Skip to content
This repository was archived by the owner on Sep 12, 2025. It is now read-only.

Commit c2f69fb

Browse files
salrashid123salrashid123
committed
migrate signer
Signed-off-by: sal rashid <salrashid123@gmail.com>
1 parent cf69ae6 commit c2f69fb

File tree

1 file changed

+9
-324
lines changed

1 file changed

+9
-324
lines changed

‎README.md‎

Lines changed: 9 additions & 324 deletions
Original file line numberDiff line numberDiff line change
@@ -12,347 +12,32 @@ see the [example/](example/) folder for more information.
1212

1313
>> this library is not supported by google
1414
15-
---
1615

17-
### Usage Signer
1816

19-
Initialize a signer and directly use `.sign()` as shown in this below and in the samples
17+
** NOTE **, this library is read-only now and has been migrated to standalone module here:
2018

2119

22-
```golang
23-
require (
24-
github.com/salrashid123/signer v0.9.3
25-
)
26-
```
20+
**github.com/salrashid123/tpmsigner**
2721

28-
then
22+
23+
the methods are the same, just import as:
2924

3025
```golang
26+
3127
import (
32-
saltpm "github.com/salrashid123/signer/tpm"
33-
"github.com/google/go-tpm/tpmutil"
28+
"github.com/salrashid123/tpmsigner"
3429
)
3530

36-
rwc, err := tpmutil.OpenTPM(path)
37-
38-
stringToSign := []byte("foo")
39-
40-
h := sha256.New()
41-
h.Write(b)
42-
digest := h.Sum(nil)
43-
44-
// assume the handle to the rsassa key is persistentHandle 0x81008001
45-
r, err := saltpm.NewTPMCrypto(&saltpm.TPM{
31+
r, err := tpmsigner.NewTPMCrypto(&tpmsigner.TPM{
4632
TpmDevice: rwc,
47-
Handle: tpm2.TPMHandle(handle),
33+
Handle: tpm2.TPMHandle(*handle),
4834
})
4935

5036
s, err := r.Sign(rand.Reader, digest, crypto.SHA256)
5137

52-
fmt.Printf("RSA Signed String: %s\n", base64.StdEncoding.EncodeToString(s))
5338
```
5439

