PCR revocation security: lazy enforcement, type-bound PCRs by khalifaT · Pull Request #34 · OpenGradient/og-evm

khalifaT · 2026-03-09T14:05:13Z

Summary

PCRs are keyed by TEE type: approvedPCRs changed from mapping(bytes32 => ApprovedPCR) to mapping(uint8 => mapping(bytes32 => ApprovedPCR)). The same PCR hash can be approved independently per TEE type.
Separated approve and revoke: approvePCR(pcrs, version, teeType) only approves; revokePCR(pcrHash, teeType, gracePeriod) only revokes (immediate or with grace period). The old previousPcrHash rotation pattern is removed.
Lazy PCR enforcement: revokePCR flips a flag or sets an expiry — no gas bomb from iterating all active TEEs. Revoked PCRs are caught at activateTEE() and heartbeat() checkpoints via _requirePCRValidForTEE.
Active TEE lists are per-type: _activeTEEList and _activeTEEIndex are now mapping(uint8 => ...), so queries like getActivatedTEEs(teeType) only return TEEs of that type.
New getLiveTEEs(teeType) query: returns TEEs that are activated, have a valid PCR, and a fresh heartbeat — fully verified on-chain.
New removeTEE(teeId): permanently deletes a TEE from all storage (indexes + mapping), for cleaning up decommissioned TEEs.
onlyTEEOwnerOrAdmin modifier: extracted shared access control for deactivateTEE, activateTEE, and removeTEE.
Re-approval support: revoked or expired PCRs can be re-approved; PCRAlreadyExists error added to prevent silent overwrites of active PCRs.
Removed convenience getters: getPublicKey, getTLSCertificate, isActive, getPaymentAddress removed — callers use getTEE() instead.
Removed computeMessageHash: unused utility removed from contract.

Design Decisions

Why lazy enforcement over automatic deactivation?

revokePCR must always be callable, even with thousands of active TEEs
A revoked TEE stays in _activeTEEList until its next heartbeat fails, but this is a stale index entry — not a security hole
Every meaningful checkpoint (registration, reactivation, heartbeat) validates both PCR status and type match via _requirePCRValidForTEE

Revocation modes:

revokePCR(hash, teeType, 0) — immediate: PCR is instantly invalid, TEEs fail on next heartbeat
revokePCR(hash, teeType, N) — grace period: TEEs keep running for N seconds, then caught lazily

Per-type active lists:

Queries no longer need to filter by type client-side
getActivatedTEEs(teeType) is O(1) storage read instead of O(n) filter

Files Changed

File	Change
`TEERegistry.sol`	Core contract: type-keyed PCRs, per-type active lists, lazy enforcement, `removeTEE`, `getLiveTEEs`
`lifecycle.js`	New/expanded test suite for lifecycle, removal, and revocation scenarios
`registry.js`	Unit tests updated for new signatures and behavior
`settlementRelay.js`	Test updated for new function signatures
`TEETestHelper.sol`	Test helper wrappers updated
`local_tee_workflow.go`	Integration tests updated
`client.go`	CLI client updated for new ABI
`pcr.go` / `tee.go`	CLI commands updated (`--tee-type` on approve, `--grace-period` on revoke)
`TEERegistry.json`	ABI artifact regenerated
`README.md`	Example code updated

Test Plan

Unit tests pass (cd tests/solidity/suites/tee && truffle test)
Integration tests pass with live enclave
Verify PCRTypeMismatch reverts when registering TEE with wrong type
Verify grace period expiry is enforced at heartbeat
Verify re-approval of revoked PCR works
Verify removeTEE cleans up all indexes

Copilot

Pull request overview

Implements defense-in-depth for PCR revocation in the TEERegistry Solidity contract, adding duplicate PCR prevention, enhanced PCR approval metadata (previous hash + grace period), and multi-checkpoint PCR enforcement (registration, activation, heartbeat), with corresponding test and integration workflow updates.

Changes:

Extend approvePCR to include previousPcrHash + gracePeriod, and emit an enhanced PCRApproved event.
Add immediate PCR revocation handling (revokePCR) with batch deactivation support and lazy enforcement in activateTEE/heartbeat.
Add/extend tests and integration script coverage for revocation, grace periods, and duplicate PCR prevention.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 8 comments.

