Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

WIP: examples: adds an agent storing keys on TPMs #87

Draft
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

baloo
Copy link
Collaborator

@baloo baloo commented Aug 1, 2024

This relies on APIs I'd like to add into tss-esapi crate

TODO:

  • plug tokio graceful shutdown, it currently leaks objects in the TPM.

@baloo baloo force-pushed the baloo/tpm-backed-keys branch from e414ee0 to 08cb475 Compare August 1, 2024 07:07
@baloo baloo marked this pull request as draft August 1, 2024 07:07
examples/tpm-backed.rs Outdated Show resolved Hide resolved
examples/tpm-backed.rs Outdated Show resolved Hide resolved
examples/tpm-backed.rs Outdated Show resolved Hide resolved
@baloo baloo force-pushed the baloo/tpm-backed-keys branch from 08cb475 to c5b745d Compare August 3, 2024 23:05
@baloo baloo force-pushed the baloo/tpm-backed-keys branch 4 times, most recently from 0a907d4 to 4222ab9 Compare August 4, 2024 03:37
Signed-off-by: Arthur Gautier <arthur.gautier@arista.com>
@baloo baloo force-pushed the baloo/tpm-backed-keys branch from 4222ab9 to 50ee6d1 Compare August 4, 2024 15:28
@wiktor-k
Copy link
Owner

wiktor-k commented Aug 5, 2024

I like the idea and where this is going. I've been thinking about the same with a couple of different design decisions:

I'd use create_primary with NIST-P256 curve and a static set of parameters on start (e.g. static unique value). That'd guarantee that the TPM-backed key is always the same and the key generation via EC is fast enough not to notice anyway. That'd remove the need to store any state making the code a bit cleaner.

@baloo
Copy link
Collaborator Author

baloo commented Aug 5, 2024

I'd use create_primary with NIST-P256 curve and a static set of parameters on start (e.g. static unique value). That'd guarantee that the TPM-backed key is always the same and the key generation via EC is fast enough not to notice anyway. That'd remove the need to store any state making the code a bit cleaner.

Yeaaah, but then I need a completely different abstraction over in tss-esapi. (I want to demo the use of a signer).
(but I'd prefer to do that too, I could then completely remove the need for the state file)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants