Skip to content

Commit bdeb52f

Browse files
salrashid123salrashid123
committed
add ek parent type
Signed-off-by: sal rashid <salrashid123@gmail.com>
1 parent 7f8e60c commit bdeb52f

File tree

3 files changed

+33
-15
lines changed

3 files changed

+33
-15
lines changed

‎README.md‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -71,7 +71,7 @@ You can set the following options on usage:
7171
| **`--keyPass`** | Passphrase for the key handle (will use TPM_KEY_AUTH env var) |
7272
| **`--pcrs`** | "PCR Bound slot:value (increasing order, comma separated)" |
7373
| **`--rawOutput`** | Return just the token, nothing else |
74-
| **`--useEKParent`** | Use endorsement RSAKey as parent (default: false) |
74+
| **`--useEKParent`** | Use endorsement keys (`rsa_ek` or `ecc_ek` as parent (default: `rsa_ek`) |
7575
| **`--tpm-session-encrypt-with-name`** | hex encoded TPM object 'name' to use with an encrypted session |
7676

7777
#### Oauth2 Options
@@ -373,7 +373,7 @@ Note that the token is static and non-refreshable through gcloud. Each token gen
373373
374374
Also note that issuing identity token is not supported
375375
376-
##### Remote Key Transfer
376+
### Remote Key Transfer
377377
378378
If you used option `3` above to transfer the service account key from your laptop (`local`) to `TPM-A` (tpm-a being the system where you will run the metadata server):
379379
@@ -418,7 +418,7 @@ tpmcopy --mode import --parentKeyType=rsa_ek --in=/tmp/out.json --out=/tmp/tpmke
418418
### run
419419
gcp-adc-tpm --keyfilepath=/tmp/tpmkey.pem \
420420
--svcAccountEmail="tpm-sa@$PROJECT_ID.iam.gserviceaccount.com" \
421-
--useEKParent --keyPass=bar --tpm-path=127.0.0.1:2321
421+
--useEKParent=rsa_ek --keyPass=bar --tpm-path=127.0.0.1:2321
422422
```
423423
424424
With service account key saved as a `PersistentHandle`
@@ -454,7 +454,7 @@ tpmcopy --mode evict \
454454
### run
455455
gcp-adc-tpm --keyfilepath=/tmp/tpmkey.pem \
456456
--svcAccountEmail="tpm-sa@$PROJECT_ID.iam.gserviceaccount.com" \
457-
--useEKParent --keyPass=bar --persistentHandle 0x81008001 --tpm-path=$TPMA
457+
--useEKParent=rsa_ek --keyPass=bar --persistentHandle 0x81008001 --tpm-path=$TPMA
458458
```
459459
460460
###### PCR Policy
@@ -492,7 +492,7 @@ tpmcopy --mode import --parentKeyType=rsa_ek --in=/tmp/out.json --out=/tmp/tpmke
492492
### run
493493
gcp-adc-tpm --keyfilepath=/tmp/tpmkey.pem \
494494
--svcAccountEmail="tpm-sa@$PROJECT_ID.iam.gserviceaccount.com" \
495-
--useEKParent --pcrs=23:F5A5FD42D16A20302798EF6ED309979B43003D2320D9F0E8EA9831A92759FB4B --tpm-path=127.0.0.1:2321
495+
--useEKParent=rsa_ek --pcrs=23:F5A5FD42D16A20302798EF6ED309979B43003D2320D9F0E8EA9831A92759FB4B --tpm-path=127.0.0.1:2321
496496
```
497497
498498
With service account key saved as a `PersistentHandle`
@@ -531,7 +531,7 @@ tpmcopy --mode evict \
531531
### run
532532
gcp-adc-tpm \
533533
--svcAccountEmail="tpm-sa@$PROJECT_ID.iam.gserviceaccount.com" \
534-
--useEKParent --pcrs=23:F5A5FD42D16A20302798EF6ED309979B43003D2320D9F0E8EA9831A92759FB4B \
534+
--useEKParent=rsa_ek --pcrs=23:F5A5FD42D16A20302798EF6ED309979B43003D2320D9F0E8EA9831A92759FB4B \
535535
--persistentHandle 0x81008001 --tpm-path=$TPMA
536536
```
537537
@@ -552,7 +552,7 @@ tpmcopy --mode import --parentKeyType=rsa_ek --in=/tmp/out.json --out=/tmp/tpmke
552552
## use the key
553553
gcp-adc-tpm --keyfilepath=/tmp/tpmkey.pem \
554554
--svcAccountEmail="tpm-sa@$PROJECT_ID.iam.gserviceaccount.com" \
555-
--useEKParent --tpm-path=127.0.0.1:2321
555+
--useEKParent=rsa_ek --tpm-path=127.0.0.1:2321
