talos

mirrors/talos

Fork 0

mirror of https://github.com/siderolabs/talos.git synced 2025-10-27 22:41:34 +01:00

Commit Graph

Author	SHA1	Message	Date
Noel Georgi	14966e718a	fix: skip over tpm2 1.2 devices For rng seed and pcr extend, let's ignore if the device is not TPM2.0 based. Seal/Unseal operations would still error out since it's explicitly user enabled feature. Signed-off-by: Noel Georgi <git@frezbo.dev>	2023-07-18 12:58:45 +05:30
Noel Georgi	166d75fe88	fix: tpm2 encrypt/decrypt flow The previous flow was using TPM PCR 11 values to bound the policy which means TPM cannot unseal when UKI changes. Now it's fixed to use PCR 7 which is bound to the SecureBoot state (SecureBoot status and Certificates). This provides a full chain of trust bound to SecureBoot state and signed PCR signature. Also the code has been refactored to use PolicyCalculator from the TPM library. Signed-off-by: Noel Georgi <git@frezbo.dev>	2023-07-14 23:58:59 +05:30

Author

SHA1

Message

Date

Noel Georgi

14966e718a

fix: skip over tpm2 1.2 devices

For rng seed and pcr extend, let's ignore if the device is not TPM2.0
based. Seal/Unseal operations would still error out since it's
explicitly user enabled feature.

Signed-off-by: Noel Georgi <git@frezbo.dev>

2023-07-18 12:58:45 +05:30

Noel Georgi

166d75fe88

fix: tpm2 encrypt/decrypt flow

The previous flow was using TPM PCR 11 values to bound the policy which
means TPM cannot unseal when UKI changes. Now it's fixed to use PCR 7
which is bound to the SecureBoot state (SecureBoot status and
Certificates). This provides a full chain of trust bound to SecureBoot
state and signed PCR signature.

Also the code has been refactored to use PolicyCalculator from the TPM
library.

Signed-off-by: Noel Georgi <git@frezbo.dev>

2023-07-14 23:58:59 +05:30

2 Commits