1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
|
package keyfile
import (
"fmt"
"github.com/google/go-tpm/tpm2"
"github.com/google/go-tpm/tpm2/transport"
)
func NewSealedData(tpm transport.TPMCloser, data []byte, ownerauth []byte, fn ...TPMKeyOption) (*TPMKey, error) {
sess := NewTPMSession(tpm)
key := NewTPMKey(OIDSealedKey, tpm2.TPM2BPublic{}, tpm2.TPM2BPrivate{}, fn...)
parenthandle, err := GetParentHandle(sess, key.Parent, ownerauth)
if err != nil {
return nil, err
}
sealBlobCmd := tpm2.Create{
ParentHandle: parenthandle,
InSensitive: tpm2.TPM2BSensitiveCreate{
Sensitive: &tpm2.TPMSSensitiveCreate{
UserAuth: tpm2.TPM2BAuth{
Buffer: []byte(nil),
},
Data: tpm2.NewTPMUSensitiveCreate(&tpm2.TPM2BSensitiveData{
Buffer: data,
}),
},
},
InPublic: tpm2.New2B(tpm2.TPMTPublic{
Type: tpm2.TPMAlgKeyedHash,
NameAlg: tpm2.TPMAlgSHA256,
ObjectAttributes: tpm2.TPMAObject{
FixedTPM: true,
FixedParent: true,
UserWithAuth: true,
NoDA: true,
},
}),
}
rsp, err := sealBlobCmd.Execute(sess.GetTPM(), sess.GetHMACIn())
if err != nil {
return nil, err
}
key.AddOptions(
WithPubkey(rsp.OutPublic),
WithPrivkey(rsp.OutPrivate),
)
return key, nil
}
func UnsealData(tpm transport.TPMCloser, key *TPMKey, ownerauth []byte) ([]byte, error) {
sess := NewTPMSession(tpm)
handle, _, err := LoadKey(sess, key, ownerauth)
if err != nil {
return nil, err
}
rsp, err := tpm2.Unseal{
ItemHandle: handle,
}.Execute(sess.GetTPM(), sess.GetHMACOut())
if err != nil {
return nil, fmt.Errorf("failed tpm2_unseal: %v", err)
}
return rsp.OutData.Buffer, nil
}
// TODO: Do we define sealed key stuff on top of the data?
// func NewSealedKey(pk any) (*TPMKey, error) {
// return nil, nil
// }
// func UnsealKey() ([]byte, error) {
// return nil, nil
// }
|
