{"id":21354873,"url":"https://github.com/salrashid123/tls_ak","last_synced_at":"2026-02-26T20:39:46.879Z","repository":{"id":181235939,"uuid":"657862501","full_name":"salrashid123/tls_ak","owner":"salrashid123","description":"TPM based TLS using Attested Keys","archived":false,"fork":false,"pushed_at":"2024-05-13T11:36:51.000Z","size":230,"stargazers_count":3,"open_issues_count":0,"forks_count":0,"subscribers_count":2,"default_branch":"main","last_synced_at":"2024-06-21T18:47:10.241Z","etag":null,"topics":["attestation","tls","trusted-platform-module"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/salrashid123.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2023-06-24T03:41:36.000Z","updated_at":"2024-05-13T11:36:55.000Z","dependencies_parsed_at":"2024-05-13T12:46:05.955Z","dependency_job_id":"02d2e565-9412-4d28-88cb-e4b74003377a","html_url":"https://github.com/salrashid123/tls_ak","commit_stats":null,"previous_names":["salrashid123/tls_ak"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/salrashid123%2Ftls_ak","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/salrashid123%2Ftls_ak/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/salrashid123%2Ftls_ak/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/salrashid123%2Ftls_ak/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/salrashid123","download_url":"https://codeload.github.com/salrashid123/tls_ak/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":225839601,"owners_count":17532308,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["attestation","tls","trusted-platform-module"],"created_at":"2024-11-22T04:14:47.967Z","updated_at":"2026-02-26T20:39:46.865Z","avatar_url":"https://github.com/salrashid123.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"## TPM based TLS using Attested Keys\n\n`TLS` where the private key on the server is bound to its `Trusted Platform Module (TPM)`.  That same TLS key is also attested through full [TPM Remote Attestation](https://tpm2-software.github.io/tpm2-tss/getting-started/2019/12/18/Remote-Attestation.html).\n\nTPM based TLS is a known technology where the private key used for TLS is embedded inside a\npeer's `Trusted Platform Module (TPM)`. However, TLS usually requires an x509 certificate which is\nitself signed by a certificate authority the peer trusts. The remote client has to trust the certificate\nissuer and that the private key resides on a TPM.\n\nThis repo describes steps whereby a remote party uses standard [TPM Remote Attestation](https://tpm2-software.github.io/tpm2-tss/getting-started/2019/12/18/Remote-Attestation.html) to ensure a keypair is resident on a TPM and then establishes TLS to the remote host by comparing\nthe peer's Public Key values during session setup. The distinguishing characteristic of this flow is\nthe TLS Certificate by itself or the CA that the peer uses is not necessarily trusted but serves as a\nconduit to create the TLS session and derive the fact that the session uses the trusted public key\non the TPM. The client trusts the TLS session not based on the x509 certificate alone of the peer or\nCA but by comparing the Public Key used in the session matches what is on the TPM confirmed\nthrough remote attestation and certification of the key.\n\nEssentially, the trusted authority that issues the x509 certificate for TLS is not strictly trusted but yet the\nclient can ensure the TLS session terminates on a device that is confirmed to host the session's private key\n\nThis ensures the client is connecting to the remote host where the TPM resides\n\n\n1. Server starts the gRPC service with default TLS configuration using ordinary rsa key files\n2. Server creates an `Attestation Key (AK)`\n3. Server creates a new elliptic key on the TPM for TLS and uses the attestation key to certify it.\n4. Server issues an `x509` using a local CA for the key in step 3\n5. Server launches a new `HTTPS` server where the server certificate and private key from step 3\n\n6. Client contacts server over default TLS and requests its `Endorsement Public Key (EKPub)`\n7. Client contacts server requesting `Attestation Key (AK)`\n8. Client and Server perform TPM [Remote Attestation](https://tpm2-software.github.io/tpm2-tss/getting-started/2019/12/18/Remote-Attestation.html)\n9. CLient and Server perform TPM [Quote-Verify](https://github.com/salrashid123/tpm2/tree/master/quote_verify) to ensure the server state is correct\n10. Client connects to server and requests the attested TLS key from step 3.\n11. Client verifies the TLS key is attested by the AK\n\n10. Client connects to the HTTPs server and compares the TLS sessions EC Public Key is the same as step step 11 (meaning its talking to that TPM's key)\n\nBasically the `gRPC` server part (1-\u003e11) does some background steps to establish trust on the EC key.\n\nAfter that, a new `HTTPS` server is launched which uses the EC Key on the TPM and a certificate signed by a local CA.\n\n![images/flow.png](images/flow.png)\n\nso whats so good about this?  well, your client is _assured_ that they are terminating the TLS connection on that VM that includes that specific TPM.\n\nNote the part where CA certificate (local or otherwise) which issues the x509 (step 4) isn't the critical part in this flow:  the fact that the attested _EC Public Key matches whats in the certificate and TLS session is important_.  If you wanted, instead of the attestor's CA that issues the x509, the server could have sent a CSR to the client (or privacy CA) for issuance.\n\nfor reference, see\n\n* [TPM remote attestation: How can I trust you?](https://community.infineon.com/t5/Blogs/TPM-remote-attestation-How-can-I-trust-you/ba-p/452729)\n* [OpenEnclave AttestedTLS](https://github.com/openenclave/openenclave/blob/master/samples/attested_tls/AttestedTLSREADME.md)\n* [Using Attestation in Transport Layer Security (TLS) and Datagram Transport Layer Security (DTLS)](https://datatracker.ietf.org/doc/draft-fossati-tls-attestation/)\n* [BlindLlama TLS](https://blindllama.mithrilsecurity.io/en/latest/docs/concepts/TPMs/) \n* [TPM 2.0 Keys for Device Identity and Attestation](https://trustedcomputinggroup.org/wp-content/uploads/TPM-2p0-Keys-for-Device-Identity-and-Attestation_v1_r12_pub10082021.pdf) (`5.2 OEM Creation of IAK and IDevID in a Single Pass`)\n\n---\n\n\u003e\u003e NOTE: this repo and code is *not* supported by google\n\n---\n\n### Setup\n\nThere are two ways to test this:\n\n1. locally with your laptop \n2. on a cloud vm (eg GCP confidential VM with a TPM)\n\nIn both cases, you'll need to have access to the eventlog on the attestor, eg this should return values only on the attestor\n\n```bash\nsudo tpm2_eventlog /sys/kernel/security/tpm0/binary_bios_measurement\n```\n\nIn both cases, the EK Cert needs to get verified to the roots so there is a bit of legwork in getting the cert chain setup\n\n\n#### Local \n\nYou can also verify this demo locally if your user has access to both the TPM and the event log. \n\nFor me, the TPM was issued by `C=CH, O=STMicroelectronics NV, CN=STSAFE TPM RSA Intermediate CA 10`\n\nfor which the verification  certs were found [here](https://www.st.com/resource/en/technical_note/tn1330-st-trusted-platform-module-tpm-endorsement-key-ek-certificates-stmicroelectronics.pdf)\n\n```bash\n## ekpublic\n$ tpm2_createek -c ek.ctx -G rsa -u ek.pub \n$ tpm2_readpublic -c ek.ctx -o ek.pem -f PEM -Q\n\n## ekcert\n$ tpm2_getekcertificate -X -o ECcert.bin\n$ openssl x509 -in ECcert.bin -inform DER -noout -text\n\n    Certificate:\n        Data:\n            Version: 3 (0x2)\n            Serial Number:\n                7e:36:61:65:3e:7b:5a:81:74:3d:03:f1:1a:92:56:ec:ff:be:04:81\n            Signature