Repository: project-oak/oak
Pull request #1820 (2020-12-10 16:51:30)

Remove GrpcTag
Now that we have the `PublicKeyIdentityTag`, the `GrpcTag`, and hmac bearer token can be removed. 

Ref #565


rbehjati: I am not quite comfortable with removing all that cpp code. Do we need something similar for `PublicKeyIdentityTag` instead? 
conradgrobler: > I am not quite comfortable with removing all that cpp code. Do we need something similar for `PublicKeyIdentityTag` instead?

I think it would be good to add support for the PublicKeyIdentityTag to the common cpp code (label.h and label.cpp) to keep the proto defintions and cpp helpers in sync.

I don't think there is a need to add special handling for public key identity tags in application_client.h.

I also noticed that authorization_bearer_token_metadata.h and authorization_bearer_token_metadata.cc seems to be unused after these changes, so could probably also be deleted.
conradgrobler: > I don't think there is a need to add special handling for public key identity tags in application_client.h.

Thinking about it a bit more, I guess it would need to provide support for adding the authentication response token as a metadata field as part of the gRPC challenge-response authentication implementation.
rbehjati: > > I don't think there is a need to add special handling for public key identity tags in application_client.h.
> 
> Thinking about it a bit more, I guess it would need to provide support for adding the authentication response token as a metadata field as part of the gRPC challenge-response authentication implementation.

I tried to add the public-key identity tag. But something is failing. I'll have to look into this later. 
rbehjati: > > I don't think there is a need to add special handling for public key identity tags in application_client.h.
> 
> Thinking about it a bit more, I guess it would need to provide support for adding the authentication response token as a metadata field as part of the gRPC challenge-response authentication implementation.

As discussed, I have created a separate issue for this: #1838

Patch:
diff --git a/examples/aggregator/client/android/cpp/client.cc b/examples/aggregator/client/android/cpp/client.cc
index 8555d57923..e346ecb1ae 100644
--- a/examples/aggregator/client/android/cpp/client.cc
+++ b/examples/aggregator/client/android/cpp/client.cc
@@ -55,7 +55,7 @@ JNIEXPORT void JNICALL Java_com_google_oak_aggregator_MainActivity_createChannel
   // The particular value corresponds to the hash on the `aggregator.wasm` line in
   // https://github.com/project-oak/oak/blob/hashes/reproducibility_index.
   oak::label::Label label = oak::WebAssemblyModuleHashLabel(
-      absl::HexStringToBytes("53d38904ac029db2f25d8a976ee4bf9060cd01c80e48e2c10d9cfcbedbec50de"));
+      absl::HexStringToBytes("29fbf24bb76ab71b81bee0ce9cc1d995191a5f814ee7e5a1e04e227176779ffe"));
   kChannel = Aggregator::NewStub(oak::ApplicationClient::CreateChannel(
       address, oak::ApplicationClient::GetTlsChannelCredentials(ca_cert), label));
   JNI_LOG("gRPC channel has been created");
diff --git a/examples/aggregator/client/cpp/aggregator.cc b/examples/aggregator/client/cpp/aggregator.cc
index 0f93c55ea6..ab824eb9fa 100644
--- a/examples/aggregator/client/cpp/aggregator.cc
+++ b/examples/aggregator/client/cpp/aggregator.cc
@@ -80,7 +80,7 @@ int main(int argc, char** argv) {
   // https://github.com/project-oak/oak/blob/hashes/reproducibility_index.
   // TODO(#1674): Add appropriate TLS endpoint tag to the label as well.
   oak::label::Label label = oak::WebAssemblyModuleHashLabel(
-      absl::HexStringToBytes("53d38904ac029db2f25d8a976ee4bf9060cd01c80e48e2c10d9cfcbedbec50de"));
+      absl::HexStringToBytes("29fbf24bb76ab71b81bee0ce9cc1d995191a5f814ee7e5a1e04e227176779ffe"));
   // Connect to the Oak Application.
   auto stub = Aggregator::NewStub(oak::ApplicationClient::CreateChannel(
       address, oak::ApplicationClient::GetTlsChannelCredentials(ca_cert), label));
diff --git a/examples/aggregator/config.toml b/examples/aggregator/config.toml
index 7dbcc2a77d..9384cd0abc 100644
--- a/examples/aggregator/config.toml
+++ b/examples/aggregator/config.toml
@@ -1,3 +1,3 @@
 grpc_server_listen_address = "[::]:8080"
 backend_server_address = "https://localhost:8888"
-aggregator_module_hash = "53d38904ac029db2f25d8a976ee4bf9060cd01c80e48e2c10d9cfcbedbec50de"
+aggregator_module_hash = "29fbf24bb76ab71b81bee0ce9cc1d995191a5f814ee7e5a1e04e227176779ffe"
diff --git a/examples/aggregator/oak_app_manifest.toml b/examples/aggregator/oak_app_manifest.toml
index 0b5970e723..7f06d54bb6 100644
--- a/examples/aggregator/oak_app_manifest.toml
+++ b/examples/aggregator/oak_app_manifest.toml
@@ -1,4 +1,4 @@
 name = "aggregator"
 
 [modules]
-app = { external = { url = "https://storage.googleapis.com/oak-modules/aggregator/53d38904ac029db2f25d8a976ee4bf9060cd01c80e48e2c10d9cfcbedbec50de", sha256 = "53d38904ac029db2f25d8a976ee4bf9060cd01c80e48e2c10d9cfcbedbec50de" } }
+app = { external = { url = "https://storage.googleapis.com/oak-modules/aggregator/29fbf24bb76ab71b81bee0ce9cc1d995191a5f814ee7e5a1e04e227176779ffe", sha256 = "29fbf24bb76ab71b81bee0ce9cc1d995191a5f814ee7e5a1e04e227176779ffe" } }
diff --git a/examples/chat/module/rust/src/lib.rs b/examples/chat/module/rust/src/lib.rs
index 5c44cc8fd4..e0da5fff32 100644
--- a/examples/chat/module/rust/src/lib.rs
+++ b/examples/chat/module/rust/src/lib.rs
@@ -103,7 +103,7 @@ fn is_valid_label(_label: &Label) -> bool {
     // (label.confidentiality_tags.len() == 1)
     //     && (if let Some(tag) = &label.confidentiality_tags[0].tag {
     //         match tag {
-    //             tag::Tag::GrpcTag(_) => true,
+    //             tag::Tag::PublicKeyIdentityTag(_) => true,
     //             _ => false,
     //         }
     //     } else {
diff --git a/oak/client/BUILD b/oak/client/BUILD
index 319c9adea4..21a3d57693 100644
--- a/oak/client/BUILD
+++ b/oak/client/BUILD
@@ -25,7 +25,6 @@ cc_library(
     hdrs = ["application_client.h"],
     visibility = ["//visibility:public"],
     deps = [
-        ":authorization_bearer_token_metadata",
         ":label_metadata",
         "//oak/common:hmac",
         "//oak/common:nonce_generator",
@@ -46,15 +45,3 @@ cc_library(
         "@com_google_absl//absl/base",
     ],
 )
-
-cc_library(
-    name = "authorization_bearer_token_metadata",
-    srcs = ["authorization_bearer_token_metadata.cc"],
-    hdrs = ["authorization_bearer_token_metadata.h"],
-    visibility = ["//visibility:public"],
-    deps = [
-        "//oak/common:label",
-        "@com_github_grpc_grpc//:grpc++",
-        "@com_google_absl//absl/base",
-    ],
-)
diff --git a/oak/client/application_client.h b/oak/client/application_client.h
index 0a1abcb8be..df9d26631a 100644
--- a/oak/client/application_client.h
+++ b/oak/client/application_client.h
@@ -17,22 +17,16 @@
 #ifndef OAK_CLIENT_APPLICATION_CLIENT_H_
 #define OAK_CLIENT_APPLICATION_CLIENT_H_
 
+#include "absl/status/status.h"
+#include "glog/logging.h"
 #include "include/grpcpp/grpcpp.h"
-#include "oak/client/authorization_bearer_token_metadata.h"
 #include "oak/client/label_metadata.h"
-#include "oak/common/hmac.h"
 #include "oak/common/label.h"
 #include "oak/common/nonce_generator.h"
 #include "oak/common/utils.h"
 
