Skip to content

Commit eca8b24

Browse files
salrashid123salrashid123
committed
breaking change: upgrade to tpm-direct; remove library managed handle
1 parent 7047274 commit eca8b24

File tree

20 files changed

+1412
-972
lines changed

20 files changed

+1412
-972
lines changed

‎README.md

+9-21
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,15 @@ Some implementations:
1919

2020
see the [example/](example/) folder for more information.
2121

22+
---
23+
24+
>> **NOTE** there will be a breaking change if you are using this library for TPM based signature after `v0.8.0`. The new structure uses the [tpm-direct](https://github.com/google/go-tpm/releases/tag/v0.9.0) API. If you would rather use the tpm2/legacy branch, please use the signer at [v0.7.2](https://github.com/salrashid123/signer/releases/tag/v0.7.2). This change also *removes* the library managed device. The caller must provide a pre-authorized key (there was no way the library could authorize the variety of auth sessions...it must be provided in)
25+
26+
27+
>> this library is not supported by google
28+
29+
---
30+
2231
### Usage Signer
2332

2433
Initialize a signer and directly use `.sign()` as shown in this sample for GCS SignedURL:
@@ -61,27 +70,6 @@ go run certgen/certgen.go -cn server.domain.com
6170

6271
---
6372

64-
### TPM Signer Device management
65-
66-
For TPM Signer, there are two modes of operation:
67-
68-
* managed externally
69-
70-
The TPM device is managed externally outside of the signer. You have to instantiate the TPM device ReadWriteCloser and client.Key outside of the library and pass that in.
71-
72-
The advantage of this is you control it opening and closing. You must close the key and closer before calling another signing operation
73-
74-
* managed by library
75-
76-
This is the preferred mode: you just pass the uint32 handle for the key and the path to the tpm device as string and the library opens/closes it as needed.
77-
78-
If the device is busy or the TPM is in use during invocation, the operation will fail.
79-
80-
TODO use a backoff retry similar to [tpmrand](https://github.com/salrashid123/tpmrand) to prevent contention.
81-
82-
Please note that we are persisting the handle here for easy access. The more formal way is to save the entire chain of keys (which is a TODO)
83-
84-
A limitation of using persistent handles is that its limited on a TPM (typically 7 slots). You have to evict (i.,e delete) one before loading a new one.
8573

