Skip to content

Commit bc8a269

Browse files
FoxboronFoxboron
committed
Merge branch 'bitsize'
* bitsize: ssh-tpm-keygen: add --supported switch to list supported bit lengths signer: Implement support for multiple hashing algos key: move to noalg keys to support different hashing algos key: Support importing p256, p386 and p512 ssh-tpm-agent: support creation of p256 p384 and p512 keys key: fetch supported ecdsa bit sizes misc: update to go 1.22
2 parents 79ce85b + ae2e096 commit bc8a269

File tree

10 files changed

+344
-109
lines changed

10 files changed

+344
-109
lines changed

‎.github/workflows/test.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ jobs:
88
strategy:
99
fail-fast: false
1010
matrix:
11-
go: [1.20.x]
11+
go: [1.22.x]
1212
os: [ubuntu-latest]
1313
runs-on: ${{ matrix.os }}
1414
steps:

‎agent/agent_test.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,7 @@ func TestAddKey(t *testing.T) {
4949

5050
client := agent.NewClient(conn)
5151

52-
k, err := key.CreateKey(tpm, tpm2.TPMAlgECDSA, []byte(""), []byte(""))
52+
k, err := key.CreateKey(tpm, tpm2.TPMAlgECDSA, 256, []byte(""), []byte(""))
5353
if err != nil {
5454
t.Fatal(err)
5555
}

‎cmd/ssh-tpm-agent/main_test.go‎

Lines changed: 11 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -104,13 +104,13 @@ func setupServer(listener net.Listener, clientKey ssh.PublicKey) (hostkey ssh.Pu
104104
return hostSigner.PublicKey(), msgSent
105105
}
106106

107-
func runSSHAuth(t *testing.T, keytype tpm2.TPMAlgID) {
107+
func runSSHAuth(t *testing.T, keytype tpm2.TPMAlgID, bits int) {
108108
tpm, err := simulator.OpenSimulator()
109109
if err != nil {
110110
t.Fatal(err)
111111
}
112112

113-
k, err := key.CreateKey(tpm, keytype, []byte(""), []byte(""))
113+
k, err := key.CreateKey(tpm, keytype, bits, []byte(""), []byte(""))
114114
if err != nil {
115115
t.Fatalf("failed creating key: %v", err)
116116
}
@@ -184,10 +184,16 @@ func runSSHAuth(t *testing.T, keytype tpm2.TPMAlgID) {
184184
}
185185

186186
func TestSSHAuth(t *testing.T) {
187-
t.Run("ecdsa - agent", func(t *testing.T) {
188-
runSSHAuth(t, tpm2.TPMAlgECDSA)
187+
t.Run("ecdsa p256 - agent", func(t *testing.T) {
188+
runSSHAuth(t, tpm2.TPMAlgECDSA, 256)
189189
})
190190
t.Run("rsa - agent", func(t *testing.T) {
191-
runSSHAuth(t, tpm2.TPMAlgRSA)
191+
runSSHAuth(t, tpm2.TPMAlgRSA, 2048)
192+
})
193+
t.Run("ecdsa p384 - agent", func(t *testing.T) {
194+
runSSHAuth(t, tpm2.TPMAlgECDSA, 384)
195+
})
196+
t.Run("ecdsa p521 - agent", func(t *testing.T) {
197+
runSSHAuth(t, tpm2.TPMAlgECDSA, 521)
192198
})
193199
}

‎cmd/ssh-tpm-keygen/main.go‎

Lines changed: 26 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -34,8 +34,12 @@ Options:
3434
-f Output keyfile.
3535
-N PIN for the key.
3636
-t ecdsa | rsa Specify the type of key to create. Defaults to ecdsa
37+
-b bits Number of bits in the key to create.
38+
rsa: 2048 (default)
39+
ecdsa: 256 (default) | 384 | 521
3740
-I, --import PATH Import existing key into ssh-tpm-agent.
3841
-A Generate host keys for all key types (rsa and ecdsa).
42+
--supported List the supported keys of the TPM.
3943
4044
Generate new TPM sealed keys for ssh-tpm-agent.
4145
@@ -97,7 +101,9 @@ func main() {
97101
var (
98102
comment, outputFile, keyPin string
99103
keyType, importKey string
104+
bits int
100105
swtpmFlag, hostKeys bool
106+
listsupported bool
101107
)
102108

