google / google/go-attestation

How to Generate a Challenge

Open
#436 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
444
Forks
109
PR merge metrics
No merged PRs in 30d

Description

I need to generate a Credentials Challenge on a remote server which will then be sent to a device. At which point the device will use the ActivateCredential command on a TPM to then respond to the challenge issued by the server. But, I am having issues surrounding how to generate that challenge from a remote server.

`NOTE`: My client with the TPM will not be running any go/go-attestation code

On my device I can generate a challenge with this command
```
dd if=/dev/urandom of=secret.data bs=32 count=1
tpm2_makecredential --tcti=none --key-algorithm=rsa --encryption-key=artifacts/ek.pub.pem --secret=secret.data --name=$(cat artifacts/ak.name | hexdump -v -e '/1 "%02x"') --credential-blob=secret.blob
```
The server at the time of challenge creation has access to the device TPM endorsement certificate and the attestation key name. Looking at the example in the readme I'm trying to generate an `AttestationParameters` which is needed by the `ActivationParameters`, but I'm not sure how one would create an `AttestationParameters` from just the attestation key name.

Contributor guide

Open the contributing guide

Research direction

Begin with the README example and the AttestationParameters and ActivationParameters APIs; compare their inputs with the device command and the available endorsement certificate and attestation key name. Done should be a documented, supported path for generating the remote credential challenge, or a clarified explanation of what additional input is required.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
security
Issue type
Documentation
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.