crypto

type EnclaveSecureSession struct {
	SessionId           string   // Base64-encoded
	ClientPriv          [32]byte // x25519 private key
	ClientPub           [32]byte // x25519 public key
	EnclavePubRaw       []byte   // enclave's ephemeral public key (decoded)
	SessionKey          []byte   // derived session key
	ExpiresAt           time.Time
	AttestationB64      string // Base64-encoded attestation document
	ExpectedNonceB64    string // Base64-encoded expected nonce for attestation
	AttestationVerified bool
	AttestationResult   *verificationResult
	// contains filtered or unexported fields
}

type GeneratedDEK struct {
	PlaintextDEK []byte
	EncryptedDEK []byte
}

type SessionConfig struct {
	// base URL of the proxy server
	Endpoint string
	// PCR values you expect from the enclave
	// Key: PCR index; Value: hex-encoded PCR hash
	// Note: use "nitro-cli describe-eif --eif-path enclave.eif" to get these
	ExpectedPCRs map[uint]string
	// AWS Nitro Root CA certificate (optional)
	RootCA *x509.Certificate
	// Maximum age of the attestation document
	MaxAttestationAge time.Duration
	// Whether to verify PCR values
	// Set to false during development, true in production
	VerifyPCRs bool
	// HTTPTimeout for requests
	HTTPTimeout time.Duration
}