8674
If you just want to issue JWT's, see
8775

‎example/README.md

+50-24
Original file line numberDiff line numberDiff line change
@@ -68,43 +68,69 @@ export PATH=$PATH:/usr/local/go/bin
6868
```bash
6969
cd example/
7070

71-
## for rsapersistentHandle
72-
73-
tpm2_createprimary -C e -c primary.ctx
74-
tpm2_create -G rsa2048:rsassa:null -g sha256 -u key.pub -r key.priv -C primary.ctx
75-
tpm2_load -C primary.ctx -u key.pub -r key.priv -c key.ctx
76-
tpm2_evictcontrol -C o -c key.ctx 0x81008001
77-
78-
## for eccpersistentHandle
79-
80-
tpm2_createprimary -C e -c primary.ctx
81-
tpm2_create -G ecc:ecdsa -g sha256 -u key.pub -r key.priv -C primary.ctx
82-
tpm2_load -C primary.ctx -u key.pub -r key.priv -c key.ctx
83-
tpm2_evictcontrol -C o -c key.ctx 0x81008002
71+
rm -rf /tmp/myvtpm && mkdir /tmp/myvtpm
72+
sudo swtpm socket --tpmstate dir=/tmp/myvtpm --tpm2 --server type=tcp,port=2321 --ctrl type=tcp,port=2322 --flags not-need-init,startup-clear
73+
export TPM2TOOLS_TCTI="swtpm:port=2321"
74+
75+
76+
## RSA - no password
77+
tpm2_createprimary -C o -G rsa2048:aes128cfb -g sha256 -c primary.ctx -a 'restricted|decrypt|fixedtpm|fixedparent|sensitivedataorigin|userwithauth|noda'
78+
tpm2_create -G rsa2048:rsassa:null -g sha256 -u key.pub -r key.priv -C primary.ctx
79+
tpm2_flushcontext -t
80+
tpm2_getcap handles-transient
81+
tpm2_load -C primary.ctx -u key.pub -r key.priv -c key.ctx
82+
tpm2_evictcontrol -C o -c key.ctx 0x81008001
83+
tpm2_flushcontext -t
84+
85+
## rsa-pss
86+
tpm2_createprimary -C o -G rsa2048:aes128cfb -g sha256 -c primary.ctx -a 'restricted|decrypt|fixedtpm|fixedparent|sensitivedataorigin|userwithauth|noda'
87+
tpm2_create -G rsa2048:rsapss:null -g sha256 -u key.pub -r key.priv -C primary.ctx --format=pem --output=rsapss_public.pem
88+
tpm2_flushcontext -t
89+
tpm2_getcap handles-transient
90+
tpm2_load -C primary.ctx -u key.pub -r key.priv -c key.ctx
91+
tpm2_evictcontrol -C o -c key.ctx 0x81008004
92+
tpm2_flushcontext -t
93+
94+
## ecc
95+
tpm2_createprimary -C o -G rsa2048:aes128cfb -g sha256 -c primary.ctx -a 'restricted|decrypt|fixedtpm|fixedparent|sensitivedataorigin|userwithauth|noda'
96+
tpm2_create -G ecc:ecdsa -g sha256 -u key.pub -r key.priv -C primary.ctx --format=pem --output=ecc_public.pem
97+
tpm2_flushcontext -t
98+
tpm2_getcap handles-transient
99+
tpm2_load -C primary.ctx -u key.pub -r key.priv -c key.ctx
100+
tpm2_evictcontrol -C o -c key.ctx 0x81008005
101+
tpm2_flushcontext -t
84102

85103

86104
## for policyRSApersistentHandle
87105

88-
tpm2_startauthsession -S session.dat
89-
tpm2_policypcr -S session.dat -l sha256:23 -L policy.dat
90-
tpm2_flushcontext session.dat
91-
tpm2_createprimary -C o -c primary2.ctx
92-
tpm2_create -G rsa2048:rsassa:null -g sha256 -u rsa2.pub -r rsa2.priv -C primary2.ctx -L policy.dat
93-
tpm2_load -C primary2.ctx -u rsa2.pub -r rsa2.priv -c rsa2.ctx
94-
tpm2_evictcontrol -C o -c rsa2.ctx 0x81008004
106+
tpm2_pcrread sha256:23
107+
tpm2_startauthsession -S session.dat
108+
tpm2_policypcr -S session.dat -l sha256:23 -L policy.dat
109+
tpm2_flushcontext session.dat
110+
tpm2_flushcontext -t
111+
tpm2_createprimary -C o -G rsa2048:aes128cfb -g sha256 -c primary.ctx -a 'restricted|decrypt|fixedtpm|fixedparent|sensitivedataorigin|userwithauth|noda'
112+
tpm2_create -G rsa2048:rsassa:null -g sha256 -u key.pub -r key.priv -C primary.ctx -L policy.dat
113+
tpm2_flushcontext -t
114+
tpm2_getcap handles-transient
115+
tpm2_load -C primary.ctx -u key.pub -r key.priv -c key.ctx
116+
tpm2_evictcontrol -C o -c key.ctx 0x81008006
117+
tpm2_flushcontext -t
95118

96119
## =====
97120

98121
cd example
99122

100-
## RSA
101-
go run sign_verify_tpm/rsa/main.go --handle=0x81008001
123+
## RSA-SSA
124+
go run sign_verify_tpm/rsassa/main.go --handle=0x81008001
125+
126+
## RSA-PSS
127+
go run sign_verify_tpm/rsapss/main.go --handle=0x81008004
102128

103129
## ECC
104-
go run sign_verify_tpm/ecc/main.go --handle=0x81008002
130+
go run sign_verify_tpm/ecc/main.go --handle=0x81008005
105131

106132
## RSA with policy
107-
go run sign_verify_tpm/policy/main.go --handle=0x81008004
133+
go run sign_verify_tpm/policy/main.go --handle=0x81008006
108134

109135
```
110136

