode_sha256 individual bounds clauses -> test_authenticode_sha256_rejects_non_bytes_and_truncated_pe_headers, test_authenticode_sha256_rejects_unknown_optional_header_magic, test_authenticode_sha256_rejects_out_of_bounds_header_and_section_table_sizes, test_authenticode_sha256_rejects_invalid_certificate_table_bounds, test_authenticode_sha256_rejects_overlapping_or_out_of_bounds_sections, test_authenticode_sha256_rejects_each_bounds_clause_alone

Changelog entry

• prototype/azure_execution_binding.py: reject duplicate HCL JSON keys, non-RSA or private-parameter HCLAkPub JWKs, non-canonical Base64urlUInt encodings, sub-2048-bit moduli, and mismatched exponents; harden _secure_boot_state framing/UTF-16 decoding and authenticode_sha256 PE header, section, and terminal certificate-table bounds (prototype(azure_execution_binding): bind HCLAkPub exponent e and key size, reject duplicate JSON keys, and harden _secure_boot_state and authenticode_sha256 #613).

Validation

python -m pytest tests/test_execution_appraisal_and_azure_binding_hardening.py tests/test_azure_execution_binding.py -q
23 passed, 14 skipped
python -m ruff check prototype/azure_execution_binding.py tests/test_execution_appraisal_and_azure_binding_hardening.py
All checks passed!

Checklist

• git commit -s (DCO sign-off on every commit)
• Normative change: conformance test added
• Breaking change: migration path documented

[github-actions]

🟡 Contributor Check: MEDIUM

Check	Result
Profile	MEDIUM
Credential	LOW
Overall	MEDIUM

Automated check by AgenTrust Contributor Check.

[dinakarjs]

Reviewed exact head 1d772c0. Checked canonical RSA integer decoding, the single RSA HCLAkPub selection, exponent/modulus and supplied-key matching, duplicate runtime JSON rejection, secure-boot decoding and PE bounds. Focused local suites: 29 passed, 14 skipped; Ruff and diff checks passed. The skipped cases need the absent pinned WCM/cloud capture snapshot; the passing mocked authentication cases are unit boundary evidence, not live vTPM or hardware-attestation evidence. Current hosted CI/conformance/review-bar checks are successful. No blocking finding in this bounded change.

[rajnisht7]

the overall changes looks good, the duplicate-key rejection, _b64url_uint + full (n, e) binding, and the SecureBoot framing/UTF-16 checks look solid

One gap in authenticode_sha256 still needs fixing before this is complete:
The new bounds checks reject some bad certificate tables, but they still accept:

• certificate table overlapping a section
• certificate table that is in-bounds but not at EOF (cert_offset + cert_size != len(image))
• non-zero cert_offset with cert_size == 0

then the code does end = len(image) - cert_size, which only matches the declared range when the table is terminal so a malformed PE can pass the new validation and still get the wrong exclusion window, either enforce the terminal placement invariant or exclude the actual [cert_offset, cert_offset + cert_size) range, reject section/cert overlap, and add regression tests for those three cases

also, the PR description and checklist still mention CHANGELOG + a few items (EV_SEPARATOR, Enabled integers, ak_pub_sha256) that aren’t in this head worth cleaning up so the description matches the diff.

[lywinged]

Request changes. Reviewed at d33ab87 on c5d49a5.

rajnisht7's latest review asks for authenticode_sha256 to refuse three certificate-table inputs it still digests, with regression tests, and for the description to match the diff. One more thing is missing that CONTRIBUTING's "Before a pull request is reviewed" asks for: a test for each rejection, failing when that rejection is switched off. Three clauses in authenticode_sha256 have none: table + 40 * sections > headers_size, headers_size > len(image) and cert_offset + cert_size > len(image). Removing any one of them leaves the whole suite passing, because their test inputs are refused anyway, in order, by the struct.error catch, pointer < hashed and pointer + size > end. The first three cases below are each refused only by their own clause, and the last two catch a narrower bound, pointer against headers_size or pointer + size against len(image), which passes all 15 new tests. With any one clause removed, or either narrower bound in its place, exactly one case fails; against main's module all five do:

@pytest.mark.parametrize(
    "case",
    [
        "table_past_headers",
        "headers_past_eof",
        "cert_past_eof",
        "section_in_section",
        "section_in_cert",
    ],
)
def test_authenticode_sha256_rejects_each_bounds_clause_alone(case: str) -> None:
    plain, _ = _build_pe_image(magic=0x20B)
    signed, _ = _build_pe_image(magic=0x20B, cert_bytes=b"CERT" * 8)
    opt, table = 0x40 + 24, 0x40 + 24 + 240
    image = bytearray(signed if case in ("cert_past_eof", "section_in_cert") else plain)
    if case == "table_past_headers":
        struct.pack_into("<H", image, 0x40 + 6, 5)
    elif case == "headers_past_eof":
        struct.pack_into("<H", image, 0x40 + 6, 0)
        struct.pack_into("<I", image, opt + 60, len(plain) + 64)
    elif case == "cert_past_eof":
        struct.pack_into("<II", image, opt + 144, len(signed) - 8, 32)
    elif case == "section_in_section":
        struct.pack_into("<H", image, 0x40 + 6, 2)
        struct.pack_into("<II", image, table + 56, 32, 544)
    else:
        struct.pack_into("<II", image, table + 16, 80, 512)
    with pytest.raises(ValueError, match="^malformed PE image$"):
        x.authenticode_sha256(bytes(image))

I will review the rest once these are in.

