tpm-enrol: move signing key off the EK slot 0x81010001 → 0x81000100
Bench (Proxmox vTPM, host cygnus-cruiser-99) confirmed via tpm2_readpublic that
0x81010001 — the handle our design used for the fleet signing key — is the
TCG-standard RSA Endorsement Key slot: the object there is the swtpm-provisioned
EK (restricted|decrypt|adminwithpolicy, RSA-2048/AES128CFB, canonical EK
authPolicy 837197…, EK cert at NV 0x1c00002). Most firmware/swtpm TPMs occupy
that slot, so EnsureKey could never create our key there — it errored reading
the EK as ECC and enrolment died before the CSR/POST.
Move the fleet signing key to 0x81000100, a non-reserved owner persistent
handle (clear of EK 0x81010001/2 and SRK 0x81000001/2). Threaded through:
- fleet-enrol -handle default + new rd.dot1x.handle= cmdline knob (baked by
extract-artifacts.sh, overridable via SMBIOS)
- files/etc/dot1x/wpa_supplicant-dot1x.conf private_key handle
- the dracut hook, bench tpm-provision.sh / tpm-selftest.sh
- CLAUDE.md invariant #1 + design/SSP docs + TODO #11
NV index 0x01800001 (owner range) is unchanged.
EnsureKey hardening: refuse to evict any restricted-decrypt object (EK/SRK) as
a safety net — never clobber the TPM endorsement/storage identity (also
protects the future EK/AK attestation path). Still self-heals a genuine stale
signing key. New regression TestEnsureKeyRefusesToEvictProtectedKey; the
stale-key regression and handle constants moved to 0x81000100.
Design note records the IDevID (0x81020001) option for the later EK/AK
attestation work. Follow-up items logged: content-aware NV presence check
(verify the cert chains to the fleet CA, so leftover/foreign NV can't suppress
enrolment) and a de-enrol/TPM-reset procedure.
This commit is contained in:
Audiobuzz
@@ -39,6 +39,10 @@ TESTMODE=0
|
||||
|
||||
# --- knobs (override on the kernel cmdline) ---------------------------------
|
||||
NVINDEX=$(getarg rd.dot1x.nvindex=); [ -n "$NVINDEX" ] || NVINDEX=0x01800001
|
||||
# Persistent handle for the signing key: a NON-reserved owner handle. NOT the EK
|
||||
# slot 0x81010001 (which most firmware/swtpm provisioning already occupies) nor
|
||||
# the SRK 0x81000001 — see EnsureKey / CLAUDE.md invariant #1.
|
||||
HANDLE=$(getarg rd.dot1x.handle=); [ -n "$HANDLE" ] || HANDLE=0x81000100
|
||||
ENROL_URL=$(getarg rd.fleet.enrol_url=); [ -n "$ENROL_URL" ] || ENROL_URL=http://boot.fleet.lab/enrol
|
||||
NETTMO=$(getarg rd.dot1x.timeout=); [ -n "$NETTMO" ] || NETTMO=60
|
||||
|
||||
@@ -104,7 +108,7 @@ info "tpm-enrol: pre-auth lease on $NIC; handing off to fleet-enrol ($ENROL_URL)
|
||||
# It drives the TPM (key/CSR/NV), the broker exchange, and the Plymouth
|
||||
# fingerprint. Exit 0 = enrolled (reboot to converge); 10 = already enrolled
|
||||
# (shouldn't reach here after the NV gate, but treat as normal boot); else fail.
|
||||
/usr/sbin/fleet-enrol -url "$ENROL_URL" -iface "$NIC" -nvindex "$NVINDEX"
|
||||
/usr/sbin/fleet-enrol -url "$ENROL_URL" -iface "$NIC" -nvindex "$NVINDEX" -handle "$HANDLE"
|
||||
rc=$?
|
||||
case "$rc" in
|
||||
0)
|
||||
|
||||
+3
-2
@@ -2,7 +2,8 @@
|
||||
//
|
||||
// Invoked from the dracut hook (95dot1x-macsec/tpm-enrol.sh) ONLY when the
|
||||
// secure build boots a host whose TPM NV 0x01800001 is empty. It:
|
||||
// 1. ensures an ECDSA signing key exists at TPM handle 0x81010001,
|
||||
// 1. ensures an ECDSA signing key exists at a non-reserved owner handle
|
||||
// (default 0x81000100 — deliberately NOT the EK slot 0x81010001),
|
||||
// 2. builds a CSR with it (key never leaves the TPM),
|
||||
// 3. submits CSR + device context to the enrolment broker, shows the returned
|
||||
// fingerprint on the Plymouth splash, and polls until an admin approves,
|
||||
@@ -42,7 +43,7 @@ func main() {
|
||||
url = flag.String("url", "http://boot.fleet.lab/enrol", "enrolment broker base URL")
|
||||
tpmPath = flag.String("tpm", "/dev/tpmrm0", "TPM device path")
|
||||
nvHex = flag.String("nvindex", "0x01800001", "TPM NV index for the client cert")
|
||||
handleHex = flag.String("handle", "0x81010001", "TPM persistent handle for the signing key")
|
||||
handleHex = flag.String("handle", "0x81000100", "TPM persistent handle for the signing key (non-reserved owner handle; NOT the EK slot 0x81010001)")
|
||||
cn = flag.String("cn", "fleet-host", "CSR CommonName (generic; identity is the cert serial)")
|
||||
iface = flag.String("iface", "", "network interface for the device-context MAC")
|
||||
caFile = flag.String("cacert", "/etc/dot1x/radius-ca.pem", "CA bundle for an https broker URL")
|
||||
|
||||
@@ -30,7 +30,7 @@ func openSim(t *testing.T) transport.TPM {
|
||||
|
||||
func TestEnsureKeyAndSignCSR(t *testing.T) {
|
||||
tpm := openSim(t)
|
||||
const h = tpm2.TPMHandle(0x81010001)
|
||||
const h = tpm2.TPMHandle(0x81000100)
|
||||
|
||||
signer, created, err := tpmkey.EnsureKey(tpm, h)
|
||||
if err != nil {
|
||||
@@ -101,14 +101,15 @@ func TestNVWriteAndPresence(t *testing.T) {
|
||||
}
|
||||
|
||||
// Regression for the bench failure "key at handle is not ECC ... selector value
|
||||
// was 1": an older provisioning path left an RSA key at 0x81010001, and EnsureKey
|
||||
// fatally failed trying to read it as ECC. It must now evict the stale key and
|
||||
// create a fresh ECC one.
|
||||
// was 1": an older provisioning path left an RSA SIGNING key at the enrol handle,
|
||||
// and EnsureKey fatally failed trying to read it as ECC. It must now evict the
|
||||
// stale key and create a fresh ECC one.
|
||||
func TestEnsureKeyEvictsStaleNonECC(t *testing.T) {
|
||||
tpm := openSim(t)
|
||||
const h = tpm2.TPMHandle(0x81010001)
|
||||
const h = tpm2.TPMHandle(0x81000100)
|
||||
|
||||
// Pre-populate the handle with an RSA key (mimics tpm2-tools/openssl default).
|
||||
// Pre-populate the handle with an RSA SIGNING key (mimics tpm2-tools/openssl
|
||||
// default) — SignEncrypt, NOT restricted/decrypt, so it is safe to evict.
|
||||
rsaTmpl := tpm2.TPMTPublic{
|
||||
Type: tpm2.TPMAlgRSA,
|
||||
NameAlg: tpm2.TPMAlgSHA256,
|
||||
@@ -163,3 +164,53 @@ func TestEnsureKeyEvictsStaleNonECC(t *testing.T) {
|
||||
t.Fatalf("post-heal ECDSA signature did not verify")
|
||||
}
|
||||
}
|
||||
|
||||
// Safety guard: if the handle ever holds a restricted-decrypt object (an EK/SRK —
|
||||
// e.g. handle misconfigured to the EK slot 0x81010001), EnsureKey must REFUSE to
|
||||
// evict it and error, never clobber the TPM's endorsement/storage identity.
|
||||
func TestEnsureKeyRefusesToEvictProtectedKey(t *testing.T) {
|
||||
tpm := openSim(t)
|
||||
const h = tpm2.TPMHandle(0x81000100)
|
||||
|
||||
// A restricted decryption primary — the shape of an EK/SRK (storage key).
|
||||
skTmpl := tpm2.TPMTPublic{
|
||||
Type: tpm2.TPMAlgECC,
|
||||
NameAlg: tpm2.TPMAlgSHA256,
|
||||
ObjectAttributes: tpm2.TPMAObject{
|
||||
FixedTPM: true, FixedParent: true, SensitiveDataOrigin: true,
|
||||
UserWithAuth: true, Restricted: true, Decrypt: true, NoDA: true,
|
||||
},
|
||||
Parameters: tpm2.NewTPMUPublicParms(tpm2.TPMAlgECC, &tpm2.TPMSECCParms{
|
||||
Symmetric: tpm2.TPMTSymDefObject{
|
||||
Algorithm: tpm2.TPMAlgAES,
|
||||
KeyBits: tpm2.NewTPMUSymKeyBits(tpm2.TPMAlgAES, tpm2.TPMKeyBits(128)),
|
||||
Mode: tpm2.NewTPMUSymMode(tpm2.TPMAlgAES, tpm2.TPMAlgCFB),
|
||||
},
|
||||
Scheme: tpm2.TPMTECCScheme{Scheme: tpm2.TPMAlgNull},
|
||||
CurveID: tpm2.TPMECCNistP256,
|
||||
KDF: tpm2.TPMTKDFScheme{Scheme: tpm2.TPMAlgNull},
|
||||
}),
|
||||
}
|
||||
cp, err := tpm2.CreatePrimary{
|
||||
PrimaryHandle: tpm2.TPMRHOwner, InPublic: tpm2.New2B(skTmpl),
|
||||
}.Execute(tpm)
|
||||
if err != nil {
|
||||
t.Fatalf("create storage-like primary: %v", err)
|
||||
}
|
||||
if _, err := (tpm2.EvictControl{
|
||||
Auth: tpm2.TPMRHOwner,
|
||||
ObjectHandle: &tpm2.NamedHandle{Handle: cp.ObjectHandle, Name: cp.Name},
|
||||
PersistentHandle: h,
|
||||
}).Execute(tpm); err != nil {
|
||||
t.Fatalf("persist storage-like key: %v", err)
|
||||
}
|
||||
_, _ = (tpm2.FlushContext{FlushHandle: cp.ObjectHandle}).Execute(tpm)
|
||||
|
||||
// EnsureKey must refuse (error), and must NOT have evicted the object.
|
||||
if _, _, err := tpmkey.EnsureKey(tpm, h); err == nil {
|
||||
t.Fatalf("EnsureKey should refuse to evict a restricted-decrypt (EK/SRK) object")
|
||||
}
|
||||
if _, err := (tpm2.ReadPublic{ObjectHandle: h}).Execute(tpm); err != nil {
|
||||
t.Fatalf("protected object was evicted (should have been left intact): %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1,7 +1,9 @@
|
||||
// Package tpmkey — TPM 2.0 operations via go-tpm (pure Go, no CGO, no tpm2-tools
|
||||
// / no openssl tpm2 provider). Provides: ensure a persistent ECDSA signing key
|
||||
// at 0x81010001, a crypto.Signer backed by it (for CSR signing), and NV cert
|
||||
// read-presence + write at 0x01800001. Talks to any transport.TPM, so the same
|
||||
// at a non-reserved owner handle (default 0x81000100 — NOT the EK slot
|
||||
// 0x81010001, see EnsureKey), a crypto.Signer backed by it (for CSR signing),
|
||||
// and NV cert read-presence + write at 0x01800001. Talks to any transport.TPM,
|
||||
// so the same
|
||||
// code runs against /dev/tpmrm0 (production) and the software simulator (tests).
|
||||
//
|
||||
// Exported so the ceremony can be tested against the go-tpm simulator from a
|
||||
@@ -105,21 +107,43 @@ func signerFromPub(tpm transport.TPM, handle tpm2.TPMHandle, name tpm2.TPM2BName
|
||||
return &Signer{tpm: tpm, handle: handle, name: name, pub: pk}, nil
|
||||
}
|
||||
|
||||
// isProtectedObject reports whether a persistent object is a restricted
|
||||
// decryption key — i.e. an Endorsement Key or Storage Root Key. We must NEVER
|
||||
// evict one of those (it would destroy the TPM's endorsement/storage identity,
|
||||
// including the EK the future EK/AK attestation path depends on). Fail-safe: if
|
||||
// the public area can't be parsed, treat it as protected.
