Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Using preset pcr_digest and pcr_ids with clevis-encrypt-tpm2 #450

Open
willakat opened this issue Feb 7, 2024 · 0 comments
Open

Using preset pcr_digest and pcr_ids with clevis-encrypt-tpm2 #450

willakat opened this issue Feb 7, 2024 · 0 comments

Comments

@willakat
Copy link

willakat commented Feb 7, 2024

When sealing a key to PCR values, it should be possible to combine measured pcr values with preset.

For instance one could use something like '"tpm2": {"pcr_bank":"sha256", "pcr_ids": "0,1,7,11", "pcr_digest": {"11": "'${pcr11}'"}}
in order to designate a value for pcr11 while using measured values for 0,1 and 7. As of writing, it seems that it isn't possible to
provide a dictionary for the pcr_digest value. Only a string value is processed (and an object value is silently ignored), this string needs to contain values for all the pcrs.

From a usability standpoint, it may be interesting to support a dictionary value for pcr_digest and use those values as
overrides on the output of tpm2_pcrread.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant