Posts
4417Following
315Followers
471OpenPGP: 3AB05486C7752FE1
Jarkko Sakkinen
jarkko
1
0
0
for tpm2_encodeobject: https://lists.buildroot.org/pipermail/buildroot/2024-May/753689.html
Key creation (not yet fully tested):
tpm2_createprimary --hierarchy o -G rsa2048 -c owner.txt
tpm2_evictcontrol -c owner.txt 0x81000001
tpm2_getcap handles-persistent
openssl genrsa -out private.pem 2048
tpm2_import -C 0x81000001 -G rsa -i private.pem -u key.pub -r key.priv
tpm2_encodeobject -C 0x81000001 -u key.pub -r key.priv -o key.priv.pem
openssl asn1parse -inform pem -in key.priv.pem -noout -out key.priv.der
key_serial=`cat key.priv.der | keyctl padd asymmetric tpm @u`
The asymmetric key should be then available as subcommands of keyctl pkey_encrypt $key_serial.
0
0
0
Jarkko Sakkinen
jarkkoA new asymmetric key type tpm2_key_rsa: https://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd.git/log/?h=tpm2_key
Missing still integration to the pre-existing ASN.1 parser but can already sign with the null seed (default if parent is not defined).
I though this would be most logical way to define asymmetric key. Later on tpm2_key_ecdsa can be added. Also for RSA we should use TPM2_RSA_Decrypt for decryption and signing, whereas ECDSA requires potentially more expensive TPM2_Sign and TPM2_EncryptDecrypt.
It is still experimental. Testing the key type itself without parser first with the help of null seed, and then adding bits to call the ASN.1 parser by implementing asymmetric_key_parser. This derived work from James Prestwood’s earlier work from 2020.
1
0
0
Jarkko Sakkinen
jarkkonever happens anywhere else (tested e.g. with Sublime Text with NeoVintageous).
0
0
0
Jarkko Sakkinen
jarkkohttps://lore.kernel.org/linux-integrity/20240518113424.13486-1-jarkko@kernel.org/T/#u
1
0
0
1
0
0
1
0
0
Jarkko Sakkinen
jarkkoukify build --linux=images/bzImage --initrd=images/roofs.cpio
Or along the lines.
I.e use Unified Kernel Image (UKI) in kernel testing.
#linux #kernel
1
0
0
Jarkko Sakkinen
jarkko
1
0
0
Jarkko Sakkinen
jarkkoThe easiest way to move forward with a feature is not to have best possible code quality (at least when tagged as RFC). Instead, having a provable payload for the feature is essential.
https://lore.kernel.org/all/D1BC3VWXKTNC.2DB9JIIDOFIOQ@kernel.org/
0
0
0
Jarkko Sakkinen
jarkko
1
0
0
Jarkko Sakkinen
jarkko
1
0
1
1
0
1