|
||||
func isProtectedObject(pub2b tpm2.TPM2BPublic) bool {
|
||||
pub, err := pub2b.Contents()
|
||||
if err != nil {
|
||||
return true
|
||||
}
|
||||
a := pub.ObjectAttributes
|
||||
return a.Restricted && a.Decrypt
|
||||
}
|
||||
|
||||
// ensureKey returns a signer for the persistent key at handle, creating +
|
||||
// persisting a fresh ECDSA key there if none exists. Returns created=true when
|
||||
// a new key was generated.
|
||||
// a new key was generated. handle MUST be a non-reserved owner handle (the fleet
|
||||
// default is 0x81000100) — NOT the EK (0x81010001/2) or SRK (0x81000001/2) slots.
|
||||
//
|
||||
// If the handle already holds an object that is NOT our ECC signing key (e.g. an
|
||||
// RSA key left by an older tpm2-tools/openssl provisioning path — go-tpm reports
|
||||
// "key at handle is not ECC"), it is treated as STALE and evicted, then a fresh
|
||||
// ECC key is created. Safe on the enrol path: this only runs on an empty-NV host,
|
||||
// so no issued cert references the old key. Only a valid ECC key is reused.
|
||||
// RSA signing key left by an older tpm2-tools/openssl provisioning path — go-tpm
|
||||
// reports "key at handle is not ECC"), it is treated as STALE and evicted, then a
|
||||
// fresh ECC key is created. Safe on the enrol path: this only runs on an empty-NV
|
||||
// host, so no issued cert references the old key. Only a valid ECC key is reused.
|
||||
// A restricted-decrypt object (EK/SRK) is NEVER evicted — it errors instead, which
|
||||
// only happens if handle was misconfigured to a reserved slot.
|
||||
func EnsureKey(tpm transport.TPM, handle tpm2.TPMHandle) (signer *Signer, created bool, err error) {
|
||||
if rp, e := (tpm2.ReadPublic{ObjectHandle: handle}).Execute(tpm); e == nil {
|
||||
if s, e2 := signerFromPub(tpm, handle, rp.Name, rp.OutPublic); e2 == nil {
|
||||
return s, false, nil // our ECC key is already there — reuse it
|
||||
// Guard FIRST: never touch a restricted-decrypt object (EK/SRK). An ECC
|
||||
// EK/SRK would otherwise parse as a usable ECC key below and be "reused".
|
||||
if isProtectedObject(rp.OutPublic) {
|
||||
return nil, false, fmt.Errorf("refusing to evict a restricted-decrypt object (EK/SRK?) at handle %#x — configure a non-reserved owner handle (e.g. 0x81000100)", uint32(handle))
|
||||
}
|
||||
// Stale/wrong-type key occupying the handle — evict so we can recreate.
|
||||
if s, e2 := signerFromPub(tpm, handle, rp.Name, rp.OutPublic); e2 == nil {
|
||||
return s, false, nil // our ECC signing key is already there — reuse it
|
||||
}
|
||||
// Stale/wrong-type signing key occupying the handle — evict so we recreate.
|
||||
if _, e2 := (tpm2.EvictControl{
|
||||
Auth: tpm2.TPMRHOwner,
|
||||
ObjectHandle: &tpm2.NamedHandle{Handle: handle, Name: rp.Name},
|
||||
|
||||
@@ -14,8 +14,11 @@ network={
|
||||
client_cert="/run/dot1x/client.pem"
|
||||
|
||||
# BENCH-VERIFY: TPM key reference method on your wpa_supplicant build.
|
||||
# Handle is the fleet signing-key handle (non-reserved owner handle; NOT the
|
||||
# EK slot 0x81010001 — see CLAUDE.md invariant #1). Keep in sync with the
|
||||
# enrolment -handle / rd.dot1x.handle default.
|
||||
# Option A (OpenSSL tpm2 provider, direct persistent handle):
|
||||
private_key="handle:0x81010001"
|
||||
private_key="handle:0x81000100"
|
||||
# Option B (tpm2-pkcs11 with a store regenerated into /run at boot):
|
||||
# private_key="pkcs11:token=fleet;object=dot1x-key;type=private;pin-value=..."
|
||||
|
||||
|
||||
Reference in New Issue
Block a user