Audiobuzz
4d6f038e3c
Bench (Proxmox vTPM, host cygnus-cruiser-99) confirmed via tpm2_readpublic that
0x81010001 — the handle our design used for the fleet signing key — is the
TCG-standard RSA Endorsement Key slot: the object there is the swtpm-provisioned
EK (restricted|decrypt|adminwithpolicy, RSA-2048/AES128CFB, canonical EK
authPolicy 837197…, EK cert at NV 0x1c00002). Most firmware/swtpm TPMs occupy
that slot, so EnsureKey could never create our key there — it errored reading
the EK as ECC and enrolment died before the CSR/POST.
Move the fleet signing key to 0x81000100, a non-reserved owner persistent
handle (clear of EK 0x81010001/2 and SRK 0x81000001/2). Threaded through:
- fleet-enrol -handle default + new rd.dot1x.handle= cmdline knob (baked by
extract-artifacts.sh, overridable via SMBIOS)
- files/etc/dot1x/wpa_supplicant-dot1x.conf private_key handle
- the dracut hook, bench tpm-provision.sh / tpm-selftest.sh
- CLAUDE.md invariant #1 + design/SSP docs + TODO #11
NV index 0x01800001 (owner range) is unchanged.
EnsureKey hardening: refuse to evict any restricted-decrypt object (EK/SRK) as
a safety net — never clobber the TPM endorsement/storage identity (also
protects the future EK/AK attestation path). Still self-heals a genuine stale
signing key. New regression TestEnsureKeyRefusesToEvictProtectedKey; the
stale-key regression and handle constants moved to 0x81000100.
Design note records the IDevID (0x81020001) option for the later EK/AK
attestation work. Follow-up items logged: content-aware NV presence check
(verify the cert chains to the fleet CA, so leftover/foreign NV can't suppress
enrolment) and a de-enrol/TPM-reset procedure.
30 lines
1.2 KiB
Plaintext
30 lines
1.2 KiB
Plaintext
# Fleet-generic wired 802.1X EAP-TLS + MACsec configuration.
|
|
# Identical on every host: per-host identity comes from the TPM
|
|
# (key at persistent handle, cert extracted from NV at boot).
|
|
ctrl_interface=/run/wpa_supplicant
|
|
eapol_version=3
|
|
ap_scan=0
|
|
|
|
network={
|
|
key_mgmt=IEEE8021X
|
|
eap=TLS
|
|
# RADIUS derives the real identity from the certificate CN/SAN
|
|
identity="fleet-host"
|
|
ca_cert="/etc/dot1x/radius-ca.pem"
|
|
client_cert="/run/dot1x/client.pem"
|
|
|
|
# BENCH-VERIFY: TPM key reference method on your wpa_supplicant build.
|
|
# Handle is the fleet signing-key handle (non-reserved owner handle; NOT the
|
|
# EK slot 0x81010001 — see CLAUDE.md invariant #1). Keep in sync with the
|
|
# enrolment -handle / rd.dot1x.handle default.
|
|
# Option A (OpenSSL tpm2 provider, direct persistent handle):
|
|
private_key="handle:0x81000100"
|
|
# Option B (tpm2-pkcs11 with a store regenerated into /run at boot):
|
|
# private_key="pkcs11:token=fleet;object=dot1x-key;type=private;pin-value=..."
|
|
|
|
macsec_policy=1 # require MACsec
|
|
macsec_integ_only=0 # confidentiality (encrypt), not integrity-only
|
|
macsec_replay_protect=1
|
|
macsec_replay_window=0
|
|
}
|