tpm-enrol: move NV cert index off OEM-occupied 0x01800001 → 0x01800100
The Dell 820 kept "finding a cert" and bypassing enrolment despite repeated BIOS TPM clears. tpm2_nvreadpublic revealed 0x01800001 on that hardware is a FIRMWARE platform index (platformcreate|policydelete|writelocked, 70 bytes — not our cert; siblings at 0x01800003/4 + 0x01810000). platformcreate survives TPM2_Clear and policydelete needs the platform's secret policy, so it's permanent and unusable by us — the blind check false-positived on it, and enrolment could never write there anyway. Same class of bug as the EK-handle collision. Move the NV cert index default 0x01800001 -> 0x01800100 (free on the 820, owner range, overridable via rd.dot1x.nvindex): cmdline (extract-artifacts.sh), fleet-enrol -nvindex, the dracut hooks, bench scripts, CLAUDE.md invariant #1, and design/SSP docs. The signing-key handle (0x81000100) is unchanged. Harden WriteNVCert: refuse a platformcreate index with a clear "pick a free owner index via rd.dot1x.nvindex" error instead of a confusing undefine failure. Regression simtest/TestWriteNVCertRefusesPlatformIndex; NV roundtrip + ReadNVCert tests moved to 0x01800100. All go tests + packer validate pass.
This commit is contained in:
Audiobuzz
+27
-7
@@ -783,7 +783,7 @@ smoke test.
|
||||
returns MSK); a `hostapd` wired authenticator does 802.1X + MACsec on an
|
||||
**isolated bridge per workstation** (flat VLAN can't auth — EAPOL dropped +
|
||||
MACsec is P2P). `enrol/tpm-provision.sh` creates the key in the TPM at
|
||||
`0x81000100` + writes the cert to NV `0x01800001`. Starting solution **signs a
|
||||
`0x81000100` + writes the cert to NV `0x01800100`. Starting solution **signs a
|
||||
CSR** (key stays in TPM); **TPM attestation** (ACME `device-attest-01`) is the
|
||||
documented upgrade on the same CA. **BENCH-VERIFY** items flagged in the files:
|
||||
hostapd MACsec build, openssl tpm2 provider vs pkcs11 key ref, EAP-TLS version.
|
||||
@@ -1026,7 +1026,7 @@ path needs **no tpm2-tools key-gen / no openssl tpm2 provider / no curl** in the
|
||||
image (removes the biggest bench risk — the provider `handle:` key-ref). It
|
||||
ensures the ECDSA key at `0x81000100`, builds the CSR, POSTs CSR+context to
|
||||
`rd.fleet.enrol_url`, shows the broker fingerprint on Plymouth, polls `/status`,
|
||||
and writes the leaf cert to NV `0x01800001`. The dracut hook `tpm-enrol.sh`
|
||||
and writes the leaf cert to NV `0x01800100`. The dracut hook `tpm-enrol.sh`
|
||||
(initqueue/settled prio 25) is now a thin GATE: empty-NV check (`tpm2_nvread`,
|
||||
still needed for the secure-path read) → pre-auth DHCP on `en*` (nmcli override of
|
||||
the secure-mode unmanaged drop-in) → `exec /usr/sbin/fleet-enrol` → reboot to
|
||||
@@ -1071,7 +1071,7 @@ have their EK there), so enrolment could never create our key.
|
||||
**`0x81000100`** (non-reserved owner handle; threaded through `fleet-enrol
|
||||
-handle` default, `rd.dot1x.handle=` cmdline knob baked by `extract-artifacts.sh`,
|
||||
`wpa_supplicant-dot1x.conf`, the bench scripts, invariant #1, and the design docs).
|
||||
NV `0x01800001` (owner range) is unchanged.
|
||||
NV index was `0x01800001` here (owner range); it MOVED to `0x01800100` in a later finding (OEM platform-NV collision on the 820 — see below).
|
||||
- **EnsureKey hardening:** (i) evicts a genuine *stale signing key* at the handle
|
||||
and recreates (self-heal for old provisioning leftovers); (ii) **refuses to evict
|
||||
any restricted-decrypt object (EK/SRK)** as a safety net — never clobber the TPM's
|
||||
@@ -1096,7 +1096,7 @@ have their EK there), so enrolment could never create our key.
