using tpm to store node identity seed #1790
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
muhamadazmy
force-pushed
the
tpm-research
branch
from
02b04d5 to
a92415d
Compare
also change the vm script to auto-start tpm if required
muhamadazmy
force-pushed
the
tpm-research
branch
from
5ed5e31 to
d1b088c
Compare
This to make sure identityd daemon uses the latest tpm binaries. It simply make sure identityd restarts when binaries are installed before continuing with the update
muhamadazmy
requested review from
maxux,
delandtj,
LeeSmet and
DylanVerstraete
as code owners
abom
reviewed
Sep 6, 2022
| // so there is a key on disk, but tpm already has a stored key | ||
| // then we still just return no need for migration to avoid | ||
| // overriding the key in tpm | ||
| return tpm, nil |
There was a problem hiding this comment.
What about old data/signatures in this case?
There was a problem hiding this comment.
This is actually to avoid overriding the key inside tpm if someone decided to put another key on disk. The idea is that key migration will happen one time (and one time only) and then delete the key file. If suddenly a key appeared then it means something is fishy and the new key file is just ignored.
There was a problem hiding this comment.
Ok, got it. I think we also assume there's no other key at our chosen address, right? (not managed by us).
There was a problem hiding this comment.
That's actually hard to grantee. Maybe we should add a validation (and clearing step) if the key is invalid.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Depends on #1787
This will does the following:
This PR uses the tpm2 utils. The branch and build and install tpm is not merged yet.