 namespace oak {
 
-constexpr size_t kPerChannelNonceSizeBytes = 32;
-
-namespace {
-const std::string kBearerTokenHmacData{"oak-grpc-bearer-token-1"};
-}  // namespace
-
 // A client connected to a previously created Oak Application.
 //
 // It allows invoking the Oak Application as specified by the Oak Application policies.
@@ -40,44 +34,6 @@ const std::string kBearerTokenHmacData{"oak-grpc-bearer-token-1"};
 // TODO(#752): Verify remote attestations.
 class ApplicationClient {
  public:
-  // Creates gRPC channel credentials by using the provided (secret) token to authenticate, and the
-  // derived (public) token HMAC to set a corresponding label on any data sent over the call.
-  static std::shared_ptr<grpc::CallCredentials> authorization_bearer_token_call_credentials(
-      const std::string& authorization_bearer_token) {
-    std::string authorization_bearer_token_hmac =
-        oak::utils::hmac_sha256(authorization_bearer_token, kBearerTokenHmacData).ValueOrDie();
-
-    return grpc::CompositeCallCredentials(
-        grpc::MetadataCredentialsFromPlugin(
-            absl::make_unique<AuthorizationBearerTokenMetadata>(authorization_bearer_token)),
-        grpc::MetadataCredentialsFromPlugin(absl::make_unique<LabelMetadata>(
-            AuthorizationBearerTokenLabel(authorization_bearer_token_hmac))));
-  }
-
-  // Generates a fresh nonce to use as authorization bearer token, and uses that to authenticate and
-  // also set a corresponding label on any data sent over this call that allows only this instance
-  // of the call to be able to retrieve it.
-  //
-  // For instance, a client may interact with a server and send some data, and then later on
-  // retrieve the data via a different call over the same channel.
-  //
-  // Note that the generated token is not directly accessible outside of this method: if the channel
-  // is closed (either intentionally or accidentally) then the previously sent data will not be
-  // accessible any more, since a new channel will be required, which will be associated with a
-  // different token.
-  //
-  // TODO(#306): Consider introducing a server-side garbage collection mechanism so
-  // that inaccessible data may be deleted. If this is not feasible, perhaps it
-  // may be based on access time only, or based on additional metadata or
-  // specific time-related policies.
-  static std::shared_ptr<grpc::CallCredentials>
-  private_authorization_bearer_token_call_credentials() {
-    NonceGenerator<kPerChannelNonceSizeBytes> nonce_generator;
-    std::string channel_authorization_bearer_token = NonceToBytes(nonce_generator.NextNonce());
-
-    return authorization_bearer_token_call_credentials(channel_authorization_bearer_token);
-  }
-
   // Returns a grpc Channel connecting to the specified address initialised with the following
   // composite channel credentials:
   // - Channel credentials, which should usually be TLS credentials
diff --git a/oak/client/authorization_bearer_token_metadata.cc b/oak/client/authorization_bearer_token_metadata.cc
deleted file mode 100644
index a2462523fa..0000000000
--- a/oak/client/authorization_bearer_token_metadata.cc
+++ /dev/null
@@ -1,38 +0,0 @@
-/*
- * Copyright 2019 The Project Oak Authors
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#include "oak/client/authorization_bearer_token_metadata.h"
-
-#include <map>
-
-#include "oak/common/label.h"
-
-namespace oak {
-
-AuthorizationBearerTokenMetadata::AuthorizationBearerTokenMetadata(
-    const std::string& authorization_bearer_token)
-    : authorization_bearer_token_(authorization_bearer_token) {}
-
-grpc::Status AuthorizationBearerTokenMetadata::GetMetadata(
-    grpc::string_ref /*service_url*/, grpc::string_ref /*method_name*/,
-    const grpc::AuthContext& /*channel_auth_context*/,
-    std::multimap<grpc::string, grpc::string>* metadata) {
-  metadata->insert(
-      std::make_pair(kOakAuthorizationBearerTokenGrpcMetadataKey, authorization_bearer_token_));
-  return grpc::Status::OK;
-}
-
-}  // namespace oak
diff --git a/oak/client/authorization_bearer_token_metadata.h b/oak/client/authorization_bearer_token_metadata.h
deleted file mode 100644
index aade1aa3ad..0000000000
--- a/oak/client/authorization_bearer_token_metadata.h
+++ /dev/null
@@ -1,42 +0,0 @@
-/*
- * Copyright 2019 The Project Oak Authors
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#ifndef OAK_CLIENT_AUTHORIZATION_BEARER_TOKEN_METADATA_H_
-#define OAK_CLIENT_AUTHORIZATION_BEARER_TOKEN_METADATA_H_
-
-#include "include/grpcpp/grpcpp.h"
-
-namespace oak {
-
-// This class injects the provided authorization bearer token to the gRPC metadata of each outgoing
-// call.
-//
-// See https://grpc.io/docs/guides/auth/.
-class AuthorizationBearerTokenMetadata : public grpc::MetadataCredentialsPlugin {
- public:
-  AuthorizationBearerTokenMetadata(const std::string& authorization_bearer_token);
-
-  grpc::Status GetMetadata(grpc::string_ref service_url, grpc::string_ref method_name,
-                           const grpc::AuthContext& channel_auth_context,
-                           std::multimap<grpc::string, grpc::string>* metadata) override;
-
- private:
-  const std::string authorization_bearer_token_;
-};
-
-}  // namespace oak
-
-#endif  // OAK_CLIENT_AUTHORIZATION_BEARER_TOKEN_METADATA_H_
diff --git a/oak/common/label.cc b/oak/common/label.cc
index 3d6ee94aba..5818dcd1de 100644
--- a/oak/common/label.cc
+++ b/oak/common/label.cc
@@ -27,11 +27,6 @@ namespace oak {
 // Keep in sync with /oak_runtime/src/node/grpc/server/mod.rs.
 const char kOakLabelGrpcMetadataKey[] = "x-oak-label-bin";
 