|
||||
|
||||
**FOLLOW-UP HARDENING:**
|
||||
- **Content-aware NV presence check — BUILT 2026-07-03.** `fleet-enrol -check-only`
|
||||
(no network / no key-gen) reads NV `0x01800001` via `tpmkey.ReadNVCert`, parses it as
|
||||
(no network / no key-gen) reads NV `0x01800100` via `tpmkey.ReadNVCert`, parses it as
|
||||
X.509, checks the validity window, and — when a real fleet CA is bundled (`-cacert`,
|
||||
default `radius-ca.pem`) — verifies it **chains** to it. Only a valid fleet cert counts
|
||||
as enrolled (rc 0); empty/garbage/foreign/expired → rc 20 (enrol + overwrite;
|
||||
@@ -1109,10 +1109,30 @@ have their EK there), so enrolment could never create our key.
|
||||
Tests: `classifyNVCert` unit table (valid/expired/garbage/foreign/no-CA) + `simtest`
|
||||
ReadNVCert roundtrip across the 512B chunk. **BENCH-VERIFY** on a real boot: a garbage/
|
||||
foreign NV now enrols instead of "normal boot".
|
||||
- **De-enrol / TPM-reset procedure** for re-testing: `tpm2_nvundefine 0x01800001 -C o`
|
||||
- **De-enrol / TPM-reset procedure** for re-testing: `tpm2_nvundefine 0x01800100 -C o`
|
||||
(+ `tpm2_evictcontrol -C o -c 0x81000100` for a stale *app* key — never the EK), or
|
||||
BIOS "Clear TPM". Document in the bench README.
|
||||
|
||||
**BENCH FINDING 2026-07-03 (FIXED) — NV index `0x01800001` collided with OEM
|
||||
platform NV; moved to `0x01800100`.** The Dell 820 kept "finding a cert" and
|
||||
bypassing enrolment even after repeated BIOS TPM clears. `tpm2_nvreadpublic`
|
||||
showed the truth: `0x01800001` on that hardware is a **firmware/platform** index
|
||||
(`platformcreate|policydelete|writelocked`, 70 bytes — NOT our cert; siblings at
|
||||
`0x01800003/4` + `0x01810000` share it), which **no owner/BIOS clear can remove**
|
||||
(`TPM2_Clear` spares `platformcreate`; `policydelete` needs the platform's secret
|
||||
policy). So our chosen index was permanently occupied by Dell — the blind check
|
||||
false-positived on it, and even the content-aware check would have failed at the
|
||||
NV **write** (can't undefine a platform index). Same class as the EK-handle
|
||||
collision. Fix: **moved the NV cert index default `0x01800001` → `0x01800100`**
|
||||
(free on the 820; owner range; overridable via `rd.dot1x.nvindex=`), threaded
|
||||
through the cmdline (`extract-artifacts.sh`), `fleet-enrol -nvindex`, the dracut
|
||||
hooks, bench scripts, invariant #1, and docs. Also **hardened `WriteNVCert`** to
|
||||
refuse a `platformcreate` index with a clear "pick a free owner index" error
|
||||
instead of a confusing undefine failure (regression `simtest/
|
||||
TestWriteNVCertRefusesPlatformIndex`). **BENCH-VERIFY:** 820 now enrols at
|
||||
`0x01800100`; and check `tpm2_nvreadpublic` on any OTHER hardware model in the
|
||||
fleet — if a vendor also squats `0x018001xx`, pick a value free on all of them.
|
||||
|
||||
**BENCH-VERIFY (host side, before trusting):** (a) go-tpm against a REAL TPM +
|
||||
swtpm on the target (the simulator proves the ceremony, not the device) — **the
|
||||
stale-key fix (above) is the first real-TPM result; re-boot to confirm it now
|
||||
@@ -1159,7 +1179,7 @@ Verification found + fixed two things the `mock` path had hidden:
|
||||
FreeRADIUS (next, before host enrolment).
