Skip to content

Commit e111fde

Browse files
committed
Adding CoRIM Profile Spec and Schema
This commit squashes all the intermediate commits from PR #49 Signed-off-by: Alex Tzonkov <[email protected]>
1 parent e7bbc3c commit e111fde

17 files changed

+3773
-80
lines changed

Documentation/corim_profile/OCP-SAFE-CoRIM-Extension-Profile-Specification.md

Lines changed: 509 additions & 0 deletions
Large diffs are not rendered by default.
Lines changed: 104 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,104 @@
1+
/ tagged-corim-map / 501({
2+
/ corim.id (0) /
3+
0: "acme-trap-audit-2025-08-03",
4+
/ corim.profile (3) /
5+
3: 111(h'060A2B0601040182F4170101'), / OID 1.3.6.1.4.1.42623.1.1 for OCP SAFE SFR profile /
6+
/ corim.entities (5) /
7+
5: [
8+
/ audit-entity / {
9+
/ entity-name (0) / 0: "My Pentest Corporation",
10+
/ role (2) / 2: [ 1 ] / manifest-creator /
11+
}
12+
],
13+
/ corim.tags / 1 : [
14+
/ concise-mid-tag / 506( <<
15+
/ concise-mid-tag / {
16+
/ comid.tag-identity / 1 : {
17+
/ comid.tag-id / 0 : "acme-trap-review-comid-001"
18+
},
19+
/ comid.triples / 4 : {
20+
/ conditional-endorsement-triples / 10 : [
21+
[ / conditional-endorsement-triple-record /
22+
[ / conditions array /
23+
[ / *** stateful-environment-record *** /
24+
/ environment-map / {
25+
/ comid.class / 0 : {
26+
/ comid.vendor / 1 : "ACME Inc.",
27+
/ comid.model / 2 : "ACME RoadRunner Trap"
28+
}
29+
},
30+
[ / claims-list /
31+
/ *** measurement-map *** / {
32+
/ comid.mval / 1 : {
33+
/ comid.digests / 2 : [ [
34+
/ hash-alg-id / -43, / sha384 /
35+
/ hash-value / h'52047e070cddf496a7f77bf6a47792797e8ee90a149bb7555d08c5f93c5ca7ea46a63a7c99edaa1659e8afadfb9c6114'
36+
],
37+
[
38+
/ hash-alg-id / -44, / sha512 /
39+
/ hash-value / h'12a5b961a5eb7e548ed436fe7b5848d428bff908cb6ffcb47ec3ac1e2a43e0b8d1ff047d387fb0a940dc7b8b0014acf344364c43ab4de624dcd15f98bee552a5'
40+
]
41+
]
42+
}
43+
}
44+
]
45+
]
46+
], /*** end stateful-environment-records ***/
47+
[ /*** endorsements ***/
48+
[ /*** endorsed-triple-record ***/
49+
/ environment-map / {
50+
/ class / 0 : {
51+
/ vendor / 1 : "ACME Inc.",
52+
/ model / 2 : "ACME RoadRunner Trap"
53+
}
54+
},
55+
[ / endorsement #1/
56+
/ measurement-map / {
57+
/ comid.mval / 1 : { / measurement-values-map /
58+
/ ocp-safe-sfr / -1 : {
59+
/ 0: review-framework-version / 0: "1.1",
60+
/ 1: report-version / 1: "1.2",
61+
/ 2: completion-date / 2: 1(1687651200),
62+
/ 3: scope-number / 3: 1,
63+
/ 4: fw-identifiers / 4: [
64+
/fw-identifier / {
65+
/ 0: fw-version / 0: {
66+
/ 0: version / 0: "1.2.3",
67+
/ 1: version-scheme / 1: "semver"
68+
}
69+
}
70+
],
71+
/ 5: device-category / 5: 0, / 0: storage, 1: network, 2: gpu, 3: cpu, 4: apu, 5: bmc /