556556
```
557557
558558
For password based non-session tranfers with H2 key:

‎cmd/main.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ var (
3232
expireIn = flag.Int("expireIn", 3600, "Token expires in seconds")
3333
scopes = flag.String("scopes", "https://www.googleapis.com/auth/cloud-platform", "comma separated scopes")
3434
useOauthToken = flag.Bool("useOauthToken", false, "Use oauth2 token instead of jwtAccessToken (default: false)")
35-
useEKParent = flag.Bool("useEKParent", false, "Use endorsement RSAKey as parent (not h2) (default: false)")
35+
useEKParent = flag.String("useEKParent", "rsa_ek", "Use endorsement (rsa_ek or ecc_ek) as parent (not h2) (default: rsa_ek)")
3636

3737
// oauth options
3838
identityToken = flag.Bool("identityToken", false, "Generate google ID token (default: false)")

‎gcp-adc-tpm.go‎

Lines changed: 25 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -78,7 +78,7 @@ type GCPTPMConfig struct {
7878
ExpireIn int
7979

8080
IdentityToken bool
81-
UseEKParent bool
81+
UseEKParent string
8282
Audience string
8383
ServiceAccountEmail string
8484
Scopes []string
@@ -146,10 +146,19 @@ func NewGCPTPMCredential(cfg *GCPTPMConfig) (Token, error) {
146146
}
147147

148148
// specify its parent directly
149-
if cfg.UseEKParent {
149+
if cfg.UseEKParent != "" {
150+
var keytype tpm2.TPMTPublic
151+
switch cfg.UseEKParent {
152+
case "rsa_ek":
153+
keytype = tpm2.RSAEKTemplate
154+
case "ecc_ek":
155+
keytype = tpm2.ECCEKTemplate
156+
default:
157+
return Token{}, fmt.Errorf("gcp-adc-tpm: unsupported ekparent: %s", cfg.UseEKParent)
158+
}
150159
primaryKey, err = tpm2.CreatePrimary{
151160
PrimaryHandle: tpm2.TPMRHEndorsement,
152-
InPublic: tpm2.New2B(tpm2.RSAEKTemplate),
161+
InPublic: tpm2.New2B(keytype),
153162
}.Execute(rwr)
154163
if err != nil {
155164
return Token{}, fmt.Errorf("gcp-adc-tpm: can't create pimaryEK: %v", err)
@@ -213,11 +222,20 @@ func NewGCPTPMCredential(cfg *GCPTPMConfig) (Token, error) {
213222
}
214223
svcAccountKey = svcAccountKeyResponse.ObjectHandle
215224
} else {
216-
if cfg.UseEKParent {
225+
if cfg.UseEKParent != "" {
226+
var keytype tpm2.TPMTPublic
227+
switch cfg.UseEKParent {
228+
case "rsa_ek":
229+
keytype = tpm2.RSAEKTemplate
230+
case "ecc_ek":
231+
keytype = tpm2.ECCEKTemplate
232+
default:
233+
return Token{}, fmt.Errorf("gcp-adc-tpm: unsupported ekparent: %s", cfg.UseEKParent)
234+
}
217235
var err error
218236
primaryKey, err = tpm2.CreatePrimary{
219237
PrimaryHandle: tpm2.TPMRHEndorsement,
220-
InPublic: tpm2.New2B(tpm2.RSAEKTemplate),
238+
InPublic: tpm2.New2B(keytype),
221239
}.Execute(rwr)
222240
if err != nil {
223241
return Token{}, fmt.Errorf("gcp-adc-tpm: can't create pimaryEK: %v", err)
@@ -290,7 +308,7 @@ func NewGCPTPMCredential(cfg *GCPTPMConfig) (Token, error) {
290308
},
291309
}
292310

293-
if cfg.UseEKParent {
311+
if cfg.UseEKParent != "" {
294312

295313
se, err = tpmjwt.NewPCRAndDuplicateSelectSession(rwr, sel, tpm2.TPM2BDigest{Buffer: pcrHash}, []byte(cfg.Keypass), primaryKey.Name, encryptionSessionHandle)
296314
if err != nil {
@@ -309,7 +327,7 @@ func NewGCPTPMCredential(cfg *GCPTPMConfig) (Token, error) {
309327

310328
} else if keyPasswordAuth != "" {
311329

312-
if cfg.UseEKParent {
330+
if cfg.UseEKParent != "" {
313331
se, err = tpmjwt.NewPolicyAuthValueAndDuplicateSelectSession(rwr, []byte(cfg.Keypass), primaryKey.Name, encryptionSessionHandle)
314332
if err != nil {
315333
return Token{}, fmt.Errorf("gcp-adc-tpm: can't create authSession: %v", err)

0 commit comments

Comments
 (0)