Documentation
¶
Index ¶
- Constants
- Variables
- func AutoDetectTPMPath(baseTPMDir string) (string, error)
- func SRKTemplateHighECC() tpm2.Public
- func SRKTemplateHighRSA() tpm2.Public
- type Session
- func (c *Session) CertifyDevIDKey() ([]byte, []byte, error)
- func (c *Session) Close()
- func (c *Session) GetAKPublic() []byte
- func (c *Session) GetEKCert() ([]byte, error)
- func (c *Session) GetEKPublic() ([]byte, error)
- func (c *Session) SolveCredActivationChallenge(credentialBlob, secret []byte) ([]byte, error)
- func (c *Session) SolveDevIDChallenge(nonce []byte) ([]byte, error)
- type SessionConfig
- type SigningKey
- type TPMPasswords
Constants ¶
const EKCertificateHandleRSA = tpmutil.Handle(0x01c00002)
ekRSACertificateHandle is the default handle for RSA endorsement key according to the TCG TPM v2.0 Provisioning Guidance, section 7.8 https://trustedcomputinggroup.org/resource/tcg-tpm-v2-0-provisioning-guidance/
Variables ¶
var OpenTPM = openTPM
Functions ¶
func AutoDetectTPMPath ¶
func SRKTemplateHighECC ¶
SRKTemplateHighECC returns the default high range SRK template (called H-2 in the specification). https://trustedcomputinggroup.org/wp-content/uploads/TCG_IWG_EKCredentialProfile_v2p3_r2_pub.pdf#page=42
func SRKTemplateHighRSA ¶
SRKTemplateHighRSA returns the default high range SRK template (called H-1 in the specification). https://trustedcomputinggroup.org/wp-content/uploads/TCG_IWG_EKCredentialProfile_v2p3_r2_pub.pdf#page=41
Types ¶
type Session ¶
type Session struct {
// contains filtered or unexported fields
}
Session represents a TPM with loaded DevID credentials and exposes methods to perfom cryptographyc operations relevant to the SPIRE node attestation workflow.
func NewSession ¶
func NewSession(scfg *SessionConfig) (*Session, error)
NewSession opens a connection to a TPM and configures it to be used for node attestation.
func (*Session) CertifyDevIDKey ¶
CertifyDevIDKey proves that the DevID Key is in the same TPM than Attestation Key.
func (*Session) Close ¶
func (c *Session) Close()
Close unloads TPM loaded objects and closes the connection to the TPM.
func (*Session) GetAKPublic ¶
GetAKPublic returns the public part of the attestation key encoded in TPM wire format.
func (*Session) GetEKPublic ¶
GetEKPublic returns the public part of the Endorsement Key encoded in TPM wire format.
func (*Session) SolveCredActivationChallenge ¶
SolveCredActivationChallenge runs credential activation on the TPM. It proves that the attestation key resides on the same TPM as the endorsement key.
type SessionConfig ¶
type SessionConfig struct {
// in future iterations of tpm libraries, TPM will accept a
// list of device paths (https://github.com/google/go-tpm/pull/256)
DevicePath string
DevIDPriv []byte
DevIDPub []byte
Passwords TPMPasswords
Log hclog.Logger
}
type SigningKey ¶
SigningKey represents a TPM loaded key
Source Files