sztp: how to get access to TPM vendor-specific-agnostic

[glimchb]

per https://github.com/opiproject/opi-prov-life/blob/main/ZTP.md

we need IDEVID access, public/private keys, certificate, serial number to start SZTP process ...

see IEEE 802.1AR - Secure Device Identity

also see https://github.com/usnistgov/iDevIDCerts

@shachartal @mestery @prasunkapoor @rsb-oss @jainvipin @alknopfler @achilikin @gupta-alok ?

let's start the discussion here, on slack and on our next meeting

[alknopfler]

Doubt I'm having on my table:

• If the agent information should be pre-loaded into the bootstrap server using the API sbd, the certificates should be generated with the serial number information to get:
• serial number : https://github.com/opiproject/sztp/blob/0439da46bff7017e4ef8d51b215f7164aed54b3c/config/sztpd.running.json.template#L102
• certificates: https://github.com/opiproject/sztp/blob/0439da46bff7017e4ef8d51b215f7164aed54b3c/config/sztpd.running.json.template#L95
• artifacts: https://github.com/opiproject/sztp/blob/0439da46bff7017e4ef8d51b215f7164aed54b3c/config/sztpd.running.json.template#L130 So, how could get this information to request to bootstrap first time ??? How could the agent get all this information?

[glimchb]

@alknopfler

1. Customer places an order to DPU vendor to buy DPUs
2. without Security (classic ZTP) - Vendor will send only Serial Numbers of the devices back to the Customer
3. with sZTP - Vendor creates certificates with serial numbers and sends them back to the Customer
4. Vendor places iDEVID (priv key, pub key, certif,..) to the Device's TPM-like storage
5. Customer loads this information to the Bootstrap server using NB APIs or configuration file
6. Devices arrive to the site and powered up
7. Device get URL of the Bootstrap server (via mDNS or SLAAC or DHCP)
8. Device offers iDEVID to the Bootstrap server
9. Bootstrap server verifies iDEVID of the device
10. Bootstrap server optionally sends ownership voucher to the device
11. Bootstrap server sends signed artifacts (OS image, config) to the device
12. Device verifies signed artifacts and starts installation

[glimchb]

also see here https://wiki.archlinux.org/title/Trusted_Platform_Module also see here https://github.com/tpm2-software also see https://github.com/opiproject/sztp/issues/123