Algorithm: sha384WithRSAEncryption\n            Issuer: C=CH, O=STMicroelectronics NV, CN=STSAFE TPM RSA Intermediate CA 10  \u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\n            Validity\n                Not Before: Apr 16 10:33:45 2023 GMT\n                Not After : Dec 31 23:59:59 9999 GMT\n            Subject: \n            Subject Public Key Info:\n                Public Key Algorithm: rsaEncryption\n                    Public-Key: (2048 bit)\n                    Modulus:\n                        00:d2:c8:63:53:\n                    Exponent: 65537 (0x10001)\n            X509v3 extensions:\n                X509v3 Authority Key Identifier: \n                    65:70:62:A7:10:56:91:6F:8C:7F:79:8A:92:DD:E6:D8:1D:0A:98:DA\n                X509v3 Subject Alternative Name: critical\n                    DirName:/tcg-at-tpmManufacturer=id:53544D20/tcg-at-tpmModel=ST33KTPM2X/tcg-at-tpmVersion=id:00090100\n                X509v3 Subject Directory Attributes: \n                    TPM Specification:\n        0:d=0  hl=2 l=  12 cons: SEQUENCE          \n        2:d=1  hl=2 l=   3 prim:  UTF8STRING        :2.0\n        7:d=1  hl=2 l=   1 prim:  INTEGER           :00\n        10:d=1  hl=2 l=   2 prim:  INTEGER           :9F\n\n\n                X509v3 Basic Constraints: critical\n                    CA:FALSE\n                X509v3 Extended Key Usage: \n                    Endorsement Key Certificate\n                X509v3 Key Usage: critical\n                    Key Encipherment\n                Authority Information Access: \n                    CA Issuers - URI:http://sw-center.st.com/STSAFE/stsafetpmrsaint10.crt \u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\n```\n\nfor my local tpm, the value for the EKCert had an issuer below so we  need to get that too\n\n```bash\n### STSAFE TPM RSA Intermediate CA 10 http://sw-center.st.com/STSAFE/stsafetpmrsaint10.crt\n$ wget http://sw-center.st.com/STSAFE/stsafetpmrsaint10.crt\n\n$ openssl x509 -in stsafetpmrsaint10.crt -inform DER -noout -text\n\n    Certificate:\n        Data:\n            Version: 3 (0x2)\n            Serial Number: 1073741840 (0x40000010)\n            Signature Algorithm: sha384WithRSAEncryption\n            Issuer: C=CH, O=STMicroelectronics NV, CN=STSAFE RSA Root CA 02\n            Validity\n                Not Before: Jan 20 00:00:00 2022 GMT\n                Not After : Jan  1 00:00:00 2042 GMT\n            Subject: C=CH, O=STMicroelectronics NV, CN=STSAFE TPM RSA Intermediate CA 10\n            Subject Public Key Info:\n                Public Key Algorithm: rsaEncryption\n                    Public-Key: (4096 bit)\n                    Modulus:\n                        00:cb:b5:33:...\n                    Exponent: 65537 (0x10001)\n            X509v3 extensions:\n                X509v3 Subject Key Identifier: \n                    65:70:62:A7:10:56:91:6F:8C:7F:79:8A:92:DD:E6:D8:1D:0A:98:DA\n                X509v3 Authority Key Identifier: \n                    7C:C2:8D:BE:6E:59:D8:4A:54:03:46:9B:13:08:00:D2:F8:F0:6D:27\n                X509v3 Certificate Policies: critical\n                    Policy: X509v3 Any Policy\n                    CPS: http://sw-center.st.com/STSAFE/\n                X509v3 Key Usage: critical\n                    Certificate Sign, CRL Sign\n                X509v3 Basic Constraints: critical\n                    CA:TRUE, pathlen:0\n                Authority Information Access: \n                    CA Issuers - URI:http://sw-center.st.com/STSAFE/STSAFERsaRootCA02.crt \u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\n                X509v3 CRL Distribution Points: \n                    Full Name:\n                    URI:http://sw-center.st.com/STSAFE/STSAFERsaRootCA02.crl\n\n        Signature Algorithm: sha384WithRSAEncryption \n\n```\n\nWhich you can also get from