Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Sign up
Appearance settings

support for pure-rust make credentials #563

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
baloo wants to merge 2 commits into parallaxsecond:main
base: main
Choose a base branch
Loading
from baloo:baloo/make-credentials

Conversation

@baloo
Copy link
Contributor

@baloo baloo commented Jan 29, 2025
edited
Loading

This brings support for a pure rust implementation of make credentials which will not involve the TPM or tpm2-tss.

Fixes #160

ionut-arm reacted with hooray emoji
@baloo baloo force-pushed the baloo/make-credentials branch 2 times, most recently from 75b7750 to 3671522 Compare January 29, 2025 06:06
@baloo baloo changed the title (削除) WIP; support for pure-rust make credentials (削除ここまで) (追記) WIP: support for pure-rust make credentials (追記ここまで) Jan 29, 2025
@baloo baloo force-pushed the baloo/make-credentials branch from 3671522 to 75fa54b Compare January 29, 2025 06:11
Copy link
Collaborator

@wiktor-k wiktor-k left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks really cool. Of course error handling and other niceties are missing but that's not the point. Happy to see tests, I've skimmed them.

Thanks! 👍

@baloo baloo force-pushed the baloo/make-credentials branch 3 times, most recently from 55774ad to 573d67e Compare January 29, 2025 21:11
let cred = vec![1, 2, 3, 4, 5];
let expected = Digest::try_from(vec![1, 2, 3, 4, 5]).unwrap();

let (credential_blob, secret) = utils::make_credential_ecc::<_, sha2::Sha256, aes::Aes128>(
Copy link
Contributor Author

@baloo baloo Jan 29, 2025
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

sha2::Sha256, aes::Aes128 here codes for EKHash and EkCipher.
Those should be read from the template of the EK ideally.

Although in reality, the template would have been dropped already and we're only working with a PEM encoded public key, and there should be some kind of default value.
https://github.com/tpm2-software/tpm2-tools/blob/master/tools/tpm2_makecredential.c#L340

Anyone with an opinion?

Copy link
Member

@ionut-arm ionut-arm Feb 8, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is your question about this test in particular, or about the interface of make_credential_ecc, and whether we can deduce the type params from the inputs?

I think generally you should be able to deduce the hash and the cipher for the EK if you know the nature of the public key, for example by doing the reverse of the mapping done here: https://github.com/parallaxsecond/rust-tss-esapi/blob/main/tss-esapi/src/abstraction/ek.rs

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No that was an API question.

I know how to get the parameters from a Public, but I don't expect the public or its template to always available.

@baloo baloo force-pushed the baloo/make-credentials branch 7 times, most recently from 9b21b16 to 89021e0 Compare January 30, 2025 06:12
@baloo baloo force-pushed the baloo/make-credentials branch 2 times, most recently from 451ae4f to c652a60 Compare January 30, 2025 23:47
@baloo baloo changed the title (削除) WIP: support for pure-rust make credentials (削除ここまで) (追記) support for pure-rust make credentials (追記ここまで) Jan 30, 2025
Copy link
Contributor Author

baloo commented Jan 30, 2025

I've finished support for both RSA and ECC, and there is now error management.
There isn't much else I can do.

ionut-arm reacted with thumbs up emoji

@baloo baloo force-pushed the baloo/make-credentials branch 6 times, most recently from 7b03a64 to 969e006 Compare February 4, 2025 17:23
Copy link
Member

@ionut-arm ionut-arm left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Only had a brief look, will come back for more :)

let cred = vec![1, 2, 3, 4, 5];
let expected = Digest::try_from(vec![1, 2, 3, 4, 5]).unwrap();

let (credential_blob, secret) = utils::make_credential_ecc::<_, sha2::Sha256, aes::Aes128>(
Copy link
Member

@ionut-arm ionut-arm Feb 8, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is your question about this test in particular, or about the interface of make_credential_ecc, and whether we can deduce the type params from the inputs?

I think generally you should be able to deduce the hash and the cipher for the EK if you know the nature of the public key, for example by doing the reverse of the mapping done here: https://github.com/parallaxsecond/rust-tss-esapi/blob/main/tss-esapi/src/abstraction/ek.rs

@baloo baloo force-pushed the baloo/make-credentials branch 2 times, most recently from a23ad53 to 0fee1eb Compare September 5, 2025 20:08
@baloo baloo force-pushed the baloo/make-credentials branch 2 times, most recently from 22eeb4c to 2a13fe1 Compare September 19, 2025 05:37
Copy link
Contributor Author

baloo commented Sep 19, 2025
edited
Loading

There is something that locks up the TPM in the CI, but I don't know what it is.

EDIT: a regression in the weak key detection or something
EDIT2: no I'm just an idiot and somehow had the test backwards.

su-sd reacted with thumbs up emoji wiktor-k and ionut-arm reacted with laugh emoji

@baloo baloo force-pushed the baloo/make-credentials branch 3 times, most recently from 4677cb5 to b37d4ab Compare September 20, 2025 05:40
@baloo baloo force-pushed the baloo/make-credentials branch 4 times, most recently from b75948f to 86e3bc6 Compare September 30, 2025 19:12
@baloo baloo force-pushed the baloo/make-credentials branch from 86e3bc6 to d9daeb7 Compare October 10, 2025 17:05
Signed-off-by: Arthur Gautier <arthur.gautier@arista.com>
@baloo baloo force-pushed the baloo/make-credentials branch 2 times, most recently from c6ed022 to c7d2de4 Compare October 10, 2025 19:57
Copy link

su-sd commented Oct 10, 2025

This is getting into great shape 🔥
Thanks to anyone involved!

@baloo baloo force-pushed the baloo/make-credentials branch 3 times, most recently from b40b767 to 53fa082 Compare October 14, 2025 15:55
Copy link
Contributor Author

baloo commented Oct 14, 2025
edited
Loading

I've split the secret sharing, from the credentials which I intend to reuse for duplicate (#585)

@baloo baloo force-pushed the baloo/make-credentials branch 4 times, most recently from 96f9ade to 98e18d9 Compare October 15, 2025 04:12
@baloo baloo mentioned this pull request Oct 15, 2025
1 task
Signed-off-by: Arthur Gautier <arthur.gautier@arista.com>
@baloo baloo force-pushed the baloo/make-credentials branch from 98e18d9 to 711a354 Compare October 15, 2025 04:18
Copy link

gibix commented Oct 23, 2025

I tested the pull request and is just great to have this feature coming! I noticed a bad error message that need to be documented. If the challenge payload is to big the error message is Invalid bytes(&[u8]) size(> 132), but the real allowed size of the payload is 96 bytes.

If you want to created a challenge from a bigger payload is considered safe to split in 96-bytes-long chunks and make separate attestation?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Firstyear Firstyear Firstyear requested changes

@wiktor-k wiktor-k wiktor-k left review comments

@ionut-arm ionut-arm ionut-arm left review comments

Requested changes must be addressed to merge this pull request.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Calling MakeCredential without a TPM

AltStyle によって変換されたページ (->オリジナル) /