55-
* [https://pkg.go.dev/github.com/salrashid123/signer/tpm](https://pkg.go.dev/github.com/salrashid123/signer/tpm)
56-
57-
58-
Please import as `go get github.com/salrashid123/signer@v0.9.3` (or whatever is the release version)
59-
60-
---
61-
62-
### Sign/Verify
63-
64-
see `example/sign_verify_tpm` folder.
65-
66-
To use this, the key must be first created on the TPM and accessed as a PersistentHandle or TPM PEM file
67-
68-
You can create these keys using `go-tpm` or using `tpm2_tools`. The example below uses tpm2_tools but for others languages and standalone applicatoins, see [openssl tpm2 provider](https://github.com/salrashid123/tpm2?tab=readme-ov-file#tpm-based-private-key) or [tpm2genkey](https://github.com/salrashid123/tpm2genkey)
69-
70-
For this, install latest [tpm2_tools](https://tpm2-tools.readthedocs.io/en/latest/INSTALL/)
71-
72-
```bash
73-
cd example/
74-
75-
## if you want to use a software TPM,
76-
# rm -rf /tmp/myvtpm && mkdir /tmp/myvtpm
77-
# swtpm socket --tpmstate dir=/tmp/myvtpm --tpm2 --server type=tcp,port=2321 --ctrl type=tcp,port=2322 --flags not-need-init,startup-clear
78-
79-
## then specify "127.0.0.1:2321" as the TPM device path in the examples
80-
## and for tpm2_tools, export the following var
81-
# export TPM2TOOLS_TCTI="swtpm:port=2321"
82-
83-
## if you are using a real tpm set --tpm-path=/dev/tpmrm0
84-
85-
## note the primary can be the "H2" profile from https://www.hansenpartnership.com/draft-bottomley-tpm2-keys.html#name-parent
86-
# printf '\x00\x00' > unique.dat
87-
# tpm2_createprimary -C o -G ecc -g sha256 -c primary.ctx -a "fixedtpm|fixedparent|sensitivedataorigin|userwithauth|noda|restricted|decrypt" -u unique.dat
88-
89-
## RSA - no password
90-
91-
tpm2_createprimary -C o -G rsa2048:aes128cfb -g sha256 -c primary.ctx -a 'restricted|decrypt|fixedtpm|fixedparent|sensitivedataorigin|userwithauth|noda'
92-
tpm2_create -G rsa2048:rsassa:null -g sha256 -u key.pub -r key.priv -C primary.ctx
93-
tpm2_flushcontext -t && tpm2_flushcontext -s && tpm2_flushcontext -l
94-
tpm2_load -C primary.ctx -u key.pub -r key.priv -c key.ctx
95-
tpm2_evictcontrol -C o -c key.ctx 0x81008001
96-
97-
go run sign_verify_tpm/rsassa/main.go --tpm-path="127.0.0.1:2321" --handle 0x81008001
98-
99-
100-
### RSA - no password with PEM key file
101-
102-
printf '\x00\x00' > unique.dat
103-
tpm2_createprimary -C o -G ecc -g sha256 -c primary.ctx -a "fixedtpm|fixedparent|sensitivedataorigin|userwithauth|noda|restricted|decrypt" -u unique.dat
104-
105-
tpm2_create -G rsa2048:rsapss:null -g sha256 -u key.pub -r key.priv -C primary.ctx --format=pem --output=rsapss_public.pem
106-
tpm2_flushcontext -t && tpm2_flushcontext -s && tpm2_flushcontext -l
107-
tpm2_load -C primary.ctx -u key.pub -r key.priv -c key.ctx
108-
tpm2_encodeobject -C primary.ctx -u key.pub -r key.priv -o key.pem
109-
110-
go run sign_verify_tpm/keyfile/main.go --tpm-path="127.0.0.1:2321" -pemFile /tmp/key.pem
11140

112-
## rsa-pss
41+
(why did i migrate this? well, i completely messed up the package names/structures )
11342

114-
tpm2_createprimary -C o -G rsa2048:aes128cfb -g sha256 -c primary.ctx -a 'restricted|decrypt|fixedtpm|fixedparent|sensitivedataorigin|userwithauth|noda'
115-
tpm2_create -G rsa2048:rsapss:null -g sha256 -u key.pub -r key.priv -C primary.ctx
116-
tpm2_flushcontext -t && tpm2_flushcontext -s && tpm2_flushcontext -l
117-
tpm2_load -C primary.ctx -u key.pub -r key.priv -c key.ctx
118-
tpm2_evictcontrol -C o -c key.ctx 0x81008004
119-
120-
go run sign_verify_tpm/rsapss/main.go --tpm-path="127.0.0.1:2321" --handle 0x81008004
121-
122-
## ecc
123-
124-
tpm2_createprimary -C o -G rsa2048:aes128cfb -g sha256 -c primary.ctx -a 'restricted|decrypt|fixedtpm|fixedparent|sensitivedataorigin|userwithauth|noda'
125-
tpm2_create -G ecc:ecdsa -g sha256 -u key.pub -r key.priv -C primary.ctx --format=pem --output=ecc_public.pem
126-
tpm2_flushcontext -t && tpm2_flushcontext -s && tpm2_flushcontext -l
127-
tpm2_load -C primary.ctx -u key.pub -r key.priv -c key.ctx
128-
tpm2_evictcontrol -C o -c key.ctx 0x81008005
129-
130-
