Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Preventing chained duplication using tpm2_policyduplicationselect #3391

Open
salrashid123 opened this issue May 9, 2024 · 2 comments · May be fixed by #3392
Open

Preventing chained duplication using tpm2_policyduplicationselect #3391

salrashid123 opened this issue May 9, 2024 · 2 comments · May be fixed by #3392

Comments

@salrashid123
Copy link
Contributor

The default end-to-end example in tpm2_duplicate describes a way to Transfer from A->B

however, you can also repeat that process to further propagate the key from a->b->c.

here's an example:

but what i really want is for the key to get used ONLY on B and prevent this chain and it seem tpm2_policyduplicationselect is whats needed somewhere.

the procedure i came up with seems to work but it'd be great if someone can confirm it ( if confirmed and there's interest in adding to to docs is warranted, i'll file the doc PR).

the thing i tried is replace tpm2_policycommandcode with tpm2_policyduplicationselect (i'm not sure if that is legit to do or not and the failed duplication could well be for some other reason and not the one i'm after..)

here's the procedure:
@AndreasFuchsTPM
Copy link
Member

That is exactly correct and it would be great to have this be added to documentation.
Maybe you can shrink it a bit (e.g. leaving out the counter example case for C) to still fit into the man page.
I'm looking forward to your PR.

@salrashid123 salrashid123 linked a pull request May 10, 2024 that will close this issue
Open
@salrashid123
Copy link
Contributor Author

a small side comment about having an example of policies on duplication:

you can use these restrictions to also clarify the controls around using TPMs for authentication to cloud provider from on-prem hardware or remote systems.

for example if you can control duplication of rsa or hmac keys, you enable some usecases for auth i looked at earler:

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Add policyduplicationselect example to duplicate docs salrashid123/tpm2-tools
2 participants
@AndreasFuchsTPM @salrashid123