-// The `-bin` suffix allows sending binary data for this metadata key.
-//
-// See https://github.com/grpc/grpc/blob/master/doc/PROTOCOL-HTTP2.md.
-const char kOakAuthorizationBearerTokenGrpcMetadataKey[] = "x-oak-authorization-bearer-token-bin";
-
 std::string SerializeLabel(const oak::label::Label& label_proto) {
   return label_proto.SerializeAsString();
 }
@@ -43,14 +38,6 @@ oak::label::Label DeserializeLabel(const std::string& label_bytes) {
   return label_proto;
 }
 
-oak::label::Label AuthorizationBearerTokenLabel(const std::string& authorization_token_hmac) {
-  oak::label::Label label;
-  auto* confidentiality_tag = label.add_confidentiality_tags();
-  confidentiality_tag->mutable_grpc_tag()->set_authorization_bearer_token_hmac(
-      authorization_token_hmac);
-  return label;
-}
-
 oak::label::Label WebAssemblyModuleHashLabel(const std::string& web_assembly_module_hash_sha_256) {
   oak::label::Label label;
   auto* confidentiality_tag = label.add_confidentiality_tags();
@@ -75,6 +62,13 @@ oak::label::Label TlsEndpointLabel(const std::string& authority) {
   return label;
 }
 
+oak::label::Label PublicKeyIdentityLabel(const std::string& public_key_identity) {
+  oak::label::Label label;
+  auto* confidentiality_tag = label.add_confidentiality_tags();
+  confidentiality_tag->mutable_public_key_identity_tag()->set_public_key(public_key_identity);
+  return label;
+}
+
 oak::label::Label PublicUntrustedLabel() {
   oak::label::Label label;
   return label;
diff --git a/oak/common/label.h b/oak/common/label.h
index 1e22f80075..89aed166e2 100644
--- a/oak/common/label.h
+++ b/oak/common/label.h
@@ -26,27 +26,12 @@ namespace oak {
 // effectively treated as the name of a custom HTTP header.
 ABSL_CONST_INIT extern const char kOakLabelGrpcMetadataKey[];
 
-// Metadata key used to refer to per-call authorization tokens.
-//
-// Each call may have multiple tokens under the same metadata key, in which case their authorities
-// get combined.
-//
-// Tokens are similar to OAuth2.0 access tokens, in that they grant the client the ability to access
-// data protected by the corresponding policies, for each token provided.
-//
-// See https://tools.ietf.org/html/rfc6750
-ABSL_CONST_INIT extern const char kOakAuthorizationBearerTokenGrpcMetadataKey[];
-
 // Serialized the provided label so that it can be sent as a binary gRPC metadata value.
 std::string SerializeLabel(const oak::label::Label& label_proto);
 
 // Deserializes the provided binary gRPC metadata value into a label.
 oak::label::Label DeserializeLabel(const std::string& label_bytes);
 
-// Creates a label that only allows declassifying data for gRPC clients that can present the
-// provided authorization bearer token.
-oak::label::Label AuthorizationBearerTokenLabel(const std::string& authorization_token_hmac);
-
 // Creates a label having as principal the provided WebAssembly module SHA-256 hash.
 oak::label::Label WebAssemblyModuleHashLabel(const std::string& web_asesemblymodule_hash_sha_256);
 
@@ -58,6 +43,9 @@ oak::label::Label WebAssemblyModuleSignatureLabel(
 // Creates a label having as principal the provided TLS authority (host:port).
 oak::label::Label TlsEndpointLabel(const std::string& authority);
 
