Comments (10)
Yes, I'm dealing with the exactly the same problem trying to learn the new API :)
from go-tpm.
Right, because just using CreatePrimary with the SRK template should always give you the correct key regardless.
However, it seems like projects like systemd use EvictControl to ensure a known persistent key can be used for sessions. Is this one of the few valid use cases for EvictControl?
systemd/systemd#26185I was also implementing the systemd flow in go, and hit by this, though v253 of systemd did not use an SRK at all
okay, the reason probably systemd persists it is due to that fact that falls back to RSA if ECC is not supported. Otherwise it doesn't seem no reason to persist an ECC key
from go-tpm.
Regardless of if systemd demands it, a PR adding EvictControl here would still be quite welcome (maybe someone else has a use case) :)
from go-tpm.
Or is that not needed anymore?
As the tpmdirect
API is suppose to mirror the actual TPM API, it's missing it seems. This makes dealing with key hierarchies impossible(?) with the current API.
from go-tpm.
Thanks, I was wondering how to persist an SRK key
from go-tpm.
It's needed and welcome, please feel free to send a PR based on the structure of the other commands, and I'd be happy to prioritize review (because reviewing the 1:1 mapped spec-to-structs code is pretty straightforward). Thank you for trying out the new API!
from go-tpm.
<remove go-TPM hat, don TCG/TPM hat>
The reason EvictControl isn't yet available in the new API is that you don't actually need it, most of the time. Of course, if you are trying to plug in to an existing infra that expects, for example, a persistent RSA SRK, then you need it.
The reason I say you do not really need it:
EvictControl takes an existing object and stores it to TPM NV for convenience. Usually this is done on Primary Keys. The main reasons (besides avoiding another call to CreatePrimary
/FlushContext
) this is done:
- That most closely reflects how the SRK worked in TPM 1.2 (it was special, somebody had to make it)
- RSA Primary Keys can take a very long time to generate each time
If you're using ECC Primary Keys (which I would recommend), the CreatePrimary call will in some cases be faster than using the key out of NV flash memory.
All that said, PR to add EvictControl is completely welcome 😎
from go-tpm.
Right, because just using CreatePrimary with the SRK template should always give you the correct key regardless.
However, it seems like projects like systemd use EvictControl to ensure a known persistent key can be used for sessions. Is this one of the few valid use cases for EvictControl?
from go-tpm.
Depending on how you have the owner hierarchy password/policy set up, then the persisted key being present at the expected index could be an indicator of trust; however, you need owner auth to CreatePrimary
, same as to EvictControl
. I'm not familiar enough with how systemd is using the persisted SRK to comment further: I am used to environments where the owner auth is well-known and thus not a barrier to adversaries in the threat model.
from go-tpm.
Right, because just using CreatePrimary with the SRK template should always give you the correct key regardless.
However, it seems like projects like systemd use EvictControl to ensure a known persistent key can be used for sessions. Is this one of the few valid use cases for EvictControl?
I was also implementing the systemd flow in go, and hit by this, though v253 of systemd did not use an SRK at all
from go-tpm.
Related Issues (20)
- support passing []byte as TPM2B HOT 2
- Add a Compare function
- Load TSS2 Private Key generated with tpm2tss-genkey HOT 2
- Inconsistency between written and read values when accessing PCR HOT 3
- reduce unnecessary overhead of Tbsi_Get_TCG_Log HOT 1
- Missing ExtraData in Quote
- Use `crypto/ecdh` for tpmdirect HOT 5
- Darwin ? HOT 1
- Consider an UnmarshalReader API for types
- HMAC Session not working HOT 2
- Support As(TPMRC) for format-1 errors.
- Support serialization of persistent handles HOT 1
- Support for RSAEncrypt and RSADecrypt commands HOT 1
- TPM Simulator reporting unrecognised command over socket
- Implement TPM2_HMAC_Start
- New Releases ?! HOT 7
- missing Name for 'SignHandle' parameter HOT 2
- cmdAuths not respecting auth value HOT 1
- broken CI
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from go-tpm.