From: Petko Manolov <sti at nucleusys.com>
To: tpm2@lists.01.org
Subject: Re: [tpm2] facilitating BIOS update with seamless PCR policy change
Date: Sat, 05 Jan 2019 20:42:56 +0200 [thread overview]
Message-ID: <20190105184256.GA1974@carbon> (raw)
In-Reply-To: 476DC76E7D1DF2438D32BFADF679FC5649CD6CEA@ORSMSX101.amr.corp.intel.com
[-- Attachment #1: Type: text/plain, Size: 1934 bytes --]
On 19-01-04 21:50:13, Roberts, William C wrote:
> You can't change an existing objects policy AFAIK. So if you have objects
> sealed to PCR state and PCR state changes, you're out of luck. Imran, that
> statement is correct right?
This is not how i read "Non-Brittle PCRs (New in 2.0)" paragraph in "A Practical
Guide to TPM2" book, page 34.
> You need to use policyauthorize when you build a new policy for an object,
> which Pretty much means, any policy signed by X is ok. Thus when PCR state
> changes, you Just sign a new PCR policy.
I really hope it is "policy signed by X _and_ these new PCR values" else it
makes no sense to use PCR values as policy, isn't it?
> See this test for an example of usage:
> https://github.com/tpm2-software/tpm2-tools/blob/master/test/integration/tests/tcti/abrmd/policyauthorize.sh
Thanks for the reference. I guess i'll be back with more questions after i
digest the above example.
cheers,
Petko
> > -----Original Message-----
> > From: tpm2 [mailto:tpm2-bounces(a)lists.01.org] On Behalf Of Petko Manolov
> > Sent: Friday, January 4, 2019 10:21 AM
> > To: tpm2(a)lists.01.org
> > Subject: [tpm2] facilitating BIOS update with seamless PCR policy change
> >
> > Hello guys,
> >
> > I'm trying to devise a way to change the PCR policy used to seal certain key into
> > TPM2 in case of BIOS change. So far i've run into this article (along with the
> > references it suggests):
> >
> > https://github.com/tpm2-software/tpm2-tss/issues/487
> >
> > However, i did not find a definitive answer there. Could someone please
> > elaborate or point me in the right direction i can read more about how to
> > authorize the new PCR policy?
> >
> >
> > thanks a bunch,
> > Petko
> > _______________________________________________
> > tpm2 mailing list
> > tpm2(a)lists.01.org
> > https://lists.01.org/mailman/listinfo/tpm2
>
next reply other threads:[~2019-01-05 18:42 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-01-05 18:42 Petko Manolov [this message]
-- strict thread matches above, loose matches on Subject: below --
2019-02-21 13:12 [tpm2] facilitating BIOS update with seamless PCR policy change Petko Manolov
2019-02-20 13:05 Petko Manolov
2019-02-18 9:20 Petko Manolov
2019-02-18 8:48 Petko Manolov
2019-01-15 19:58 Roberts, William C
2019-01-06 2:47 Desai, Imran
2019-01-04 21:50 Roberts, William C
2019-01-04 18:20 Petko Manolov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190105184256.GA1974@carbon \
--to=tpm2@lists.01.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox