salrashid123

similar to https://github.com/aws-samples/sigv4-signing-examples but the varaint below invokes sts.GetCallerIdentity where the AWS_SECRET_ACCESS_KEY is embedded in a TPM

In other words, this sample will seal the AWS_SECRET_ACCESS_KEY inside a TPM and then use the TPM to create an AWS v4 signature at no time does the secret leave the TPM but it can be made to issue an hmac

for more info, see

• https://github.com/salrashid123/tpm2/tree/master/hmac_import

Variant of AWS v4 signing without SDK

• https://github.com/aws-samples/sigv4-signing-examples

but the varaint below invokes sts.GetCallerIdentity

To use, simply export env vars and run the python script below.

The script will manually sign and invoke the api using the AWS_SECRET_ACCESS_KEY as the secret

Procedure to transfer a TPM key from one TPMA to TPMB with policies:

• policy_duplicateselect: TPMB cannot re-export it.
• policy_pcr: allows TPMA to set which PCR values must be preset on B to use this key

see Prevent Chained duplication from A -> B -> C using tpm2_policyduplicationselect

• crate prmiary

• create key

• evict primary to persistent handle 0x81000000

• save key with go-tpm-keyfiles

• load key using go-tpm-keyfile

module main

Generate a primary using the specified format described in ASN.1 Specification for TPM 2.0 Key Files where the template h-2 is described in pg 43 TCG EK Credential Profile

the priamry is formatted for use with openssl

## create the primary

seal an external hmac key to a tpm with a PCR policy

export secret="change this password to a secret"
export plain="foo"
echo -n $secret > hmac.key
hexkey=$(xxd -p -c 256 < hmac.key)
echo $hexkey
echo -n $plain > data.in
openssl dgst -sha256 -mac hmac -macopt hexkey:$hexkey data.in

sample demonstrating cross-usage/compatiblity between

go-tpm go-tpm-keyfile go-tpm-tools

package main

EC permanent handle as parent:

https://www.hansenpartnership.com/draft-bottomley-tpm2-keys.html#section-3.1.8

	// pg26:  7.5.1: https://trustedcomputinggroup.org/wp-content/uploads/TCG-TPM-v2.0-Provisioning-Guidance-Published-v1r1.pdf
	// pg 43: B.4.5 Template H-2: ECC NIST P256 (Storage) https://trustedcomputinggroup.org/wp-content/uploads/TCG-EK-Credential-Profile-V-2.5-R2_published.pdf