[tpm2] Re: Schema of object.json
Roberts, William C <william.c.roberts at intel.com>
| Newsgroups | dev.linux.lists.tpm2 |
|---|---|
| Message-ID | <SN6PR11MB343702298042C74118F96352B8999@SN6PR11MB3437.namprd11.prod.outlook.com> |
In the JSON format, those are just representations of the TPM2B_PUBLIC and TPM2B_PRIVATE data structures.
The TPM2B_PRIVATE is defined as just a byte array, which contains the key specific data. That data is protected by
it's parent key, which in most instances is the SRK.
How the data is protected is found in the arch doc section 23.3
https://trustedcomputinggroup.org/wp-content/uploads/TCG_TPM2_r1p59_Part1_Architecture_pub.pdf
The easiest way, IMO to view the protections is to look at the wrap code in tpm2-pytss:
https://github.com/tpm2-software/tpm2-pytss/blob/master/tpm2_pytss/utils.py#L58
The tests also show the flow:
https://github.com/tpm2-software/tpm2-pytss/blob/64fa9fb037bf363890bb112da351a6feccf49fd8/test/test_makecred.py#L123
The general flow of data structures is that:
TPM2B_SENSITIVE(authValue, seedValue, keyData (sensitive) --> wrap(parent key) --> TPM2B_PRIVATE
________________________________
From: Anthony Arrascue <AArrascue(a)neuroloop.de>
Sent: Tuesday, November 16, 2021 10:09 AM
To: David Challener <david.c.challener(a)gmail.com>; tpm2(a)lists.01.org <tpm2(a)lists.01.org>
Subject: [tpm2] Re: Schema of object.json
Hi David,
Thank you for your reply. Do you know if I can find documentation about this?
I found what I believe is the serialization / deserialization of those JSON objects:
https://github.com/tpm2-software/tpm2-tss/blob/04a2853994eb31747c3e19c2601d99e675067794/src/tss2-fapi/ifapi_json_serialize.c
https://github.com/tpm2-software/tpm2-tss/blob/04a2853994eb31747c3e19c2601d99e675067794/src/tss2-fapi/ifapi_json_deserialize.c
But this encryption process of the PrivK, with the PubKey of the SRK is then somewhere else?
Best,
Anthony
From: David Challener <david.c.challener(a)gmail.com>
Sent: Tuesday, 16 November 2021 16:56
To: Anthony Arrascue <AArrascue(a)neuroloop.de>
Subject: Re: [tpm2] Schema of object.json
I expect the private key is the encrytion of the real private key with the srk oublic key.
On Tue, Nov 16, 2021, 9:31 AM Anthony Arrascue <AArrascue(a)neuroloop.de<mailto:AArrascue(a)neuroloop.de>> wrote:
Hello,
I am using TPM2-TSS v. 2.4.x and TPM2-TOOLS v. 4.X.
Let’s suppose I create a key running:
tss2_createkey --path=HS/SRK/MyKey --type="sign,noDa,decrypt,system" --authValue=blabla
This creates a folder MyKey in […]/keystore/P_RSA2048SHA256/HS/SRK/MyKey and a file object.json inside.
I was wondering what the public / private keys are?
public":{
"size":278,
"publicArea":{…},
… "unique":"acc645e440fce2b34772dc94658c2b0daf3c18053ecfd7924ef3346dd764d7c5dd91ca207683a5ea884f03adf7e198728c39a8a59f01326a80f768a0f7302dd0b7e37b0c1efa22e8604f85c061c0a81e60ab97edb1e81cdc2b889ad2414045c273ce6af38260a91dd6857013bdffd7e5541a0a9f3221ea6bd1c41f650dd3f52f5cac75e76e0618541c622f48e0967867e1d40c632f5e87600442d7e534390741d4b4f0a9b7ac0a141ce07c0d5d7447c598183d2c48a8bccf9ddb867193518e2cb10c86f03bc996d3b054b383df7f10f2c6d0d070358c72a325e2ad5301ae1f4834160aaefa1cecb3e8e0441e1fb0ab60feefd35e2c9ec6439fdc9a0e5b6456ff"
}
},
…
"serialization":"",
"private":"00201f93bbec6eb3d00f08cb8cafd48dffe6b06150fa45b989072922b2049c962de80010baf3c7683d5039a27cb73036531a869137bc3a57d30b8c348b73ce134eb11066e45803e5ee7bba20192ab4f6881b21004261ab06af37c68a22758284d9d21fc91d49748f6eee1bc8f1011d0e4fd228642e98f3ee65a4161d1cc53af6b0dfb48aafc9cefde1ca8212b08e16b4c15d0a16adc36b19133350f73bace6f12d11c084d9eb953cf9c87d0a2f2b34617a2369ffc9fb299113bba531d9be465e033ec54511cf6b6e3463e84018e40eaded1fa6ad13da671946cd03a567f3",
…
Questions: what is the meaning of the “unique” and “private” keys?
