attest

package
v0.0.0-...-c4c2d28 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Mar 21, 2026 License: MIT Imports: 25 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

View Source 
var (
	ECCSRK_H2_Template = tpm2.TPMTPublic{
		Type:    tpm2.TPMAlgECC,
		NameAlg: tpm2.TPMAlgSHA256,
		ObjectAttributes: tpm2.TPMAObject{
			FixedTPM:            true,
			FixedParent:         true,
			SensitiveDataOrigin: true,
			UserWithAuth:        true,
			NoDA:                true,
			Restricted:          true,
			Decrypt:             true,
		},
		Parameters: tpm2.NewTPMUPublicParms(
			tpm2.TPMAlgECC,
			&tpm2.TPMSECCParms{
				Symmetric: tpm2.TPMTSymDefObject{
					Algorithm: tpm2.TPMAlgAES,
					KeyBits: tpm2.NewTPMUSymKeyBits(
						tpm2.TPMAlgAES,
						tpm2.TPMKeyBits(128),
					),
					Mode: tpm2.NewTPMUSymMode(
						tpm2.TPMAlgAES,
						tpm2.TPMAlgCFB,
					),
				},
				CurveID: tpm2.TPMECCNistP256,
			},
		),
		Unique: tpm2.NewTPMUPublicID(
			tpm2.TPMAlgECC,
			&tpm2.TPMSECCPoint{
				X: tpm2.TPM2BECCParameter{
					Buffer: make([]byte, 0),
				},
				Y: tpm2.TPM2BECCParameter{
					Buffer: make([]byte, 0),
				},
			},
		),
	}
	ECCAKTemplate = tpm2.TPMTPublic{
		Type:    tpm2.TPMAlgECC,
		NameAlg: tpm2.TPMAlgSHA256,
		ObjectAttributes: tpm2.TPMAObject{
			FixedTPM:            true,
			FixedParent:         true,
			SensitiveDataOrigin: true,
			UserWithAuth:        true,
			NoDA:                true,
			Restricted:          true,
			SignEncrypt:         true,
		},
		Parameters: tpm2.NewTPMUPublicParms(
			tpm2.TPMAlgECC,
			&tpm2.TPMSECCParms{
				Scheme: tpm2.TPMTECCScheme{
					Scheme: tpm2.TPMAlgECDSA,
					Details: tpm2.NewTPMUAsymScheme(
						tpm2.TPMAlgECDSA,
						&tpm2.TPMSSigSchemeECDSA{
							HashAlg: tpm2.TPMAlgSHA256,
						},
					),
				},
				CurveID: tpm2.TPMECCNistP256,
			},
		),
		Unique: tpm2.NewTPMUPublicID(
			tpm2.TPMAlgECC,
			&tpm2.TPMSECCPoint{
				X: tpm2.TPM2BECCParameter{
					Buffer: make([]byte, 0),
				},
				Y: tpm2.TPM2BECCParameter{
					Buffer: make([]byte, 0),
				},
			},
		),
	}

	RSAAKTemplate = tpm2.TPMTPublic{
		Type:    tpm2.TPMAlgRSA,
		NameAlg: tpm2.TPMAlgSHA256,
		ObjectAttributes: tpm2.TPMAObject{
			FixedTPM:            true,
			FixedParent:         true,
			SensitiveDataOrigin: true,
			UserWithAuth:        true,
			NoDA:                true,
			Restricted:          true,
			SignEncrypt:         true,
		},
		Parameters: tpm2.NewTPMUPublicParms(
			tpm2.TPMAlgRSA,
			&tpm2.TPMSRSAParms{
				Scheme: tpm2.TPMTRSAScheme{
					Scheme: tpm2.TPMAlgRSASSA,
					Details: tpm2.NewTPMUAsymScheme(
						tpm2.TPMAlgRSASSA,
						&tpm2.TPMSSigSchemeRSASSA{
							HashAlg: tpm2.TPMAlgSHA256,
						},
					),
				},
				KeyBits: 2048,
			},
		),
		Unique: tpm2.NewTPMUPublicID(
			tpm2.TPMAlgRSA,
			&tpm2.TPM2BPublicKeyRSA{
				Buffer: make([]byte, 256),
			},
		),
	}
)

