search for: tpm2

...existing ssh key to engine form, the ssh private key usually has to be converted first to a form openssl can understand, like PKCS8 and then passed into the engine conversion command. So to convert a private key stored in file rsa to TPM engine format, you do ssh-keygen -p -m PKCS8 -f rsa create_tpm2_key -w rsa rsa.tpm Then to use the TPM key simply mv rsa.tpm rsa and openssh will be able to use this key using the -o option to specify the engine: ssh -o tpm2 -i rsa user at host Note that engines usually have specific limits on the type of keys they accept (so TPM 2.0 usually only does 2048 b...

...se two source > > files: > > > > - https://chromium.googlesource.com/chromiumos/platform/crosvm/+/18ce5713e6cb99c40aafec52b67c28ba12a44f31/devices/src/virtio/tpm.rs > > - https://chromium.googlesource.com/chromiumos/platform/crosvm/+/18ce5713e6cb99c40aafec52b67c28ba12a44f31/tpm2/src/lib.rs > > These files/links do not make sense for kernel testing. Please remove > them from the next version. To clarify generally for a virtio device we want - guest support - device support - spec If the device is implemented in qemu and guest in linux kernel, then there are lots...

>> Let me rephrase my question: what does using OpenSSL engines enable >> that we can't already do via PKCS#11? > > It allows you to use the TPM2 as a secure key store, because there's no > current PKCS11 code for it. > > The essential difference is that Engine files are just that: flat files > where the key is stored in a form only decodeable by the engine. > PKCS11 tokens are...

...4:34 +0000, Blumenthal, Uri - 0553 - MITLL wrote: > >> Let me rephrase my question: what does using OpenSSL > engines enable > >> that we can't already do via PKCS#11? > > > > It allows you to use the TPM2 as a secure key store, > because there's no > > current PKCS11 code for it. > > > > The essential difference is that Engine files are just > that: flat files > > where the key is stored in a form only deco...

On Thu, 2 Nov 2017, James Bottomley wrote: > On Fri, 2017-11-03 at 13:11 +1100, Damien Miller wrote: > > On Thu, 26 Oct 2017, James Bottomley wrote: > > > > > > > > Engine keys are keys whose file format is understood by a specific > > > engine rather than by openssl itself.??Since these keys are file > > > based, the pkcs11 interface isn't

...> > > > > > > > - https://chromium.googlesource.com/chromiumos/platform/crosvm/+/18ce5713e6cb99c40aafec52b67c28ba12a44f31/devices/src/virtio/tpm.rs > > > > - https://chromium.googlesource.com/chromiumos/platform/crosvm/+/18ce5713e6cb99c40aafec52b67c28ba12a44f31/tpm2/src/lib.rs > > > > > > These files/links do not make sense for kernel testing. Please remove > > > them from the next version. > > > > To clarify generally for a virtio device we want > > - guest support > > - device support > > - spec >...

...> > > > > > > - https://chromium.googlesource.com/chromiumos/platform/crosvm/+/18ce5713e6cb99c40aafec52b67c28ba12a44f31/devices/src/virtio/tpm.rs > > > > > - https://chromium.googlesource.com/chromiumos/platform/crosvm/+/18ce5713e6cb99c40aafec52b67c28ba12a44f31/tpm2/src/lib.rs > > > > > > > > These files/links do not make sense for kernel testing. Please remove > > > > them from the next version. > > > > > > To clarify generally for a virtio device we want > > > - guest support > > > - d...

...can be found in these two source > files: > > - https://chromium.googlesource.com/chromiumos/platform/crosvm/+/18ce5713e6cb99c40aafec52b67c28ba12a44f31/devices/src/virtio/tpm.rs > - https://chromium.googlesource.com/chromiumos/platform/crosvm/+/18ce5713e6cb99c40aafec52b67c28ba12a44f31/tpm2/src/lib.rs > > and is currently backed by the libtpm2 TPM simulator: > > - https://chromium.googlesource.com/chromiumos/third_party/tpm2/ > > Reviewed-on: https://chromium-review.googlesource.com/1387655 > Reviewed-by: Andrey Pronin <apronin at chromium.org> > Teste...

