google / google/go-attestation
How to Generate a Challenge
- Dominant language
- Go
- Stars
- 444
- Forks
- 109
- PR merge metrics
- No merged PRs in 30d
Description
I need to generate a Credentials Challenge on a remote server which will then be sent to a device. At which point the device will use the ActivateCredential command on a TPM to then respond to the challenge issued by the server. But, I am having issues surrounding how to generate that challenge from a remote server.
`NOTE`: My client with the TPM will not be running any go/go-attestation code
On my device I can generate a challenge with this command
```
dd if=/dev/urandom of=secret.data bs=32 count=1
tpm2_makecredential --tcti=none --key-algorithm=rsa --encryption-key=artifacts/ek.pub.pem --secret=secret.data --name=$(cat artifacts/ak.name | hexdump -v -e '/1 "%02x"') --credential-blob=secret.blob
```
The server at the time of challenge creation has access to the device TPM endorsement certificate and the attestation key name. Looking at the example in the readme I'm trying to generate an `AttestationParameters` which is needed by the `ActivationParameters`, but I'm not sure how one would create an `AttestationParameters` from just the attestation key name.
Contributor guide
Research direction
Begin with the README example and the AttestationParameters and ActivationParameters APIs; compare their inputs with the device command and the available endorsement certificate and attestation key name. Done should be a documented, supported path for generating the remote credential challenge, or a clarified explanation of what additional input is required.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- security
- Issue type
- Documentation
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100