google / google/go-tpm

Windows TPM Base Services (TBS) - Missing Functionality

Open
#275 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
673
Forks
188
PR merge metrics
No merged PRs in 30d

Description

Windows 10 and 11 automatically take ownership and provision the TPM. See the following excerpt from the documentation:

> # About TPM initialization and ownership
> Starting with Windows 10 and Windows 11, the operating system automatically initializes and takes ownership of the TPM. This is a change from previous operating systems, where you would initialize the TPM and create an owner password.

[Source](https://docs.microsoft.com/en-us/windows/security/information-protection/tpm/initialize-and-configure-ownership-of-the-tpm#about-tpm-initialization-and-ownership)

The default Windows configuration ensures that delegated authorization information is available in the Windows Registry. `TBS.h` exports functionality that can be utilized to retrieve these delegated authorization values.

Access to this functionality is not currently implemented in [tpmutil](https://github.com/google/go-tpm/blob/77d0de8718a8638d94d2e9b6ae2a8b6122b38d47/tpmutil/tbs/tbs_windows.go).

Contributor guide

Open the contributing guide

Research direction

Start with tpmutil/tbs/tbs_windows.go and the linked TBS.h documentation. Identify the Windows TBS functionality for retrieving delegated authorization values from the Registry, then implement access to it in tpmutil. Done means tpmutil exposes the relevant delegated authorization information on Windows 10 and 11.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
operating-systems, security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.