decodeCertify not returning signature

[salrashid123]

The signature portion from the decoeCertify seems to just return the whole response/

I can' confirm the exact root cause but can state that the verification of the cetified signature using the AK signer worked with github.com/google/go-tpm v0.3.1 (sample repro here)

not with latest@ github.com/google/go-tpm v0.3.3-0.20210409082102-d3310770bfec (sample repro here)

the change was made here:
ecde583#diff-92947631269f2d84f2baa92d703b215f7843a553a375c945715f669e2e831d7fL1747

---

the diff between working

https://github.com/google/go-tpm/blob/master/tpm2/tpm2.go#L1756

func decodeCertify(resp []byte) ([]byte, []byte, error) {
	var paramSize uint32
	var attest, signature tpmutil.U16Bytes
	var sigAlg, hashAlg Algorithm

	buf := bytes.NewBuffer(resp)
	if err := tpmutil.UnpackBuf(buf, &paramSize); err != nil {
		return nil, nil, err
	}
	buf.Truncate(int(paramSize))
	if err := tpmutil.UnpackBuf(buf, &attest, &sigAlg); err != nil {
		return nil, nil, err
	}
	// If sigAlg is AlgNull, there will be no hashAlg or signature.
	// This will happen if AlgNull was passed in the Certify() as
	// the signing key (no need to sign the response).
	// See TPM2 spec part4 pg227 SignAttestInfo()
	if sigAlg != AlgNull {
		if sigAlg == AlgECDSA {
			var r, s tpmutil.U16Bytes
			if err := tpmutil.UnpackBuf(buf, &hashAlg, &r, &s); err != nil {
				return nil, nil, err
			}
			signature = append(r, s...)
		} else {
			if err := tpmutil.UnpackBuf(buf, &hashAlg, &signature); err != nil {
				return nil, nil, err
			}
		}
	}
	return attest, signature, nil
}

and not working

https://github.com/google/go-tpm/blob/v0.3.1/tpm2/tpm2.go#L1600

func decodeCertify(resp []byte) ([]byte, []byte, error) {
	var paramSize uint32
	var attest tpmutil.U16Bytes

	buf := bytes.NewBuffer(resp)
	if err := tpmutil.UnpackBuf(buf, &paramSize); err != nil {
		return nil, nil, err
	}
	buf.Truncate(int(paramSize))
	if err := tpmutil.UnpackBuf(buf, &attest); err != nil {
		return nil, nil, err
	}
	return attest, buf.Bytes(), nil
}