Skip to content

Add Pluton attestation APIs #7262

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
nguyenteresaMSFT wants to merge 11 commits into
base: main
Choose a base branch
from
Open

Add Pluton attestation APIs #7262

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
11 commits
Select commit Hold shift + click to select a range
d505f04
add pluton
nguyenteresaMSFT Jul 21, 2026
42c0a24
refactoring
nguyenteresaMSFT Jul 21, 2026
93fdcd9
Merge branch 'Azure:main' into main
nguyenteresaMSFT Jul 28, 2026
c09adea
add pluton test, parameter renaming
nguyenteresaMSFT Jul 29, 2026
5463ecb
Merge branch 'main' of https://github.com/nguyenteresaMSFT/azure-sdk-…
nguyenteresaMSFT Jul 29, 2026
68aa9f0
policy tests
nguyenteresaMSFT Aug 6, 2026
1760031
api version update
nguyenteresaMSFT Aug 6, 2026
45422cc
api version notes
nguyenteresaMSFT Aug 7, 2026
cd9cbcd
fix tests
nguyenteresaMSFT Aug 11, 2026
ff79f51
update assets.json
nguyenteresaMSFT Aug 11, 2026
ce2f07a
rerun checks
nguyenteresaMSFT Aug 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 21 additions & 0 deletions sdk/attestation/azure-security-attestation/inc/azure/attestation/attestation_client.hpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -247,7 +247,28 @@ namespace Azure { namespace Security { namespace Attestation {
AttestTpmOptions const& options = AttestTpmOptions{},
Azure::Core::Context const& context = Azure::Core::Context{}) const;

/**
* @brief Sends Pluton-based attestation data to the service.
*
* @param dataToAttest - Attestation request data.
* @param options - Options to the attestation request.
* @param context - Context for the operation.
*
* @return Response<PlutonAttestationResult> - The result of the attestation operation
*/
Response<Models::PlutonAttestationResult> AttestPluton(

@LarryOsterman Larry Osterman (LarryOsterman) Aug 6, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Since the AttestPluton depends on a custom API version, document the requirement of the custom API version.

@nguyenteresaMSFT nguyenteresaMSFT Aug 7, 2026

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Note added.

std::vector<uint8_t> const& dataToAttest,
AttestPlutonOptions const& options = AttestPlutonOptions{},
Comment thread
nguyenteresaMSFT marked this conversation as resolved.
Azure::Core::Context const& context = Azure::Core::Context{}) const;
Comment thread
nguyenteresaMSFT marked this conversation as resolved.
Comment thread
nguyenteresaMSFT marked this conversation as resolved.

private:
template <typename ResultT>
Response<ResultT> AttestBackend(
std::vector<uint8_t> const& dataToAttest,
std::string const& tracingName,
std::string const& attestPath,
Azure::Core::Context const& context) const;

Azure::Core::Url m_endpoint;
std::string m_apiVersion;
std::shared_ptr<Azure::Core::Http::_internal::HttpPipeline> m_pipeline;
Expand Down
9 changes: 9 additions & 0 deletions ...ttestation/azure-security-attestation/inc/azure/attestation/attestation_client_models.hpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -464,6 +464,15 @@ namespace Azure { namespace Security { namespace Attestation { namespace Models
std::vector<uint8_t> TpmResult;
};

/** @brief The result of a call to AttestPluton.
*/
struct PlutonAttestationResult final
{
/** @brief Attestation response data.
*/
std::vector<uint8_t> PlutonResult;

@LarryOsterman Larry Osterman (LarryOsterman) Aug 6, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Because the attestation result is unstructured data, it implies that a client cannot make any assumptions about the contents of the PlutonResult, the only thing they can depend on is the status of the operation.

That restriction may be excessively limiting to your customers, but the documentation for this API is extremely minimal.

I'm not 100% sure how any customer is going to be able to use this API.

@nguyenteresaMSFT nguyenteresaMSFT Aug 7, 2026

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Work to create public documentation describing the Pluton protocol messages is on our radar. Our primary goal for now is to unblock our partner team who are already acquainted with the request/response structures.

};

/**
* @brief The PolicyModification enumeration represents the result of an attestation
* policy modification.
Expand Down
6 changes: 6 additions & 0 deletions ...testation/azure-security-attestation/inc/azure/attestation/attestation_client_options.hpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -264,6 +264,12 @@ namespace Azure { namespace Security { namespace Attestation {
{
};

/** @brief Parameters sent to the attestation service for the AttestPluton API.
*/
struct AttestPlutonOptions final
{
};

/** @brief The AttestationSigningKey represents a tuple of asymmetric private cryptographic key
* and X.509 certificate wrapping the public key contained in the certificate.
*
Expand Down
32 changes: 25 additions & 7 deletions sdk/attestation/azure-security-attestation/src/attestation_client.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -203,26 +203,28 @@ Azure::Response<AttestationToken<AttestationResult>> AttestationClient::AttestOp
}
}

