Windows TPM Base Services (TBS) - Missing Functionality
- Dominant language
- Go
- Stars
- 673
- Forks
- 188
- PR merge metrics
- No merged PRs in 30d
Description
Windows 10 and 11 automatically take ownership and provision the TPM. See the following excerpt from the documentation:
> # About TPM initialization and ownership
> Starting with Windows 10 and Windows 11, the operating system automatically initializes and takes ownership of the TPM. This is a change from previous operating systems, where you would initialize the TPM and create an owner password.
[Source](https://docs.microsoft.com/en-us/windows/security/information-protection/tpm/initialize-and-configure-ownership-of-the-tpm#about-tpm-initialization-and-ownership)
The default Windows configuration ensures that delegated authorization information is available in the Windows Registry. `TBS.h` exports functionality that can be utilized to retrieve these delegated authorization values.
Access to this functionality is not currently implemented in [tpmutil](https://github.com/google/go-tpm/blob/77d0de8718a8638d94d2e9b6ae2a8b6122b38d47/tpmutil/tbs/tbs_windows.go).
Contributor guide
Research direction
Start with tpmutil/tbs/tbs_windows.go and the linked TBS.h documentation. Identify the Windows TBS functionality for retrieving delegated authorization values from the Registry, then implement access to it in tpmutil. Done means tpmutil exposes the relevant delegated authorization information on Windows 10 and 11.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- operating-systems, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100