From a0deef9ce58c4a4f9bdb46b9b0807dea14b8dd9d Mon Sep 17 00:00:00 2001 From: Chris Coulson Date: Tue, 1 Sep 2026 17:26:18 +0100 Subject: [PATCH] report: Don't create TPM2 attestation key with adminWithPolicy The default attestation key for the TPM2 report signer is currently created with an empty policy but with the adminWithPolicy attribute set. This makes it impossible to authorize use of the key for the ADMIN role, which is required by TPM2_Certify. This drops the adminWithPolicy attribute so that it can be authorized using its (empty) authorization value. This is appropriate for local style attestation keys ("LAKs"). I've been working on an interface for managing attestation keys which will support creating an IAK, and this will have both the adminWithPolicy attribute set and a policy defined as specified in the TCG "TPM 2.0 Keys for Device Identity and Attestation" spec. (cherry picked from commit fc5875d137d7afc6ed9fc63bd77f28cec90d1555) --- src/shared/tpm2-util.c | 1 - src/test/test-tpm2.c | 2 +- 2 files changed, 1 insertion(+), 2 deletions(-) diff --git a/src/shared/tpm2-util.c b/src/shared/tpm2-util.c index 7a20965658..5c2622a291 100644 --- a/src/shared/tpm2-util.c +++ b/src/shared/tpm2-util.c @@ -1842,7 +1842,6 @@ int tpm2_get_best_attestation_key_template(Tpm2Context *c, TPMT_PUBLIC *ret) { TPMA_OBJECT_FIXEDPARENT | TPMA_OBJECT_SENSITIVEDATAORIGIN | TPMA_OBJECT_USERWITHAUTH | - TPMA_OBJECT_ADMINWITHPOLICY | TPMA_OBJECT_RESTRICTED | TPMA_OBJECT_SIGN_ENCRYPT, .parameters.asymDetail = { diff --git a/src/test/test-tpm2.c b/src/test/test-tpm2.c index 7ebcb0e30e..82c452a8a6 100644 --- a/src/test/test-tpm2.c +++ b/src/test/test-tpm2.c @@ -1818,7 +1818,7 @@ static void check_best_attestation_key_template(Tpm2Context *c) { ASSERT_TRUE(IN_SET(template.type, TPM2_ALG_RSA, TPM2_ALG_ECC)); ASSERT_TRUE(IN_SET(template.nameAlg, TPM2_ALG_SHA256, TPM2_ALG_SHA384)); - ASSERT_EQ(template.objectAttributes, TPMA_OBJECT_FIXEDTPM | TPMA_OBJECT_FIXEDPARENT | TPMA_OBJECT_SENSITIVEDATAORIGIN | TPMA_OBJECT_USERWITHAUTH | TPMA_OBJECT_ADMINWITHPOLICY | TPMA_OBJECT_RESTRICTED | TPMA_OBJECT_SIGN_ENCRYPT); + ASSERT_EQ(template.objectAttributes, TPMA_OBJECT_FIXEDTPM | TPMA_OBJECT_FIXEDPARENT | TPMA_OBJECT_SENSITIVEDATAORIGIN | TPMA_OBJECT_USERWITHAUTH | TPMA_OBJECT_RESTRICTED | TPMA_OBJECT_SIGN_ENCRYPT); ASSERT_EQ(template.parameters.asymDetail.symmetric.algorithm, TPM2_ALG_NULL); ASSERT_NE(template.parameters.asymDetail.scheme.scheme, TPM2_ALG_NULL); ASSERT_TRUE(IN_SET(template.parameters.asymDetail.scheme.details.anySig.hashAlg, TPM2_ALG_SHA256, TPM2_ALG_SHA384));