tpm-enrol: move signing key off the EK slot 0x81010001 → 0x81000100

Bench (Proxmox vTPM, host cygnus-cruiser-99) confirmed via tpm2_readpublic that
0x81010001 — the handle our design used for the fleet signing key — is the
TCG-standard RSA Endorsement Key slot: the object there is the swtpm-provisioned
EK (restricted|decrypt|adminwithpolicy, RSA-2048/AES128CFB, canonical EK
authPolicy 837197…, EK cert at NV 0x1c00002). Most firmware/swtpm TPMs occupy
that slot, so EnsureKey could never create our key there — it errored reading
the EK as ECC and enrolment died before the CSR/POST.

Move the fleet signing key to 0x81000100, a non-reserved owner persistent
handle (clear of EK 0x81010001/2 and SRK 0x81000001/2). Threaded through:
  - fleet-enrol -handle default + new rd.dot1x.handle= cmdline knob (baked by
    extract-artifacts.sh, overridable via SMBIOS)
  - files/etc/dot1x/wpa_supplicant-dot1x.conf private_key handle
  - the dracut hook, bench tpm-provision.sh / tpm-selftest.sh
  - CLAUDE.md invariant #1 + design/SSP docs + TODO #11
NV index 0x01800001 (owner range) is unchanged.

EnsureKey hardening: refuse to evict any restricted-decrypt object (EK/SRK) as
a safety net — never clobber the TPM endorsement/storage identity (also
protects the future EK/AK attestation path). Still self-heals a genuine stale
signing key. New regression TestEnsureKeyRefusesToEvictProtectedKey; the
stale-key regression and handle constants moved to 0x81000100.

Design note records the IDevID (0x81020001) option for the later EK/AK
attestation work. Follow-up items logged: content-aware NV presence check
(verify the cert chains to the fleet CA, so leftover/foreign NV can't suppress
enrolment) and a de-enrol/TPM-reset procedure.

docs/TODO.md

@@ -766,7 +766,7 @@ smoke test.
     returns MSK); a `hostapd` wired authenticator does 802.1X + MACsec on an
     **isolated bridge per workstation** (flat VLAN can't auth — EAPOL dropped +
     MACsec is P2P). `enrol/tpm-provision.sh` creates the key in the TPM at
-    `0x81010001` + writes the cert to NV `0x01800001`. Starting solution **signs a
+    `0x81000100` + writes the cert to NV `0x01800001`. Starting solution **signs a
     CSR** (key stays in TPM); **TPM attestation** (ACME `device-attest-01`) is the
     documented upgrade on the same CA. **BENCH-VERIFY** items flagged in the files:
     hostapd MACsec build, openssl tpm2 provider vs pkcs11 key ref, EAP-TLS version.
@@ -775,7 +775,7 @@ smoke test.
     capability check (run on the booted open-port image, no `disable_dot1x` needed)
     to de-risk the TPM half before the full path. Likely first finding: no openssl
     TPM2 **provider** in the image (`tpm2-tss` ≠ the provider) — add `tpm2-openssl`.
-  - **Enrolment of the per-host identity** (key@`0x81010001` + cert@NV) is its own
+  - **Enrolment of the per-host identity** (key@`0x81000100` + cert@NV) is its own
     design — see **#11** (TOFU + OOB fingerprint broker, pre-auth permit-set,
     provisioning UKI). `tpm-provision.sh` is the manual bench stand-in for it.
 - **NVMe discovery by DNS:** `nvmet_traddr=nvme.fleet.lab` (CI), resolved at boot
@@ -968,7 +968,7 @@ enrolls.
     every NIC/GPU option ROM is covered by your keys — clearing MS db can break
     signed **option ROMs** (NIC PXE/HTTP-boot, GPU init), bricking the boot path.
   - **PCR 7 check:** enrollment changes the Secure Boot measurement in PCR 7;
-    confirm nothing the fleet seals to the TPM (the EAP-TLS key at `0x81010001`,
+    confirm nothing the fleet seals to the TPM (the EAP-TLS key at `0x81000100`,
     NV cert) is PCR-7-policy-bound before relying on this.
 