‎example/go.mod

+4-10
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,11 @@
11
module main
22

3-
go 1.20
3+
go 1.22
4+
5+
toolchain go1.22.2
46

57
require (
6-
github.com/google/go-tpm v0.9.0
8+
github.com/google/go-tpm v0.9.1-0.20240510201744-5c2f0887e003
79
github.com/google/go-tpm-tools v0.4.4
810
github.com/salrashid123/signer/kms v0.0.0
911
github.com/salrashid123/signer/tpm v0.0.0
@@ -19,23 +21,15 @@ require (
1921
github.com/go-logr/stdr v1.2.2 // indirect
2022
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
2123
github.com/golang/protobuf v1.5.4 // indirect
22-
github.com/google/go-configfs-tsm v0.2.2 // indirect
23-
github.com/google/go-sev-guest v0.9.3 // indirect
24-
github.com/google/go-tdx-guest v0.3.1 // indirect
25-
github.com/google/logger v1.1.1 // indirect
2624
github.com/google/s2a-go v0.1.7 // indirect
27-
github.com/google/uuid v1.6.0 // indirect
2825
github.com/googleapis/enterprise-certificate-proxy v0.3.2 // indirect
2926
github.com/googleapis/gax-go/v2 v2.12.3 // indirect
30-
github.com/pborman/uuid v1.2.1 // indirect
31-
github.com/pkg/errors v0.9.1 // indirect
3227
go.opencensus.io v0.24.0 // indirect
3328
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.49.0 // indirect
3429
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.49.0 // indirect
3530
go.opentelemetry.io/otel v1.24.0 // indirect
3631
go.opentelemetry.io/otel/metric v1.24.0 // indirect
3732
go.opentelemetry.io/otel/trace v1.24.0 // indirect
38-
go.uber.org/multierr v1.11.0 // indirect
3933
golang.org/x/crypto v0.21.0 // indirect
4034
golang.org/x/net v0.23.0 // indirect
4135
golang.org/x/oauth2 v0.18.0 // indirect

