ECC Endorsement Certificate not generated by swtpm_setup #773
Labels
not-a-bug
Not a bug
Comments
|
Here's the output of the swtpm_setup run: Since swtpm 0.4 swtpm_setup has been creating a NIST-P384/secp384r1 key and stores it at location Documentation is here: https://github.com/stefanberger/swtpm/wiki/Certificates-created-by-swtpm_setup#tpm-2-certificates TCG docs section 2.2.1.5.1: https://trustedcomputinggroup.org/wp-content/uploads/TCG_IWG_Credential_Profile_EK_V2.1_R13.pdf |
|
Thanks! I somehow expected a |
Primarily to get the switch to NIST-P384 behind us asap. I would expect this to come in the future anyway. |
|
Is there a way I can write an P-256 EK key to the NVRAM? I've used the following command to generate one: $ swtpm_localca --tpm2 --type ek --tpm-manufacturer 00001014 --tpm-model swtpm --tpm-version 20221208 --tpm-spec-family 2.0 --tpm-spec-level 0 --tpm-spec-revision 146 --ek x=$(openssl rand -hex 32 | tr -d '\n '),y=$(openssl rand -hex 32 | tr -d '\n '),id=secp256r1But I am not able to find a way I can write it from a Dockerfile. The swtpm daemon can not run during a Docker build process, so I can not just write to the tpm using tpm-tools. I've found the C function that writes the EK, but I cannot just run that from the command line: Line 1336 in c6b78f4 |
Can you run a script from within the Dockerfile that RUNs swtpm and lets you use the tpm tools to write the cert into it and terminates swtpm in the end? |
|
Executing this script in a single dbus-daemon --fork --system
swtpm socket --tpmstate dir=/tmp/mytpm2 --tpm2 --ctrl type=tcp,port=2322 --server type=tcp,port=2321 --flags not-need-init -d
tpm2-abrmd --tcti="swtpm:port=2321" --allow-root &
tpm2_nvdefine 0x01c0000a -C p -a 'ppwrite|writedefine|ppread|ownerread|authread|no_da|platformcreate'
tpm2_nvwrite 0x01c0000a -C p -i ek.cert
tpm2_nvwritelock 0x01c0000a -C p
rm /run/dbus/pid |
|
@stefanberger why does the create certificate does not have a public key included? |
|
When I take the logging output from above I get the following for sec384r1: So this looks good with secp384r1. I created a prime256v1 (= secp256r1) key: Get x and y from it and create cert: So the output is as expected for secp256r1. I would suggest to check your input or work with a real key's x and y parameters rather than random numbers. Edit: OpenSSL checks whether the points are on the curve and bails out if they are not - this is due to the random numbers. The certificate is basically useless and shouldn't be created though GnuTLS in this doesn't seem to care creating this certificate. For as long as GnuTLS checks that the point is on the curve when it does math with it, that's important. |
|
Thanks!! I made a simple bash script to extract the X and Y from the P256 EK: tpm2_createek -G ecc -c - -u ek.pub -f der
PUBLIC_KEY=$(openssl ec -pubin -in ek.pub -inform DER -pubout -text | head -n 7 | tail -n 5 | tr -d '[:space:]:' | tail -c128)
PUBLIC_KEY_X=$(echo -n $PUBLIC_KEY | head -c64)
PUBLIC_KEY_Y=$(echo -n $PUBLIC_KEY | tail -c64)
swtpm_localca --tpm2 --type ek --tpm-manufacturer 00001014 --tpm-model swtpm --tpm-version 20221208 --tpm-spec-family 2.0 --tpm-spec-level 0 --tpm-spec-revision 146 --ek x=$PUBLIC_KEY_X,y=$PUBLIC_KEY_Y,id=secp256r1
tpm2_nvdefine 0x01c0000a -C p -a 'ppwrite|writedefine|ppread|ownerread|authread|no_da|platformcreate' -s $(stat --printf="%s" ek.cert)
tpm2_nvwrite 0x01c0000a -C p -i ek.cert
tpm2_nvwritelock 0x01c0000a -C p |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Describe the bug
ECC Endorsement Certificate not generated by swtpm_setup while using the
--eccis used.To Reproduce
swtpm_setup --tpmstate /tmp/mytpm2 --ecc --create-ek-cert --create-platform-cert --tpm2 --lock-nvramto setup swtpm.tpm2_getekcertificate -o ek_rsa.crt -o ek_ecc.crt, will outputWARN: Ignoring the additional output file since only 1 cert found on NV.Expected behavior
An EC Endorsement Key Certificate is expected at nv index
0x01C0000A.Desktop:
bullseye-slimVersions of relevant components
Additional context
The RSA EK certificate is generated, but the ECC is not.
The text was updated successfully, but these errors were encountered: