Absorb TPMT_SIGNATURE parsing so cmcp and ca2a can drop their copies

[imran-siddique]

Follow-up from cmcp#447 (retiring the triplicated TPM verifier) and ca2a#73.

The gap

verify_tpm_quote takes a bare signature. But the format real TPM tooling emits is TPMT_SIGNATURE: that is what tpm2_quote -s writes and what tpm2-pytss signature.marshal() returns. agent-manifest models TPMS_ATTEST (parse_tpm_quote) and the chain plus signature verification, but nothing unwraps the signature envelope.

So every consumer that collects a quote from actual hardware has to parse TPMT_SIGNATURE itself before it can call the canonical verifier:

• cmcp_verify/tpm.py has parse_tpmt_signature (added in cmcp#448)
• ca2a_verify/tpm.py now has its own (ca2a#74)

That is the same wire-format parser in two places, which is a smaller version of exactly the problem cmcp#447 set out to retire. Both were written against the same spec and both are load-bearing: without them the canonical verifier cannot be called on real evidence at all.

Proposal

Export parse_tpmt_signature(blob) -> ParsedSignature (fields: sig_alg, hash_alg, signature) covering the three schemes a quote can use:

• TPM_ALG_RSASSA (0x0014) and TPM_ALG_RSAPSS (0x0016): size-prefixed TPM2B_PUBLIC_KEY_RSA
• TPM_ALG_ECDSA (0x0018): two size-prefixed integers, R then S, re-encoded as a DER sequence so cryptography verifies it directly

Optionally, accept a marshalled TPMT_SIGNATURE directly in verify_tpm_quote by sniffing the envelope, which would let callers pass hardware output through untouched.

Worth noting while this is open: verify_tpm_quote currently hardcodes SHA-256 for both the ECDSA and RSA paths, and RSA is PKCS#1 v1.5 only. Azure vTPM signs RSASSA/SHA-256 so that combination is validated, but a quote using RSAPSS or a SHA-384 digest would not verify. If TPMT_SIGNATURE parsing lands here, the hash_alg it carries is the natural way to select the digest instead of assuming one.

Sequencing

Not urgent, and deliberately not blocking: ca2a#74 shipped with a local copy so the collector work was not gated on a release here. When this lands, both repos drop their copies and bump their floor.

/cc @imran-siddique

[imran-siddique]

Scope addition: TPM_ST_ATTEST_NV (0x8014) has the same gap, and it is now blocking a second consumer.

verify_tpm_quote rejects any attest type that is not TPM_ST_ATTEST_QUOTE, and parse_tpm_quote assumes the attested union is a TPML_PCR_SELECTION followed by a PCR digest. An NV certify carries TPMS_NV_CERTIFY_INFO instead (indexName as TPM2B_NAME, offset as UINT16, nvContents as TPM2B_MAX_NV_BUFFER), so neither function can read one.

cmcp needs this for the gateway measurement proof (agentrust-io/cmcp#432): the measurement lives in a TPM_NT_EXTEND NV index, and TPM2_NV_Certify is the only sound way to get the TPM to sign its value. That shipped in cmcp#459 with a local parse_nv_certify, plus local signature verification, because the canonical verifier cannot be called on this attest type at all. Only the certificate chain is delegated, via verify_cert_chain.

So the duplication now covers two wire formats rather than one:

Format	Where duplicated	Why agent-manifest cannot help today
TPMT_SIGNATURE	cmcp, ca2a	verify_tpm_quote takes a bare signature; real tooling emits the envelope
TPM_ST_ATTEST_NV	cmcp	attest type rejected, and the union parse assumes a quote

Suggested shape. Rather than one function per structure, split the common TPMS_ATTEST header parse from the type-specific union, and expose the type so a caller can branch:

parse_tpm_attest(blob) -> TpmAttest(magic, attest_type, qualified_signer, qualifying_data, attested_raw)
parse_nv_certify_info(attested_raw) -> NvCertifyInfo(index_name, offset, nv_contents)
parse_tpmt_signature(blob) -> ParsedSignature(sig_alg, hash_alg, signature)

That also fixes the digest-agility point raised in the original comment, since ParsedSignature.hash_alg becomes the natural way to select the digest instead of verify_tpm_quote hardcoding SHA-256 and PKCS#1 v1.5.

Validated on hardware 2026-08-01, so these are real byte layouts rather than spec-derived guesses: an NV certify from an Azure Trusted Launch vTPM produced a 173-byte attest and a 262-byte TPMT_SIGNATURE, and indexName / offset / nvContents all parse at the offsets above, with nvContents equal to what TPM2_NV_Read returns. Happy to hand over the vectors.

Still not blocking: cmcp and ca2a both ship working local copies. But the count went from one duplicated format to two, which is the direction this issue exists to reverse.