Skip to content

tpm2: Support safely rotating the lockout hierarchy authorization value #539

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
chrisccoulson merged 8 commits into from
Apr 24, 2026
Merged

tpm2: Support safely rotating the lockout hierarchy authorization value #539

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
cf97c51
tpm2: Support safely rotating the lockout hierarchy authorization value
chrisccoulson Apr 2, 2026
e6e8742
Fix a build failure
chrisccoulson Apr 23, 2026
80fc58b
Rename WithProvisionNewLockoutAuthValue to WithProvisionNewLockoutAut…
chrisccoulson Apr 23, 2026
c01832d
tpm2: Add WithUnconfiguredLockoutAuth
chrisccoulson Apr 23, 2026
cf4c7f1
Fix some test failures
chrisccoulson Apr 23, 2026
cfb6e6c
tpm2: Merge ErrInvalidLockoutAuthPolicy and ErrLockoutAuthUpdateInter…
chrisccoulson Apr 23, 2026
a2ef396
Fix a unit test bug that reduced coverage
chrisccoulson Apr 23, 2026
a37d93f
Remove a dead case
chrisccoulson Apr 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ require (
github.com/canonical/go-kbkdf v0.0.0-20250104172618-3b1308f9acf9
github.com/canonical/go-password-validator v0.0.0-20250617132709-1b205303ca54
github.com/canonical/go-sp800.90a-drbg v0.0.0-20210314144037-6eeb1040d6c3
github.com/canonical/go-tpm2 v1.16.0
github.com/canonical/go-tpm2 v1.16.2
github.com/canonical/tcglog-parser v0.0.0-20240924110432-d15eaf652981
github.com/jessevdk/go-flags v1.5.0
github.com/snapcore/snapd v0.0.0-20220714152900-4a1f4c93fc85
Expand Down
2 changes: 2 additions & 0 deletions go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,8 @@ github.com/canonical/go-tpm2 v1.15.0 h1:T4dVCO8qCs76vDDs4vWNpvPdh7UHuSORPH4Scq7N
github.com/canonical/go-tpm2 v1.15.0/go.mod h1:P50xMwC7y5/uxPikzWdK4d9pW9orKi8+ZL5sBifxoBQ=
github.com/canonical/go-tpm2 v1.16.0 h1:AX+hpmdPgR8i3VFe3DVgKO46S5EpnumKP0yS5ND/Tz8=
github.com/canonical/go-tpm2 v1.16.0/go.mod h1:P50xMwC7y5/uxPikzWdK4d9pW9orKi8+ZL5sBifxoBQ=
github.com/canonical/go-tpm2 v1.16.2 h1:Jg/okfKQ1BDdRYIjq2ZrwhsDDttMn+NSnxue3XUJBZg=
github.com/canonical/go-tpm2 v1.16.2/go.mod h1:P50xMwC7y5/uxPikzWdK4d9pW9orKi8+ZL5sBifxoBQ=
github.com/canonical/tcglog-parser v0.0.0-20210824131805-69fa1e9f0ad2/go.mod h1:QoW2apR2tBl6T/4czdND/EHjL1Ia9cCmQnIj9Xe0Kt8=
github.com/canonical/tcglog-parser v0.0.0-20240924110432-d15eaf652981 h1:vrUzSfbhl8mzdXPzjxq4jXZPCCNLv18jy6S7aVTS2tI=
github.com/canonical/tcglog-parser v0.0.0-20240924110432-d15eaf652981/go.mod h1:ywdPBqUGkuuiitPpVWCfilf2/gq+frhq4CNiNs9KyHU=
Expand Down
6 changes: 6 additions & 0 deletions internal/testutil/x509.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,3 +39,9 @@ func ParsePKCS1PrivateKey(c *C, data []byte) *rsa.PrivateKey {
c.Assert(err, IsNil)
return key
}

func ParsePKCS8PrivateKey(c *C, data []byte) any {
key, err := x509.ParsePKCS8PrivateKey(data)
c.Assert(err, IsNil)
return key
}
2 changes: 1 addition & 1 deletion tools/gen-compattest-data/main.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -167,7 +167,7 @@ func run() int {
}
defer tpm.Close()

if err := tpm.EnsureProvisioned(secboot_tpm2.WithProvisionNewLockoutAuthValue([]byte("1234"))); err != nil {
if err := tpm.EnsureProvisioned(secboot_tpm2.WithProvisionNewLockoutAuthData(rand.Reader, func(_ []byte) error { return nil })); err != nil {
fmt.Fprintf(os.Stderr, "Cannot provision TPM: %v\n", err)
return 1
}
Expand Down
3 changes: 3 additions & 0 deletions tpm2/export_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,12 +51,15 @@ var (
MakeSealedKeyData = makeSealedKeyData
MakeKeyDataNoAuth = makeKeyDataNoAuth
MakeKeyDataWithPassphraseConstructor = makeKeyDataWithPassphraseConstructor
NewDefaultLockoutAuthPolicy = newDefaultLockoutAuthPolicy
NewKeyData = newKeyData
NewKeyDataPolicy = newKeyDataPolicy
NewKeyDataPolicyLegacy = newKeyDataPolicyLegacy
NewPolicyAuthPublicKey = newPolicyAuthPublicKey
NewPolicyOrDataV0 = newPolicyOrDataV0
NewPolicyOrTree = newPolicyOrTree
NewUpdateLockoutAuthValueKey = newUpdateLockoutAuthValueKey
NewUpdateAuthValueLockoutAuthPolicy = newUpdateAuthValueLockoutAuthPolicy
ReadKeyDataV0 = readKeyDataV0
ReadKeyDataV1 = readKeyDataV1
ReadKeyDataV2 = readKeyDataV2
Expand Down
Loading
Loading