[#1090] Fix ACA Provisioning Issue When Using ECC Key by ThatSilentCoder · Pull Request #1127 · nsacyber/HIRS

ThatSilentCoder · 2026-03-06T21:14:07Z

Description

Fix exceptions caused by provisioning against the ACA that is setup using the ECC key parameter in the setup script.

Test Instructions:

Remove your local setup of the ACA using the follwing commands:

On Linux:

sudo package/linux/aca/aca_remove_setup.sh

On Windows (Powershell 7 Core in Admin mode):

package\win\aca\aca_remove_setup.ps1

Setup the ACA to use ECC keys as follows:

On Linux:

sudo package/linux/aca/aca_setup.sh -aa ecc -u

On Windows (Powershell 7 Core in Admin mode):

package\win\aca\aca_setup.ps1 -aa ecc -u

If everything is configured correctly, run the ACA.
Run the provisioner against the ACA for different policy settings: no policy enabled, platform credential
validation enabled, endorsement credential validation enabled, firmware validation enabled.
Verify that for each policy setting, assuming you've uploaded the correct certificates/RIMS up to the ACA per policy, the provisioning succeeds and that the ACA produces two issued certificates.
Verify that for each policy setting, no exceptions/errors are thrown in the console/logs.

Summary Of Changes:

Added the -aca-alg, -ta-alg, and -db-alg parameters to the PowerShell scripts to enable ACA setup on Windows using both ECC and RSA. Since introducing these parameters required updates across multiple scripts, additional fixes were made to address improper PowerShell syntax, along with general formatting improvements to the .ps1 files.
Used the ShellCheck plugin while updating portions of the Bash scripts to address warnings and potential issues. Also improved the help menu output for better usability.
Refactored the REST controller and service classes (specifically the Identity Claim and Certificate Processor classes) to align with proper Spring Boot MVC design patterns.
Converted the Identity Claim and Certificate Processor classes into Spring-managed services by annotating them with @Service annotation, as they were effectively acting as services.
Simplified the Identity Claim and Certificate Processor classes by moving unrelated logic into appropriate service classes, reducing complexity and better adhering to the Single Responsibility Principle.
Converted utility classes used by the Identity Claim and Certificate Processor classes into Spring-managed service classes, as they contained business logic and repository interactions.
ACA can now determine the type of keys being provided, rather than assuming all keys are RSA, and supports handling both ECC and RSA during the provisioning process.

Issues This PR Addresses:

Closes #1090

…hm used throughout the application (prop has been added to the app.properties for both win and linux machines), deleted a repo that wasnt being used anywhere, changed the name of the rest controller and service class, re-wrote the workflow from rest controller to backend since it was setup incorrectly. Provisioning is sort-of crypto-agile. It can parse the rsa key without an issue, now need to work on doing the same for the ecc key.

… array. Fixing up some warnings for the shell scripts.

…n bash scripts. Took care of a majority of them.

…s in the utils class.

…ential using ecc. Fixed the enum class. Removed throws exception decorator from methods. Made abstract processor abstract. Might consider ditching the abstract processor and placing them in a utils class. This might be a bit more complicated than we imagined.

…methods, moved the restconrtoller, service and service impl to a package that makes sense for these classes, deleted abstract processor, moved methods that pertain to each procressor to their respective processor and moved any common utilities to a util function. Might need to change the way we extract the public key algorithm for this to work properly.

…services to reduce the lines of code in some of the bigger processors (and to separate responsibilities). Removed public key algorithm property in app.properties. Can now extract algo from the alg id inside of a byte array. Added a new property to Public Key Algorithm enum.

…tored the device info processor service so now there isnt one huge monolith that handles the device info parsing. Will take on more refactoring for other intricate parts in future commits.

…ed to figure how to remove componetinforepo completely since it is only being used once. Same with device repo.

… need to add algo param to the powershell scripts so this works on windows and will have to address scenarios where the ak and ek keys are not rsa keys. currently have a method that handles that situation but will need to figure out how to implement that issue.

…ripts slowly but surely. Renamed some functions in the service/helper classes.

…n params are set. Corrrected language/presentation of help menu for both bash and ps scripts.

…a, aa, and da parameters and can now set the ecc and rsa configs based on the provided alg param. Corrected spelling, syntax errors, and other minor things to ensure these scripts can be run without any issues.

…1132)

…toring the cert request processor service. Refactored PS setup script and formatted ps1 scripts. Will work on the method that takes ak and ek ecc key and should be done with draft PR.

…ionerStateService class, moved validation services to the validation service package. Started working on creating a credential blob using two ecc keys. Almost at the finish line.

…provision utils. Can remove WIP from PR.

…e that holds the rest controller, fixed other minor issues.