 **Decision before building:** auto-enroll trades assurance for convenience and is
@@ -1007,7 +1007,7 @@ it talks to `/dev/tpmrm0` DIRECTLY (via `transport.FromReadWriter` on an
 `os.File` — no `linuxtpm`, so go-tpm is the only vendored dep), so the enrolment
 path needs **no tpm2-tools key-gen / no openssl tpm2 provider / no curl** in the
 image (removes the biggest bench risk — the provider `handle:` key-ref). It
-ensures the ECDSA key at `0x81010001`, builds the CSR, POSTs CSR+context to
+ensures the ECDSA key at `0x81000100`, builds the CSR, POSTs CSR+context to
 `rd.fleet.enrol_url`, shows the broker fingerprint on Plymouth, polls `/status`,
 and writes the leaf cert to NV `0x01800001`. The dracut hook `tpm-enrol.sh`
 (initqueue/settled prio 25) is now a thin GATE: empty-NV check (`tpm2_nvread`,
@@ -1038,22 +1038,55 @@ ECDSA sign → CSR verify → chunked NV write → re-enrol) against the go-tpm
 simulator** (separate `files/enrol/simtest/` module so the CGO simulator never
 enters the shipped build). Both run in CI.
 
-**BENCH FINDING 2026-07-02 (FIXED, commit c574fa4) — stale non-ECC key at the
-handle.** First real-TPM boot (host `cygnus-cruiser-99`, `rd.dot1x=0`) failed:
-`fleet-enrol: ensure key at 0x81010001: key at handle is not ECC: did not contain
-eccDetail (selector value was 1)`. The host already had an **RSA** key persisted at
-`0x81010001` (from an older tpm2-tools/openssl provisioning path); `EnsureKey`
-fatally errored reading it as ECC → enrolment died before the CSR/POST, so the
-splash flashed "FIRST-BOOT TPM ENROLMENT" then the test system booted with **no
-fingerprint and nothing at the broker**. Fix: `EnsureKey` now **evicts a
-wrong-type/unusable key and recreates** a fresh ECC key (safe on the enrol path —
-empty NV, no cert references the old key); a valid ECC key is still reused.
-Regression `simtest/TestEnsureKeyEvictsStaleNonECC` (pre-plants an RSA key). **Needs
-a rebuild + re-boot to confirm on the bench** (the sim proves the recovery, not the
-device). ⚠ **Don't hand-run `sudo fleet-enrol` on the booted STIG host to test** —
-the confined admin domain (`sysadm_t`) is SELinux-**denied** write to
-`/dev/tpmrm0` (`avc: denied … tpm_device_t`), so it fails before the TPM regardless;
-the faithful path is the **initramfs** run (reboot) which is unconfined.
+**BENCH FINDING 2026-07-02 (FIXED) — the signing-key handle `0x81000100` was the
+EK slot; moved to `0x81000100`.** First real-TPM boot (host `cygnus-cruiser-99`,
+Proxmox vTPM, `rd.dot1x=0`) failed: `fleet-enrol: ensure key at 0x81010001: key at
+handle is not ECC: did not contain eccDetail (selector value was 1)`. `EnsureKey`
+died reading an existing RSA object as ECC → enrolment died before the CSR/POST, so
+the splash flashed "FIRST-BOOT TPM ENROLMENT" then the test system booted with **no
+fingerprint and nothing at the broker**. Root cause (confirmed via `tpm2_readpublic`
+under `enforcing=0`): **`0x81000100` is the TCG-standard RSA Endorsement Key handle**
+— the object there was the swtpm-provisioned **EK** (`restricted|decrypt|adminwithpolicy`,
+RSA-2048/AES128CFB, canonical EK authPolicy `837197674484b3f8…`), with its EK cert at
+NV `0x1c00002`. Our design squatted the EK slot fleet-wide (most firmware/swtpm TPMs
+have their EK there), so enrolment could never create our key.
+  - **Fix (commit c574fa4 + follow-up):** the fleet signing key moved to
+    **`0x81000100`** (non-reserved owner handle; threaded through `fleet-enrol
+    -handle` default, `rd.dot1x.handle=` cmdline knob baked by `extract-artifacts.sh`,
+    `wpa_supplicant-dot1x.conf`, the bench scripts, invariant #1, and the design docs).
+    NV `0x01800001` (owner range) is unchanged.
+  - **EnsureKey hardening:** (i) evicts a genuine *stale signing key* at the handle
+    and recreates (self-heal for old provisioning leftovers); (ii) **refuses to evict
+    any restricted-decrypt object (EK/SRK)** as a safety net — never clobber the TPM's
+    endorsement/storage identity (also protects the future EK/AK attestation).
+    Regressions: `simtest/TestEnsureKeyEvictsStaleNonECC` + `TestEnsureKeyRefusesToEvictProtectedKey`.
+  - **IDevID note (future):** if EK/AK attestation (`device-attest-01`, §"Stronger
+    assurance") lands, the natural home for a TPM device-identity key is the TCG
+    **IDevID** handle `0x81020001` (LDevID `0x81030001`) — see tpm-enrolment-design.md.
+    Not adopted for v1 (implies the IDevID template/cert conventions).
+  - **Also seen — leftover NV suppresses enrolment:** a *different* host (the 820)
+    booted `tpm-enrol: client cert present at NV 0x01800001 — normal boot` with nothing
+    enrolled this session — leftover NV state (from an earlier `tpm-provision.sh` /
+    `tpm-selftest.sh --use-real-handles`) **persists in the hardware TPM** across
+    reinstalls. Our presence check is content-blind (index defined ⇒ "enrolled"), so
+    foreign/stale NV silently skips enrolment (→ secure-path auth would then fail). See
+    the **content-aware NV check** item below.
+  - **Needs a rebuild + re-boot to confirm** (the sim proves the ceremony, not the
+    device). ⚠ **Don't hand-run `sudo fleet-enrol` on the booted STIG host** — the
+    confined admin domain (`sysadm_t`) is SELinux-**denied** write to `/dev/tpmrm0`
+    (`avc: denied … tpm_device_t`); the faithful path is the **initramfs** run
+    (reboot, unconfined), or `enforcing=0` for hand-run TPM inspection.
+
+**FOLLOW-UP HARDENING (from the two findings above, not yet built):**
+- **Content-aware NV presence check** — read NV `0x01800001`, parse as X.509, verify
+  it **chains to the fleet CA** (bundled `radius-ca.pem`); only then treat as enrolled,
+  else enrol + overwrite (`WriteNVCert` already undefine+redefines). Cleanest as a
+  `fleet-enrol -check-only` mode (no network) the hook calls — one content-aware source
+  of truth, replacing the hook's blind `tpm2_nvread` and the binary's `NVPresent`
+  (defined-only). Stops leftover/foreign NV from suppressing enrolment.
+- **De-enrol / TPM-reset procedure** for re-testing: `tpm2_nvundefine 0x01800001 -C o`
+  (+ `tpm2_evictcontrol -C o -c 0x81000100` for a stale *app* key — never the EK), or
+  BIOS "Clear TPM". Document in the bench README.
 
