mirror of
https://github.com/siderolabs/talos.git
synced 2025-10-27 22:41:34 +01:00
166d75fe88
The previous flow was using TPM PCR 11 values to bound the policy which means TPM cannot unseal when UKI changes. Now it's fixed to use PCR 7 which is bound to the SecureBoot state (SecureBoot status and Certificates). This provides a full chain of trust bound to SecureBoot state and signed PCR signature. Also the code has been refactored to use PolicyCalculator from the TPM library. Signed-off-by: Noel Georgi <git@frezbo.dev>
73 lines
2.0 KiB
Go
73 lines
2.0 KiB
Go
// This Source Code Form is subject to the terms of the Mozilla Public
|
|
// License, v. 2.0. If a copy of the MPL was not distributed with this
|
|
// file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
|
|
|
// Package tpm2 provides TPM2.0 related functionality helpers.
|
|
package tpm2
|
|
|
|
import (
|
|
"crypto/rsa"
|
|
"crypto/x509"
|
|
"encoding/pem"
|
|
"fmt"
|
|
"os"
|
|
|
|
"github.com/google/go-tpm/tpm2"
|
|
)
|
|
|
|
// ParsePCRSigningPubKey parses a PEM encoded RSA public key.
|
|
func ParsePCRSigningPubKey(file string) (*rsa.PublicKey, error) {
|
|
pcrSigningPubKey, err := os.ReadFile(file)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("failed to read pcr signing public key: %v", err)
|
|
}
|
|
|
|
block, _ := pem.Decode(pcrSigningPubKey)
|
|
if block == nil {
|
|
return nil, fmt.Errorf("failed to decode pcr signing public key")
|
|
}
|
|
|
|
// parse rsa public key
|
|
tpm2PubKeyAny, err := x509.ParsePKIXPublicKey(block.Bytes)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
tpm2PubKey, ok := tpm2PubKeyAny.(*rsa.PublicKey)
|
|
if !ok {
|
|
return nil, fmt.Errorf("failed to cast pcr signing public key to rsa")
|
|
}
|
|
|
|
return tpm2PubKey, nil
|
|
}
|
|
|
|
// RSAPubKeyTemplate returns a TPM2.0 public key template for RSA keys.
|
|
func RSAPubKeyTemplate(bitlen, exponent int, modulus []byte) tpm2.TPMTPublic {
|
|
return tpm2.TPMTPublic{
|
|
Type: tpm2.TPMAlgRSA,
|
|
NameAlg: tpm2.TPMAlgSHA256,
|
|
ObjectAttributes: tpm2.TPMAObject{
|
|
Decrypt: true,
|
|
SignEncrypt: true,
|
|
UserWithAuth: true,
|
|
},
|
|
Parameters: tpm2.NewTPMUPublicParms(tpm2.TPMAlgRSA, &tpm2.TPMSRSAParms{
|
|
Symmetric: tpm2.TPMTSymDefObject{
|
|
Algorithm: tpm2.TPMAlgNull,
|
|
Mode: tpm2.NewTPMUSymMode(tpm2.TPMAlgRSA, tpm2.TPMAlgNull),
|
|
},
|
|
Scheme: tpm2.TPMTRSAScheme{
|
|
Scheme: tpm2.TPMAlgNull,
|
|
Details: tpm2.NewTPMUAsymScheme(tpm2.TPMAlgRSA, &tpm2.TPMSSigSchemeRSASSA{
|
|
HashAlg: tpm2.TPMAlgNull,
|
|
}),
|
|
},
|
|
KeyBits: tpm2.TPMKeyBits(bitlen),
|
|
Exponent: uint32(exponent),
|
|
}),
|
|
Unique: tpm2.NewTPMUPublicID(tpm2.TPMAlgRSA, &tpm2.TPM2BPublicKeyRSA{
|
|
Buffer: modulus,
|
|
}),
|
|
}
|
|
}
|