ThatSilentCoder · 2026-03-06T21:15:51Z

...CA/src/main/java/hirs/attestationca/persist/provision/helper/CredentialManagementHelper.java

- * Utility class which includes credential management functions used by the ACA.
- */
-@Log4j2
-public final class CredentialManagementHelper {


This has been refactored to a SpringBoot service class.

ThatSilentCoder · 2026-03-06T21:16:24Z

...ava/hirs/attestationca/persist/provision/service/AttestationCertificateAuthorityService.java

+ * Interface that defines the responsibilities of the Attestation Certificate Authority service.
 */
-public interface RestfulInterface {
+public interface AttestationCertificateAuthorityService {


Renamed the interface class to better reflect its purpose.

ThatSilentCoder · 2026-03-06T21:17:30Z

...estationCA/src/test/java/hirs/attestationca/persist/AttestationCertificateAuthorityTest.java

- * Test suite for {@link AttestationCertificateAuthority}.
- */
-@TestInstance(TestInstance.Lifecycle.PER_CLASS)              // needed to use non-static BeforeAll
-public class AttestationCertificateAuthorityTest {


The class has been renamed.

ThatSilentCoder · 2026-03-06T21:18:47Z

...ationCA/src/main/java/hirs/attestationca/persist/RestfulAttestationCertificateAuthority.java

-@Log4j2
-@RestController
-@RequestMapping("/HIRS_AttestationCA")
-public class RestfulAttestationCertificateAuthority extends AttestationCertificateAuthority


REST Controller class has been renamed and refactored.

ThatSilentCoder · 2026-03-06T21:20:23Z

...in/java/hirs/attestationca/persist/provision/service/CertificateRequestProcessorService.java

+     *
+     * @return signature algorithm associated with the private key
+     */
+    private String getSignatureAlgorithm() {


This function resolves the issue.

ThatSilentCoder · 2026-03-19T17:36:50Z

...tationCA/src/main/java/hirs/attestationca/persist/provision/CertificateRequestProcessor.java

-import java.util.List;
-
-@Log4j2
-public class CertificateRequestProcessor extends AbstractProcessor {


This has been renamed and has been turned into a @service component.

ThatSilentCoder · 2026-03-19T17:38:40Z

HIRS_AttestationCA/src/main/java/hirs/attestationca/persist/validation/ValidationService.java

@@ -1,4 +1,4 @@
-package hirs.attestationca.persist.service;
+package hirs.attestationca.persist.validation;



Moved this Service class to the appropriate package.

ThatSilentCoder · 2026-03-19T17:39:09Z

..._AttestationCA/src/main/java/hirs/attestationca/persist/AttestationCertificateAuthority.java

- * Identity Request.
- */
-@Log4j2
-public abstract class AttestationCertificateAuthority {


Has been renamed and refactored into a @service component.

ThatSilentCoder · 2026-03-19T17:50:24Z

...in/java/hirs/attestationca/persist/provision/service/CertificateRequestProcessorService.java

+ */
+@Service
+@Log4j2
+public class CertificateRequestProcessorService {


This is just the refactored version of the original CertificateRequestProcessor

ThatSilentCoder · 2026-03-19T17:52:39Z

...rc/main/java/hirs/attestationca/persist/provision/service/IdentityClaimProcessorService.java

+ */
+@Service
+@Log4j2
+public class IdentityClaimProcessorService {


Refactored version of the Identity Claim Processor class.

ThatSilentCoder added 20 commits February 19, 2026 17:51

v3.1_issue_1090: First cut of the fixing the ecc provisioning issue.

8964f31

Merge branch 'main' into v3.1_issue_1090-fix-aca-provision-using-ecc-key

553ba00

v3.1_issue_1090: Figuring out how to parse the ecc key from the bytes…

879ec7e

… array. Fixing up some warnings for the shell scripts.

v3.1_issue_1090: Fixing warnings/errors pointed out by shell plugin i…

9d14600

…n bash scripts. Took care of a majority of them.

Merge branch 'main' into v3.1_issue_1090-fix-aca-provision-using-ecc-key

f7969bc

v3.1_issue_1090: Fixed a lot of tests. Removed a lot of unused method…

4f1e778

…s in the utils class.

Merge branch 'main' into v3.1_issue_1090-fix-aca-provision-using-ecc-key

cc01535

Merge branch 'main' into v3.1_issue_1090-fix-aca-provision-using-ecc-key

40bd091

Merge branch 'main' into v3.1_issue_1090-fix-aca-provision-using-ecc-key

45471b0

v3.1_issue_1090: SLowly but surely making progress.

6527bc0

v3.1_issue_1090: Merged main into local branch.

