Add TPMKMS implementation #253
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
A new instance of a random generator backed by a TPM can be created by calling `rand.New()`. It can be used instead of `rand.Reader`. Opening and closing the connection to the TPM is performed transparently.
maraino
requested changes
Jun 7, 2023
When CreateAttestation is used with the TPMKMS, the existing CertificationParameters are required to be returned, so that they can be used within an application. The certification facts are recorded at the time of key attestation.
maraino
reviewed
Jun 7, 2023
maraino
previously approved these changes
Jun 7, 2023
I thought I already added coverage reporting through combining the results from multiple tests runs, but maybe this typo resulted in it not working as expected: c2407d1. And now also include |
maraino
previously approved these changes
Jun 7, 2023
maraino
approved these changes
Jun 7, 2023
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR adds a KMS implementation backed by a TPM. It uses our
tpmpackage and its storage methods for its core operations. It uses URIs similar to the format used by PKCS11 to address / configure (attestation) keys.The
TPMKMSimplementation supports attestation through configuration of the attestation CA to use when instantiating the KMS instance. This configuration is provided through an URI too. A default client implementation is provided that interacts with the Smallstep Attestation CA. A custom implementation can be provided through theAttestationClientinterface.As a bonus, this PR includes an
io.Readerimplementation backed by thetpmpackage to make a TPM generate random data.