...rface because it assumes the private keys are already present in some token (so there's no way to pass in a file name). The candidate I have for this is openssh private keys based in the trusted platform module (either tpm 1.2 or tpm 2.0 ... we have engines for both). This is an example of my tpm2 based private/public ssh-key: jejb at jarvis:~> ssh-add -o tpm2 /home/jejb/.ssh/id_rsa Enter engine key passphrase: jejb at jarvis:~> ssh-add -l 2048 SHA256:ZAv7jrI2bB2VBgk5jHA1g/fe4rVX1GqyCdPwF0ELU9k jejb at mulgrave (RSA) jejb at jarvis:~> cat .ssh/id_rsa -----BEGIN TSS2 KEY BLOB----- M...

...gt; >> files: > >> > >> - https://chromium.googlesource.com/chromiumos/platform/crosvm/+/18ce5713e6cb99c40aafec52b67c28ba12a44f31/devices/src/virtio/tpm.rs > >> - https://chromium.googlesource.com/chromiumos/platform/crosvm/+/18ce5713e6cb99c40aafec52b67c28ba12a44f31/tpm2/src/lib.rs > >> > >> and is currently backed by the libtpm2 TPM simulator: > >> > >> - https://chromium.googlesource.com/chromiumos/third_party/tpm2/ > >> > >> Reviewed-on: https://chromium-review.googlesource.com/1387655 > >> Reviewed-...

...t; { > int i; > u64 mask = 0; > diff --git a/drivers/char/tpm/tpm_crb.c b/drivers/char/tpm/tpm_crb.c > index b917b9d5f710..f789f7e5a17d 100644 > --- a/drivers/char/tpm/tpm_crb.c > +++ b/drivers/char/tpm/tpm_crb.c > @@ -27,10 +27,9 @@ > > #define ACPI_SIG_TPM2 "TPM2" > > -static const u8 CRB_ACPI_START_UUID[] = { > - /* 0000 */ 0xAB, 0x6C, 0xBF, 0x6B, 0x63, 0x54, 0x14, 0x47, > - /* 0008 */ 0xB7, 0xCD, 0xF0, 0x20, 0x3C, 0x03, 0x68, 0xD4 > -}; > +static const uuid_le crb_acpi_start_uuid = > + UUID_LE(0x6BBF6...

...i_handle handle, const uuid_le *uuid, u64 rev, u64 funcs) { int i; u64 mask = 0; diff --git a/drivers/char/tpm/tpm_crb.c b/drivers/char/tpm/tpm_crb.c index b917b9d5f710..f789f7e5a17d 100644 --- a/drivers/char/tpm/tpm_crb.c +++ b/drivers/char/tpm/tpm_crb.c @@ -27,10 +27,9 @@ #define ACPI_SIG_TPM2 "TPM2" -static const u8 CRB_ACPI_START_UUID[] = { - /* 0000 */ 0xAB, 0x6C, 0xBF, 0x6B, 0x63, 0x54, 0x14, 0x47, - /* 0008 */ 0xB7, 0xCD, 0xF0, 0x20, 0x3C, 0x03, 0x68, 0xD4 -}; +static const uuid_le crb_acpi_start_uuid = + UUID_LE(0x6BBF6CAB, 0x5463, 0x4714, + 0xB7, 0xCD, 0xF0, 0x20, 0x3...

...0] ACPI: DBG2 0x000000007A8C8DE8 000054 (v00 INTEL 00000002 MSFT 0000005F) [ 0.000000] ACPI: BGRT 0x000000007A8C8E40 000038 (v01 MSI_NB MEGABOOK 01072009 AMI 00010013) [ 0.000000] ACPI: SSDT 0x000000007A8C8E78 0000AE (v02 SgRef SgPeg 00001000 INTL 20160422) [ 0.000000] ACPI: TPM2 0x000000007A8C8F28 000034 (v03 Tpm2Tabl 00000001 AMI 00000000) [ 0.000000] ACPI: SSDT 0x000000007A8C8F60 001EA5 (v01 OptRef OptTabl 00001000 INTL 20160422) [ 0.000000] ACPI: ASF! 0x000000007A8CAE08 0000A0 (v32 INTEL HCG 00000001 TFSM 000F4240) [ 0.000000] ACPI: Local APIC ad...