Is there a place where a schema can be found for a key?
The private part cannot be the private key right? It would not make sense that this is stored as plain text.
Thank you very much for any help.
Best,
Anthony Arrascue
_______________________________________________
tpm2 mailing list -- tpm2(a)lists.01.org<mailto:tpm2(a)lists.01.org>
To unsubscribe send an email to tpm2-leave(a)lists.01.org<mailto:tpm2-leave(a)lists.01.org>
%(web_page_url)slistinfo%(cgiext)s/%(_internal_name)s
attachment.htm
(text/html, 12.3 KB)
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
In the JSON format, those are just representations of the TPM2B_PUBLIC and TPM2B_PRIVATE data structures.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
The TPM2B_PRIVATE is defined as just a byte array, which contains the key specific data. That data is protected by</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
it's parent key, which in most instances is the SRK.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
How the data is protected is found in the arch doc section 23.3</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<a href="https://trustedcomputinggroup.org/wp-content/uploads/TCG_TPM2_r1p59_Part1_Architecture_pub.pdf" id="LPNoLPOWALinkPreview" style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt;">https://trustedcomputinggroup.org/wp-content/uploads/TCG_TPM2_r1p59_Part1_Architecture_pub.pdf</a><br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
The easiest way, IMO to view the protections is to look at the wrap code in tpm2-pytss:</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<a href="https://github.com/tpm2-software/tpm2-pytss/blob/master/tpm2_pytss/utils.py#L58" id="LPNoLPOWALinkPreview_1">https://github.com/tpm2-software/tpm2-pytss/blob/master/tpm2_pytss/utils.py#L58</a><br>
</div>
<div class="_Entity _EType_OWALinkPreview _EId_OWALinkPreview_1 _EReadonly_1"></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
The tests also show the flow:</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<a href="https://github.com/tpm2-software/tpm2-pytss/blob/64fa9fb037bf363890bb112da351a6feccf49fd8/test/test_makecred.py#L123" id="LPlnk591546">https://github.com/tpm2-software/tpm2-pytss/blob/64fa9fb037bf363890bb112da351a6feccf49fd8/test/test_makecred.py#L123</a><br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
The general flow of data structures is that:</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
TPM2B_SENSITIVE(authValue, seedValue, keyData (sensitive) --> wrap(parent key) --> TPM2B_PRIVATE</div>
<div class="_Entity _EType_OWALinkPreview _EId_OWALinkPreview _EReadonly_1"></div>
<br>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> Anthony Arrascue <[email protected]><br>
<b>Sent:</b> Tuesday, November 16, 2021 10:09 AM<br>
<b>To:</b> David Challener <[email protected]>; [email protected] <[email protected]><br>
<b>Subject:</b> [tpm2] Re: Schema of object.json</font>
<div> </div>
</div>
<style>
<!--
@font-face
{font-family:"Cambria Math"}
@font-face
{font-family:Calibri}
p.x_MsoNormal, li.x_MsoNormal, div.x_MsoNormal
{margin:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif}
a:link, span.x_MsoHyperlink
{color:blue;
text-decoration:underline}
span.x_EmailStyle18
{font-family:"Calibri",sans-serif;
color:windowtext}
.x_MsoChpDefault
{font-family:"Calibri",sans-serif}
@page WordSection1
{margin:72.0pt 72.0pt 72.0pt 72.0pt}
div.x_WordSection1
{}
-->
</style>
<div lang="en-DE" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="x_WordSection1">
<p class="x_MsoNormal"><span lang="EN-US" style="">Hi David,</span></p>
<p class="x_MsoNormal"><span lang="EN-US" style="">Thank you for your reply. Do you know if I can find documentation about this?<br>
<br>
</span></p>
<p class="x_MsoNormal"><span lang="EN-US" style="">I found what I believe is the serialization / deserialization of those JSON objects:</span></p>
<p class="x_MsoNormal"><span lang="EN-US" style=""><a href="https://github.com/tpm2-software/tpm2-tss/blob/04a2853994eb31747c3e19c2601d99e675067794/src/tss2-fapi/ifapi_json_serialize.c">https://github.com/tpm2-software/tpm2-tss/blob/04a2853994eb31747c3e19c2601d99e675067794/src/tss2-fapi/ifapi_json_serialize.c</a></span></p>
<p class="x_MsoNormal"><span lang="EN-US" style=""><a href="https://github.com/tpm2-software/tpm2-tss/blob/04a2853994eb31747c3e19c2601d99e675067794/src/tss2-fapi/ifapi_json_deserialize.c">https://github.com/tpm2-software/tpm2-tss/blob/04a2853994eb31747c3e19c2601d99e675067794/src/tss2-fapi/ifapi_json_deserialize.c</a></span></p>
<p class="x_MsoNormal"><span lang="EN-US" style=""> </span></p>
<p class="x_MsoNormal"><span lang="EN-US" style="">But this encryption process of the PrivK, with the PubKey of the SRK is then somewhere else?</span></p>
<p class="x_MsoNormal"><span lang="EN-US" style=""> </span></p>
<p class="x_MsoNormal"><span lang="EN-US" style="">Best,</span></p>
<p class="x_MsoNormal"><span lang="EN-US" style="">Anthony</span></p>
<p class="x_MsoNormal"><span lang="EN-US" style=""> </span></p>
<p class="x_MsoNormal"><span lang="en-DE" style=""> </span></p>
<div style="border:none; border-left:solid blue 1.5pt; padding:0cm 0cm 0cm 4.0pt">
<div>
<div style="border:none; border-top:solid #E1E1E1 1.0pt; padding:3.0pt 0cm 0cm 0cm">
<p class="x_MsoNormal"><b><span lang="EN-US">From:</span></b><span lang="EN-US"> David Challener <[email protected]>
<br>
<b>Sent:</b> Tuesday, 16 November 2021 16:56<br>
<b>To:</b> Anthony Arrascue <[email protected]><br>
<b>Subject:</b> Re: [tpm2] Schema of object.json</span></p>
</div>
</div>
<p class="x_MsoNormal"> </p>
<div>
<p class="x_MsoNormal">I expect the private key is the encrytion of the real private key with the srk oublic key.</p>
</div>
<p class="x_MsoNormal"> </p>
<div>
<div>
<p class="x_MsoNormal">On Tue, Nov 16, 2021, 9:31 AM Anthony Arrascue <<a href="mailto:[email protected]">[email protected]</a>> wrote:</p>
</div>
<blockquote style="border:none; border-left:solid #CCCCCC 1.0pt; padding:0cm 0cm 0cm 6.0pt; margin-left:4.8pt; margin-right:0cm">
<div>
<div>
<p class="x_MsoNormal" style=""><span lang="en-DE">Hello,</span></p>
<p class="x_MsoNormal" style=""><span lang="en-DE"> </span></p>
<p class="x_MsoNormal" style=""><span lang="EN-US">I am using TPM2-TSS v. 2.4.x and TPM2-TOOLS v. 4.X.</span><span lang="en-DE"></span></p>
<p class="x_MsoNormal" style=""><span lang="EN-US"> </span><span lang="en-DE"></span></p>
<p class="x_MsoNormal" style=""><span lang="EN-US">Lets suppose I create a key running:</span><span lang="en-DE"></span></p>
<p class="x_MsoNormal" style=""><span lang="EN-US">tss2_createkey --path=HS/SRK/MyKey --type="sign,noDa,decrypt,system" --authValue=blabla</span><span lang="en-DE"></span></p>
<p class="x_MsoNormal" style=""><span lang="EN-US"> </span><span lang="en-DE"></span></p>
<p class="x_MsoNormal" style=""><span lang="EN-US">This creates a folder MyKey in [
]/keystore/P_RSA2048SHA256/HS/SRK/MyKey and a file object.json inside.</span><span lang="en-DE"></span></p>
<p class="x_MsoNormal" style=""><span lang="EN-US">I was wondering what the public / private keys are?</span><span lang="en-DE"></span></p>
<p class="x_MsoNormal" style=""><span lang="EN-US"> </span><span lang="en-DE"></span></p>
<p class="x_MsoNormal" style=""><b><span lang="EN-US" style="font-size:9.0pt">public":{</span></b><span lang="en-DE"></span></p>
<p class="x_MsoNormal" style=""><b><span lang="EN-US" style="font-size:9.0pt"> "size":278,</span></b><span lang="en-DE"></span></p>
<p class="x_MsoNormal" style=""><b><span lang="EN-US" style="font-size:9.0pt"> "publicArea":{
},</span></b><span lang="en-DE"></span></p>
<p class="x_MsoNormal" style=""><b><span lang="EN-US" style="font-size:9.0pt">
</span></b><b><span lang="DE" style="font-size:9.0pt"> "unique":"acc645e440fce2b34772dc94658c2b0daf3c18053ecfd7924ef3346dd764d7c5dd91ca207683a5ea884f03adf7e198728c39a8a59f01326a80f768a0f7302dd0b7e37b0c1efa22e8604f85c061c0a81e60ab97edb1e81cdc2b889ad2414045c273ce6af38260a91dd6857013bdffd7e5541a0a9f3221ea6bd1c41f650dd3f52f5cac75e76e0618541c622f48e0967867e1d40c632f5e87600442d7e534390741d4b4f0a9b7ac0a141ce07c0d5d7447c598183d2c48a8bccf9ddb867193518e2cb10c86f03bc996d3b054b383df7f10f2c6d0d070358c72a325e2ad5301ae1f4834160aaefa1cecb3e8e0441e1fb0ab60feefd35e2c9ec6439fdc9a0e5b6456ff"</span></b><span lang="en-DE"></span></p>
<p class="x_MsoNormal" style=""><b><span lang="DE" style="font-size:9.0pt"> </span>
</b><b><span lang="EN-US" style="font-size:9.0pt">}</span></b><span lang="en-DE"></span></p>
<p class="x_MsoNormal" style=""><b><span lang="EN-US" style="font-size:9.0pt"> },</span></b><span lang="en-DE"></span></p>
<p class="x_MsoNormal" style=""><b><span lang="EN-US" style="font-size:9.0pt">
</span></b><span lang="en-DE"></span></p>
<p class="x_MsoNormal" style=""><b><span lang="EN-US" style="font-size:9.0pt"> "serialization":"",</span></b><span lang="en-DE"></span></p>
<p class="x_MsoNormal" style=""><b><span lang="EN-US" style="font-size:9.0pt">"private":"00201f93bbec6eb3d00f08cb8cafd48dffe6b06150fa45b989072922b2049c962de80010baf3c7683d5039a27cb73036531a869137bc3a57d30b8c348b73ce134eb11066e45803e5ee7bba20192ab4f6881b21004261ab06af37c68a22758284d9d21fc91d49748f6eee1bc8f1011d0e4fd228642e98f3ee65a4161d1cc53af6b0dfb48aafc9cefde1ca8212b08e16b4c15d0a16adc36b19133350f73bace6f12d11c084d9eb953cf9c87d0a2f2b34617a2369ffc9fb299113bba531d9be465e033ec54511cf6b6e3463e84018e40eaded1fa6ad13da671946cd03a567f3",</span></b><span lang="en-DE"></span></p>
<p class="x_MsoNormal" style=""><b><span lang="EN-US" style="font-size:9.0pt">
</span></b><span lang="en-DE"></span></p>
<p class="x_MsoNormal" style=""><span lang="EN-US"> </span><span lang="en-DE"></span></p>
<p class="x_MsoNormal" style=""><b><span lang="EN-US">Questions</span></b><span lang="EN-US">: what is the meaning of the unique and private keys?</span><span lang="en-DE"></span></p>
<p class="x_MsoNormal" style=""><span lang="EN-US">Is there a place where a schema can be found for a key?</span><span lang="en-DE"></span></p>
<p class="x_MsoNormal" style=""><span lang="EN-US">The private part cannot be the private key right? It would not make sense that this is stored as plain text.</span><span lang="en-DE"></span></p>
<p class="x_MsoNormal" style=""><span lang="EN-US"> </span><span lang="en-DE"></span></p>
<p class="x_MsoNormal" style=""><span lang="EN-US">Thank you very much for any help.</span><span lang="en-DE"></span></p>
<p class="x_MsoNormal" style=""><span lang="EN-US">Best,</span><span lang="en-DE"></span></p>
<p class="x_MsoNormal" style=""><span lang="EN-US">Anthony Arrascue</span><span lang="en-DE"></span></p>
<p class="x_MsoNormal" style=""><span lang="EN-US"> </span><span lang="en-DE"></span></p>
<p class="x_MsoNormal" style=""><span lang="EN-US"> </span><span lang="en-DE"></span></p>
</div>
</div>
<p class="x_MsoNormal">_______________________________________________<br>
tpm2 mailing list -- <a href="mailto:[email protected]" target="_blank">[email protected]</a><br>
To unsubscribe send an email to <a href="mailto:[email protected]" target="_blank">
[email protected]</a><br>
%(web_page_url)slistinfo%(cgiext)s/%(_internal_name)s</p>
</blockquote>
</div>
</div>
</div>
</div>
</body>
</html>