google / google/go-tpm-tools

failed to validate the PCClient event log in VMware

Open
#223 3 comments 0 reactions 0 assignees View on GitHub
Dominant language
C
Stars
309
Forks
118
Avg merge
1d 16h
Merged PRs (30d)
33

Description

I've created the following script for testing proposes and I'm running it on a VMware VM with a virtualized TPM with RHEL8 as the OS. I got the following error when running `server.VerifyAttestation`:

failed to validate the PCClient event log:
failed to replay event log: event log failed to verify: the following registers failed to replay: [0]

Is this expected to happen? I'm thinking about testing this on my real machine with the actual TPM but I afraid to break something.

The code is pretty much the same as the verify_test.go one but using VMwares virtualized TPM.

`package main

import (
"crypto"
"fmt"

"github.com/google/go-tpm-tools/client"
"github.com/google/go-tpm-tools/server"
"github.com/google/go-tpm/tpm2"
)

func main() {

tpm, err := tpm2.OpenTPM()
if err != nil {
fmt.Println("[ERROR] opening tpm failed: ", err)
return
}

AttestationKeyRSA, err := client.AttestationKeyRSA(tpm)
defer AttestationKeyRSA.Close()

if err != nil {
fmt.Println("[ERROR] RSA AK Creation failed: ", err)
return
}
fmt.Println("[INFO] AK Created: ", AttestationKeyRSA)

nonce, err := tpm2.GetRandom(tpm, 15)

if err != nil {
fmt.Println("[ERROR] nonce creation failed: ", err)
return
}
fmt.Println("[INFO] nonce Created: ", nonce)

attestation, err := AttestationKeyRSA.Attest(client.AttestOpts{Nonce: nonce})

if err != nil {
fmt.Println("[ERROR] Attestation failed: ", err)
return
}

MachineState, err := server.VerifyAttestation(attestation, server.VerifyOpts{
Nonce: nonce,
TrustedAKs: []crypto.PublicKey{AttestationKeyRSA.PublicKey()},
})

if err != nil {
// handle error
fmt.Println("[ERROR] VerifyAttestation failed: ", err)
return
}

fmt.Println("INFO: Grub State", MachineState)

}`

Contributor guide

Open the contributing guide

Research direction

Start by comparing the reported script with verify_test.go and trace server.VerifyAttestation through the PCClient event-log replay that reports register 0. Reproduce on the RHEL8 VMware VM with a virtualized TPM; done means determining whether this event-log failure is expected and documenting or correcting the validation behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.