Skip to content

Commit 36fb4b8

Browse files
salrashid123salrashid123
committed
upate readme; session example
1 parent bd234ca commit 36fb4b8

File tree

7 files changed

+117
-163
lines changed

7 files changed

+117
-163
lines changed

‎README.md

+11-3
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,9 @@ Use the signer to create a TLS session, sign CA/CSRs, generate signed url or jus
1212
Some implementations:
1313

1414
- `kms/`: Sample that implements `crypto.Signer` using Google Cloud KMS.
15-
- `tpm/`: Sample that implements `crypto.Signer` using `go-tpm` library for Trusted Platform Module This internally uses [go-tpm-tools.client.GetSigner()](https://pkg.go.dev/github.com/google/go-tpm-tools/client#Key.GetSigner)
15+
- `tpm/`: Sample that implements `crypto.Signer` using `go-tpm` library for Trusted Platform Module.
16+
17+
other stuff:
1618

1719
- `util/certgen/`: Library that generates a self-signed x509 certificate for the KMS and TPM based signers above
1820
- `util/csrgen/`: Library that generates a CSR using the key in KMS or TPM
@@ -80,7 +82,7 @@ If you just want to issue JWT's, see
8082

8183
The TPM device is managed externally outside of the signer. You have to instantiate the TPM device ReadWriteCloser and client.Key outside of the library and pass that in.
8284

83-
The advantage of this is you control it opening and closing. You must close the key and closer before calling another signing operation.
85+
The advantage of this is you control it opening and closing.
8486

8587
```golang
8688
rwc, err := OpenTPM(*tpmPath)
@@ -97,8 +99,14 @@ If you just want to issue JWT's, see
9799
Name: pub.Name,
98100
},
99101
})
100-
// the tpm is opened and then closed after every sign operation
102+
101103
s, err := r.Sign(rand.Reader, digest, crypto.SHA256)
104+
105+
// close the TPM if you are done signing
106+
rwc.Close()
107+
108+
// you need to reinitialize NewTPMCrypto if you
109+
// want to sign again after closing
102110
```
103111

104112

‎example/README.md

+21-11
Original file line numberDiff line numberDiff line change
@@ -134,28 +134,29 @@ type Session interface {
134134
}
135135
```
136136

137-
eg:
137+
for example, for a PCR and [AuthPolicy](https://github.com/google/go-tpm/pull/359) enforcement (eg, a PCR and password), you can define a custom session callback
138138

139139
```golang
140-
// for pcr sessions
141-
type MyCustomSession struct {
142-
rwr transport.TPM
143-
sel []tpm2.TPMSPCRSelection
140+
type MyPCRAndPolicyAuthValueSession struct {
141+
rwr transport.TPM
142+
sel []tpm2.TPMSPCRSelection
143+
password []byte
144144
}
145145

146-
func NewMyCustomSession(rwr transport.TPM, sel []tpm2.TPMSPCRSelection) (MyCustomSession, error) {
147-
return MyCustomSession{rwr, sel}, nil
146+
func NewPCRAndPolicyAuthValueSession(rwr transport.TPM, sel []tpm2.TPMSPCRSelection, password []byte) (MyPCRAndPolicyAuthValueSession, error) {
147+
return MyPCRAndPolicyAuthValueSession{rwr, sel, password}, nil
148148
}
149149

150-
func (p MyCustomSession) GetSession() (auth tpm2.Session, closer func() error, err error) {
150+
func (p MyPCRAndPolicyAuthValueSession) GetSession() (auth tpm2.Session, closer func() error, err error) {
151151

152-
sess, closer, err := tpm2.PolicySession(p.rwr, tpm2.TPMAlgSHA256, 16)
152+
var options []tpm2.AuthOption
153+
options = append(options, tpm2.Auth(p.password))
154+
155+
sess, closer, err := tpm2.PolicySession(p.rwr, tpm2.TPMAlgSHA256, 16, options...)
153156
if err != nil {
154157
return nil, nil, err
155158
}
156159

157-
// implement whatever you want here, i'm just using policypcr
158-
159160
_, err = tpm2.PolicyPCR{
160161
PolicySession: sess.Handle(),
161162
Pcrs: tpm2.TPMLPCRSelection{
@@ -165,8 +166,17 @@ func (p MyCustomSession) GetSession() (auth tpm2.Session, closer func() error, e
165166
if err != nil {
166167
return nil, nil, err
167168
}
169+
170+
_, err = tpm2.PolicyAuthValue{
171+
PolicySession: sess.Handle(),
172+
}.Execute(p.rwr)
173+
if err != nil {
174+
return nil, nil, err
175+
}
176+
168177
return sess, closer, nil
169178
}
179+
170180
```
171181
---
172182

‎example/go.mod

+27-25
Original file line numberDiff line numberDiff line change
@@ -5,45 +5,47 @@ go 1.22
55
toolchain go1.22.2
66

77
require (
8-
github.com/google/go-tpm v0.9.1-0.20240510201744-5c2f0887e003
8+
github.com/google/go-tpm v0.9.1
99
github.com/google/go-tpm-tools v0.4.4
1010
github.com/salrashid123/signer/kms v0.0.0
1111
github.com/salrashid123/signer/tpm v0.0.0
1212
)
1313

1414
require (
15-
cloud.google.com/go/compute v1.25.1 // indirect
16-
cloud.google.com/go/compute/metadata v0.2.3 // indirect
17-
cloud.google.com/go/iam v1.1.7 // indirect
18-
cloud.google.com/go/kms v1.15.8 // indirect
15+
cloud.google.com/go v0.114.0 // indirect
16+
cloud.google.com/go/auth v0.5.1 // indirect
17+
cloud.google.com/go/auth/oauth2adapt v0.2.2 // indirect
18+
cloud.google.com/go/compute/metadata v0.3.0 // indirect
19+
cloud.google.com/go/iam v1.1.8 // indirect
20+
cloud.google.com/go/kms v1.17.1 // indirect
21+
cloud.google.com/go/longrunning v0.5.7 // indirect
1922
github.com/felixge/httpsnoop v1.0.4 // indirect
20-
github.com/go-logr/logr v1.4.1 // indirect
23+
github.com/go-logr/logr v1.4.2 // indirect
2124
github.com/go-logr/stdr v1.2.2 // indirect
2225
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
2326
github.com/golang/protobuf v1.5.4 // indirect
2427
github.com/google/s2a-go v0.1.7 // indirect
2528
github.com/googleapis/enterprise-certificate-proxy v0.3.2 // indirect
26-
github.com/googleapis/gax-go/v2 v2.12.3 // indirect
29+
github.com/googleapis/gax-go/v2 v2.12.4 // indirect
2730
go.opencensus.io v0.24.0 // indirect
28-
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.49.0 // indirect
29-
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.49.0 // indirect
30-
go.opentelemetry.io/otel v1.24.0 // indirect
31-
go.opentelemetry.io/otel/metric v1.24.0 // indirect
32-
go.opentelemetry.io/otel/trace v1.24.0 // indirect
33-
golang.org/x/crypto v0.21.0 // indirect
34-
golang.org/x/net v0.23.0 // indirect
35-
golang.org/x/oauth2 v0.18.0 // indirect
36-
golang.org/x/sync v0.6.0 // indirect
37-
golang.org/x/sys v0.18.0 // indirect
38-
golang.org/x/text v0.14.0 // indirect
31+
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.52.0 // indirect
32+
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.52.0 // indirect
33+
go.opentelemetry.io/otel v1.27.0 // indirect
34+
go.opentelemetry.io/otel/metric v1.27.0 // indirect
35+
go.opentelemetry.io/otel/trace v1.27.0 // indirect
36+
golang.org/x/crypto v0.24.0 // indirect
37+
golang.org/x/net v0.26.0 // indirect
38+
golang.org/x/oauth2 v0.21.0 // indirect
39+
golang.org/x/sync v0.7.0 // indirect
40+
golang.org/x/sys v0.21.0 // indirect
41+
golang.org/x/text v0.16.0 // indirect
3942
golang.org/x/time v0.5.0 // indirect
40-
google.golang.org/api v0.172.0 // indirect
41-
google.golang.org/appengine v1.6.8 // indirect
42-
google.golang.org/genproto v0.0.0-20240401170217-c3f982113cda // indirect
43-
google.golang.org/genproto/googleapis/api v0.0.0-20240401170217-c3f982113cda // indirect
44-
google.golang.org/genproto/googleapis/rpc v0.0.0-20240401170217-c3f982113cda // indirect
45-
google.golang.org/grpc v1.63.0 // indirect
46-
google.golang.org/protobuf v1.33.0 // indirect
43+
google.golang.org/api v0.183.0 // indirect
44+
google.golang.org/genproto v0.0.0-20240604185151-ef581f913117 // indirect
45+
google.golang.org/genproto/googleapis/api v0.0.0-20240604185151-ef581f913117 // indirect
46+
google.golang.org/genproto/googleapis/rpc v0.0.0-20240604185151-ef581f913117 // indirect
47+
google.golang.org/grpc v1.64.0 // indirect
48+
google.golang.org/protobuf v1.34.1 // indirect
4749
)
4850

4951
replace (

0 commit comments

Comments
 (0)