Re: [PATCH 13/17] tpm: Add verification of kernel signing key provenance

[James Bottomley <James.Bottomley@HansenPartnership.com>]

On Thu, 2026-10-08 at 06:20 -0700, Matthew Garrett wrote:
> Add tpm2_kernel_key_verify(), which checks the provenance produced by
> tpm2_kernel_key_create() and returns the public key it shows the
> kernel created. It checks that:
> 
> * The session audit attestation is signed by this TPM's kernel AK
> 
> * Replaying the logged cpHash and rpHash pairs from a zero digest
> reproduces the attested session digest
> 
> * Each logged rpHash matches the recorded response parameters, and
> the commands were PCR_Read, NV_Read, and CreateLoaded in that order
> 
> * PCR 5 was read, and held the value it holds now
> 
> * The read of the NV index returned the magic value
> 
> * The key created has exactly the attributes of a kernel signing key.
> 
> Since userspace cannot store the magic value in the kernel NV index,
> this shows that the key was created while the kernel was in control
> of the TPM.

This does strike me as very elaborate, especially the ephemeral key
bit; would you countenance a simplification?  Since all you want is
proof that the hibernate image hash matches the one the creating kernel
made, you could simply create your kernel only NV index as a PCR and
measure the hash directly to that.  Since user space is barred from
writing, all you need is an audit of the measurement going into the NV
register (indeed, it could be an ordinary NV index you simply write the
hash value to), coupled with a read of PCR 5.  Then your audit log
directly verifies the hibernate image hash and you don't have to bother
with the ephemeral keys.

Regards,

James