lkml.org 
[lkml]   [2015]   [Nov]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH 2/2] keys, trusted: seal with a policy
On Tue, Nov 17, 2015 at 06:27:22PM +0200, Jarkko Sakkinen wrote:
> Support for sealing with a authorization policy.
>
> Two new options for trusted keys:
>
> * 'policydigest=': provide an auth policy digest for sealing.
> * 'policyhandle=': provide a policy session handle for unsealing.

I think it is good to say a word about how to test this since the user
space supports is still lagging a bit (there's no way to do a "sticky"
handle in TSS2 yet).

I have my own low-level test scripts over here:

https://github.com/jsakkine/tpm2-scripts

Trivial example:

KEYHANDLE=$(sudo ./tpm2-root-key)
POLICYDIGEST=$(sudo ./tpm2-pcr-policy --pcr 16 --name-alg=sha256 --bank=sha1 --trial)
POLICYHANDLE=$(sudo ./tpm2-pcr-policy --pcr 16 --name-alg=sha256 --bank=sha1)

KEYID=$(keyctl add trusted kmk "new 32 keyhandle=$KEYHANDLE hash=sha256 policydigest=$POLICYDIGEST" @u)
keyctl pipe $KEYID
keyctl clear @u
keyctl add trusted kmk "load `cat blob.hex` keyhandle=$KEYHANDLE policyhandle=0x03000000" @u
keyctl clear @u

sudo ./tpm2-flush $KEYHANDLE

/Jarkko


\
 
 \ /
  Last update: 2015-11-21 20:01    [W:0.080 / U:1.284 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site