|
||||
|
||||
How a host gets its **802.1X EAP-TLS client identity** the first time — the key at
|
||||
TPM handle `0x81000100` + cert at NV `0x01800001` that invariant #1 says must come
|
||||
TPM handle `0x81000100` + cert at NV `0x01800100` that invariant #1 says must come
|
||||
from enrolment, never the image. Distinct from #10 (that enrols *Secure Boot*
|
||||
PK/KEK/db); this enrols the *network identity*. They share the provisioning UKI +
|
||||
isolated-environment vehicle. Pairs with #8 + the CA decision (start **step-ca**,
|
||||
@@ -1170,7 +1190,7 @@ on an empty TPM the host generates a key *in* the TPM, builds a CSR, submits it
|
||||
an enrolment **broker**, and shows a **fingerprint** on the Plymouth splash; an
|
||||
admin visually cross-checks that fingerprint against the broker's pending-list and
|
||||
approves; the broker has step-ca sign the CSR and returns the cert; the host writes
|
||||
it to NV `0x01800001` and proceeds to authenticate. Sound, recognised pattern
|
||||
it to NV `0x01800100` and proceeds to authenticate. Sound, recognised pattern
|
||||
(SSH/WireGuard/Signal-style OOB verification); good fit for invariant #1.
|
||||
|
||||
**Key design decisions (settled 2026-06-22):**
|
||||
|
||||
@@ -85,7 +85,7 @@ approval** — on an empty TPM the host generates a key *in* the TPM
|
||||
(`0x81000100`), submits a CSR to an enrolment **broker** (reachable via the same
|
||||
pre-auth permit-set, e.g. an `/enrol/` location on the serving nginx → broker →
|
||||
step-ca signer), and shows a fingerprint on the Plymouth splash; an admin
|
||||
cross-checks it and approves; the signed cert is written to NV `0x01800001` and
|
||||
cross-checks it and approves; the signed cert is written to NV `0x01800100` and
|
||||
authentication proceeds. Enrol triggers on **empty-NV only** (expired cert →
|
||||
automatic renew; auth-failure-with-cert → alert, not re-enrol). The fingerprint
|
||||
authorises *which device*; **TPM attestation** (step-ca ACME `device-attest-01`)
|
||||
|
||||
@@ -20,7 +20,7 @@ These are consequences of the CLAUDE.md invariants, not preferences:
|
||||
stateless and buffers only in RAM (best-effort).
|
||||
2. **Identity from the TPM, never baked.** No per-host state in any artifact
|
||||
(invariant #1). The agent derives identity at runtime from the **TPM-held
|
||||
cert** (key `0x81000100`, cert NV `0x01800001`) — the same identity used for
|
||||
cert** (key `0x81000100`, cert NV `0x01800100`) — the same identity used for
|
||||
802.1X EAP-TLS and the NVMe hostnqn. No enrollment token in the image.
|
||||
3. **Pull-based control, no inbound surface.** The boot LAN is locked down and
|
||||
segmented; we do not open an always-on inbound control port on hosts. Hosts
|
||||
|
||||
+1
-1
@@ -91,7 +91,7 @@ manifest. One commit = one release = one digest = one manifest entry.
|
||||
3. **Initramfs (dracut)** brings up the NIC and performs **802.1X EAP-TLS**
|
||||
network authentication using a **private key held in the TPM** (persistent
|
||||
handle `0x81000100`); the client certificate is read from TPM NV index
|
||||
`0x01800001`.
|
||||
`0x01800100`.
|
||||
4. On authorisation, **MACsec** is established on the access link (link-layer
|
||||
encryption/integrity); the host then obtains an IP **on the MACsec interface**
|
||||
via DHCP.
|
||||
|
||||
@@ -8,7 +8,7 @@ end-to-end *minus* the human-approval queue; the only unbuilt piece is the
|
||||
**enrolment broker**.
|
||||
|
||||
How a diskless host acquires — and keeps — its **one cryptographic identity**: a
|
||||
signing key at TPM handle `0x81000100` and a cert at NV index `0x01800001`.
|
||||
signing key at TPM handle `0x81000100` and a cert at NV index `0x01800100`.
|
||||
Invariant #1 forbids baking any per-host state into the image, so this identity
|
||||
**must** be minted at enrolment, at runtime, from the TPM. That single identity is
|
||||
then reused for everything: **802.1X EAP-TLS**, the **NVMe hostnqn** (derived from
|
||||
@@ -29,7 +29,7 @@ separate box — is what makes the two designs one coherent identity story.
