Add support for creating IAK and IDevID keys and certificates #823
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
stefanberger
force-pushed
the
stefanberger/iak_idevid
branch
9 times, most recently
from
f0d4dab to
f685cdb
Compare
stefanberger
force-pushed
the
stefanberger/iak_idevid
branch
3 times, most recently
from
6337037 to
1493455
Compare
stefanberger
force-pushed
the
stefanberger/iak_idevid
branch
from
1493455 to
e360af6
Compare
stefanberger
force-pushed
the
stefanberger/iak_idevid
branch
from
e360af6 to
24d74c9
Compare
stefanberger
force-pushed
the
stefanberger/iak_idevid
branch
from
24d74c9 to
6640fb0
Compare
stefanberger
force-pushed
the
stefanberger/iak_idevid
branch
from
6640fb0 to
f85d43c
Compare
stefanberger
force-pushed
the
stefanberger/iak_idevid
branch
2 times, most recently
from
c873318 to
1877ea1
Compare
stefanberger
force-pushed
the
stefanberger/iak_idevid
branch
from
1877ea1 to
0836cf4
Compare
stefanberger
commented
Oct 18, 2024
| cmd = concat_arrays(cmd, | ||
| (const gchar *[]){ | ||
| "--type", "platform", | ||
| "--type", tmp_typ, |
stefanberger
force-pushed
the
stefanberger/iak_idevid
branch
from
0836cf4 to
e98579f
Compare
Add support for certificate types iak and idevid. Both require the new command line option --tpm-serial-num to be passed. Add support for creating the ASN.1 for the SAN for the new certificates. Advertise the support for the new certificate types using the capabilities JSON with entries "cmdarg-tpm-serial-num" and "supports-iak-idevid". Add documentation to the man page and extend test cases. Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Add support for the --tpm-serial-num command line option to pass it on to swtpm_cert. Make the vmid part of the serialNumber of the subject passed to swtpm_cert (following an email exchange with TCG IWG). Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Add documentation to the man page. Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Prepare the code to allow EC keys to be created with 2 different nonces. So far always 2 identical nonces were used in all templates. Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Extend swtpm_setup to create IAK and IDevID keys and certificates. Use the same CA for signing the IAK and IDevID certificates as used for the EK and platform certificates since all these certificates are issued at the same time anyway. Add documentation to the man page. Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Create the IAK hwSerialNum from the authority key identifier and serial number extracted from the EK certificate. Adjust a test script that now needs to use a valid certificate for the EK so that we can get the authority key identifier and serial from it to create the serial number for the IAK certificate. Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
stefanberger
force-pushed
the
stefanberger/iak_idevid
branch
from
e98579f to
5c4b2ba
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR extends the tools swtpm_cert, swtpm_localca, and swtpm_setup to create IAK and IDevID keys and certificates.
ToDo:
<TCG Manuf Code>:<EK Authority Key Id>:<Ek Cert Serial Number>