Networking Device Attestation and CoRIM-based Reference Measurement Sharing

CoRIM Structure

A CoRIM is associated with an image release. The CoRIM contains one or more CoMIDs, with each CoMID providing reference claims for a device. A signed CoRIM includes a set of protected header parameters, a set of unprotected header parameters, the payload, and the COSE Single Signer (COSE-Sign1) signature. The signature covers the protected header parameters and the payload. The message structures are built on the CBOR array type.

The corim-meta-map structure identifies the entity creating and signing the CoRIM and is part of the protected header parameters. Currently, the meta map contents reflect the following: 

{ "signer": { "name": "NVIDIA" } }

At the top-level, IANA global content tags identify unsigned and signed CoRIMs. The top-level CoRIM structure is described by the following CDDL rules:

corim = #6.500 (corim-type-choice)
$corim-type-choice /= #6.501 (corim-map)
$corim-type-choice /= #6.502 (signed-corim)

NVLINK6 ASIC
ConnectX-8 and ConnectX-9 SuperNIC

The NVLINK6 ASIC, ConnectX-8, and ConnectX-9 share the same CoRIM file structure which is illustrated in the figure below.

You can find more information about each device’s measurement block format in the sections NVLINK6 ASIC Measurements, ConnectX-8 Measurements and ConnectX-9 Measurements.


BlueField-3 DPU

The CoRIM file structure for BlueField-3 DPU is depicted in the figure below and adheres to the measurement block definition presented in section BlueField-3 Measurements.

ConnectX-7 Adapter Cards

The CoRIM file structure for ConnectX-7 is depicted in the figure below and adheres to the measurement block definition presented in section ConnectX-7 Measurements.

Last updated: