tpm-enrol: move signing key off the EK slot 0x81010001 → 0x81000100

Bench (Proxmox vTPM, host cygnus-cruiser-99) confirmed via tpm2_readpublic that
0x81010001 — the handle our design used for the fleet signing key — is the
TCG-standard RSA Endorsement Key slot: the object there is the swtpm-provisioned
EK (restricted|decrypt|adminwithpolicy, RSA-2048/AES128CFB, canonical EK
authPolicy 837197…, EK cert at NV 0x1c00002). Most firmware/swtpm TPMs occupy
that slot, so EnsureKey could never create our key there — it errored reading
the EK as ECC and enrolment died before the CSR/POST.

Move the fleet signing key to 0x81000100, a non-reserved owner persistent
handle (clear of EK 0x81010001/2 and SRK 0x81000001/2). Threaded through:
  - fleet-enrol -handle default + new rd.dot1x.handle= cmdline knob (baked by
    extract-artifacts.sh, overridable via SMBIOS)
  - files/etc/dot1x/wpa_supplicant-dot1x.conf private_key handle
  - the dracut hook, bench tpm-provision.sh / tpm-selftest.sh
  - CLAUDE.md invariant #1 + design/SSP docs + TODO #11
NV index 0x01800001 (owner range) is unchanged.

EnsureKey hardening: refuse to evict any restricted-decrypt object (EK/SRK) as
a safety net — never clobber the TPM endorsement/storage identity (also
protects the future EK/AK attestation path). Still self-heals a genuine stale
signing key. New regression TestEnsureKeyRefusesToEvictProtectedKey; the
stale-key regression and handle constants moved to 0x81000100.

Design note records the IDevID (0x81020001) option for the later EK/AK
attestation work. Follow-up items logged: content-aware NV presence check
(verify the cert chains to the fleet CA, so leftover/foreign NV can't suppress
enrolment) and a de-enrol/TPM-reset procedure.

files/enrol/simtest/tpmsim_test.go

@@ -30,7 +30,7 @@ func openSim(t *testing.T) transport.TPM {
 
 func TestEnsureKeyAndSignCSR(t *testing.T) {
 	tpm := openSim(t)
-	const h = tpm2.TPMHandle(0x81010001)
+	const h = tpm2.TPMHandle(0x81000100)
 
 	signer, created, err := tpmkey.EnsureKey(tpm, h)
 	if err != nil {
@@ -101,14 +101,15 @@ func TestNVWriteAndPresence(t *testing.T) {
 }
 
 // Regression for the bench failure "key at handle is not ECC ... selector value
-// was 1": an older provisioning path left an RSA key at 0x81010001, and EnsureKey
-// fatally failed trying to read it as ECC. It must now evict the stale key and
-// create a fresh ECC one.
+// was 1": an older provisioning path left an RSA SIGNING key at the enrol handle,
+// and EnsureKey fatally failed trying to read it as ECC. It must now evict the
+// stale key and create a fresh ECC one.
 func TestEnsureKeyEvictsStaleNonECC(t *testing.T) {
 	tpm := openSim(t)
-	const h = tpm2.TPMHandle(0x81010001)
+	const h = tpm2.TPMHandle(0x81000100)
 
-	// Pre-populate the handle with an RSA key (mimics tpm2-tools/openssl default).
+	// Pre-populate the handle with an RSA SIGNING key (mimics tpm2-tools/openssl
+	// default) — SignEncrypt, NOT restricted/decrypt, so it is safe to evict.
 	rsaTmpl := tpm2.TPMTPublic{
 		Type:    tpm2.TPMAlgRSA,
 		NameAlg: tpm2.TPMAlgSHA256,
@@ -163,3 +164,53 @@ func TestEnsureKeyEvictsStaleNonECC(t *testing.T) {
 		t.Fatalf("post-heal ECDSA signature did not verify")
 	}
 }
+
+// Safety guard: if the handle ever holds a restricted-decrypt object (an EK/SRK —
+// e.g. handle misconfigured to the EK slot 0x81010001), EnsureKey must REFUSE to
+// evict it and error, never clobber the TPM's endorsement/storage identity.
+func TestEnsureKeyRefusesToEvictProtectedKey(t *testing.T) {
+	tpm := openSim(t)
+	const h = tpm2.TPMHandle(0x81000100)
+
+	// A restricted decryption primary — the shape of an EK/SRK (storage key).
+	skTmpl := tpm2.TPMTPublic{
+		Type:    tpm2.TPMAlgECC,
+		NameAlg: tpm2.TPMAlgSHA256,
+		ObjectAttributes: tpm2.TPMAObject{
+			FixedTPM: true, FixedParent: true, SensitiveDataOrigin: true,
+			UserWithAuth: true, Restricted: true, Decrypt: true, NoDA: true,
+		},
+		Parameters: tpm2.NewTPMUPublicParms(tpm2.TPMAlgECC, &tpm2.TPMSECCParms{
+			Symmetric: tpm2.TPMTSymDefObject{
+				Algorithm: tpm2.TPMAlgAES,
+				KeyBits:   tpm2.NewTPMUSymKeyBits(tpm2.TPMAlgAES, tpm2.TPMKeyBits(128)),
+				Mode:      tpm2.NewTPMUSymMode(tpm2.TPMAlgAES, tpm2.TPMAlgCFB),
+			},
+			Scheme:  tpm2.TPMTECCScheme{Scheme: tpm2.TPMAlgNull},
+			CurveID: tpm2.TPMECCNistP256,
+			KDF:     tpm2.TPMTKDFScheme{Scheme: tpm2.TPMAlgNull},
+		}),
+	}
+	cp, err := tpm2.CreatePrimary{
+		PrimaryHandle: tpm2.TPMRHOwner, InPublic: tpm2.New2B(skTmpl),
+	}.Execute(tpm)
+	if err != nil {
+		t.Fatalf("create storage-like primary: %v", err)
+	}
+	if _, err := (tpm2.EvictControl{
+		Auth:             tpm2.TPMRHOwner,
+		ObjectHandle:     &tpm2.NamedHandle{Handle: cp.ObjectHandle, Name: cp.Name},
+		PersistentHandle: h,
+	}).Execute(tpm); err != nil {
+		t.Fatalf("persist storage-like key: %v", err)
+	}
+	_, _ = (tpm2.FlushContext{FlushHandle: cp.ObjectHandle}).Execute(tpm)
+
+	// EnsureKey must refuse (error), and must NOT have evicted the object.
+	if _, _, err := tpmkey.EnsureKey(tpm, h); err == nil {
+		t.Fatalf("EnsureKey should refuse to evict a restricted-decrypt (EK/SRK) object")
+	}
+	if _, err := (tpm2.ReadPublic{ObjectHandle: h}).Execute(tpm); err != nil {
+		t.Fatalf("protected object was evicted (should have been left intact): %v", err)
+	}
+}