google / google/go-tpm

Add `DictionaryAttackLockReset` support

Open
#422 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
673
Forks
188
PR merge metrics
No merged PRs in 30d

Description

Suggest adding `DictionaryAttackLockReset` command from [25.2 TPM2_DictionaryAttackLockReset](https://trustedcomputinggroup.org/wp-content/uploads/TPM-Rev-2.0-Part-3-Commands-01.38.pdf) (and probably also `TPM2_DictionaryAttackParameters`)

for the former, maybe

```golang
// DictionaryAttackLockReset is the input to TPM2_DictionaryAttackLockReset.
// See definition in Part 3, Commands, section 25.2.
type DictionaryAttackLockReset struct {
LockHandle TPMIRHLockout `gotpm:"handle,auth"`
}

// Command implements the Command interface.
func (DictionaryAttackLockReset) Command() TPMCC { return TPMCCDictionaryAttackLockReset }

// Execute executes the command and returns the response.
func (cmd DictionaryAttackLockReset) Execute(t transport.TPM, s ...Session) (*DictionaryAttackLockResetResponse, error) {
var rsp DictionaryAttackLockResetResponse
if err := execute[DictionaryAttackLockResetResponse](t, cmd, &rsp, s...); err != nil {
return nil, err
}
return &rsp, nil
}

// DictionaryAttackLockResetResponse is the response from TPM2_DictionaryAttackLockReset.
type DictionaryAttackLockResetResponse struct{}
```

and a simple test could be

```golang
func TestDictionaryAttackLockReset(t *testing.T) {
thetpm, err := simulator.OpenSimulator()
if err != nil {
t.Fatalf("could not connect to TPM simulator: %v", err)
}
defer thetpm.Close()

dl := DictionaryAttackLockReset{
LockHandle: TPMRHLockout,
}

if _, err := dl.Execute(thetpm); err != nil {
t.Fatalf("DictionaryAttackLockReset failed: %v", err)
}
}
```

thought a full end-to-end maybe more complex where you force a lockout, verify by reading `tpm2_getcap properties-variable inLockout`, reset and reread the property

Contributor guide

Open the contributing guide

Research direction

Start with TPM specification section 25.2 and the proposed TestDictionaryAttackLockReset using simulator.OpenSimulator. Compare existing command implementations, then confirm the reset command executes successfully with TPMRHLockout; the optional DictionaryAttackParameters support and full lockout end-to-end flow are additional scope to clarify.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
security
Issue type
Feature
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
52/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.