keylime / keylime/rust-keylime
Don't tpm_hash_alg for PCR bank selection and key options
Open
Nobody has claimed this yet.
- Dominant language
- Rust
- Stars
- 162
- Forks
- 76
- Avg merge
- 4d 17h
- Merged PRs (30d)
- 3
Description
Currently the tpm_hash_alg option is used in the following places:
- Hash algorithm used for the AK
- Hash algorithm used for signature scheme
- PCR selection for quotes
The first two are loosely tied together, but the selection of which type of PCRs should be included in the quote should be independent.
My proposed split would be:
pcr_hash_alg: selection of the PCR hash algorithmtpm_hash_alg: by default set toautoordefaultwhich just uses the same as the EK. For the signing we should be able to use the option set in the AK and not needing to specify it separately for singing.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
The issue names no files or tests. Start by tracing every use of tpm_hash_alg, especially AK creation, signature scheme selection, and PCR quote selection. Done means PCR selection can use an independent pcr_hash_alg, while TPM and signing behavior follow the proposed defaults without requiring duplicate configuration.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- cryptography, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100