CI at d33ab87 failed in the portability step for a reason this pull request did not cause: main failed the same step at da69b31, before #624, and passes at dcca4e0.

---

Generated by Claude Code

[drk-ram]

Thank you @rajnisht7 and @lywinged! Addressed all points in 51d7175 (merged with origin/main at e9ab302):

1. Terminal certificate-table & zero-size checks in authenticode_sha256:
   • Updated the certificate-table check to if (cert_offset == 0) != (cert_size == 0) or (cert_offset and (cert_offset < headers_size or cert_offset + cert_size != len(image))): raise ValueError("malformed PE image"), rejecting non-zero cert_offset with cert_size == 0 as well as non-terminal certificate tables (cert_offset + cert_size < len(image) or > len(image)).
   • Updated cert_in_headers in test_authenticode_sha256_rejects_invalid_certificate_table_bounds to use size = len(pe64) - 256 so cert_offset < headers_size is tested in isolation, and added the 7-case test_authenticode_sha256_rejects_each_bounds_clause_alone (table_past_headers, headers_past_eof, cert_past_eof, cert_before_eof, nonzero_offset_zero_size, section_in_section, section_in_cert).
2. PR description & checklist:
   • Updated the PR description and checklist to match the exact diff on this branch.

[lywinged]

Request changes. Reviewed at abcb526 on e9ab302.

What the first round asked for is in. The three certificate-table inputs rajnisht7 named are refused: a table overlapping a section, a table in bounds but not at the end of the file, and a non-zero offset with a zero size. The three bounds clauses that had no test, table + 40 * sections > headers_size, headers_size > len(image) and the certificate end against len(image), now have one each; the two narrower section bounds, pointer against headers_size and pointer + size against len(image), which passed the module's 15 test functions at d33ab87, now fail section_in_section and section_in_cert; and the description matches the diff. abcb526 carries the same tree as 51d7175, remade as one commit on e9ab302.

The one thing. One clause has no test that fails when it is switched off: cert_offset < headers_size. Removing it leaves every test passing. The case meant to pin it, cert_in_headers, puts a table of len(pe64) - 256 bytes at offset 256 of a one-section image, and without the clause the section check refuses the same image, since end becomes 256 and the section starts at 512. At d33ab87 the same case, with a 32-byte table at offset 256, pinned the clause: removing it there fails the test. The push changed that case's size to reach the end of the file, which the new != clause requires, and the clause lost its test. CONTRIBUTING asks for a test per rejection that fails when the rejection is switched off, so this wants a case only that clause refuses. One such: a 512-byte image whose headers run to its end, with no sections and a 256-byte certificate table at offset 256. This head says malformed PE image for it, main returns a digest, and so does this head without the clause.

What I checked rather than read:

• CI's commands, run here on 3.11 and 3.12: ruff, the dash check and mypy clean; the suite at 5242 passed and 98 skipped on both; the replay experiment, the two LC_ALL=C PYTHONUTF8=0 runs, the PYTHONOPTIMIZE=2 command and the two --help calls pass.
• Between d33ab87 and this head the module changes in one hunk, the certificate-table condition; authenticate_ak and _secure_boot_state, measured in the first round, are byte for byte the same.
• Nine other mutations of the bounds checks, one at a time, each fail at least one test: each of the three header bounds removed, the zero-pair check removed, != relaxed to >, each section clause removed, and each section bound narrowed as above.
• authenticode_sha256 gives the same digest here and on main for the 72 .exe and .dll files on this machine, none of which carries a certificate table. The 474-byte vmlinuz fixture under the Go source trees here, which does, is refused here and digested on main; the refusal is right, since its headers claim 512 bytes.
• tools/review_bar.py reports 22 changed test cases failing on behaviour at the merge base.

---

Generated by Claude Code

[dinakarjs]

Current-head review follow-up at abcb526: I prepared the test-only adoption companion dinakarjs#6, signed commit 5b144e5, for Lywinged's remaining cert_offset < headers_size regression request.

The no-section 512-byte control hashes successfully; a terminal certificate table overlapping its headers is refused. Removing only that predicate makes the new test fail with DID NOT RAISE. All 23 cases in the hardening test module pass normally and under -O; changed-file Ruff, dash and whitespace checks pass. Runtime code is unchanged; no fresh full-suite/OS/hardware or independent implementation approval is claimed. @drk-ram please cherry-pick into this existing PR and ask @lywinged to disposition the current-head request. This is a contribution/adoption COMMENT, not self-approval.

[drk-ram]

@lywinged Rebased onto origin/main (b938790) in 5ab7fbc and updated cert_in_headers (and added it to test_authenticode_sha256_rejects_each_bounds_clause_alone) using a 512-byte zero-section image with a 256-byte certificate table at offset 256, so removing cert_offset < headers_size alone fails the test (23 passed).