‎example/go.sum

+6-7
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
22
cloud.google.com/go v0.112.2 h1:ZaGT6LiG7dBzi6zNOvVZwacaXlmf3lRqnC4DQzqyRQw=
3+
cloud.google.com/go v0.112.2/go.mod h1:iEqjp//KquGIJV/m+Pk3xecgKNhV+ry+vVTsy4TbDms=
34
cloud.google.com/go/compute v1.25.1 h1:ZRpHJedLtTpKgr3RV1Fx23NuaAEN1Zfx9hw1u4aJdjU=
45
cloud.google.com/go/compute v1.25.1/go.mod h1:oopOIR53ly6viBYxaDhBfJwzUAxf1zE//uf3IB011ls=
56
cloud.google.com/go/compute/metadata v0.2.3 h1:mg4jlk7mCAj6xXp9UJ4fjI9VUI5rubuGBW5aJ7UnBMY=
@@ -44,8 +45,6 @@ github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaS
4445
github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
4546
github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
4647
github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
47-
github.com/google/certificate-transparency-go v1.1.2 h1:4hE0GEId6NAW28dFpC+LrRGwQX5dtmXQGDbg8+/MZOM=
48-
github.com/google/go-attestation v0.5.0 h1:jXtAWT2sw2Yu8mYU0BC7FDidR+ngxFPSE+pl6IUu3/0=
4948
github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
5049
github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
5150
github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
@@ -54,22 +53,21 @@ github.com/google/go-cmp v0.5.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/
5453
github.com/google/go-cmp v0.5.3/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
5554
github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
5655
github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
56+
github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
5757
github.com/google/go-configfs-tsm v0.2.2 h1:YnJ9rXIOj5BYD7/0DNnzs8AOp7UcvjfTvt215EWcs98=
5858
github.com/google/go-configfs-tsm v0.2.2/go.mod h1:EL1GTDFMb5PZQWDviGfZV9n87WeGTR/JUg13RfwkgRo=
5959
github.com/google/go-sev-guest v0.9.3 h1:GOJ+EipURdeWFl/YYdgcCxyPeMgQUWlI056iFkBD8UU=
6060
github.com/google/go-sev-guest v0.9.3/go.mod h1:hc1R4R6f8+NcJwITs0L90fYWTsBpd1Ix+Gur15sqHDs=
6161
github.com/google/go-tdx-guest v0.3.1 h1:gl0KvjdsD4RrJzyLefDOvFOUH3NAJri/3qvaL5m83Iw=
6262
github.com/google/go-tdx-guest v0.3.1/go.mod h1:/rc3d7rnPykOPuY8U9saMyEps0PZDThLk/RygXm04nE=
63-
github.com/google/go-tpm v0.9.0 h1:sQF6YqWMi+SCXpsmS3fd21oPy/vSddwZry4JnmltHVk=
64-
github.com/google/go-tpm v0.9.0/go.mod h1:FkNVkc6C+IsvDI9Jw1OveJmxGZUUaKxtrpOS47QWKfU=
63+
github.com/google/go-tpm v0.9.1-0.20240510201744-5c2f0887e003 h1:gfGQAIxsEEAuYuFvjCGpDnTwisMJOz+rUfJMkk4yTmc=
64+
github.com/google/go-tpm v0.9.1-0.20240510201744-5c2f0887e003/go.mod h1:h9jEsEECg7gtLis0upRBQU+GhYVH6jMjrFxI8u6bVUY=
6565
github.com/google/go-tpm-tools v0.4.4 h1:oiQfAIkc6xTy9Fl5NKTeTJkBTlXdHsxAofmQyxBKY98=
6666
github.com/google/go-tpm-tools v0.4.4/go.mod h1:T8jXkp2s+eltnCDIsXR84/MTcVU9Ja7bh3Mit0pa4AY=
67-
github.com/google/go-tspi v0.3.0 h1:ADtq8RKfP+jrTyIWIZDIYcKOMecRqNJFOew2IT0Inus=
6867
github.com/google/logger v1.1.1 h1:+6Z2geNxc9G+4D4oDO9njjjn2d0wN5d7uOo0vOIW1NQ=
6968
github.com/google/logger v1.1.1/go.mod h1:BkeJZ+1FhQ+/d087r4dzojEg1u2ZX+ZqG1jTUrLM+zQ=
7069
github.com/google/s2a-go v0.1.7 h1:60BLSyTrOV4/haCDW4zb1guZItoSq8foHCXrAnjBo/o=
7170
github.com/google/s2a-go v0.1.7/go.mod h1:50CgR4k1jNlWBu4UfS4AcfhVe1r6pdZPygJ3R8F0Qdw=
72-
github.com/google/uuid v1.0.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
7371
github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
7472
github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
7573
github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
@@ -91,6 +89,7 @@ github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/
9189
github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
9290
github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
9391
github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk=
92+
github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
9493
github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
9594
go.opencensus.io v0.24.0 h1:y73uSU6J157QMP2kn2r30vwW1A2W2WFwSCGnAVxeaD0=
9695
go.opencensus.io v0.24.0/go.mod h1:vNK8G9p7aAivkbmorf4v+7Hgx+Zs0yY+0fOtgBfjQKo=
@@ -103,6 +102,7 @@ go.opentelemetry.io/otel v1.24.0/go.mod h1:W7b9Ozg4nkF5tWI5zsXkaKKDjdVjpD4oAt9Qi
103102
go.opentelemetry.io/otel/metric v1.24.0 h1:6EhoGWWK28x1fbpA4tYTOWBkPefTDQnb8WSGXlc88kI=
104103
go.opentelemetry.io/otel/metric v1.24.0/go.mod h1:VYhLe1rFfxuTXLgj4CBiyz+9WYBA8pNGJgDcSFRKBco=
105104
go.opentelemetry.io/otel/sdk v1.22.0 h1:6coWHw9xw7EfClIC/+O31R8IY3/+EiRFHevmHafB2Gw=
105+
go.opentelemetry.io/otel/sdk v1.22.0/go.mod h1:iu7luyVGYovrRpe2fmj3CVKouQNdTOkxtLzPvPz1DOc=
106106
go.opentelemetry.io/otel/trace v1.24.0 h1:CsKnnL4dUAr/0llH9FKuc698G04IrpWV0MQA/Y1YELI=
107107
go.opentelemetry.io/otel/trace v1.24.0/go.mod h1:HPc3Xr/cOApsBI154IU0OI0HJexz+aw5uPdbs3UCjNU=
108108
go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
@@ -142,7 +142,6 @@ golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5h
142142
golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
143143
golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
144144
golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
145-
golang.org/x/sys v0.0.0-20210426230700-d19ff857e887/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
146145
golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
147146
golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
148147
golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=

