failed to validate the PCClient event log in VMware
- Dominant language
- C
- Stars
- 309
- Forks
- 118
- Avg merge
- 1d 16h
- Merged PRs (30d)
- 33
Description
I've created the following script for testing proposes and I'm running it on a VMware VM with a virtualized TPM with RHEL8 as the OS. I got the following error when running `server.VerifyAttestation`:
failed to validate the PCClient event log:
failed to replay event log: event log failed to verify: the following registers failed to replay: [0]
Is this expected to happen? I'm thinking about testing this on my real machine with the actual TPM but I afraid to break something.
The code is pretty much the same as the verify_test.go one but using VMwares virtualized TPM.
`package main
import (
"crypto"
"fmt"
"github.com/google/go-tpm-tools/client"
"github.com/google/go-tpm-tools/server"
"github.com/google/go-tpm/tpm2"
)
func main() {
tpm, err := tpm2.OpenTPM()
if err != nil {
fmt.Println("[ERROR] opening tpm failed: ", err)
return
}
AttestationKeyRSA, err := client.AttestationKeyRSA(tpm)
defer AttestationKeyRSA.Close()
if err != nil {
fmt.Println("[ERROR] RSA AK Creation failed: ", err)
return
}
fmt.Println("[INFO] AK Created: ", AttestationKeyRSA)
nonce, err := tpm2.GetRandom(tpm, 15)
if err != nil {
fmt.Println("[ERROR] nonce creation failed: ", err)
return
}
fmt.Println("[INFO] nonce Created: ", nonce)
attestation, err := AttestationKeyRSA.Attest(client.AttestOpts{Nonce: nonce})
if err != nil {
fmt.Println("[ERROR] Attestation failed: ", err)
return
}
MachineState, err := server.VerifyAttestation(attestation, server.VerifyOpts{
Nonce: nonce,
TrustedAKs: []crypto.PublicKey{AttestationKeyRSA.PublicKey()},
})
if err != nil {
// handle error
fmt.Println("[ERROR] VerifyAttestation failed: ", err)
return
}
fmt.Println("INFO: Grub State", MachineState)
}`
Contributor guide
Research direction
Start by comparing the reported script with verify_test.go and trace server.VerifyAttestation through the PCClient event-log replay that reports register 0. Reproduce on the RHEL8 VMware VM with a virtualized TPM; done means determining whether this event-log failure is expected and documenting or correcting the validation behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100