Posts
5655
Following
354
Followers
553
.
Also, 'rsaParent' is just weird thing to have. Why not just have the whole TPM2B_PUBLIC blob for the parent key and applications can cherry pick what they want instead? It makes zero sense.
0
0
0

Jarkko Sakkinen

A great example, why "parent" attribute does not really work in TPMKey ASN.1 definition is Linux kernel.

We have explicit parameter for parent handle called 'keyhandle' because the attribute stored in the ASN.1 is useless and ambiguous data.

#linux #kernel #tpm
1
0
0
@pinkforest nope, i know it exist but have not had any use on what i do :-)
0
0
0

Jarkko Sakkinen

Edited 6 months ago
One reason I've stuck on ext4 is that I also run Bitwig Studio on my Linux machine, and generally speaking ext4 has more predictable latency (and more options for recovering data). Ultimately the choice file system is a throughput vs latency question, and this is probably also why Apple never migrated from HFS(+) to ZFS :-)
1
0
0

Jarkko Sakkinen

I think it would be great if we put endorsement certificates for sysfs.

I.e. with very little code/scripting on can then provide tools and means for remote attestation server to generate challenges (e.g. during OS installation).

#linux #kernel #tpm
0
0
1

Jarkko Sakkinen

Edited 6 months ago
Applied a largeish patch [1] to my master:

1. 11 files changed, 508 insertions(+), 566 deletions(-)
2. https://lore.kernel.org/linux-integrity/20251206113110.1793407-4-jarkko@kernel.org/

There's no really sane way to split this so thus I thought it is good idea to early merge it in the beginning of the release cycle in order to maximize coverage :-)
0
0
0
@Netux I'm not 100% sure if I need them but it is good idea to include MS signatures in order to be robust with oproms. Thus, in a common case you want to do that despite owning the KEK keys.
0
0
1

Jarkko Sakkinen

Phew, total 4 separate pull requests for 6.19, all landed without complains :-)
0
0
1

Jarkko Sakkinen

Awesome, it went through first time. Finally had time to actually enable secure boot with sbctl.

Here’s what I did:

  1. Enabled secure boot in custom mode (i.e., not standard mode) from BIOS settings.
  2. Erased all keys. This triggers so called “setup mode” for the next boot.
  3. Typed bunch of random commands :-)

I did the script couple of weeks ago but did not have time to test it live (until now).

1
0
2

Jarkko Sakkinen

3/4 PRs done for 6.19, one to go
0
0
1

Jarkko Sakkinen

Just like there is this half-insulting term "SJW", or "social justice warrior", there should another term "NWW" aka "non-woke warrior" IMHO.

... when I was young IDEs had NON-WOKE names such as "Code Warrior" ;-)
0
0
0

Jarkko Sakkinen

alias readelf='readelf -W'

like the first thing to ever do with readelf ;-)
0
0
0
I think it would be nice patch to merge as it does early roundwork for policy execution as side-effect.
0
0
0

Jarkko Sakkinen

This kernel patch embeds an extension for the TPMKey specification:

https://lore.kernel.org/linux-integrity/20251205030205.140842-3-jarkko@kernel.org/

I.e. optional 'parentName' attribute. It also populates kernel's ASN.1 definition with the full spec. It's a bottleneck in the ASN.1 format.

#linux #kernel #tpm
1
0
0

Jarkko Sakkinen

UserHasNoMailboxAndNoLicenseAssignedError

Microsoft clearly makes the best error codes.
0
0
2

Jarkko Sakkinen

In Himmelblau evolution it will be interesting to see if there's someday perhaps a subset of graph API to provide "the service' too.
0
0
0
@suihkulokki i'm not sure if that page has anything to do with clients. looks like it is related to vms hosted in azure.
0
0
0

Jarkko Sakkinen

Couple of new features:

1. Creates and loads both 'loadable' and 'importable' keys from external keys.
2. tpm2sh load has now --load flag to load a generated keyedhash key as a trusted key to the kernel keyring.

#linux #kernel #tpm #rustlang
0
0
2

Jarkko Sakkinen

Cool, got ssh logins through Azure/Intune working to built Ms after fighting for some time with systemd-creds :-) Himmelblau 2.0 feels surprsingly stable environment.
0
0
1
Show older