-
Notifications
You must be signed in to change notification settings - Fork 58
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Enable different key sizes and curves for EK and AK #846
base: master
Are you sure you want to change the base?
Conversation
Note that this now outputs in the quote Edit: decided to make the string encoding for RSA 2024 just |
cde261e
to
fdbdb4a
Compare
Codecov ReportAttention: Patch coverage is
Additional details and impacted files
Flags with carried forward coverage won't be shown. Click here to find out more.
|
This is now mostly blocked on a new stable release of the tss-esapi create. There is also the issue that the parsing of the EK TPM structure goes somewhere wrong, as the verifier says that the EK public key in the TSS structure and the one in the EK certificate don't match. I'll investigate where this goes wrong. |
This PR is also blocked on parallaxsecond/rust-tss-esapi#552 being backported, otherwise the EK verification will always fail. |
@ansasaki this is now fully working. We still need to wait for a new release of tss-esapi bindings to actually use it. |
823df43
to
f3d69ba
Compare
Signed-off-by: Thore Sommer <[email protected]>
2c4ee14
to
9a9506e
Compare
Signed-off-by: Thore Sommer <[email protected]>
Signed-off-by: Thore Sommer <[email protected]>
Signed-off-by: Thore Sommer <[email protected]>
Registration and EK verification using swtpm with the Nist384 curve works. Unfortunatly something with is broken when trying to verify the actual quote:
Might be an padding issue or something else that we missed. |
This implements a selection of the different key sizes for RSA and curves for ECC for EK and AK using the backported changes in rust-tss-esapi.
Further this then also enables us to use EK certs for non default key types.
Note this is currently blocked until parallaxsecond/rust-tss-esapi#546 gets merged and we have a new release.