go run sign_verify_tpm/ecc/main.go --tpm-path="127.0.0.1:2321" --handle 0x81008005
131-
132-
## for policyPCR
133-
134-
tpm2_pcrread sha256:23
135-
tpm2_startauthsession -S session.dat
136-
tpm2_policypcr -S session.dat -l sha256:23 -L policy.dat
137-
tpm2_flushcontext session.dat
138-
tpm2_flushcontext -t && tpm2_flushcontext -s && tpm2_flushcontext -l
139-
tpm2_createprimary -C o -G rsa2048:aes128cfb -g sha256 -c primary.ctx -a 'restricted|decrypt|fixedtpm|fixedparent|sensitivedataorigin|userwithauth|noda'
140-
tpm2_create -G rsa2048:rsassa:null -g sha256 -u key.pub -r key.priv -C primary.ctx -L policy.dat
141-
tpm2_flushcontext -t && tpm2_flushcontext -s && tpm2_flushcontext -l
142-
tpm2_load -C primary.ctx -u key.pub -r key.priv -c key.ctx
143-
tpm2_evictcontrol -C o -c key.ctx 0x81008006
144-
145-
go run sign_verify_tpm/policy_pcr/main.go --handle=0x81008006 --tpm-path="127.0.0.1:2321"
146-
147-
## for password
148-
149-
tpm2_createprimary -C o -G rsa2048:aes128cfb -g sha256 -c primary.ctx -a 'restricted|decrypt|fixedtpm|fixedparent|sensitivedataorigin|userwithauth|noda'
150-
tpm2_create -G rsa2048:rsassa:null -p testpwd -g sha256 -u key.pub -r key.priv -C primary.ctx
151-
tpm2_flushcontext -t && tpm2_flushcontext -s && tpm2_flushcontext -l
152-
tpm2_load -C primary.ctx -u key.pub -r key.priv -c key.ctx
153-
tpm2_evictcontrol -C o -c key.ctx 0x81008007
154-
155-
go run sign_verify_tpm/password/main.go --handle=0x81008007 --tpm-path="127.0.0.1:2321"
156-
157-
158-
## for policyassword
159-
160-
tpm2_createprimary -C o -G rsa2048:aes128cfb -g sha256 -c primary.ctx -a 'restricted|decrypt|fixedtpm|fixedparent|sensitivedataorigin|userwithauth|noda'
161-
162-
tpm2_startauthsession -S session.dat
163-
tpm2_policypassword -S session.dat -L policy.dat
164-
tpm2_flushcontext session.dat
165-
166-
tpm2_create -G rsa2048:rsassa:null -p testpwd -g sha256 -u key.pub -r key.priv -C primary.ctx -L policy.dat
167-
tpm2_flushcontext -t && tpm2_flushcontext -s && tpm2_flushcontext -l
168-
tpm2_load -C primary.ctx -u key.pub -r key.priv -c key.ctx
169-
tpm2_evictcontrol -C o -c key.ctx 0x81008008
170-
171-
go run sign_verify_tpm/password/main.go --handle=0x81008007 --tpm-path="127.0.0.1:2321"
172-
173-
```
174-
175-
176-
### Usage TLS
177-
178-
* for tpm see [mTLS with TPM bound private key](https://github.com/salrashid123/go_tpm_https_embed)
179-
180-
### Sign/Verify ECC
181-
182-
The default output signature format for ECC based keys is ASN1 format as described in [ecdsa.SignASN1](https://pkg.go.dev/crypto/ecdsa#Sign)
183-
184-
If you need the raw output format, set `ECCRawOutput: true` in the config.
185-
186-
See the examples folder for usage
187-
188-
### Usage: Generate CSR
189-
190-
The following will generate a TPM based key and then issue a CSR against it.
191-
192-
```bash
193-
### create key, rsassa
194-
# using H2 template ( https://gist.github.com/salrashid123/9822b151ebb66f4083c5f71fd4cdbe40 )
195-
printf '\x00\x00' > unique.dat
196-
tpm2_createprimary -C o -G ecc -g sha256 \
197-
-c primary.ctx -a "fixedtpm|fixedparent|sensitivedataorigin|userwithauth|noda|restricted|decrypt" -u unique.dat
198-
199-
tpm2_create -G rsa2048:rsassa:null -g sha256 -u key.pub -r key.priv -C primary.ctx
200-
tpm2_flushcontext -t
201-
tpm2_load -C primary.ctx -u key.pub -r key.priv -c key.ctx
202-
tpm2_evictcontrol -C o -c key.ctx 0x81008001
203-
tpm2_flushcontext -t
204-
tpm2_encodeobject -C primary.ctx -u key.pub -r key.priv -o private.pem
205-
206-
cd util/csrgen/
207-
go run csrgen/csrgen.go -cn server.domain.com --persistentHandle 0x81008001
208-
```
209-
210-
### Usage: Generate self-signed certificate
211-
212-
The following will generate a key on the tpm, then use that RSA key to issue a CSR and then sign that CSR with by itself to get an x509.
213-
214-
You can ofcourse modify it to just sign any csr with a TPM backed key
215-
216-
217-
```bash
218-
# using H2 template ( https://gist.github.com/salrashid123/9822b151ebb66f4083c5f71fd4cdbe40 )
219-
printf '\x00\x00' > unique.dat
220-
tpm2_createprimary -C o -G ecc -g sha256 \
221-
-c primary.ctx -a "fixedtpm|fixedparent|sensitivedataorigin|userwithauth|noda|restricted|decrypt" -u unique.dat
222-
223-
tpm2_create -G rsa2048:rsassa:null -g sha256 -u key.pub -r key.priv -C primary.ctx
224-
tpm2_flushcontext -t
225-
tpm2_load -C primary.ctx -u key.pub -r key.priv -c key.ctx
226-
tpm2_evictcontrol -C o -c key.ctx 0x81008002
227-
tpm2_flushcontext -t
228-
tpm2_encodeobject -C primary.ctx -u key.pub -r key.priv -o private.pem
229-
230-
go run certgen/certgen.go -cn server.domain.com --persistentHandle 0x81008002
231-
```
232-
233-
---
234-
235-
If you just want to issue JWT's, see
236-
237-
* [https://github.com/salrashid123/golang-jwt-tpm](https://github.com/salrashid123/golang-jwt-tpm)
238-
* [https://github.com/salrashid123/golang-jwt-pkcs11](https://github.com/salrashid123/golang-jwt-pkcs11)
239-
240-
or real random:
241-
242-
* [TPM backed crypto/rand Reader](https://github.com/salrashid123/tpmrand)
243-
244-
---
245-
246-
#### Keys with Auth Policy
247-
248-
If the key is setup with an AuthPolicy (eg, a policy that requires a passphrase or a predefined PCR values to exist), you can specify those in code or define your own
249-
250-
251-
##### PasswordAuth
252-
253-
If the key requires a password, initialize a `NewPasswordAuthSession`
254-
255-
```golang
256-
se, err := saltpm.NewPasswordAuthSession(rwr, []byte(*keyPass), 0)
257-
258-
rr, err := saltpm.NewTPMCrypto(&saltpm.TPM{
259-
TpmDevice: rwc,
260-
Handle: tpm2.TPMHandle(*handle),
261-
AuthSession: se,
262-
})
263-
```
264-
265-
##### PCRPolicy
266-
267-
If the key requires a password, initialize a `NewPCRSession`
268-
269-
```golang
270-
se, err := saltpm.NewPCRSession(rwr, []tpm2.TPMSPCRSelection{
271-
{
272-
Hash: tpm2.TPMAlgSHA256,
273-
PCRSelect: tpm2.PCClientCompatible.PCRs(uint(23)),
274-
},
275-
}, tpm2.TPM2BDigest{}, 0)
276-
277-
rr, err := saltpm.NewTPMCrypto(&saltpm.TPM{
278-
TpmDevice: rwc,
279-
Handle: tpm2.TPMHandle(*handle),
280-
AuthSession: se,
281-
})
282-
283-
```
284-
285-
##### CustomPolicy
286-
287-
Note, you can define your own policy for import too...just implement the "session" interface from the signer:
288-
289-
```golang
290-
type Session interface {
291-
GetSession() (auth tpm2.Session, closer func() error, err error) // this supplies the session handle to the library
292-
}
293-
```
294-
295-
for example, for a PCR and [AuthPolicy](https://github.com/google/go-tpm/pull/359) enforcement (eg, a PCR and password), you can define a custom session callback.
296-
297-
```golang
298-
type MyPCRAndPolicyAuthValueSession struct {
299-
rwr transport.TPM
300-
sel []tpm2.TPMSPCRSelection
301-
password []byte
302-
}
303-
304-
func NewPCRAndPolicyAuthValueSession(rwr transport.TPM, sel []tpm2.TPMSPCRSelection, password []byte) (MyPCRAndPolicyAuthValueSession, error) {
305-
return MyPCRAndPolicyAuthValueSession{rwr, sel, password}, nil
306-
}
307-
308-
func (p MyPCRAndPolicyAuthValueSession) GetSession() (auth tpm2.Session, closer func() error, err error) {
309-
310-
var options []tpm2.AuthOption
311-
options = append(options, tpm2.Auth(p.password))
312-
313-
sess, closer, err := tpm2.PolicySession(p.rwr, tpm2.TPMAlgSHA256, 16, options...)
314-
if err != nil {
315-
return nil, nil, err
316-
}
317-
318-
_, err = tpm2.PolicyPCR{
319-
PolicySession: sess.Handle(),
320-
Pcrs: tpm2.TPMLPCRSelection{
321-
PCRSelections: p.sel,
322-
},
323-
}.Execute(p.rwr)
324-
if err != nil {
325-
return nil, closer, err
326-
}
327-
328-
_, err = tpm2.PolicyAuthValue{
329-
PolicySession: sess.Handle(),
330-
}.Execute(p.rwr)
331-
if err != nil {
332-
return nil, closer, err
333-
}
334-
335-
return sess, closer, nil
336-
}
337-
338-
```
339-
340-
which you can call as:
341-
342-
```golang
343-
se, err := NewPCRAndPolicyAuthValueSession(rwr, []tpm2.TPMSPCRSelection{
344-
{
345-
Hash: tpm2.TPMAlgSHA256,
346-
PCRSelect: tpm2.PCClientCompatible.PCRs(uint(*pcr)),
347-
},
348-
}, []byte("testpswd"))
349-
350-
rr, err := saltpm.NewTPMCrypto(&saltpm.TPM{
351-
TpmDevice: rwc,
352-
Handle: tpm2.TPMHandle(*handle*),
353-
AuthSession: se,
354-
})
355-
```
356-
357-
---
35843

0 commit comments

Comments
 (0)