|
||||
## Design philosophy (forced by the architecture invariants)
|
||||
|
||||
1. **One identity, minted once, reused everywhere.** Key `0x81000100` + cert
|
||||
NV `0x01800001` = 802.1X identity = NVMe hostnqn (`…:host-<cert-serial>`) =
|
||||
NV `0x01800100` = 802.1X identity = NVMe hostnqn (`…:host-<cert-serial>`) =
|
||||
mTLS client identity. There is no second secret. (Invariant #1.)
|
||||
2. **The private key never leaves the TPM.** Generated *in* the TPM; only a CSR
|
||||
and the issued cert ever cross the wire — both are public. This is why the
|
||||
@@ -50,7 +50,7 @@ separate box — is what makes the two designs one coherent identity story.
|
||||
|
||||
## The identity lifecycle (the load-bearing state machine)
|
||||
|
||||
Triggered by the state of NV `0x01800001` and the cert within it. The three events
|
||||
Triggered by the state of NV `0x01800100` and the cert within it. The three events
|
||||
are deliberately **split** — conflating them is a security regression:
|
||||
|
||||
```
|
||||
@@ -76,7 +76,7 @@ are deliberately **split** — conflating them is a security regression:
|
||||
|
||||
Key generated in the TPM, persisted at `0x81000100`; CSR built with it via the
|
||||
openssl tpm2 provider (key never leaves the TPM); issued cert written DER to NV
|
||||
`0x01800001`. At boot, `dot1x-macsec-up.sh` reads the cert from NV, wpa_supplicant
|
||||
`0x01800100`. At boot, `dot1x-macsec-up.sh` reads the cert from NV, wpa_supplicant
|
||||
signs EAP-TLS with the handle key, and the hostnqn is derived from the cert serial.
|
||||
All of this is built and bench-proven; enrolment just replaces the *manual* sign
|
||||
step with a brokered, human-gated one.
|
||||
@@ -174,7 +174,7 @@ pinned for mTLS — one trust anchor across 802.1X, NVMe, and management.
|
||||
store cert ◀───────────────────────────────
|
||||
8. GET /enrol/status/{id} (poll) ───▶
|
||||
◀── APPROVED + cert ────────────────
|
||||
9. write cert DER → NV 0x01800001
|
||||
9. write cert DER → NV 0x01800100
|
||||
10. reboot into production UKI → 802.1X EAP-TLS → mTLS mgmt
|
||||
```
|
||||
|
||||
@@ -221,7 +221,7 @@ on the existing `disable_dot1x` / `boot_splash` cmdline toggles):
|
||||
auto-detects empty-NV and branches into enrolment in early boot. Picked because it
|
||||
needs **no separate provisioning boot path** — everything stays purely
|
||||
network-booted (no USB / no provisioning media to manage). The empty-NV gate is the
|
||||
safety: NV-write at `0x01800001` needs TPM owner auth, so empty-NV is hard to
|
||||
safety: NV-write at `0x01800100` needs TPM owner auth, so empty-NV is hard to
|
||||
coerce. Accepted trade-offs: production carries the enrolment + pre-auth broker code
|
||||
permanently, and there is no PCR-11 discrimination. The empty-NV branch is mutually
|
||||
exclusive with the secure path, so it does not endanger the load-bearing hook
|
||||
@@ -346,7 +346,7 @@ exists. Enrolment is where it comes into being.
|
||||
trigger** as a static **Go + go-tpm** binary (`files/enrol/`, `fleet-enrol`)
|
||||
talking to `/dev/tpmrm0` directly — ensures the key at `0x81000100`, builds the
|
||||
CSR, POSTs to the broker, shows the Plymouth fingerprint, polls, writes the leaf
|
||||
cert to NV `0x01800001`. A thin dracut GATE hook (`95dot1x-macsec/tpm-enrol.sh`,
|
||||
cert to NV `0x01800100`. A thin dracut GATE hook (`95dot1x-macsec/tpm-enrol.sh`,
|
||||
initqueue/settled prio 25) does the empty-NV check + pre-auth DHCP on the
|
||||
physical NIC + reboot-to-converge. No tpm2-tools key-gen / openssl provider /
|
||||
curl needed in the image (go-tpm does it all). Built **out of the VM** on the CI
|
||||
|
||||
Reference in New Issue
Block a user