Deprecate cli related components

[bitboom]

This PR deprecates cli and use rsictl as is. (Fixed #382.)

• Add tools/rsictl as a submodule
• Remove diverged libs (cose, cca-token, rsi-el0)
• Use rust-rsi at sdk

[bitboom]

@p-sawicki2

I am currently resolving #382 in this PR. As the final step, I plan to remove lib/cca_token, which is the token module in rust-rsi.

One of the requirements from the certifier is to provide a C API that allows access to the RIM value and the Realm’s Challenge from the attestation report.

// certifier
rv = islet_parse(CLAIM_TITLE_RIM,
                 claims,
                 claims_len,
                 measurement_out,
                 measurement_out_size);
return rv == ISLET_SUCCESS;

I have been using ClaimData for parsing this information in SDK. However, since the token module in rust-rsi is private, it cannot be directly accessed from the SDK.

// islet-sdk
#[no_mangle]
pub unsafe extern "C" fn islet_parse(
    title: *const c_char,
    claims: *const c_uchar,
    claims_len: c_int,
    value_out: *mut c_uchar,
    value_out_len: *mut c_int,
) -> islet_status_t {
    let do_parse = || -> Result<(), Error> {
...
        match parse(&claims, title) {
            Some(ClaimData::Bstr(value)) => {
...
            }

To address this, I believe there are two possible approaches:

1. Provide an API in rust-rsi that allows parsing by passing the name of a specific claim.
2. Make the token module a public module so that the SDK can access it directly and perform the parsing.

Could you share which approach do you prefer?

[p-sawicki2]

@bitboom I would prefer the 2nd option, bacause rust-rsi already contains code for parsing (verifier.rs) the attestation token and getting the claims (example usage of get_claim() function: parser.rs). So, it seems that the only thing is just making them public.
@Havner What is your opinion on that?

[Havner]

@bitboom I'm not sure I understand. You need to extract the RIM and the challenge from the token? Because if that is the case you don't need to make any changes to the rust-rsi. You do verify_token which is re-exported in the lib.rs and you have a struct of claims AttestationClaims (platform and realm tokens) from which you can extract any information you need.

[bitboom]

@bitboom I'm not sure I understand. You need to extract the RIM and the challenge from the token? Because if that is the case you don't need to make any changes to the rust-rsi. You do verify_token which is re-exported in the lib.rs and you have a struct of claims AttestationClaims (platform and realm tokens) from which you can extract any information you need.

I found the way to extract platform & realm claims from platform & realm tokens. Thanks!

let realm_claims = RealmClaims::from_raw_claims(&claims.realm_claims.token_claims, &claims.realm_claims.measurement_claims)?;
let plat_claims = PlatClaims::from_raw_claims(&claims.platform_claims.token_claims)?;