Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Seal info w EK pub or cert on systems without TPM #343

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

akutz
Copy link

@akutz akutz commented Sep 4, 2023

This patch introduces support for sealing information to an endorsement key without needing to be on a system with a TPM. This feature enables support for clients that want to encrypt small amounts of data in order to bootstrap a virtual machine that may only have an endorsement key prior to first boot.

For example, the following command, when executed from the root of this project, produces output that can only be unsealed on the system with a TPM that has the specified endorsement key:

  1. For example, on a system without a TPM, the following command seals the specified plain-text data to the provided endorsement key RSA certificate:

    echo "Hello, world." | go run ./examples/tpm2-ekseal/main.go -ek-pem ./tpm2/testdata/ek-rsa-crt.pem -f 0

    The use of the -f 0 tells the program to emit the encrypted, duplicated object as base64-encoded data, its parts delimited by @@NULL@@:

    AE4ACAALAAAEAAAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAgjD2tBVBgi06poK/qVwaY8tEKr/NRmEFkNlW3P2Bgy3M=@@NULL@@AFoAIOR+5y1YYp28HDEIaBM/NqsiZ5oY55Qw/5LqQg/L/9ZHd81bf0xE1rkhcOo4PwknfpNevbU9vwY+w2l/xwSq5qjhDVzL5rfCUaYD/kDr7T/FONLm+dSz1jo=@@NULL@@AQASLSEbE2TSHJozv1IhIhvjp0bhy7WUAQatA4/zUxgrqXO9QuFkO5YbtAVd/yukMAbVgIiaHr/miQHlEfU01AU/FDKKM0dT117m0+fEhIBlGhuTfwwg6/rU+FLTDBUyV6HluYdtHMgMlHPi9X67gRIhlZfPJYnlfwDE7kU8AXJydqSIanomFG5KU4IGclBTZGsOIdzJ3F6KB1hG44wxeoCi6yFha08G+I5wb0I7xOkiVb4GkW2KGEYMAjBJTbMJcUcm1pQQQsRL8jHJRMze5Etj5MPjKhwdAGU7wYis77wynBB5fa2QX0rECHN8IhPXhBvun4CW7F6NcdV/MM3IecpM
  2. On the system with the TPM and matching endorsement key, the file ./examples/tpm2-ekseal/tpm2-unseal.sh may be used with its -0 flag to unseal the data:

    echo 'AE4ACAALAAAEAAAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAgjD2tBVBgi06poK/qVwaY8tEKr/NRmEFkNlW3P2Bgy3M=@@NULL@@AFoAIOR+5y1YYp28HDEIaBM/NqsiZ5oY55Qw/5LqQg/L/9ZHd81bf0xE1rkhcOo4PwknfpNevbU9vwY+w2l/xwSq5qjhDVzL5rfCUaYD/kDr7T/FONLm+dSz1jo=@@NULL@@AQASLSEbE2TSHJozv1IhIhvjp0bhy7WUAQatA4/zUxgrqXO9QuFkO5YbtAVd/yukMAbVgIiaHr/miQHlEfU01AU/FDKKM0dT117m0+fEhIBlGhuTfwwg6/rU+FLTDBUyV6HluYdtHMgMlHPi9X67gRIhlZfPJYnlfwDE7kU8AXJydqSIanomFG5KU4IGclBTZGsOIdzJ3F6KB1hG44wxeoCi6yFha08G+I5wb0I7xOkiVb4GkW2KGEYMAjBJTbMJcUcm1pQQQsRL8jHJRMze5Etj5MPjKhwdAGU7wYis77wynBB5fa2QX0rECHN8IhPXhBvun4CW7F6NcdV/MM3IecpM' | \
    tpm2-ekunseal.sh -0 2>/dev/null

    The above command will emit the original, sealed text:

    Hello, world.

The above, end-to-end example used RSA, but ECC is possible as well:

  1. On a system without the TPM, seal the data while specifying the ECC public certificate:

    echo "Hello, world." | go run ./examples/tpm2-ekseal/main.go -ek-pem ./tpm2/testdata/ek-ecc-crt.pem -f 0 
  2. Echo the emitted data on the system with the TPM, this time using the -G ecc flag to specify the algorithm:

    echo 'AE4ACAALAAAEAAAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAg7gVvQhmvIP9CvGZgrK+X3Ivcm1+pyBu5IVwV+WU5zZo=@@NULL@@AFoAIIYRbmB7f32ATtXs0ITU7cKyW+ihpDw3YrO+KMNtno15l5L4B0HmOVkBbBkmq9FI+P0BNt1dUlmskEiLY2l3HTCrXCSrnc2cmpIY/1Qj5xab4GBknH4zwO8=@@NULL@@AEQAID4Mo1N3w133AnMkBdqxEedDDhDZIUC07RDMTjTwLFOMACA0Bx74PwXK5ve4IUhGDb1TXptQGlNUTKf0y3u/ULKMfA==' | \
    tpm2-ekunseal.sh -0 -G ecc 2>/dev/null

    The above command will emit the original, sealed text:

    Hello, world.

Special kudos/shout-out to my colleague @jessepool for helping with this. I would have been lost without him!

@akutz akutz requested review from alexmwu, jkl73 and a team as code owners September 4, 2023 20:18
@akutz akutz force-pushed the feature/enc-to-ek-sans-tpm branch 3 times, most recently from 973b36f to 1d12d24 Compare September 4, 2023 20:37
akutz added a commit to akutz/govmomi that referenced this pull request Sep 4, 2023
This patch introduces support for encrypting plain-text
information for VMs with TPM2 devices without the system
on which the command is run needing a TPM.

Please refer to google/go-tpm#343
for more information.
akutz added a commit to akutz/govmomi that referenced this pull request Sep 4, 2023
This patch introduces support for encrypting plain-text
information for VMs with TPM2 devices without the system
on which the command is run needing a TPM.

Please refer to google/go-tpm#343
for more information.
akutz added a commit to akutz/govmomi that referenced this pull request Sep 5, 2023
This patch introduces support for encrypting plain-text
information for VMs with TPM2 devices without the system
on which the command is run needing a TPM.

Please refer to google/go-tpm#343
for more information.
akutz added a commit to akutz/govmomi that referenced this pull request Sep 5, 2023
This patch introduces support for encrypting plain-text
information for VMs with TPM2 devices without the system
on which the command is run needing a TPM.

Please refer to google/go-tpm#343
for more information.
@akutz akutz force-pushed the feature/enc-to-ek-sans-tpm branch from 1d12d24 to 154640f Compare September 5, 2023 16:48
akutz added a commit to akutz/govmomi that referenced this pull request Sep 5, 2023
This patch introduces support for encrypting plain-text
information for VMs with TPM2 devices without the system
on which the command is run needing a TPM.

Please refer to google/go-tpm#343
for more information.
This patch introduces support for sealing information to an
endorsement key without needing to be on a system with a TPM. This
feature enables support for clients that want to encrypt small
amounts of data in order to bootstrap a virtual machine that may
only have an endorsement key prior to first boot.
@akutz akutz force-pushed the feature/enc-to-ek-sans-tpm branch from 154640f to 05ab0eb Compare September 14, 2023 15:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant