vtpm deep quote in locality 0
Status from this message: Applied, thanks.
Get series with b4
b4 am [email protected]Versions newest first · linked by author and title
- v3 Latest2 patches 2 repliesApplied
- v22 patches 6 repliesSuperseded
- v12 patches 3 repliesSuperseded
Changes in v3 from the cover letter
- removed useless whitespace
- fixed compiling issues for tpm emulator
Changes from v1, suggested by Daniel:
- flags parameter is now mandatory
- updated documentation about externData calculation
- constant size for externData structure, perform SHA1 on empty string
if requested parameter is NULL
- return error if invalid bit is set in flags
- added VTPM_QUOTE_FLAGS_GROUP_PUBKEY flag
Patches in v3 Applied
| # | Subject and files | Size | Replies | Applied |
|---|---|---|---|---|
| 1/2 | vtpm: deep quote flagsstubdom/ stubdom/ stubdom/ | +135 | 0 replies | |
| 2/2 | vtpmmgr: execute deep quote in locality 0stubdom/ stubdom/ stubdom/ +2 more | +115 | 0 replies |
Reviews trailers per patch
All 2 patches have a Reviewed-by or Acked-by.
| Patch | Daniel De Graaf |
|---|---|
| 1/2 | A-b |
| 2/2 | A-b |
Trailers given in replies are filled; those carried in the patches from earlier versions are outlined with dashes.
Cover letter [PATCH v3 0/2] vtpm deep quote in locality 0
Changes from v2:
- removed useless whitespace
- fixed compiling issues for tpm emulator
Changes from v1, suggested by Daniel:
- flags parameter is now mandatory
- updated documentation about externData calculation
- constant size for externData structure, perform SHA1 on empty string
if requested parameter is NULL
- return error if invalid bit is set in flags
- added VTPM_QUOTE_FLAGS_GROUP_PUBKEY flag
Right now, deep quote functionality is enabled just when vtpm manager is started with locality=2. This requirement is enforced by the current implementation which uses PCRs that can be reset in locality 2: 20,21,22,23.
Since some TPM chips do not enable access to other locality than 0 this patch enables the deep quote functionality for vtpm manager started with locality=0.
The patches are based on a suggestion given by Daniel De Graaf in another thread on the list:
- Add a field to the request - extraInfoFlags
- Compute externData = SHA1 (
extraInfoFlags
requestData
[SHA1 (
[SHA1 (UUIDs if requested)]
[SHA1 (vTPM measurements if requested)]
[SHA1 (vTPM group update policy if requested)]
[SHA1 (vTPM group public key if requested)]
) if flags !=0 ]
)
- Perform deep quotes using the above externData value instead of the value
provided by the vTPM.
Embedding additional data in externData is equivalently secure as extending it into PCRs.
This change also has the benefit of increasing the flexibility of the request. It is simple to define additional flags and add data to the hash if needed.
Emil Condrea (2):
vtpm: deep quote flags
vtpmmgr: execute deep quote in locality 0
stubdom/Makefile | 1 + stubdom/vtpm-deepquote-anyloc.patch | 127 ++++++++++++++++++++++++++++++++++++ stubdom/vtpm/vtpm_cmd.c | 13 ++-- stubdom/vtpmmgr/marshal.h | 1 + stubdom/vtpmmgr/mgmt_authority.c | 91 +++++++++++++++++++++++--- stubdom/vtpmmgr/mgmt_authority.h | 2 +- stubdom/vtpmmgr/vtpm_cmd_handler.c | 7 +- stubdom/vtpmmgr/vtpm_manager.h | 27 +++++++- 8 files changed, 250 insertions(+), 19 deletions(-) create mode 100644 stubdom/vtpm-deepquote-anyloc.patch
Signature · 1 line
2.1.0