103109
defaultComment := func() string {
@@ -120,10 +126,12 @@ func main() {
120126
flag.StringVar(&outputFile, "f", "", "output keyfile")
121127
flag.StringVar(&keyPin, "N", "", "new pin for the key")
122128
flag.StringVar(&keyType, "t", "ecdsa", "key to create")
129+
flag.IntVar(&bits, "b", 0, "number of bits")
123130
flag.StringVar(&importKey, "I", "", "import key")
124131
flag.StringVar(&importKey, "import", "", "import key")
125132
flag.BoolVar(&swtpmFlag, "swtpm", false, "use swtpm instead of actual tpm")
126133
flag.BoolVar(&hostKeys, "A", false, "generate host keys")
134+
flag.BoolVar(&listsupported, "supported", false, "list tpm caps")
127135

128136
flag.Parse()
129137

@@ -133,6 +141,16 @@ func main() {
133141
}
134142
defer tpm.Close()
135143

144+
if listsupported {
145+
fmt.Printf("ecdsa bit lengths:")
146+
for _, alg := range key.SupportedECCAlgorithms(tpm) {
147+
fmt.Printf(" %d", alg)
148+
}
149+
fmt.Println()
150+
fmt.Println("rsa bit lengths: 2048")
151+
os.Exit(0)
152+
}
153+
136154
// Generate host keys
137155
if hostKeys {
138156
// Mimics the `ssh-keygen -A -f ./something` behaviour
@@ -141,9 +159,12 @@ func main() {
141159
outputPath = path.Join(outputFile, outputPath)
142160
}
143161

144-
lookup := map[string]tpm2.TPMAlgID{
145-
"rsa": tpm2.TPMAlgRSA,
146-
"ecdsa": tpm2.TPMAlgECDSA,
162+
lookup := map[string]struct {
163+
alg tpm2.TPMAlgID
164+
bits int
165+
}{
166+
"rsa": {alg: tpm2.TPMAlgRSA, bits: 2048},
167+
"ecdsa": {alg: tpm2.TPMAlgECDSA, bits: 256},
147168
}
148169
for n, t := range lookup {
149170
filename := fmt.Sprintf("ssh_tpm_host_%s_key", n)
@@ -156,7 +177,7 @@ func main() {
156177

157178
slog.Info("Generating new host key", slog.String("algorithm", strings.ToUpper(n)))
158179

159-
k, err := key.CreateKey(tpm, t, []byte(""), []byte(defaultComment))
180+
k, err := key.CreateKey(tpm, t.alg, t.bits, []byte(""), []byte(defaultComment))
160181
if err != nil {
161182
log.Fatal(err)
162183
}
@@ -311,7 +332,7 @@ func main() {
311332
log.Fatal(err)
312333
}
313334
} else {
314-
k, err = key.CreateKey(tpm, tpmkeyType, pin, []byte(comment))
335+
k, err = key.CreateKey(tpm, tpmkeyType, bits, pin, []byte(comment))
315336
if err != nil {
316337
log.Fatal(err)
317338
}

‎go.mod‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
module github.com/foxboron/ssh-tpm-agent
22

3-
go 1.20
3+
go 1.22
44

55
require (
66
github.com/foxboron/swtpm_test v0.0.0-20230726224112-46aaafdf7006

