parallaxsecond / rust-tss-esapi

TSS 2.0 Enhanced System API (ESAPI) Rust wrapper
https://docs.rs/tss-esapi/
Apache License 2.0
85 stars 51 forks source link

Get random authvalues locally instead of from the TPM #508

Closed tgonzalezorlandoarm closed 5 months ago

tgonzalezorlandoarm commented 5 months ago

Currently, the TPM itself is the root of trust for randomness in authvalues used for creating Primary Keys. This is susceptible to physical attacks over the TPM bus.

 * Get authvalues via the 'getrandom' crate

getrandom retrieves random data from the (operating) system sources
and assumes "that the system always provides high-quality
cryptographically secure random data, ideally backed by hardware
entropy sources", so the administrator of the platfrom should take
this into account.

Note: This change may slow down the tests as accessing random values
from the OS instead of the TPM may be slower.
tgonzalezorlandoarm commented 5 months ago

I will create the same PR in main once this is reviewed

Superhepper commented 5 months ago

@tgonzalezorlandoarm I hope you will make a pr for main as well?

tgonzalezorlandoarm commented 5 months ago

@Superhepper yes, done :+1: