google / google/go-tpm

Seed `PolicyCalculator` state

Open
#437 3 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
673
Forks
188
PR merge metrics
No merged PRs in 30d

Description

I'm implementing some TPM policies around `PolicyPCR` and `PolicyOR`, largely based off on the `systemd-pcrlock` implementation.

The problem is that the `PolicyOR` policy takes a list of hashes of potential policy states. In an easy case we are just building on top of an all `0x0` hash. However in more complicated scenarios we might do multiple policies before we get to the `PolicyOR` step. If we execute all of these steps on the TPM we can use `PolicyGetDigest` to get an hash of the current policies, but there is no way for us to use this digest and build a `PolicyCalculator` on top of it for the induvidual `PolicyOR` branches.

We could be careful and run all policy statements with `Update()` and `Execute()`, but that seems like a lot of work if we could instead build a calculator on top of an existing digest?

I'm thinking we could implementing something like `NewPolicyCalculatorWithState(alg TPMIAlgHash, state []byte)` or a `SetState(state []byte)` function. But I'm not completely sure if this is the correct approach here?

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.