Jump to: navigation, search

Difference between revisions of "StarlingX/Distro/tpm-verify"

(Created page with "= TPM test guide = === Team Information === * Project Lead: '''zhaos''' <zhaos@neusoft.com> * Technical Lead: * Contributors: '''chen.dq''' <chen.dq@neusoft.com>; '''fuyong'...")
 
(Team Information)
Line 4: Line 4:
 
* Project Lead: '''zhaos''' <zhaos@neusoft.com>
 
* Project Lead: '''zhaos''' <zhaos@neusoft.com>
 
* Technical Lead:  
 
* Technical Lead:  
* Contributors: '''chen.dq''' <chen.dq@neusoft.com>; '''fuyong''' <fuyong@intel.com>
+
* Contributors: '''chen.dq''' <chen.dq@neusoft.com>; '''fuyong''' <fuyong@neusoft.com>
  
 
=== Team Objective / Priorities ===
 
=== Team Objective / Priorities ===

Revision as of 07:14, 20 March 2020

TPM test guide

Team Information

  • Project Lead: zhaos <zhaos@neusoft.com>
  • Technical Lead:
  • Contributors: chen.dq <chen.dq@neusoft.com>; fuyong <fuyong@neusoft.com>

Team Objective / Priorities

Introduce how to use tpm2-tools in starlingx

Hardware Requirement

TPM hardware device support

Preparation Environment

  • BIOS turn on tpm
    • security -> TPM2 enabled
  • Check hardware support for TPM
  $ dmesg | grep tpm
  • Check software support for TPM
  $ cat /proc/devices | grep tpm
  • Service startup
  $ systemctl status tpm2-abrmd.service

Encrypt / Decrypt

  • Set TPM related password
    • To take ownership with "ownerpass" as owner password, "endorsepass" as endorsement password, "lockpass" as lockout password:
   $ tpm2_takeownership -o ownerpass -e endorsepass -l lockpass
  • Create a Primary Object
    • Create a Primary Object in endorsement hierarchy, with objectpass as the object password, with RSA keys & SHA256 name hash algorithm, with object context saved in file po.ctx.
   $ tpm2_createprimary -H e -K objectpass -g 0x000b -G 0x0001 -C po.ctx -P endorsepass
  • Create a RSA key under the previous primary key
    • Create a RSA key under the previous primary key, with subobjectpass as the object password, with SHA256 name hash algorithm, with public portion saved in key.pub and private

portion saved in key.priv.

   $ tpm2_create -c po.ctx -P objectpass -K subobjectpass -g 0x000b -G 0x0001 -u key.pub -r key.priv
  • Load the created RSA key
 $ tpm2_load -c po.ctx -P objectpass -u key.pub -r key.priv -n key.name -C obj.ctx
  • Encrypt with RSA key
 $ tpm2_rsaencrypt -c obj.ctx -o data.encrypt data.in
  • Decrypt with RSA key
 $ tpm2_rsadecrypt -c obj.ctx -P subobjectpass -I data.encrypted -o data.out

Signature / Verify Signature

  • Sign on data with RSA key
    • Sign on data with RSA key, using SHA256 as hash algorithm.
   $ tpm2_sign -c obj.ctx -P subobjectpass -g 0x000b -m msg.in -s sig.out
  • Verify signature with RSA key
 $ tpm2_verifysignature -c obj.ctx -g 0x000b -m msg.in -s sig.out -t tk.sig