72+
/ 6: issues / 6: [
73+
/ issue-entry / {
74+
/ 0: title / 0: "Memory corruption when reading record from SPI flash",
75+
/ 1: cvss-score / 1: "7.9",
76+
/ 2: cvss-vector / 2: "AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L",
77+
/ 3: cwe / 3: "CWE-111",
78+
/ 4: description / 4: "Due to insufficient input validation in the firmware, a local attacker who tampers with a configuration structure in SPI flash, can cause stack-based memory corruption.",
79+
/ 5: cvss-version / 5: "3.1"
80+
},
81+
/ issue-entry / {
82+
/ 0: title / 0: "Debug commands enable arbitrary memory read/write",
83+
/ 1: cvss-score / 1: "8.7",
84+
/ 2: cvss-vector / 2: "AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L",
85+
/ 3: cwe / 3: "CWE-222",
86+
/ 4: description / 4: "The firmware exposes debug command handlers that enable host-side drivers to read and write arbitrary regions of the device's SRAM.",
87+
/ 5: cvss-version / 5: "3.1",
88+
/ 6: cve / 6: "CVE-2014-10000"
89+
}
90+
]
91+
}
92+
}
93+
}
94+
]
95+
]
96+
]
97+
]
98+
]
99+
}
100+
}
101+
>> )
102+
]
103+
}
104+
)
Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
; Auditor CoRIM – Corim which embeds the SFR fields
2+
; OCP SAFE SFR CoRIM Profile OID: 1.3.6.1.4.1.42623.1.1
3+
4+
$$measurement-values-map-extension //= (
5+
&(ocp-safe-sfr: -1) => ocp-safe-sfr-map ; Private extension for OCP SAFE SFR
6+
)
7+
8+
ocp-safe-sfr-map = {
9+
&(review-framework-version: 0) => tstr
10+
&(report-version: 1) => tstr
11+
&(completion-date: 2) => time
12+
&(scope-number: 3) => integer
13+
&(fw-identifiers: 4) => [ + fw-identifier ]
14+
? &(device-category: 5) => $device-category
15+
? &(issues: 6) => [ + issue-entry ]
16+
* $$ocp-safe-sfr-map-ext
17+
}
18+
19+
issue-entry = {
20+
&(title: 0) => tstr
21+
&(cvss-score: 1) => tstr
22+
&(cvss-vector: 2) => tstr
23+
&(cwe: 3) => tstr
24+
&(description: 4) => tstr
25+
? &(cvss-version: 5) => tstr
26+
? &(cve: 6) => tstr
27+
* $$ocp-safe-issue-entry-ext
28+
}
29+
30+
fw-identifier = non-empty<{
31+
? &(fw-version: 0) => version-map
32+
? &(fw-file-digests: 1) => digests-type
33+
? &(repo-tag: 2) => tstr
34+
? &(src-manifest: 3) => src-manifest
35+
}>
36+
37+
manifest-entry = {
38+
&(filename: 0) => tstr
39+
&(file-hash: 1) => digests-type
40+
}
41+
42+
src-manifest = {
43+
&(manifest-digest: 0) => digests-type
44+
&(manifest: 1) => [ + manifest-entry ]
45+
}
46+
47+
$device-category /= storage
48+
$device-category /= network
49+
$device-category /= gpu
50+
$device-category /= cpu
51+
$device-category /= apu
52+
$device-category /= bmc
53+
54+
storage = 0
55+
network = 1
56+
gpu = 2
57+
cpu = 3
58+
apu = 4
59+
bmc = 5

