Serve noise.ita_token so clients verify without an Intel account#267
Merged
Conversation
The agent already mints an Intel Trust Authority token for CP registration (over a freshness nonce). Clients connecting directly over Noise had to mint their own appraisal of the agent's separate Noise quote, which required every client to hold an ITA API key (an Intel account) — minting needs a key, but verifying a token only needs Intel's public JWKS. Mint a second token over the Noise quote (the one binding the Noise pubkey into report_data) and serve it on /health as noise.ita_token, refreshed alongside the registration token. Clients now verify this token against the public JWKS — no account — and check the report_data binding, instead of minting. Additive: the existing quote_b64/pubkey_hex fields stay for older/insecure-skip clients. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
DD preview readyURL: https://pr-267.devopsdefender.com Browser login: visit https://pr-267.devopsdefender.com — DD redirects you to Machine-to-machine: GitHub Actions workflows in the Register endpoint for a local agent: |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
The agent already mints an ITA token for CP registration (over a freshness nonce). Clients connecting directly over Noise had to mint their own appraisal of the agent's separate Noise quote — which required every client to hold an Intel Trust Authority API key. But minting needs a key; verifying only needs Intel's public JWKS.
This mints a second token over the Noise quote (the one binding the Noise pubkey into
report_data) and serves it on/healthasnoise.ita_token, refreshed alongside the registration token.Why
Lets
dd-client(and any client) verify the agent's attestation against the public JWKS — no API key, no Intel account — instead of minting. The account-bearing step stays on the agent, which is already provisioned for it. Full independent attestation is preserved.Safety
Additive —
quote_b64/pubkey_hexstay for older /--insecure-skipclients. Safe to merge & deploy; unlocks the keyless client path. Pairs with devopsdefender/dd-clientfeature/structured-client.🤖 Generated with Claude Code