Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

add ECC P-256 key support #4

Merged
merged 2 commits into from
Sep 18, 2023
Merged

add ECC P-256 key support #4

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
bde19dd
add ECC P-256 key support
shjala Aug 29, 2023
11feb75
refactoring : rename functions to be more descriptive
shjala Aug 31, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions doc/USAGE.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -64,18 +64,18 @@ counter, err = IncreaseMonotonicCounter(0x1500017)
Client must validate `approvedPolicySignature` signature using the `key.PublicKey` before replacing any old policy. After update Client should be able to read back the secret with a new policy that matches the new system state.

## Rotating the Signing Key
To rotate the signing key, using the old key, sign the new key and generate a new Authorization Digest based on the new key and send the `newKey.PublicKey`, `newAuthDigest` and `approvedPolicyNewSig` to the client.
To rotate the signing key you can either have your own verification logic for the new public key and just use the same logic described in "Generating Mutable Policies" or use the old key to create a signing chain (this might be problematic if devices lost connection with the controller and you retire the old keys). To do this, simply sign the new key and generate a new Authorization Digest based on the new key and send the `newKey.PublicKey`, `newAuthDigest` and `approvedPolicyNewSig` to the client.

```go
newKey, _ := GenKeyPair()
newkeySig, newAuthDigest, approvedPolicyNewSig, err := RotateAuthDigestWithPolicy(oldKey, newKey, pcrs, rbp)
```

After receiving the new key and signature, by calling `ResealSecretWithNewAuthDigest` client verifiers the new key is signed with the old key and then reseals the secret using the new Authorization Digest which is bound to new key:
After receiving the new key and signature, by calling `ResealTpmSecretWithVerifiedAuthDigest` client verifiers the new key is signed with the old key and then reseals the secret using the new Authorization Digest which is bound to new key:

```go
rbp := RBP{Counter: 0x1500017, Check: 2}
err = ResealSecretWithNewAuthDigest(0x1500016,
err = ResealTpmSecretWithVerifiedAuthDigest(0x1500016,
&oldKey.PublicKey,
&newKey.PublicKey,
newkeySig,
Expand Down
Loading
Loading