‎example/sign_verify_tpm/ecc/main.go

+53-36
Original file line numberDiff line numberDiff line change
@@ -8,12 +8,16 @@ import (
88
"encoding/base64"
99
"flag"
1010
"fmt"
11+
"io"
1112
"log"
1213
"math/big"
14+
"net"
1315
"os"
16+
"slices"
1417

15-
"github.com/google/go-tpm-tools/client"
16-
"github.com/google/go-tpm/legacy/tpm2"
18+
"github.com/google/go-tpm-tools/simulator"
19+
"github.com/google/go-tpm/tpm2"
20+
"github.com/google/go-tpm/tpm2/transport"
1721
"github.com/google/go-tpm/tpmutil"
1822
saltpm "github.com/salrashid123/signer/tpm"
1923
)
@@ -23,47 +27,56 @@ const ()
2327
/*
2428
2529
26-
## for eccpersistentHandle
27-
28-
tpm2_createprimary -C e -c primary.ctx
29-
tpm2_create -G ecc:ecdsa -g sha256 -u key.pub -r key.priv -C primary.ctx
30-
tpm2_load -C primary.ctx -u key.pub -r key.priv -c key.ctx
31-
tpm2_evictcontrol -C o -c key.ctx 0x81008002
32-
33-
## ECC
34-
go run sign_verify_tpm/ecc/main.go --handle=0x81008002
35-
30+
## ecc
31+
tpm2_createprimary -C o -G rsa2048:aes128cfb -g sha256 -c primary.ctx -a 'restricted|decrypt|fixedtpm|fixedparent|sensitivedataorigin|userwithauth|noda'
32+
tpm2_create -G ecc:ecdsa -g sha256 -u key.pub -r key.priv -C primary.ctx --format=pem --output=ecc_public.pem
33+
tpm2_flushcontext -t
34+
tpm2_getcap handles-transient
35+
tpm2_load -C primary.ctx -u key.pub -r key.priv -c key.ctx
36+
tpm2_evictcontrol -C o -c key.ctx 0x81008005
37+
tpm2_flushcontext -t
3638
*/
3739

