fleet-enrol: self-heal a stale non-ECC key at the enrol handle

Bench boot failed with "fleet-enrol: ensure key at 0x81010001: key at handle
is not ECC: did not contain eccDetail (selector value was 1)": a real host had
an RSA key persisted at 0x81010001 (left by an older tpm2-tools/openssl
provisioning path), and EnsureKey fatally errored trying to read it as our ECC
signing key — so enrolment died before the CSR/POST and the host fell through
to a normal boot (no fingerprint, nothing at the broker).

EnsureKey now evicts a wrong-type/unusable key at the handle and creates a
fresh ECC key. Safe on the enrol path: it only runs on an empty-NV host, so no
issued cert references the old key. A valid ECC key is still reused (idempotent
retried enrol).

Regression: simtest TestEnsureKeyEvictsStaleNonECC pre-plants an RSA key and
asserts EnsureKey recreates a usable ECC signer (passes against the go-tpm
simulator).

files/enrol/simtest/tpmsim_test.go

@@ -99,3 +99,67 @@ func TestNVWriteAndPresence(t *testing.T) {
 		t.Fatalf("WriteNVCert rewrite: %v", err)
 	}
 }
+
+// Regression for the bench failure "key at handle is not ECC ... selector value
+// was 1": an older provisioning path left an RSA key at 0x81010001, and EnsureKey
+// fatally failed trying to read it as ECC. It must now evict the stale key and
+// create a fresh ECC one.
+func TestEnsureKeyEvictsStaleNonECC(t *testing.T) {
+	tpm := openSim(t)
+	const h = tpm2.TPMHandle(0x81010001)
+
+	// Pre-populate the handle with an RSA key (mimics tpm2-tools/openssl default).
+	rsaTmpl := tpm2.TPMTPublic{
+		Type:    tpm2.TPMAlgRSA,
+		NameAlg: tpm2.TPMAlgSHA256,
+		ObjectAttributes: tpm2.TPMAObject{
+			FixedTPM: true, FixedParent: true, SensitiveDataOrigin: true,
+			UserWithAuth: true, SignEncrypt: true, NoDA: true,
+		},
+		Parameters: tpm2.NewTPMUPublicParms(tpm2.TPMAlgRSA, &tpm2.TPMSRSAParms{
+			Symmetric: tpm2.TPMTSymDefObject{Algorithm: tpm2.TPMAlgNull},
+			Scheme: tpm2.TPMTRSAScheme{
+				Scheme: tpm2.TPMAlgRSASSA,
+				Details: tpm2.NewTPMUAsymScheme(tpm2.TPMAlgRSASSA, &tpm2.TPMSSigSchemeRSASSA{
+					HashAlg: tpm2.TPMAlgSHA256,
+				}),
+			},
+			KeyBits: 2048,
+		}),
+	}
+	cp, err := tpm2.CreatePrimary{
+		PrimaryHandle: tpm2.TPMRHOwner, InPublic: tpm2.New2B(rsaTmpl),
+	}.Execute(tpm)
+	if err != nil {
+		t.Fatalf("create RSA primary: %v", err)
+	}
+	if _, err := (tpm2.EvictControl{
+		Auth:             tpm2.TPMRHOwner,
+		ObjectHandle:     &tpm2.NamedHandle{Handle: cp.ObjectHandle, Name: cp.Name},
+		PersistentHandle: h,
+	}).Execute(tpm); err != nil {
+		t.Fatalf("persist stale RSA key: %v", err)
+	}
+	_, _ = (tpm2.FlushContext{FlushHandle: cp.ObjectHandle}).Execute(tpm)
+
+	// EnsureKey must self-heal: evict the RSA key, create + persist a fresh ECC key.
+	signer, created, err := tpmkey.EnsureKey(tpm, h)
+	if err != nil {
+		t.Fatalf("EnsureKey over stale RSA key: %v", err)
+	}
+	if !created {
+		t.Errorf("EnsureKey should have recreated the key (created=true)")
+	}
+	if _, ok := signer.Public().(*ecdsa.PublicKey); !ok {
+		t.Fatalf("recreated signer is not ECDSA")
+	}
+	// and it must be usable for signing (the whole point of the recovery).
+	dig := sha256.Sum256([]byte("post-heal"))
+	sig, err := signer.Sign(rand.Reader, dig[:], nil)
+	if err != nil {
+		t.Fatalf("sign after heal: %v", err)
+	}
+	if !ecdsa.VerifyASN1(signer.Public().(*ecdsa.PublicKey), dig[:], sig) {
+		t.Fatalf("post-heal ECDSA signature did not verify")
+	}
+}

files/enrol/tpmkey/tpmkey.go

@@ -108,10 +108,25 @@ func signerFromPub(tpm transport.TPM, handle tpm2.TPMHandle, name tpm2.TPM2BName
 // ensureKey returns a signer for the persistent key at handle, creating +
 // persisting a fresh ECDSA key there if none exists. Returns created=true when
 // a new key was generated.
+//
+// If the handle already holds an object that is NOT our ECC signing key (e.g. an
+// RSA key left by an older tpm2-tools/openssl provisioning path — go-tpm reports
+// "key at handle is not ECC"), it is treated as STALE and evicted, then a fresh
+// ECC key is created. Safe on the enrol path: this only runs on an empty-NV host,
+// so no issued cert references the old key. Only a valid ECC key is reused.
 func EnsureKey(tpm transport.TPM, handle tpm2.TPMHandle) (signer *Signer, created bool, err error) {
 	if rp, e := (tpm2.ReadPublic{ObjectHandle: handle}).Execute(tpm); e == nil {
-		s, e2 := signerFromPub(tpm, handle, rp.Name, rp.OutPublic)
-		return s, false, e2
+		if s, e2 := signerFromPub(tpm, handle, rp.Name, rp.OutPublic); e2 == nil {
+			return s, false, nil // our ECC key is already there — reuse it
+		}
+		// Stale/wrong-type key occupying the handle — evict so we can recreate.
+		if _, e2 := (tpm2.EvictControl{
+			Auth:             tpm2.TPMRHOwner,
+			ObjectHandle:     &tpm2.NamedHandle{Handle: handle, Name: rp.Name},
+			PersistentHandle: handle,
+		}).Execute(tpm); e2 != nil {
+			return nil, false, fmt.Errorf("evict stale (non-ECC) key at handle: %w", e2)
+		}
 	}
 
 	cp, err := tpm2.CreatePrimary{