 **BENCH-VERIFY (host side, before trusting):** (a) go-tpm against a REAL TPM +
 swtpm on the target (the simulator proves the ceremony, not the device) — **the
@@ -1101,7 +1134,7 @@ Verification found + fixed two things the `mock` path had hidden:
   FreeRADIUS (next, before host enrolment).
 
 How a host gets its **802.1X EAP-TLS client identity** the first time — the key at
-TPM handle `0x81010001` + cert at NV `0x01800001` that invariant #1 says must come
+TPM handle `0x81000100` + cert at NV `0x01800001` that invariant #1 says must come
 from enrolment, never the image. Distinct from #10 (that enrols *Secure Boot*
 PK/KEK/db); this enrols the *network identity*. They share the provisioning UKI +
 isolated-environment vehicle. Pairs with #8 + the CA decision (start **step-ca**,

docs/design-v2-errata.md

@@ -82,7 +82,7 @@ boot→secure dynamic VLAN. Consequences:
 **Per-host 802.1X identity is created by an enrolment flow, never baked in**
 (invariant #1). Chosen pattern: **trust-on-first-use with out-of-band fingerprint
 approval** — on an empty TPM the host generates a key *in* the TPM
-(`0x81010001`), submits a CSR to an enrolment **broker** (reachable via the same
+(`0x81000100`), submits a CSR to an enrolment **broker** (reachable via the same
 pre-auth permit-set, e.g. an `/enrol/` location on the serving nginx → broker →
 step-ca signer), and shows a fingerprint on the Plymouth splash; an admin
 cross-checks it and approves; the signed cert is written to NV `0x01800001` and