3840
var (
39-
tpmPath = flag.String("tpm-path", "/dev/tpm0", "Path to the TPM device (character device or a Unix socket).")
40-
handle = flag.Uint("handle", 0, "rsa Handle value")
41+
tpmPath = flag.String("tpm-path", "127.0.0.1:2321", "Path to the TPM device (character device or a Unix socket).")
42+
handle = flag.Uint("handle", 0x81008001, "rsa Handle value")
4143
)
4244

45+
var TPMDEVICES = []string{"/dev/tpm0", "/dev/tpmrm0"}
46+
47+
func OpenTPM(path string) (io.ReadWriteCloser, error) {
48+
if slices.Contains(TPMDEVICES, path) {
49+
return tpmutil.OpenTPM(path)
50+
} else if path == "simulator" {
51+
return simulator.GetWithFixedSeedInsecure(1073741825)
52+
} else {
53+
return net.Dial("tcp", path)
54+
}
55+
}
56+
4357
func main() {
4458

4559
flag.Parse()
4660

47-
// >>>>>>>>>>>>>>>>>>>> Managed Externally
48-
49-
// open a tpm and key if using externally managed handle
50-
rwc, err := tpm2.OpenTPM(*tpmPath)
61+
rwc, err := OpenTPM(*tpmPath)
5162
if err != nil {
52-
fmt.Fprintf(os.Stderr, "Can't open TPM %s: %v", *tpmPath, err)
53-
return
63+
log.Fatalf("can't open TPM %q: %v", *tpmPath, err)
5464
}
65+
defer func() {
66+
if err := rwc.Close(); err != nil {
67+
log.Fatalf("can't close TPM %q: %v", *tpmPath, err)
68+
}
69+
}()
70+
71+
rwr := transport.FromReadWriter(rwc)
5572

56-
pHandle := tpmutil.Handle(uint32(*handle))
57-
k, err := client.LoadCachedKey(rwc, pHandle, nil)
73+
pub, err := tpm2.ReadPublic{
74+
ObjectHandle: tpm2.TPMHandle(*handle),
75+
}.Execute(rwr)
5876
if err != nil {
59-
fmt.Fprintf(os.Stderr, "error loading rsa key%v\n", err)
60-
os.Exit(1)
77+
log.Fatalf("error executing tpm2.ReadPublic %v", err)
6178
}
6279

63-
// >>>>>>>>>>>>>>>>>>>> Managed by library
64-
65-
// ************************
66-
6780
stringToSign := "foo"
6881
fmt.Printf("Data to sign %s\n", stringToSign)
6982

@@ -74,9 +87,12 @@ func main() {
7487
digest := h.Sum(nil)
7588

7689
er, err := saltpm.NewTPMCrypto(&saltpm.TPM{
77-
// managed externally
78-
TpmDevice: rwc,
79-
Key: k,
90+
TpmDevice: rwc,
91+
AuthHandle: &tpm2.AuthHandle{
92+
Handle: tpm2.TPMHandle(*handle),
93+
Name: pub.Name,
94+
Auth: tpm2.PasswordAuth(nil),
95+
},
8096
ECCRawOutput: true, // use raw output; not asn1
8197
})
8298
if err != nil {
@@ -111,14 +127,15 @@ func main() {
111127
os.Exit(1)
112128
}
113129
fmt.Printf("ECDSA Signed String verified\n")
114-
rwc.Close()
115-
k.Close()
116130

117131
// now verify with ASN1 output format for ecc using library managed device
118132
erasn, err := saltpm.NewTPMCrypto(&saltpm.TPM{
119-
// manged by library
120-
TpmPath: *tpmPath,
121-
KeyHandle: uint32(*handle),
133+
TpmDevice: rwc,
134+
AuthHandle: &tpm2.AuthHandle{
135+
Handle: tpm2.TPMHandle(*handle),
136+
Name: pub.Name,
137+
Auth: tpm2.PasswordAuth(nil),
138+
},
122139
//ECCRawOutput: false,
123140
})
124141
if err != nil {

0 commit comments

Comments
 (0)