58 lines
2.1 KiB
Diff
58 lines
2.1 KiB
Diff
|
From b48c1096766f8fd1a9edc1ac5c1c0eea16dc2e5b Mon Sep 17 00:00:00 2001
|
||
|
|
From: Jonas Witschel <diabonas@gmx.de>
|
||
|
|
Date: Fri, 6 Sep 2019 15:04:35 +0200
|
||
|
|
Subject: [PATCH] clevis-encrypt-tpm2: fix TPM object attributes
|
||
|
|
|
||
|
|
Fix two problems with the current specification of the object
|
||
|
|
attributes:
|
||
|
|
|
||
|
|
1. According to the Trusted Platform Module Library Family 2.0
|
||
|
|
Specification - Part 2: Structures, Revision 1.38, Section 8.3.3.5,
|
||
|
|
sensitiveDataOrigin shall not be set for data objects:
|
||
|
|
|
||
|
|
NOTE 3 The inSensitive.sensitive.data.size parameter may not be zero for
|
||
|
|
a data object so sensitiveDataOrigin is required to be CLEAR. A data
|
||
|
|
object has type = TPM_ALG_KEYEDHASH and its sign and decrypt attributes
|
||
|
|
are CLEAR.
|
||
|
|
|
||
|
|
tpm2-tools 3.X silently removes the inconsistent 'sensitivedataorigin'
|
||
|
|
attribute.
|
||
|
|
|
||
|
|
2. If the key is sealed against a certain PCR configuration,
|
||
|
|
'userwithauth' needs to be clear so that the key cannot be unsealed with
|
||
|
|
the default empty authorisation password. On the other hand, if the key
|
||
|
|
is not sealed against a specific PCR configuration, 'userwithauth' must
|
||
|
|
be set because there is no PCR policy to fulfil.
|
||
|
|
|
||
|
|
tpm2-tools 3.X silently adds 'userwithauth' if no policy is specified
|
||
|
|
for tpm2_create.
|
||
|
|
---
|
||
|
|
src/pins/tpm2/clevis-encrypt-tpm2 | 4 +++-
|
||
|
|
1 file changed, 3 insertions(+), 1 deletion(-)
|
||
|
|
|
||
|
|
diff --git a/src/pins/tpm2/clevis-encrypt-tpm2 b/src/pins/tpm2/clevis-encrypt-tpm2
|
||
|
|
index c70187d7f4c..a7f333269bc 100755
|
||
|
|
--- a/src/pins/tpm2/clevis-encrypt-tpm2
|
||
|
|
+++ b/src/pins/tpm2/clevis-encrypt-tpm2
|
||
|
|
@@ -24,7 +24,7 @@ auth="o"
|
||
|
|
# Algorithm type must be keyedhash for object with user provided sensitive data.
|
||
|
|
alg_create_key="keyedhash"
|
||
|
|
# Attributes for the created TPM2 object with the JWK as sensitive data.
|
||
|
|
-obj_attr="fixedtpm|fixedparent|sensitivedataorigin|noda|adminwithpolicy"
|
||
|
|
+obj_attr="fixedtpm|fixedparent|noda|adminwithpolicy"
|
||
|
|
|
||
|
|
function on_exit() {
|
||
|
|
if ! rm -rf $TMP; then
|
||
|
|
@@ -130,6 +130,8 @@ if [ -n "$pcr_ids" ]; then
|
||
|
|
fi
|
||
|
|
|
||
|
|
policy_options="-L $TMP/pcr.policy"
|
||
|
|
+else
|
||
|
|
+ obj_attr="$obj_attr|userwithauth"
|
||
|
|
fi
|
||
|
|
|
||
|
|
if ! tpm2_create -Q -g "$hash" -G "$alg_create_key" -c $TMP/primary.context -u $TMP/jwk.pub \
|
||
|
|
--
|
||
|
|
2.21.0
|
||
|
|
|