Non-HOTP setups need to reboot after signing, otherwise trying to boot and TPM DUK unsealing fails because PCR5 doesn't match
Open
Nobody has claimed this yet.
- Dominant language
- Makefile
- Stars
- 1.6k
- Forks
- 211
- Avg merge
- 4d 21h
- Merged PRs (30d)
- 6
Description
Recently added gating forgot about non-HOTP users which doesn't seal/unseals secrets with usb modules not loaded
Sorry folks, Heads kinda became HOTP USB centric recently, will fix this eventually; for now you can mitigate by rebooting when TPM DUK doesn't work because PCR5 doesn't match (sealed without sub modules loaded)
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing the recently added gating for non-HOTP users and the TPM DUK sealing and unsealing flow when USB modules are not loaded. Reproduce the PCR5 mismatch during boot, then verify that signing and subsequent boot work for non-HOTP setups without requiring a reboot.
Written by the indexing model from the issue text.
Assessment
- Domain
- operating-systems, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Needs clarification
- Newbie friendliness
- 42/100