[tpm2] Re: Stablishing trust on to TPM simulator

[tpm2] Re: Stablishing trust on to TPM simulator

[Imran Desai]

[-- Attachment #1: Type: text/plain, Size: 39 bytes --]

Have you looked at https://keylime.dev?

[tpm2] Re: Stablishing trust on to TPM simulator

[william.c.roberts]

[-- Attachment #1: Type: text/plain, Size: 1171 bytes --]

> 
> Missing step:
> 1. (Attestator VM) check if vendor root certificates validate the EK certificate
> -------- 

So as Imran points out keylime.dev has a system that does all of this. To verify a certificate on the server, it would be some form of
openssl verify command. I don't recall if tpm2_createek will output stable keys between ibmtpm server invocations where the NVChip
file is removed, so be wary of that. NVChip is where the ibmtpm simulator stores its persistent data, like the endorsement hiearchy
seed. If that seed is randomized, removing that will get you a new key. The NVChip file is always in the CWD of the ibmtpm process.
For an actual TPM, it depends, TL;DR is that recent versions of tpm2_getekcertificate will fetch it for you (offhand I cannot recall the
version, but its at least 4.0 for ecc keys).  Certificates are stored in NV Indexes defined by the TCG, and some Intel platforms have it
available via a web URL. The simulator does none of these steps, so you would have to mock it by creating your own EK Cert and storing
it to the tpm NV index. You can then use openssl verify command to make sure that its a good certificate.

[tpm2] Re: Stablishing trust on to TPM simulator

[@ 2020-05-23 19:49 UTC (permalink / raw)]

[-- Attachment #1: Type: text/plain, Size: 730 bytes --]

Hi Desai and Roberts.

Thank you for yours responses.

Yes, Desai, I already knew the Keylime project. And, indeed, I got the feeling that they were doing what I wanted. But in a first moment, I want to do the demo by myself, so I can better understand the concepts and steps involved to create the chain of trust. Perhaps I'll consider using Keylime when I'll be comfortable with the whole process.

Roberts, the path you pointed was really correct. Thank you.

I created an issue on the swtpm project and Stefan extended a wiki about certificate creation.
For those interested, it is here:  https://github.com/stefanberger/swtpm/wiki/Certificiates-created-by-swtpm_setup#verifying-your-ek-cert-against-the-ca

Regards