+// Creates a label having as principal the provided public key identity.
+oak::label::Label PublicKeyIdentityLabel(const std::string& public_key_identity);
+
 // Creates a public untrusted label, which is the least confidential and least trusted label and
 // applies no confidentiality restrictions to the data contained in the request.
 oak::label::Label PublicUntrustedLabel();
diff --git a/oak_abi/proto/label.proto b/oak_abi/proto/label.proto
index f27ec32ff2..39ef3f1a6a 100644
--- a/oak_abi/proto/label.proto
+++ b/oak_abi/proto/label.proto
@@ -39,26 +39,14 @@ message Label {
 // See https://pdos.csail.mit.edu/papers/flume-sosp07.pdf section 3.1.
 message Tag {
   oneof tag {
-    GrpcTag grpc_tag = 1;
-    WebAssemblyModuleTag web_assembly_module_tag = 2;
-    WebAssemblyModuleSignatureTag web_assembly_module_signature_tag = 3;
-    TlsEndpointTag tls_endpoint_tag = 4;
-    PublicKeyIdentityTag public_key_identity_tag = 5;
+    WebAssemblyModuleTag web_assembly_module_tag = 1;
+    WebAssemblyModuleSignatureTag web_assembly_module_signature_tag = 2;
+    TlsEndpointTag tls_endpoint_tag = 3;
+    PublicKeyIdentityTag public_key_identity_tag = 4;
     Top top_tag = 6;
   }
 }
 
-// Policies related to gRPC communication, referring to the native gRPC node within the TCB.
-message GrpcTag {
-  // In order for a client to be authorized to fulfill a tag with (public)
-  // `authorization_bearer_token_hmac` value h, the client needs to provide a (secret) bearer token
-  // s such that h = HMAC-SHA256(s, "oak-grpc-bearer-token-1").
-  //
-  // We don't use the raw token t as the tag itself because labels are considered public by default,
-  // so the confidentiality of the token would be compromised immediately.
-  bytes authorization_bearer_token_hmac = 1;
-}
-
 // Policies related to modules, referring to the native WebAssembly node within the TCB.
 message WebAssemblyModuleTag {
   // The attestation for a single WebAssembly module, a SHA256 digest of the module in binary
diff --git a/oak_abi/src/label/mod.rs b/oak_abi/src/label/mod.rs
index e1013a2727..3f528b8ff3 100644
--- a/oak_abi/src/label/mod.rs
+++ b/oak_abi/src/label/mod.rs
@@ -87,17 +87,6 @@ pub fn confidentiality_label(tag: Tag) -> crate::proto::oak::label::Label {
     }
 }
 
-/// Creates a [`Tag`] having as principal the provided authorization bearer token.
-///
-/// See https://github.com/project-oak/oak/blob/main/oak_abi/proto/label.proto
-pub fn authorization_bearer_token_hmac_tag(authorization_bearer_token_hmac: &[u8]) -> Tag {
-    Tag {
-        tag: Some(tag::Tag::GrpcTag(GrpcTag {
-            authorization_bearer_token_hmac: authorization_bearer_token_hmac.into(),
-        })),
-    }
-}
-
 /// Creates a [`Tag`] having as principal the provided WebAssembly module SHA-256 hash.
 ///
 /// See https://github.com/project-oak/oak/blob/main/oak_abi/proto/label.proto
@@ -137,10 +126,10 @@ pub fn tls_endpoint_tag(authority: &str) -> Tag {
 /// Creates a [`Tag`] having as principal the provided identification Ed25519 public key.
 ///
 /// See https://github.com/project-oak/oak/blob/main/oak_abi/proto/label.proto
-pub fn public_key_identity_tag(public_key: Vec<u8>) -> Tag {
+pub fn public_key_identity_tag(public_key: &[u8]) -> Tag {
     Tag {
         tag: Some(tag::Tag::PublicKeyIdentityTag(PublicKeyIdentityTag {
-            public_key,
+            public_key: public_key.into(),
         })),
     }
 }
diff --git a/oak_runtime/src/node/grpc/server/mod.rs b/oak_runtime/src/node/grpc/server/mod.rs
index b2eb25b1f7..472d716822 100644
--- a/oak_runtime/src/node/grpc/server/mod.rs
+++ b/oak_runtime/src/node/grpc/server/mod.rs
@@ -387,7 +387,7 @@ fn get_user_identity_label(metadata_map: &MetadataMap) -> Result<Label, OakIdent
     })?;
 
     let public_key = verify_signed_challenge(signed_challenge)?;
-    Ok(confidentiality_label(public_key_identity_tag(public_key)))
+    Ok(confidentiality_label(public_key_identity_tag(&public_key)))
 }
 
 /// Verifies the signed challenge retrieved from the gRPC request, and returns the public key if the
diff --git a/oak_runtime/src/node/http/server.rs b/oak_runtime/src/node/http/server.rs
index d1b34e41b3..1ddf55dd84 100644
--- a/oak_runtime/src/node/http/server.rs
+++ b/oak_runtime/src/node/http/server.rs
@@ -374,7 +374,7 @@ impl HttpRequestHandler {
             // If no identity is provided, return public-untrusted
             Label::public_untrusted()
         } else {
-            confidentiality_label(public_key_identity_tag(user_identity))
+            confidentiality_label(public_key_identity_tag(&user_identity))
         };
 
         // Create a pair of temporary channels to pass the HTTP request to the Oak Node, and


Test patch:
diff --git a/oak_abi/src/label/tests.rs b/oak_abi/src/label/tests.rs
index e86b709807..97748decc3 100644
--- a/oak_abi/src/label/tests.rs
+++ b/oak_abi/src/label/tests.rs
@@ -24,27 +24,27 @@ fn serialize_deserialize() {
             integrity_tags: vec![],
         },
         Label {
-            confidentiality_tags: vec![authorization_bearer_token_hmac_tag(&[0, 0, 0])],
-            integrity_tags: vec![authorization_bearer_token_hmac_tag(&[1, 1, 1])],
+            confidentiality_tags: vec![public_key_identity_tag(&[0, 0, 0])],
+            integrity_tags: vec![public_key_identity_tag(&[1, 1, 1])],
         },
         Label {
             confidentiality_tags: vec![
-                authorization_bearer_token_hmac_tag(&[0, 0, 0]),
-                authorization_bearer_token_hmac_tag(&[0, 0, 0]),
+                public_key_identity_tag(&[0, 0, 0]),
+                public_key_identity_tag(&[0, 0, 0]),
             ],
             integrity_tags: vec![
-                authorization_bearer_token_hmac_tag(&[1, 1, 1]),
-                authorization_bearer_token_hmac_tag(&[1, 1, 1]),
+                public_key_identity_tag(&[1, 1, 1]),
+                public_key_identity_tag(&[1, 1, 1]),
             ],
         },
         Label {
             confidentiality_tags: vec![
-                authorization_bearer_token_hmac_tag(&[0, 0, 0]),
-                authorization_bearer_token_hmac_tag(&[1, 1, 1]),
+                public_key_identity_tag(&[0, 0, 0]),
+                public_key_identity_tag(&[1, 1, 1]),
             ],
             integrity_tags: vec![
-                authorization_bearer_token_hmac_tag(&[2, 2, 2]),
-                authorization_bearer_token_hmac_tag(&[3, 3, 3]),
+                public_key_identity_tag(&[2, 2, 2]),
+                public_key_identity_tag(&[3, 3, 3]),
             ],
         },
     ];
@@ -57,8 +57,8 @@ fn serialize_deserialize() {
 
 #[test]
 fn label_flow() {
-    let tag_0 = authorization_bearer_token_hmac_tag(&[0, 0, 0]);
-    let tag_1 = authorization_bearer_token_hmac_tag(&[1, 1, 1]);
+    let tag_0 = public_key_identity_tag(&[0, 0, 0]);
+    let tag_1 = public_key_identity_tag(&[1, 1, 1]);
 
     let public_untrusted = Label::public_untrusted();
 
diff --git a/oak_runtime/src/node/http/tests.rs b/oak_runtime/src/node/http/tests.rs
index c6eab9a882..de62d1c3ed 100644
--- a/oak_runtime/src/node/http/tests.rs
+++ b/oak_runtime/src/node/http/tests.rs
@@ -335,7 +335,7 @@ async fn test_https_server_can_serve_https_requests_with_user_identity_as_reques
 
     let signature = create_signature();
 
-    let label = confidentiality_label(public_key_identity_tag(signature.clone().public_key));
+    let label = confidentiality_label(public_key_identity_tag(&signature.clone().public_key));
 
