Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update the EKC gathering script to handle extra data in NVRAM index #6

Closed
iadgovuser29 opened this issue Oct 9, 2018 · 0 comments
Closed
Assignees
Labels
enhancement New feature or request

Comments

@iadgovuser29
Copy link
Collaborator

Problem:

get_ek.sh gathers the EK certificate with the assumption that the NVRAM index contains only the certificate. We recently encountered a case where the index contained pad bytes after the certificate. Querying the size of the NVRAM index area showed the EC was 1600 bytes. The EC itself was only 1169 bytes. An attempt to give the 1600 byte file as the EC to the paccor signer resulted in Bouncycastle returning an IOException due to the extra data in the stream.

The fix:

get_ek.sh can detect the ASN1 length sequence in the data returned from NVRAM. The script can then truncate anything after the specific number of bytes from the data.

@iadgovuser29 iadgovuser29 added the enhancement New feature or request label Oct 9, 2018
@iadgovuser29 iadgovuser29 changed the title Update the EKC gathering script to handle extra data Update the EKC gathering script to handle extra data in NVRAM index Oct 9, 2018
@iadgovuser29 iadgovuser29 self-assigned this Oct 9, 2018
iadgovuser29 added a commit that referenced this issue Oct 9, 2018
iadgovuser29 added a commit that referenced this issue Oct 9, 2018
[#6] get_ek.sh removes extra bytes before and after first ASN1 sequence
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

1 participant