‎go.sum‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,14 +6,19 @@ github.com/foxboron/swtpm_test v0.0.0-20230726224112-46aaafdf7006 h1:50sW4r0Pcvl
66
github.com/foxboron/swtpm_test v0.0.0-20230726224112-46aaafdf7006/go.mod h1:eIXCMsMYCaqq9m1KSSxXwQG11krpuNPGP3k0uaWrbas=
77
github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
88
github.com/golang/mock v1.6.0 h1:ErTB+efbowRARo13NNdxyJji2egdxLGQhRaY+DUumQc=
9+
github.com/golang/mock v1.6.0/go.mod h1:p6yTPP+5HYm5mzsMV8JkE6ZKdX+/wYM6Hr+LicevLPs=
910
github.com/google/go-sev-guest v0.6.1 h1:NajHkAaLqN9/aW7bCFSUplUMtDgk2+HcN7jC2btFtk0=
11+
github.com/google/go-sev-guest v0.6.1/go.mod h1:UEi9uwoPbLdKGl1QHaq1G8pfCbQ4QP0swWX4J0k6r+Q=
1012
github.com/google/go-tpm v0.9.1-0.20230807150904-c49efc441a60 h1:WZpppXXHrrk6r76Vn2HPf1S/5MhuVjiaef3FHeLf0vA=
1113
github.com/google/go-tpm v0.9.1-0.20230807150904-c49efc441a60/go.mod h1:FkNVkc6C+IsvDI9Jw1OveJmxGZUUaKxtrpOS47QWKfU=
1214
github.com/google/go-tpm-tools v0.3.13-0.20230620182252-4639ecce2aba h1:qJEJcuLzH5KDR0gKc0zcktin6KSAwL7+jWKBYceddTc=
1315
github.com/google/go-tpm-tools v0.3.13-0.20230620182252-4639ecce2aba/go.mod h1:EFYHy8/1y2KfgTAsx7Luu7NGhoxtuVHnNo8jE7FikKc=
1416
github.com/google/logger v1.1.1 h1:+6Z2geNxc9G+4D4oDO9njjjn2d0wN5d7uOo0vOIW1NQ=
17+
github.com/google/logger v1.1.1/go.mod h1:BkeJZ+1FhQ+/d087r4dzojEg1u2ZX+ZqG1jTUrLM+zQ=
1518
github.com/google/uuid v1.3.0 h1:t6JiXgmwXMjEs8VusXIJk2BXHsn+wx8BZdTaoZ5fu7I=
19+
github.com/google/uuid v1.3.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
1620
github.com/pborman/uuid v1.2.0 h1:J7Q5mO4ysT1dv8hyrUGHb9+ooztCXu1D8MY8DZYsu3g=
21+
github.com/pborman/uuid v1.2.0/go.mod h1:X/NO0urCmaxf9VXbdlT7C2Yzkj2IKimNn4k+gtPdI/k=
1722
github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
1823
github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
1924
github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
@@ -36,8 +41,6 @@ golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACk
3641
golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
3742
golang.org/x/crypto v0.12.0 h1:tFM/ta59kqch6LlvYnPa0yx5a83cL2nHflFhYKvv9Yk=
3843
golang.org/x/crypto v0.12.0/go.mod h1:NF0Gs7EO5K4qLn+Ylc+fih8BSTeIjAP05siRnAh98yw=
39-
golang.org/x/exp v0.0.0-20230801115018-d63ba01acd4b h1:r+vk0EmXNmekl0S0BascoeeoHk/L7wmaW2QF90K+kYI=
40-
golang.org/x/exp v0.0.0-20230801115018-d63ba01acd4b/go.mod h1:FXUEEKJgO7OQYeo8N01OfiKP8RXMtf6e8aTskBGqWdc=
4144
golang.org/x/exp v0.0.0-20230817173708-d852ddb80c63 h1:m64FZMko/V45gv0bNmrNYoDEq8U5YUhetc9cBWKS1TQ=
4245
golang.org/x/exp v0.0.0-20230817173708-d852ddb80c63/go.mod h1:0v4NqG35kSWCMzLaMeX+IQrlSnVE/bqGSyC2cz/9Le8=
4346
golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
@@ -65,7 +68,9 @@ golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8T
6568
golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
6669
golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
6770
google.golang.org/protobuf v1.28.0 h1:w43yiav+6bVFTBQFZX0r7ipe9JQ1QsbMgHwbBziscLw=
71+
google.golang.org/protobuf v1.28.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
6872
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
6973
gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
7074
gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
7175
gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
76+
gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

0 commit comments

Comments
 (0)