     // Send an HTTPS request, and check that response has StatusCode::OK
     let resp = send_request(
diff --git a/oak_runtime/src/tests.rs b/oak_runtime/src/tests.rs
index dbebf00cd8..0ac161250b 100644
--- a/oak_runtime/src/tests.rs
+++ b/oak_runtime/src/tests.rs
@@ -18,8 +18,8 @@ use super::*;
 use maplit::{hashmap, hashset};
 use oak_abi::{
     label::{
-        authorization_bearer_token_hmac_tag, confidentiality_label, public_key_identity_tag,
-        tls_endpoint_tag, web_assembly_module_signature_tag, web_assembly_module_tag, Label,
+        confidentiality_label, public_key_identity_tag, tls_endpoint_tag,
+        web_assembly_module_signature_tag, web_assembly_module_tag, Label,
     },
     proto::oak::application::{
         node_configuration::ConfigType, ApplicationConfiguration, GrpcServerConfiguration,
@@ -126,9 +126,7 @@ fn run_node_body(node_label: &Label, node_privilege: &NodePrivilege, node_body:
 /// Returns a non-trivial label for testing.
 fn test_label() -> Label {
     Label {
-        confidentiality_tags: vec![oak_abi::label::authorization_bearer_token_hmac_tag(&[
-            1, 1, 1,
-        ])],
+        confidentiality_tags: vec![oak_abi::label::public_key_identity_tag(&[1, 1, 1])],
         integrity_tags: vec![],
     }
 }
@@ -176,8 +174,8 @@ fn create_channel_same_label_err() {
 /// Only Nodes with a public confidentiality label may create other Nodes and Channels.
 #[test]
 fn create_channel_less_confidential_label_err() {
-    let tag_0 = oak_abi::label::authorization_bearer_token_hmac_tag(&[1, 1, 1]);
-    let tag_1 = oak_abi::label::authorization_bearer_token_hmac_tag(&[2, 2, 2]);
+    let tag_0 = oak_abi::label::public_key_identity_tag(&[1, 1, 1]);
+    let tag_1 = oak_abi::label::public_key_identity_tag(&[2, 2, 2]);
     let initial_label = Label {
         confidentiality_tags: vec![tag_0, tag_1.clone()],
         integrity_tags: vec![],
@@ -203,9 +201,9 @@ fn create_channel_less_confidential_label_err() {
 /// Only Nodes with a public confidentiality label may create other Nodes and Channels.
 #[test]
 fn create_channel_less_confidential_label_declassification_err() {
-    let tag_0 = oak_abi::label::authorization_bearer_token_hmac_tag(&[1, 1, 1]);
-    let tag_1 = oak_abi::label::authorization_bearer_token_hmac_tag(&[2, 2, 2]);
-    let other_tag = oak_abi::label::authorization_bearer_token_hmac_tag(&[3, 3, 3]);
+    let tag_0 = oak_abi::label::public_key_identity_tag(&[1, 1, 1]);
+    let tag_1 = oak_abi::label::public_key_identity_tag(&[2, 2, 2]);
+    let other_tag = oak_abi::label::public_key_identity_tag(&[3, 3, 3]);
     let initial_label = Label {
         confidentiality_tags: vec![tag_0.clone(), tag_1.clone()],
         integrity_tags: vec![],
@@ -236,8 +234,8 @@ fn create_channel_less_confidential_label_declassification_err() {
 /// Only Nodes with a public confidentiality label may create other Nodes and Channels.
 #[test]
 fn create_channel_less_confidential_label_no_privilege_err() {
-    let tag_0 = oak_abi::label::authorization_bearer_token_hmac_tag(&[1, 1, 1]);
-    let tag_1 = oak_abi::label::authorization_bearer_token_hmac_tag(&[2, 2, 2]);
+    let tag_0 = oak_abi::label::public_key_identity_tag(&[1, 1, 1]);
+    let tag_1 = oak_abi::label::public_key_identity_tag(&[2, 2, 2]);
     let initial_label = Label {
         confidentiality_tags: vec![tag_0.clone(), tag_1.clone()],
         integrity_tags: vec![],
@@ -271,7 +269,7 @@ fn create_channel_less_confidential_label_no_privilege_err() {
 /// Data is always allowed to flow to more confidential labels.
 #[test]
 fn create_channel_with_more_confidential_label_from_public_untrusted_node_ok() {
-    let tag_0 = oak_abi::label::authorization_bearer_token_hmac_tag(&[1, 1, 1]);
+    let tag_0 = oak_abi::label::public_key_identity_tag(&[1, 1, 1]);
     let initial_label = &Label::public_untrusted();
     let more_confidential_label = Label {
         confidentiality_tags: vec![tag_0],
@@ -316,7 +314,7 @@ fn create_channel_with_more_confidential_label_from_public_untrusted_node_ok() {
 ///   to the newly added privilege)
 #[test]
 fn create_channel_with_more_confidential_label_from_public_node_with_downgrade_ok() {
-    let tag_0 = oak_abi::label::authorization_bearer_token_hmac_tag(&[1, 1, 1]);
+    let tag_0 = oak_abi::label::public_key_identity_tag(&[1, 1, 1]);
     let initial_label = Label::public_untrusted();
     let more_confidential_label = Label {
         confidentiality_tags: vec![tag_0.clone()],
@@ -364,7 +362,7 @@ fn create_channel_with_more_confidential_label_from_public_node_with_downgrade_o
 ///   thanks to the infinite privilege)
 #[test]
 fn create_channel_with_more_confidential_label_from_public_node_with_top_privilege_ok() {
-    let tag_0 = oak_abi::label::authorization_bearer_token_hmac_tag(&[1, 1, 1]);
+    let tag_0 = oak_abi::label::public_key_identity_tag(&[1, 1, 1]);
     let initial_label = Label::public_untrusted();
     let more_confidential_label = Label {
         confidentiality_tags: vec![tag_0],
@@ -403,8 +401,8 @@ fn create_channel_with_more_confidential_label_from_public_node_with_top_privile
 
