tpm-enrol: move signing key off the EK slot 0x81010001 → 0x81000100

Bench (Proxmox vTPM, host cygnus-cruiser-99) confirmed via tpm2_readpublic that
0x81010001 — the handle our design used for the fleet signing key — is the
TCG-standard RSA Endorsement Key slot: the object there is the swtpm-provisioned
EK (restricted|decrypt|adminwithpolicy, RSA-2048/AES128CFB, canonical EK
authPolicy 837197…, EK cert at NV 0x1c00002). Most firmware/swtpm TPMs occupy
that slot, so EnsureKey could never create our key there — it errored reading
the EK as ECC and enrolment died before the CSR/POST.

Move the fleet signing key to 0x81000100, a non-reserved owner persistent
handle (clear of EK 0x81010001/2 and SRK 0x81000001/2). Threaded through:
  - fleet-enrol -handle default + new rd.dot1x.handle= cmdline knob (baked by
    extract-artifacts.sh, overridable via SMBIOS)
  - files/etc/dot1x/wpa_supplicant-dot1x.conf private_key handle
  - the dracut hook, bench tpm-provision.sh / tpm-selftest.sh
  - CLAUDE.md invariant #1 + design/SSP docs + TODO #11
NV index 0x01800001 (owner range) is unchanged.

EnsureKey hardening: refuse to evict any restricted-decrypt object (EK/SRK) as
a safety net — never clobber the TPM endorsement/storage identity (also
protects the future EK/AK attestation path). Still self-heals a genuine stale
signing key. New regression TestEnsureKeyRefusesToEvictProtectedKey; the
stale-key regression and handle constants moved to 0x81000100.

Design note records the IDevID (0x81020001) option for the later EK/AK
attestation work. Follow-up items logged: content-aware NV presence check
(verify the cert chains to the fleet CA, so leftover/foreign NV can't suppress
enrolment) and a de-enrol/TPM-reset procedure.

files/enrol/tpmkey/tpmkey.go

@@ -1,7 +1,9 @@
 // Package tpmkey — TPM 2.0 operations via go-tpm (pure Go, no CGO, no tpm2-tools
 // / no openssl tpm2 provider). Provides: ensure a persistent ECDSA signing key
-// at 0x81010001, a crypto.Signer backed by it (for CSR signing), and NV cert
-// read-presence + write at 0x01800001. Talks to any transport.TPM, so the same
+// at a non-reserved owner handle (default 0x81000100 — NOT the EK slot
+// 0x81010001, see EnsureKey), a crypto.Signer backed by it (for CSR signing),
+// and NV cert read-presence + write at 0x01800001. Talks to any transport.TPM,
+// so the same
 // code runs against /dev/tpmrm0 (production) and the software simulator (tests).
 //
 // Exported so the ceremony can be tested against the go-tpm simulator from a
@@ -105,21 +107,43 @@ func signerFromPub(tpm transport.TPM, handle tpm2.TPMHandle, name tpm2.TPM2BName
 	return &Signer{tpm: tpm, handle: handle, name: name, pub: pk}, nil
 }
 
+// isProtectedObject reports whether a persistent object is a restricted
+// decryption key — i.e. an Endorsement Key or Storage Root Key. We must NEVER
+// evict one of those (it would destroy the TPM's endorsement/storage identity,
+// including the EK the future EK/AK attestation path depends on). Fail-safe: if
+// the public area can't be parsed, treat it as protected.
+func isProtectedObject(pub2b tpm2.TPM2BPublic) bool {
+	pub, err := pub2b.Contents()
+	if err != nil {
+		return true
+	}
+	a := pub.ObjectAttributes
+	return a.Restricted && a.Decrypt
+}
+
 // ensureKey returns a signer for the persistent key at handle, creating +
 // persisting a fresh ECDSA key there if none exists. Returns created=true when
-// a new key was generated.
+// a new key was generated. handle MUST be a non-reserved owner handle (the fleet
+// default is 0x81000100) — NOT the EK (0x81010001/2) or SRK (0x81000001/2) slots.
 //
 // If the handle already holds an object that is NOT our ECC signing key (e.g. an
-// RSA key left by an older tpm2-tools/openssl provisioning path — go-tpm reports
-// "key at handle is not ECC"), it is treated as STALE and evicted, then a fresh
-// ECC key is created. Safe on the enrol path: this only runs on an empty-NV host,
-// so no issued cert references the old key. Only a valid ECC key is reused.
+// RSA signing key left by an older tpm2-tools/openssl provisioning path — go-tpm
+// reports "key at handle is not ECC"), it is treated as STALE and evicted, then a
+// fresh ECC key is created. Safe on the enrol path: this only runs on an empty-NV
+// host, so no issued cert references the old key. Only a valid ECC key is reused.
+// A restricted-decrypt object (EK/SRK) is NEVER evicted — it errors instead, which
+// only happens if handle was misconfigured to a reserved slot.
 func EnsureKey(tpm transport.TPM, handle tpm2.TPMHandle) (signer *Signer, created bool, err error) {
 	if rp, e := (tpm2.ReadPublic{ObjectHandle: handle}).Execute(tpm); e == nil {
-		if s, e2 := signerFromPub(tpm, handle, rp.Name, rp.OutPublic); e2 == nil {
-			return s, false, nil // our ECC key is already there — reuse it
+		// Guard FIRST: never touch a restricted-decrypt object (EK/SRK). An ECC
+		// EK/SRK would otherwise parse as a usable ECC key below and be "reused".
+		if isProtectedObject(rp.OutPublic) {
+			return nil, false, fmt.Errorf("refusing to evict a restricted-decrypt object (EK/SRK?) at handle %#x — configure a non-reserved owner handle (e.g. 0x81000100)", uint32(handle))
 		}
-		// Stale/wrong-type key occupying the handle — evict so we can recreate.
+		if s, e2 := signerFromPub(tpm, handle, rp.Name, rp.OutPublic); e2 == nil {
+			return s, false, nil // our ECC signing key is already there — reuse it
+		}
+		// Stale/wrong-type signing key occupying the handle — evict so we recreate.
 		if _, e2 := (tpm2.EvictControl{
 			Auth:             tpm2.TPMRHOwner,
 			ObjectHandle:     &tpm2.NamedHandle{Handle: handle, Name: rp.Name},