6169988

v3.1_issue_1090: Just to quiet spotbug error.

b3b0259

Merge branch 'main' into v3.1_issue_1090-fix-aca-provision-using-ecc-key

9da7763

v3.1_issue_1090: Made some name changes to the service classes, refac…

fc79f20

…tored the device info processor service so now there isnt one huge monolith that handles the device info parsing. Will take on more refactoring for other intricate parts in future commits.

v3.1_issue_1120: Finished refactoring the identityclaimprocessor. nee…

72393a2

…ed to figure how to remove componetinforepo completely since it is only being used once. Same with device repo.

ThatSilentCoder linked an issue Mar 6, 2026 that may be closed by this pull request

Fix ACA provision using ecc key #1090

Open

ThatSilentCoder added the enhancement Improving on an implemented feature label Mar 6, 2026

ThatSilentCoder added 2 commits March 6, 2026 17:00

v3.1_issue_1090: Should fix the unusual system error.

8f256fd

Merge branch 'main' into v3.1_issue_1090-fix-aca-provision-using-ecc-key

c55528c

ThatSilentCoder added the refactor Code improvements, restructuring, or cleanup without changing external behavior. label Mar 10, 2026

ThatSilentCoder added 5 commits March 10, 2026 17:48

v3.1_issue_1127: Adding the setup ecc keys param to the powershell sc…

b368c91

…ripts slowly but surely. Renamed some functions in the service/helper classes.

Merge branch 'main' into v3.1_issue_1090-fix-aca-provision-using-ecc-key

ac0ec5c

v3.1_issue1127: Can now add rsa,ecc properties to the spring file whe…

5e57027

…n params are set. Corrrected language/presentation of help menu for both bash and ps scripts.

v3.1_issue1127: Finished modifying powershell scripts to accept the t…

7fb5757

…a, aa, and da parameters and can now set the ecc and rsa configs based on the provided alg param. Corrected spelling, syntax errors, and other minor things to ensure these scripts can be run without any issues.

Piped output of write-output to WriteAndLog function

1c796c5

iadgovuser29 and others added 7 commits March 13, 2026 09:16

MSBuild should build msi on fips systems; better version reporting (#…

35be596

…1132)

Merge branch 'main' into v3.1_issue_1090-fix-aca-provision-using-ecc-key

fb47a66

v3.1_issue_1127: Created a new service class for the tpm state. Refac…

335c42c

…toring the cert request processor service. Refactored PS setup script and formatted ps1 scripts. Will work on the method that takes ak and ek ecc key and should be done with draft PR.

Merge branch 'main' into v3.1_issue_1090-fix-aca-provision-using-ecc-key

7e8307a

v3.1_issue_1127: Forgot to add autowired annotation to the Tpm2Provis…

51d284d

…ionerStateService class, moved validation services to the validation service package. Started working on creating a credential blob using two ecc keys. Almost at the finish line.

v3.1_issue_1127: This should fix the build error on github.

582911e

v3.1_issue_1127: Finished the make credential using ecc keys func in …

d567049

…provision utils. Can remove WIP from PR.

ThatSilentCoder marked this pull request as ready for review March 18, 2026 22:04

ThatSilentCoder requested review from iadgovuser26, iadgovuser29 and iadgovuser59 March 18, 2026 22:04

ThatSilentCoder added server v3.2.0 Issues for Release 3.2.0 of the ACA labels Mar 19, 2026

ThatSilentCoder added 2 commits March 19, 2026 13:13

Merge branch 'main' into v3.1_issue_1090-fix-aca-provision-using-ecc-key

252dedc

v3.1_issue_1127: Corrected some checkstyle errors, added a new packag…

e63a30e

…e that holds the rest controller, fixed other minor issues.

ThatSilentCoder commented Mar 19, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[#1090] Fix ACA Provisioning Issue When Using ECC Key#1127

[#1090] Fix ACA Provisioning Issue When Using ECC Key#1127
ThatSilentCoder wants to merge 36 commits intomainfrom
v3.1_issue_1090-fix-aca-provision-using-ecc-key

ThatSilentCoder commented Mar 6, 2026 •

edited

Loading

Uh oh!

ThatSilentCoder Mar 6, 2026

Uh oh!

ThatSilentCoder Mar 6, 2026

Uh oh!

ThatSilentCoder Mar 6, 2026

Uh oh!

ThatSilentCoder Mar 6, 2026

Uh oh!

ThatSilentCoder Mar 6, 2026

Uh oh!

ThatSilentCoder Mar 19, 2026

Uh oh!

ThatSilentCoder Mar 19, 2026

Uh oh!

ThatSilentCoder Mar 19, 2026

Uh oh!

ThatSilentCoder Mar 19, 2026

Uh oh!

ThatSilentCoder Mar 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

		@@ -1,4 +1,4 @@
		package hirs.attestationca.persist.service;
		package hirs.attestationca.persist.validation;

Conversation

ThatSilentCoder commented Mar 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Test Instructions:

Summary Of Changes:

Issues This PR Addresses:

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

ThatSilentCoder commented Mar 6, 2026 •

edited

Loading