File	Description
`contracts/solidity/TEERegistry.sol`	Adds PCR duplicate prevention, enhanced PCR approval metadata, PCR revocation with batch deactivation, and additional PCR checks during activation/heartbeat.
`tests/solidity/suites/tee/test/registry.js`	Adds a new test suite covering duplicate PCR prevention, PCR revocation, grace period approval/event fields, and admin-only batch deactivation.
`scripts/integration/local_tee_workflow.go`	Updates integration workflow (RPC URL, bytecode) and adds a new section + helper calls to exercise PCR revocation/grace/duplicate behavior.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

contracts/solidity/TEERegistry.sol

tests/solidity/suites/tee/test/registry.js

scripts/integration/local_tee_workflow.go

contracts/solidity/TEERegistry.sol

Copilot

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated 7 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

tests/solidity/suites/tee/test/registry.js

scripts/tee-mgmt-cli/cmd/pcr.go

contracts/solidity/TEERegistry.sol

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

…ient/og-evm into kha/pcr-revocation-security-fix

Copilot

Pull request overview

Copilot reviewed 10 out of 10 changed files in this pull request and generated 3 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

scripts/tee-mgmt-cli/cmd/pcr.go

contracts/solidity/TEERegistry.sol

tests/solidity/suites/tee/test/registry.js

khalifaT added 3 commits March 9, 2026 14:08

update revocation process

9ed80f8

update integration tests

7a04378

update unit tests with the new revocation process

102afa6

adambalogh marked this pull request as ready for review March 9, 2026 17:35

adambalogh requested a review from Copilot March 9, 2026 17:49

Copilot started reviewing on behalf of adambalogh March 9, 2026 17:50 View session

Copilot AI reviewed Mar 9, 2026

View reviewed changes

adambalogh reviewed Mar 9, 2026

View reviewed changes

contracts/solidity/TEERegistry.sol Outdated Show resolved Hide resolved

adambalogh reviewed Mar 9, 2026

View reviewed changes

contracts/solidity/TEERegistry.sol Outdated Show resolved Hide resolved

fixes

3060ddc

adambalogh added the run-ci Run ETE Testing Suite label Mar 9, 2026

adambalogh requested a review from Copilot March 9, 2026 20:44

Copilot started reviewing on behalf of adambalogh March 9, 2026 20:45 View session

Copilot AI reviewed Mar 9, 2026

View reviewed changes

adambalogh and others added 3 commits March 9, 2026 16:49

Update tests/solidity/suites/tee/test/registry.js

fc72c31

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

heartbeat fix

a2bcc49

Merge branch 'kha/pcr-revocation-security-fix' of github.com:OpenGrad…

f5d15c0

…ient/og-evm into kha/pcr-revocation-security-fix

adambalogh changed the title ~~update revocation process~~ PCR revocation security: lazy enforcement, type-bound PCRs Mar 9, 2026

adambalogh added run-ci Run ETE Testing Suite and removed run-ci Run ETE Testing Suite labels Mar 9, 2026

fix tests

20711fb

adambalogh added run-ci Run ETE Testing Suite and removed run-ci Run ETE Testing Suite labels Mar 9, 2026

adambalogh requested a review from Copilot March 9, 2026 21:29

Copilot started reviewing on behalf of adambalogh March 9, 2026 21:30 View session

Copilot AI reviewed Mar 9, 2026

View reviewed changes

scripts/tee-mgmt-cli/cmd/pcr.go Show resolved Hide resolved

contracts/solidity/TEERegistry.sol Show resolved Hide resolved

tests/solidity/suites/tee/test/registry.js Outdated Show resolved Hide resolved

balogh.adam@icloud.com added 4 commits March 9, 2026 17:41

cli fix

c0c50bb

update readme

e0d3485

coomplete test

efd291c

reg

c1c1dd9

balogh.adam@icloud.com added 10 commits March 9, 2026 18:39

key by type

cd1024a

simplify

08070d0

modifier

7342e1f

rm query

e1c4f95

comments

73b9750

cleanup

5e0f440

update test

063fa1f

remove method

5f8d35a

remove tests

65dda94

update cli

c271d05

adambalogh added run-ci Run ETE Testing Suite and removed run-ci Run ETE Testing Suite labels Mar 10, 2026

add back hekper

d721cef

adambalogh added run-ci Run ETE Testing Suite and removed run-ci Run ETE Testing Suite labels Mar 10, 2026

balogh.adam@icloud.com added 4 commits March 9, 2026 20:43

check approved

a8a2fef

live

12696f2

live

dee37dc

fix test

1b5ef1c

adambalogh added run-ci Run ETE Testing Suite and removed run-ci Run ETE Testing Suite labels Mar 10, 2026

balogh.adam@icloud.com added 3 commits March 9, 2026 21:01

doc

2638d66

doc

0dd884f

num

1482622

adambalogh added run-ci Run ETE Testing Suite and removed run-ci Run ETE Testing Suite labels Mar 10, 2026

balogh.adam@icloud.com added 2 commits March 9, 2026 21:07

doc

4430937

doc

f9fe8ef

adambalogh approved these changes Mar 10, 2026

View reviewed changes

adambalogh merged commit 758e149 into main Mar 10, 2026
5 checks passed

Conversation

khalifaT commented Mar 9, 2026 • edited by adambalogh Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Design Decisions

Files Changed

Test Plan

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

khalifaT commented Mar 9, 2026 •

edited by adambalogh

Loading