shortform_report-main/.gitignore

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
file_hashes.txt
2+
testkey_ecdsa_p521.pub
3+
testkey_p521.pem
4+
__pycache__
5+
*.cbor
6+
*.jws
7+
*.json
Lines changed: 222 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,222 @@
1+
# CBOR CoRIM Human-Readable Inspector - Auditor Guide
2+
3+
## Overview
4+
5+
The CBOR CoRIM Human-Readable Inspector is a tool designed specifically for security auditors and reviewers who need to visually inspect and verify the contents of CBOR-encoded CoRIM (CBOR Object Representation of Information Model) files. This tool converts the binary CBOR format into a clear, human-readable report that shows all fields, their meanings, and their values.
6+
7+
## Why This Tool is Needed
8+
9+
CBOR is a binary format that is not human-readable in its raw form. While CBOR is efficient for machine processing, auditors need to be able to:
10+
11+
- **Verify Data Integrity**: Ensure all expected fields are present and correctly formatted
12+
- **Validate Content**: Check that security review data matches expectations
13+
- **Audit Compliance**: Confirm that CoRIM files follow the OCP SAFE SFR profile specification
14+
- **Troubleshoot Issues**: Identify problems in CoRIM generation or encoding
15+
16+
## Quick Start
17+
18+
### Basic Usage
19+
20+
```bash
21+
# Inspect a CoRIM file
22+
python cbor_human_inspector.py my_security_review.cbor
23+
24+
# Show raw CBOR data in addition to decoded structure (currently only supports unsigned CoRIM)
25+
python cbor_human_inspector.py my_security_review.cbor --show-raw
26+
```
27+
28+
## Understanding the Output
29+
30+
The inspector provides a hierarchical view of the CoRIM structure with clear explanations:
31+
32+
### 1. Top-Level Information
33+
```
34+
📊 Total CBOR size: 1286 bytes
35+
🔍 Analysis timestamp: 2025-01-15 14:30:22
36+
✅ CBOR Tag Found: 501 (CoRIM (CBOR Object Representation of Information Model))
37+
```
38+
39+
### 2. CoRIM Fields Breakdown
40+
41+
The tool explains each field with its purpose:
42+
43+
- **Field 0 (CoRIM ID)**: Unique identifier for this CoRIM
44+
- **Field 1 (Tags)**: List of COMID tags containing the actual security review data
45+
- **Field 3 (Profile)**: Should show OID 1.3.6.1.4.1.42623.1.1 for OCP SAFE SFR
46+
- **Field 5 (Entities)**: Information about who created/maintains this CoRIM
47+
48+
### 3. Security Review Data (SFR Extension)
49+
50+
The most important section for auditors shows the actual security review findings:
51+
52+
```
53+
🔐 SFR Extension (-1) Found!
54+
📋 SFR Data contains 7 fields:
55+
56+
🔸 Field 0: Review Framework Version
57+
🔸 Field 1: Report Version
58+
🔸 Field 2: Completion Date
59+
🔸 Field 3: Scope Number
60+
🔸 Field 4: Firmware Identifiers
61+
🔸 Field 5: Device Category
62+
🔸 Field 6: Issues - List of security issues found
63+
```
64+
65+
### 4. Security Issues Detail
66+
67+
Each security issue is clearly displayed:
68+
69+
```
70+
🔴 Issue #1:
71+
Title: Buffer Overflow in Firmware Parser
72+
CVSS Score: 9.1
73+
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
74+
CWE: CWE-787
75+
Description: A critical buffer overflow vulnerability...
76+
CVE: CVE-2025-0123
77+
```
78+
79+
## Validation Checklist for Auditors
80+
81+
When reviewing a CoRIM file, verify the following:
82+
83+
### ✅ Structure Validation
84+
- [ ] File has correct CoRIM CBOR tag (501)
85+
- [ ] CoRIM contains required fields (0, 1, 3, 5) - **Inspector automatically checks this**
86+
- [ ] Profile field (3) contains OID 1.3.6.1.4.1.42623.1.1 - **Inspector flags if missing**
87+
- [ ] Tags field (1) contains at least one COMID tag (506)
88+
89+
### ✅ SFR Extension Validation
90+
- [ ] SFR extension (-1) is present in measurement values
91+
- [ ] All required SFR fields are present (0-6)
92+
- [ ] Completion date is properly encoded with CBOR timestamp tag
93+
- [ ] Device category is a valid integer (0-5)
94+
- [ ] Framework version matches expected value
95+
96+
### ✅ Security Issues Validation
97+
- [ ] Each issue has required fields: title, CVSS score, CVSS vector, CWE, description
98+
- [ ] CVSS scores are valid (0.0-10.0)
99+
- [ ] CVSS vectors follow proper format
100+
- [ ] CWE identifiers are properly formatted
101+
- [ ] CVE identifiers are present when applicable
102+
103+
### ✅ Data Quality Validation
104+
- [ ] Firmware identifiers contain vendor, product, version information
105+
- [ ] Hash values are properly formatted (SHA384/SHA512)
106+
- [ ] Entity information includes name and roles
107+
- [ ] All text fields contain meaningful content
108+
109+
## Common Issues and Troubleshooting
110+
111+
### Missing Profile Field
112+
```
113+
❌ Profile should be OID tag (111), found: <type>
114+
```
115+
**Solution**: The CoRIM must include the OCP SAFE SFR profile OID. Check CoRIM generation code.
116+
117+
### Incorrect Extension Value
118+
```
119+
❌ Missing SFR extension (-1)
120+
```
121+
**Solution**: Verify that the SFR extension is using -1 (private extension) instead of 1029.
122+
123+
### Invalid Date Encoding
124+
```
125+
❌ Should be datetime with CBOR tag 1
126+
```
127+
**Solution**: Completion dates must be encoded with CBOR timestamp tag (1).
128+
129+
### Missing Required Fields
130+
```
131+
❌ Required CoRIM field X missing
132+
```
133+
**Solution**: Check that all mandatory CoRIM fields are included during generation.
134+
135+
## Device Category Reference
136+
137+
The tool automatically translates device category numbers:
138+
139+
- **0**: CPU (Central Processing Unit)
140+
- **1**: GPU (Graphics Processing Unit)
141+
- **2**: BMC (Baseboard Management Controller)
142+
- **3**: NIC (Network Interface Controller)
143+
- **4**: Storage (Storage devices)
144+
- **5**: Other (Other device types)
145+
146+
## CBOR Tag Reference
147+
148+
Common CBOR tags you'll see in the output:
149+
150+
- **Tag 1**: POSIX timestamp (seconds since epoch)
151+
- **Tag 111**: Object Identifier (OID)
152+
- **Tag 501**: CoRIM (CBOR Object Representation of Information Model)
153+
- **Tag 506**: COMID (Concise Module Identifier)
154+
155+
## Advanced Usage
156+
157+
### Comparing Multiple CoRIMs
158+
159+
```bash
160+
# Inspect multiple files for comparison
161+
python cbor_human_inspector.py review_v1.cbor > review_v1_analysis.txt
162+
python cbor_human_inspector.py review_v2.cbor > review_v2_analysis.txt
163+
diff review_v1_analysis.txt review_v2_analysis.txt
164+
```
165+
166+
### Automated Validation
167+
168+
The inspector can be integrated into automated validation workflows:
169+
170+
```bash
171+
# Check if inspection succeeds (exit code 0 = success)
172+
if python cbor_human_inspector.py security_review.cbor; then
173+
echo "CoRIM structure is valid"
174+
else
175+
echo "CoRIM has structural issues"
176+
fi
177+
```
178+
179+
### Raw Data Analysis
180+
181+
Use `--show-raw` to see the actual CBOR bytes for deep analysis:
182+
183+
```bash
184+
python cbor_human_inspector.py review.cbor --show-raw
185+
```
186+
187+
This shows the first 100 bytes of raw CBOR data, useful for debugging encoding issues.
188+
189+
## Integration with Other Tools
190+
191+
### With CDDL Validation
192+
193+
The human inspector complements CDDL schema validation:
194+
195+
1. **First**: Run CDDL validation to check schema compliance
196+
2. **Then**: Use human inspector to verify content and meaning
197+
3. **Finally**: Review the human-readable output for audit purposes
198+
199+
### With JSON Reports
200+
201+
The inspector works with CoRIM files generated from JSON security review reports:
202+
203+
```
204+
JSON Report → CoRIM Generation → CBOR Encoding → Human Inspector
205+
```
206+
207+
## Best Practices for Auditors
208+
209+
1. **Always inspect the profile field** - Ensure it contains the correct OCP SAFE SFR OID
210+
2. **Verify issue count matches expectations** - Check that all reported issues are present
211+
3. **Validate timestamps** - Ensure completion dates are reasonable and properly encoded
212+
4. **Check firmware identifiers** - Verify they match the actual firmware being reviewed
213+
5. **Review CVSS scores** - Ensure they align with the severity of described issues
214+
6. **Examine entity information** - Confirm the Security Review Provider is correctly identified
215+
216+
## Support and Troubleshooting
217+
218+
If you encounter issues with the inspector:
219+
220+
1. **Check file format**: Ensure the file is a valid CBOR file
221+
2. **Verify file size**: Empty or corrupted files will cause errors
222+
3. **Review error messages**: The tool provides detailed error information

0 commit comments

Comments
 (0)