docs/fleet-management-design.md

@@ -20,7 +20,7 @@ These are consequences of the CLAUDE.md invariants, not preferences:
    stateless and buffers only in RAM (best-effort).
 2. **Identity from the TPM, never baked.** No per-host state in any artifact
    (invariant #1). The agent derives identity at runtime from the **TPM-held
-   cert** (key `0x81010001`, cert NV `0x01800001`) — the same identity used for
+   cert** (key `0x81000100`, cert NV `0x01800001`) — the same identity used for
    802.1X EAP-TLS and the NVMe hostnqn. No enrollment token in the image.
 3. **Pull-based control, no inbound surface.** The boot LAN is locked down and
    segmented; we do not open an always-on inbound control port on hosts. Hosts

docs/ssp-annex-a-ism-residual-risk.md

@@ -99,7 +99,7 @@ ISM/PSPF style). Ratings are **pre-treatment** unless stated; the AO accepts the
 
 | Topic | ISM (rep.) | Requirement intent | System implementation | Status | Residual |
 |---|---|---|---|---|---|
-| Strong machine authentication | ISM-1546*, ISM-0974* | Mutual, certificate-based auth. | **802.1X EAP-TLS**, client key non-exportable in **TPM** (`0x81010001`), cert in TPM NV. | Partial | R-01 (not bench-verified; disabled in test builds), R-08 (placeholder CA) |
+| Strong machine authentication | ISM-1546*, ISM-0974* | Mutual, certificate-based auth. | **802.1X EAP-TLS**, client key non-exportable in **TPM** (`0x81000100`), cert in TPM NV. | Partial | R-01 (not bench-verified; disabled in test builds), R-08 (placeholder CA) |
 | Privileged access restricted | ISM-1507*, ISM-0445* | Limit & control admin access. | Single key-only `wheel` admin; root login disabled; admin **confined to `staff_u`** with a sudo `sysadm_r`/`sysadm_t` role/type transition (SELinux context elevates on privilege use). | Partial | R-05 |
 | Secure remote administration | ISM-1506*, ISM-1232* | Hardened admin channel. | SSH **key-only**, password & keyboard-interactive off, hardened ciphers/MACs/KEX (STIG crypto policy; ECDSA/RSA keys — ed25519 excluded by policy). | Implemented | — |
 | No default/shared credentials | ISM-1304* | No baked credentials. | No per-host secrets in any artifact; identity from TPM at runtime; `machine-id` empty; host keys regenerated at first boot. | Implemented | — |

docs/ssp.md

@@ -90,7 +90,7 @@ manifest. One commit = one release = one digest = one manifest entry.
    hash and STIG kernel parameters). No GRUB.
 3. **Initramfs (dracut)** brings up the NIC and performs **802.1X EAP-TLS**
    network authentication using a **private key held in the TPM** (persistent
-   handle `0x81010001`); the client certificate is read from TPM NV index
+   handle `0x81000100`); the client certificate is read from TPM NV index
    `0x01800001`.
 4. On authorisation, **MACsec** is established on the access link (link-layer
    encryption/integrity); the host then obtains an IP **on the MACsec interface**

docs/tpm-enrolment-design.md

@@ -8,7 +8,7 @@ end-to-end *minus* the human-approval queue; the only unbuilt piece is the
 **enrolment broker**.
 
 How a diskless host acquires — and keeps — its **one cryptographic identity**: a
-signing key at TPM handle `0x81010001` and a cert at NV index `0x01800001`.
+signing key at TPM handle `0x81000100` and a cert at NV index `0x01800001`.
 Invariant #1 forbids baking any per-host state into the image, so this identity
 **must** be minted at enrolment, at runtime, from the TPM. That single identity is
 then reused for everything: **802.1X EAP-TLS**, the **NVMe hostnqn** (derived from
@@ -28,7 +28,7 @@ separate box — is what makes the two designs one coherent identity story.
 
 ## Design philosophy (forced by the architecture invariants)
 
-1. **One identity, minted once, reused everywhere.** Key `0x81010001` + cert
+1. **One identity, minted once, reused everywhere.** Key `0x81000100` + cert
    NV `0x01800001` = 802.1X identity = NVMe hostnqn (`…:host-<cert-serial>`) =
    mTLS client identity. There is no second secret. (Invariant #1.)
 2. **The private key never leaves the TPM.** Generated *in* the TPM; only a CSR
@@ -74,7 +74,7 @@ are deliberately **split** — conflating them is a security regression:
 
 ### 1. TPM key + NV cert (exists — `tpm-provision.sh`)
 
-Key generated in the TPM, persisted at `0x81010001`; CSR built with it via the
+Key generated in the TPM, persisted at `0x81000100`; CSR built with it via the
 openssl tpm2 provider (key never leaves the TPM); issued cert written DER to NV
 `0x01800001`. At boot, `dot1x-macsec-up.sh` reads the cert from NV, wpa_supplicant
 signs EAP-TLS with the handle key, and the hostnqn is derived from the cert serial.
@@ -158,7 +158,7 @@ pinned for mTLS — one trust anchor across 802.1X, NVMe, and management.
 ```
   empty-NV host (early-boot enrol branch) broker (= fleet-mgr bootstrap)     admin        step-ca
   ───────────────────────────────         ─────────────────────────────     ─────        ───────
-  1. key in TPM @0x81010001
+  1. key in TPM @0x81000100
   2. build CSR (key never leaves)
   3. POST /enrol/request (CSR+context) ─▶  create PENDING, pick nonce,
                                            compute fingerprint
@@ -295,6 +295,26 @@ point (verify the attestation statement before signing). The CA bootstrap alread
 carries a commented `acme-attest` provisioner block
 (`serving/dot1x-bench/step-ca/bootstrap.sh`).
 
+### Signing-key handle choice (and the IDevID option)
+
+The fleet signing key is persisted at **`0x81000100`** — a non-reserved **owner**
+persistent handle. It is deliberately **not** the EK slot `0x81010001` / `0x81010002`
+nor the SRK `0x81000001` / `0x81000002`: firmware and swtpm provisioning routinely
+occupy those (bench-confirmed 2026-07-02 — a Proxmox vTPM had the standard **RSA
+Endorsement Key** at `0x81010001`, restricted-decrypt, with the canonical EK
+authPolicy `837197…`, and its EK cert at NV `0x1c00002`). `EnsureKey` therefore
+also refuses to evict any restricted-decrypt object as a safety net. The handle is
+overridable via `rd.dot1x.handle=` / `fleet-enrol -handle`.
+
+**Future option — IDevID (`0x81020001`):** if/when the EK/AK attestation path above
+lands, the natural home for a TPM-resident *device identity* key is the TCG
+**IDevID** handle `0x81020001` (with **LDevID** at `0x81030001`), per *TPM 2.0 Keys
+for Device Identity and Attestation*. Moving there would align our key with the
+IDevID template + EK-anchored certification flow (the key is certified by an AK that
+chains to the EK) rather than a bare owner primary. Not adopted for v1 (it implies
+the full IDevID template/cert conventions we don't yet follow); revisit together with
+`device-attest-01`.
+
 ## Inventory record born at enrolment
 
 ```
@@ -324,7 +344,7 @@ exists. Enrolment is where it comes into being.
    approve → cert; pubkey match). Ships in `serving/dot1x-bench/docker-compose.yml`.
 3. **Host side — BUILT 2026-07-02 (awaiting bench):** the **inline empty-NV
    trigger** as a static **Go + go-tpm** binary (`files/enrol/`, `fleet-enrol`)
-   talking to `/dev/tpmrm0` directly — ensures the key at `0x81010001`, builds the
+   talking to `/dev/tpmrm0` directly — ensures the key at `0x81000100`, builds the
    CSR, POSTs to the broker, shows the Plymouth fingerprint, polls, writes the leaf
    cert to NV `0x01800001`. A thin dracut GATE hook (`95dot1x-macsec/tpm-enrol.sh`,
    initqueue/settled prio 25) does the empty-NV check + pre-auth DHCP on the