Functions

func EkPolicy 

func EkPolicy(t transport.TPM, handle tpm2.TPMISHPolicy, nonceTPM tpm2.TPM2BNonce) error

func GetAK 

func GetAK(rwc transport.TPMCloser, alg tpm2.TPMAlgID) (*tpm2.NamedHandle, *tpm2.CreatePrimaryResponse, error)

func GetAKWithHandel 

func GetAKWithHandel(rwc transport.TPMCloser, handel *tpm2.NamedHandle) (*tpm2.NamedHandle, *tpm2.CreateLoadedResponse, error)

func GetEK 

func GetEK(rwc transport.TPMCloser, alg tpm2.TPMAlgID) (*tpm2.NamedHandle, *tpm2.TPMTPublic, error)

func GetEKCert 

func GetEKCert(rwc transport.TPMCloser, alg tpm2.TPMAlgID) (*x509.Certificate, error)

func GetEKHandle 

func GetEKHandle(rwc transport.TPMCloser) (crypto.PublicKey, error)

func GetSRKPrimary 

func GetSRKPrimary(rwc transport.TPMCloser) (*tpm2.NamedHandle, *tpm2.TPMTPublic, error)

func HashPub 

func HashPub(b crypto.PublicKey) []byte

func NewCryptoPublicEncapKey 

func NewCryptoPublicEncapKey(pub crypto.PublicKey) tpm2.LabeledEncapsulationKey

Types

type AKCertificate 

type AKCertificate struct {
	// contains filtered or unexported fields
}

func NewAKCertificate 

func NewAKCertificate(ak *tpm2.TPMTPublic) (*AKCertificate, error)

func (*AKCertificate) Cert 

func (a *AKCertificate) Cert() *x509.Certificate

Cert returns the x509 cert

func (*AKCertificate) PublicKey 

func (a *AKCertificate) PublicKey() crypto.PublicKey

func (*AKCertificate) SetExtensions 

func (a *AKCertificate) SetExtensions(uri string, t *TPMInfo)

type AttestClient 

type AttestClient struct {
	// contains filtered or unexported fields
}

func NewClient 

func NewClient(url string) *AttestClient

func (*AttestClient) GetAttestURL 

func (a *AttestClient) GetAttestURL() string

func (*AttestClient) GetAttestWithAlg 

func (a *AttestClient) GetAttestWithAlg(rwc transport.TPMCloser, ap *Attestation) ([]*x509.Certificate, error)

func (*AttestClient) GetSecretURL 

func (a *AttestClient) GetSecretURL() string

type Attestation 

type Attestation struct {
	TPMInfo      *TPMInfo
	EKCerts      []*x509.Certificate
	EKPub        crypto.PublicKey
	AKCert       []byte
	AttestParams *AttestationParameters
	// contains filtered or unexported fields
}

func NewAttestation 

func NewAttestation(rwc transport.TPMCloser, conf *AttestationConfig) (*Attestation, error)

func (*Attestation) AKCertificate 

func (a *Attestation) AKCertificate() (*AKCertificate, error)

func (*Attestation) ActivateCredential 

func (a *Attestation) ActivateCredential(rwc transport.TPMCloser, cred tpm2.TPM2BIDObject, secret tpm2.TPM2BEncryptedSecret) ([]byte, error)

func (*Attestation) ActivateCredentialWithAlg 

func (a *Attestation) ActivateCredentialWithAlg(rwc transport.TPMCloser, _ tpm2.TPMAlgID, cred tpm2.TPM2BIDObject, secret tpm2.TPM2BEncryptedSecret) ([]byte, error)

func (*Attestation) Alg 

func (a *Attestation) Alg() tpm2.TPMAlgID

func (*Attestation) CreateCredential 

func (a *Attestation) CreateCredential(secret []byte) (*AttestationResponse, error)

CreateCredential creates an encrypted credential to be used for ActivateCredential

func (*Attestation) EKPubHash 

func (a *Attestation) EKPubHash() string

func (*Attestation) MarshalJSON 

func (a *Attestation) MarshalJSON() ([]byte, error)

func (*Attestation) UnmarshalJSON 

func (a *Attestation) UnmarshalJSON(b []byte) error

func (*Attestation) Verify 

func (a *Attestation) Verify() (bool, error)

Verify attestation

type AttestationConfig 

type AttestationConfig struct {
	AKHandle *tpm2.NamedHandle
	AKRsp    *tpm2.CreatePrimaryResponse
	KeyAlg   tpm2.TPMAlgID
	// TODO: Use this with the key
	Name []byte
}

type AttestationParameters 

type AttestationParameters struct {
	Public            *tpm2.TPMTPublic
	CreateData        *tpm2.TPMSCreationData
	CreateAttestation *tpm2.TPMSAttest
	CreateSignature   []byte
}

func CertifyKey 

func CertifyKey(rwc transport.TPMCloser, ak tpm2.NamedHandle, keyhandle tpm2.NamedHandle, pub *tpm2.TPMTPublic, data []byte) (*AttestationParameters, error)

func NewAttestationParametersWithAlg 

func NewAttestationParametersWithAlg(rwc transport.TPMCloser, conf *AttestationConfig) (*AttestationParameters, error)

func (*AttestationParameters) MarshalJSON 

func (a *AttestationParameters) MarshalJSON() ([]byte, error)

func (*AttestationParameters) ToJSON 

func (a *AttestationParameters) ToJSON() *attestationParameters

func (*AttestationParameters) UnmarshalJSON 

func (a *AttestationParameters) UnmarshalJSON(b []byte) error

func (*AttestationParameters) Verify 

func (a *AttestationParameters) Verify() (bool, error)

func (*AttestationParameters) VerifyCreation 

func (a *AttestationParameters) VerifyCreation(restricted bool) (bool, error)

type AttestationResponse 

type AttestationResponse struct {
	Credential tpm2.TPM2BIDObject        `json:"credential"`
	Secret     tpm2.TPM2BEncryptedSecret `json:"secret"`
}

AttestationResponse is the serialized Credential Activation

func NewAttestationResponse 

func NewAttestationResponse() *AttestationResponse

func (*AttestationResponse) MarshalJSON 

func (a *AttestationResponse) MarshalJSON() ([]byte, error)

func (*AttestationResponse) UnmarshalJSON 

func (a *AttestationResponse) UnmarshalJSON(b []byte) error

type ECDHPublicEncapKey 

type ECDHPublicEncapKey struct {
	// contains filtered or unexported fields
}

func (*ECDHPublicEncapKey) Encapsulate 

func (pub *ECDHPublicEncapKey) Encapsulate(random io.Reader, label string) (secret []byte, ciphertext []byte, err error)

func (*ECDHPublicEncapKey) NameAlg 

func (pub *ECDHPublicEncapKey) NameAlg() tpm2.TPMAlgID

NameAlg implements LabeledEncapsulationKey.

func (*ECDHPublicEncapKey) SymmetricParameters 

func (pub *ECDHPublicEncapKey) SymmetricParameters() *tpm2.TPMTSymDefObject

SymmetricParameters implements LabeledEncapsulationkey.

type RSAPublicEncapKey 

type RSAPublicEncapKey struct {
	// contains filtered or unexported fields
}

func (*RSAPublicEncapKey) Encapsulate 

func (pub *RSAPublicEncapKey) Encapsulate(random io.Reader, label string) (secret []byte, ciphertext []byte, err error)

func (*RSAPublicEncapKey) NameAlg 

func (pub *RSAPublicEncapKey) NameAlg() tpm2.TPMAlgID

NameAlg implements LabeledEncapsulationKey.

func (*RSAPublicEncapKey) SymmetricParameters 

func (pub *RSAPublicEncapKey) SymmetricParameters() *tpm2.TPMTSymDefObject

SymmetricParameters implements LabeledEncapsulationkey.

type SecretRequest 

type SecretRequest struct {
	Secret []byte `json:"secret"` // decrypted secret
}

type SecretResponse 

type SecretResponse struct {
	CertificateChain [][]byte `json:"chain"`
}

type TCGVendorID 

type TCGVendorID uint32

func (TCGVendorID) String 

func (id TCGVendorID) String() string

type TPMInfo 

type TPMInfo struct {
	Manufacturer    string `json:"manufacturer,omitempty"`
	Model           string `json:"model,omitempty"`
	Version         uint8  `json:"version,omitempty"`
	FirmwareVersion string `json:"firmwareVersion,omitempty"`
}

func NewTPMInfo 

func NewTPMInfo(rwc transport.TPMCloser) (*TPMInfo, error)

func NewTPMInfoFromASN 

func NewTPMInfoFromASN(b []byte) *TPMInfo

func (*TPMInfo) MarshalASN 

func (t *TPMInfo) MarshalASN() []byte

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.