Azure::Response<TpmAttestationResult> AttestationClient::AttestTpm(
template <typename ResultT>
Azure::Response<ResultT> AttestationClient::AttestBackend(
std::vector<uint8_t> const& dataToAttest,
AttestTpmOptions const&,
std::string const& tracingName,
std::string const& attestPath,
Azure::Core::Context const& context) const
{
auto tracingContext(m_tracingFactory.CreateTracingContext("AttestTpm", context));
auto tracingContext(m_tracingFactory.CreateTracingContext(tracingName, context));
try
{
std::string jsonToSend = TpmDataSerializer::Serialize(dataToAttest);
std::string jsonToSend = TpmAndPlutonDataSerializer::Serialize(dataToAttest);
auto encodedVector = std::vector<uint8_t>(jsonToSend.begin(), jsonToSend.end());
Azure::Core::IO::MemoryBodyStream stream(encodedVector);

auto request = AttestationCommonRequest::CreateRequest(
m_endpoint, m_apiVersion, HttpMethod::Post, {"attest/Tpm"}, &stream);
m_endpoint, m_apiVersion, HttpMethod::Post, {attestPath}, &stream);

// Send the request to the service.
auto response
= AttestationCommonRequest::SendRequest(*m_pipeline, request, tracingContext.Context);
std::vector<uint8_t> returnedBody{TpmDataSerializer::Deserialize(response)};
return Response<TpmAttestationResult>(TpmAttestationResult{returnedBody}, std::move(response));
std::vector<uint8_t> returnedBody{TpmAndPlutonDataSerializer::Deserialize(response)};
return Response<ResultT>(ResultT{returnedBody}, std::move(response));
Comment thread
nguyenteresaMSFT marked this conversation as resolved.
Outdated
}
catch (std::runtime_error const& ex)
{
Expand All @@ -231,6 +233,22 @@ Azure::Response<TpmAttestationResult> AttestationClient::AttestTpm(
}
}

Azure::Response<TpmAttestationResult> AttestationClient::AttestTpm(
std::vector<uint8_t> const& dataToAttest,
AttestTpmOptions const&,
Azure::Core::Context const& context) const
{
return AttestBackend<TpmAttestationResult>(dataToAttest, "AttestTpm", "attest/Tpm", context);
}

Azure::Response<PlutonAttestationResult> AttestationClient::AttestPluton(
std::vector<uint8_t> const& dataToAttest,
AttestPlutonOptions const&,
Azure::Core::Context const& context) const
{
return AttestBackend<PlutonAttestationResult>(dataToAttest, "AttestPluton", "attest/Pluton", context);
}

namespace {
std::shared_timed_mutex SharedStateLock;
}
Expand Down
8 changes: 4 additions & 4 deletions sdk/attestation/azure-security-attestation/src/private/attestation_deserializers_private.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -396,24 +396,24 @@ namespace Azure { namespace Security { namespace Attestation { namespace _detail
returnValue.CertificateThumbprint, jsonResult, "x-ms-certificate-thumbprint");
return returnValue;
}
std::string TpmDataSerializer::Serialize(std::vector<uint8_t> const& tpmData)
std::string TpmAndPlutonDataSerializer::Serialize(std::vector<uint8_t> const& tpmData)
{
Azure::Core::Json::_internal::json jsonData;
jsonData["data"] = Azure::Core::_internal::Base64Url::Base64UrlEncode(tpmData);
return jsonData.dump();
}
Comment thread
nguyenteresaMSFT marked this conversation as resolved.
Outdated
std::vector<uint8_t> TpmDataSerializer::Deserialize(
std::vector<uint8_t> TpmAndPlutonDataSerializer::Deserialize(
Azure::Core::Json::_internal::json const& jsonData)
{
std::vector<uint8_t> returnValue;
JsonOptional::SetIfExists<std::string, std::vector<uint8_t>>(
returnValue, jsonData, "data", Azure::Core::_internal::Base64Url::Base64UrlDecode);
return returnValue;
}
std::vector<uint8_t> TpmDataSerializer::Deserialize(
std::vector<uint8_t> TpmAndPlutonDataSerializer::Deserialize(
std::unique_ptr<Azure::Core::Http::RawResponse> const& response)
{
return TpmDataSerializer::Deserialize(
return TpmAndPlutonDataSerializer::Deserialize(
Azure::Core::Json::_internal::json::parse(response->GetBody()));
}

Expand Down
2 changes: 1 addition & 1 deletion sdk/attestation/azure-security-attestation/src/private/attestation_deserializers_private.hpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -136,7 +136,7 @@ namespace Azure { namespace Security { namespace Attestation { namespace _detail
Azure::Core::Json::_internal::json const& json);
};

struct TpmDataSerializer
struct TpmAndPlutonDataSerializer
{
static std::string Serialize(std::vector<uint8_t> const& tpmData);
Comment thread
nguyenteresaMSFT marked this conversation as resolved.
Outdated
static std::vector<uint8_t> Deserialize(Azure::Core::Json::_internal::json const& jsonData);
Expand Down
Loading