 #[test]
 fn create_channel_with_more_confidential_label_from_non_public_node_with_downgrade_err() {
-    let tag_0 = oak_abi::label::authorization_bearer_token_hmac_tag(&[1, 1, 1]);
-    let tag_1 = oak_abi::label::authorization_bearer_token_hmac_tag(&[2, 2, 2]);
+    let tag_0 = oak_abi::label::public_key_identity_tag(&[1, 1, 1]);
+    let tag_1 = oak_abi::label::public_key_identity_tag(&[2, 2, 2]);
     let initial_label = Label {
         confidentiality_tags: vec![tag_0.clone()],
         integrity_tags: vec![],
@@ -472,8 +470,8 @@ fn create_node_invalid_configuration_err() {
 /// of any sort, regardless of label.
 #[test]
 fn create_channel_by_nonpublic_node_err() {
-    let tag_0 = oak_abi::label::authorization_bearer_token_hmac_tag(&[1, 1, 1]);
-    let tag_1 = oak_abi::label::authorization_bearer_token_hmac_tag(&[2, 2, 2]);
+    let tag_0 = oak_abi::label::public_key_identity_tag(&[1, 1, 1]);
+    let tag_1 = oak_abi::label::public_key_identity_tag(&[2, 2, 2]);
     let initial_label = Label {
         confidentiality_tags: vec![tag_0.clone()],
         integrity_tags: vec![],
@@ -506,8 +504,8 @@ fn create_channel_by_nonpublic_node_err() {
 /// succeeds.
 #[test]
 fn create_node_more_confidential_label_ok() {
-    let tag_0 = oak_abi::label::authorization_bearer_token_hmac_tag(&[1, 1, 1]);
-    let tag_1 = oak_abi::label::authorization_bearer_token_hmac_tag(&[2, 2, 2]);
+    let tag_0 = oak_abi::label::public_key_identity_tag(&[1, 1, 1]);
+    let tag_1 = oak_abi::label::public_key_identity_tag(&[2, 2, 2]);
     let initial_label = Label::public_untrusted();
     let more_confidential_label = Label {
         confidentiality_tags: vec![tag_0.clone()],
@@ -650,20 +648,17 @@ fn downgrade_multiple_labels_using_top_privilege() {
 
     let wasm_tag = web_assembly_module_tag(&[1, 2, 3]);
     let signature_tag = web_assembly_module_signature_tag(&[1, 2, 3]);
-    let bearer_token_tag = authorization_bearer_token_hmac_tag(&[1, 2, 3]);
-    let public_key_identity_tag = public_key_identity_tag(vec![1, 2, 3]);
+    let public_key_identity_tag = public_key_identity_tag(&[1, 2, 3]);
     let tls_endpoint_tag = tls_endpoint_tag("google.com");
 
     let wasm_label = confidentiality_label(wasm_tag.clone());
     let signature_label = confidentiality_label(signature_tag.clone());
-    let bearer_token_label = confidentiality_label(bearer_token_tag.clone());
     let public_key_identity_label = confidentiality_label(public_key_identity_tag.clone());
     let tls_endpoint_label = confidentiality_label(tls_endpoint_tag.clone());
     let mixed_label = Label {
         confidentiality_tags: vec![
             wasm_tag,
             signature_tag,
-            bearer_token_tag,
             public_key_identity_tag,
             tls_endpoint_tag,
         ],
@@ -677,9 +672,6 @@ fn downgrade_multiple_labels_using_top_privilege() {
     assert!(top_privilege
         .downgrade_label(&signature_label)
         .flows_to(&Label::public_untrusted()));
-    assert!(top_privilege
-        .downgrade_label(&bearer_token_label)
-        .flows_to(&Label::public_untrusted()));
     assert!(top_privilege
         .downgrade_label(&public_key_identity_label)
         .flows_to(&Label::public_untrusted()));