v/tpm2-store
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
No description
33 commits 1 branch 0 tags 136 KiB
Rust 91.4%
Nix 4.5%
Shell 4.1%
Find a file
Patrick Uiterwijk 3dcb2874e0 Add defaults for policy path and pubkey path 
This should send people strongly to use the defaults, so that other
tools can easily determine whether policies are in use and what their
values are.
It still allows overriding them.

Signed-off-by: Patrick Uiterwijk <patrick@puiterwijk.org>
2020-12-03 16:42:52 +00:00
src Add defaults for policy path and pubkey path 2020-12-03 16:42:52 +00:00
tests Re-enable the tests 2020-12-03 14:30:58 +00:00
.gitignore Generate a new key and signed policy during the test 2020-07-22 16:46:54 +02:00
Cargo.toml Rebase on tpm2-policy 0.3.1 for a fix 2020-12-03 16:59:52 +01:00
LICENSE Initial commit 2020-07-16 16:22:34 +02:00
README.md Add some policy instructions to the README 2020-07-22 16:38:36 +02:00

README.md

clevis-pin-tpm2

Rewritten Clevis TPM2 PIN

This rewrite supports all previously encrypted values of the PCR-only clevis TPM2 PIN. Additionally, it supports Authorized Policies to delegate authorization of PCR values to an external party.

Creating policies

A reference implementation has been made available for creating policies as parsed by this pin. To use this, first create a policy (see instructions in the repository) and take the output signed policy and the public key JSON. These files need to be available when the PIN runs, so if the pin is used to encrypt the filesystem root, it will probably need to be in /boot. Then run: $binary encrypt '{"policy_pubkey_path": "/boot/policy_pubkey.json", "policy_ref": "", "policy_path": "/boot/policy.json"}' <somefile. This results in an encrypted blob. During the encryption, the policy pubkey needs to exist, the policy does not.

To decrypt this blob, the file specified in the policy_path during encrypt needs to contain a policy that matches the policy_ref with any steps that would match the current PCRs of the system. If that's the case, $binary decrypt <blob will return the contents of the original file back.