the doc above, page 5 \n\nTo get the root, again on pg5 of the doc `STSAFE RSA Root CA 02 http://sw-center.st.com/STSAFE/STSAFERsaRootCA02.crt`\n\n```bash\n$ wget  http://sw-center.st.com/STSAFE/STSAFERsaRootCA02.crt\n$ openssl x509 -in STSAFERsaRootCA02.crt  -inform DER -noout -text\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number: 93583579283458 (0x551d20000002)\n        Signature Algorithm: sha384WithRSAEncryption\n        Issuer: C=CH, O=STMicroelectronics NV, CN=STSAFE RSA Root CA 02\n        Validity\n            Not Before: Jan 20 00:00:00 2022 GMT\n            Not After : Dec 31 00:00:00 9999 GMT\n        Subject: C=CH, O=STMicroelectronics NV, CN=STSAFE RSA Root CA 02\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncryption\n                Public-Key: (4096 bit)\n                Modulus:\n                    00:c8:3b:47:6d:..\n                Exponent: 65537 (0x10001)\n        X509v3 extensions:\n            X509v3 Subject Key Identifier: \n                7C:C2:8D:BE:6E:59:D8:4A:54:03:46:9B:13:08:00:D2:F8:F0:6D:27\n            X509v3 Key Usage: critical\n                Certificate Sign, CRL Sign\n            X509v3 Basic Constraints: critical\n                CA:TRUE\n    Signature Algorithm: sha384WithRSAEncryption\n```\n\nThe PCR values `PCR0` were:\n\n```bash\n$ tpm2_pcrread\n  sha256:\n    0 : 0x7BB4353897632FD086982175A027DAFCC33F61ADBAB4EBFC6D13927B97A8C084\n```\n\nNow, both of these are DER files so to convert to PEM:\n\n```bash\nopenssl x509 -in stsafetpmrsaint10.crt -inform DER -noout -text certs/stsafetpmrsaint10.pem\nopenssl x509 -in STSAFERsaRootCA02.crt -inform DER -noout -text -out certs/stmtpmekroot.pem\n```\n\nSo to run, i used\n\n```bash\ngo run server/grpc_attestor.go --grpcport :50051 --applicationPort :8081  --v=10 -alsologtostderr\n\nexport ATTESTOR_ADDRESS=127.0.0.1\ngo run client/grpc_verifier.go --host=127.0.0.1:50051 \\\n   --appaddress=$ATTESTOR_ADDRESS:8081      --ekintermediateCA=certs/stsafetpmrsaint10.pem  --ekrootCA=certs/stmtpmekroot.pem  --expectedPCRMapSHA256=0:7bb4353897632fd086982175a027dafcc33f61adbab4ebfc6d13927b97a8c084     --v=10 -alsologtostderr\n```\n\nThe output is like this on both ends\n\n#### Verifier\n\n```bash\n$ go run client/grpc_verifier.go --host=127.0.0.1:50051 \\\n   --appaddress=$ATTESTOR_ADDRESS:8081   \\\n      --ekintermediateCA=certs/stsafetpmrsaint10.pem  \\\n       --ekrootCA=certs/stmtpmekroot.pem \\\n        --expectedPCRMapSHA256=0:7bb4353897632fd086982175a027dafcc33f61adbab4ebfc6d13927b97a8c084 \\\n            --v=10 -alsologtostderr\n\nI1004 15:17:10.506757 3468104 grpc_verifier.go:95] =============== start GetEK ===============\nI1004 15:17:10.516616 3468104 grpc_verifier.go:235]         EKCertificate ========\n-----BEGIN CERTIFICATE-----\nMIIFDzCCAvegAwIBAgIUfjZhZT57WoF0PQPxGpJW7P++BIEwDQYJKoZIhvcNAQEM\nBQAwWTELMAkGA1UEBhMCQ0gxHjAcBgNVBAoTFVNUTWljcm9lbGVjdHJvbmljcyBO\nVjEqMCgGA1UEAxMhU1RTQUZFIFRQTSBSU0EgSW50ZXJtZWRpYXRlIENBIDEwMCAX\nDTIzMDQxNjEwMzM0NVoYDzk5OTkxMjMxMjM1OTU5WjAAMIIBIjANBgkqhkiG9w0B\nAQEFAAOCAQ8AMIIBCgKCAQEA0shjU+4tGz+FRFoe4SVxNtZA7hGxA1MeC891SLmn\nOMiXGZGgBJGPv+USVLY2OJFln4X94vvNE1Rh06HFG9FoPBA//coeFavi7cjV9GUh\n3beY8wX6ergOMTxl38xbiBN6LKYuqwQ51wuMrOB5Q0n8XIJwjCfnSWGCAo16FadU\nxteEixOuWbHW+If7T/j3FsHzD+QCbCYrQ1AzrHCHNsiwMAyKXdIncJnNaKi8qLDl\nD4IXT2RbjijSoAFWO086Li5gwtVVoMULN4B4d83309EI11LvCiNCWGAJZ7pxTME7\n+WJMurXcJec19c9M4YrjEAEggxfxKc+Bktv1ibCCeOegVwIDAQABo4IBJDCCASAw\nHwYDVR0jBBgwFoAUZXBipxBWkW+Mf3mKkt3m2B0KmNowVwYDVR0RAQH/BE0wS6RJ\nMEcxFjAUBgVngQUCAQwLaWQ6NTM1NDREMjAxFTATBgVngQUCAgwKU1QzM0tUUE0y\nWDEWMBQGBWeBBQIDDAtpZDowMDA5MDEwMDAiBgNVHQkEGzAZMBcGBWeBBQIQMQ4w\nDAwDMi4wAgEAAgIAnzAMBgNVHRMBAf8EAjAAMBAGA1UdJQQJMAcGBWeBBQgBMA4G\nA1UdDwEB/wQEAwIFIDBQBggrBgEFBQcBAQREMEIwQAYIKwYBBQUHMAKGNGh0dHA6\nLy9zdy1jZW50ZXIuc3QuY29tL1NUU0FGRS9zdHNhZmV0cG1yc2FpbnQxMC5jcnQw\nDQYJKoZIhvcNAQEMBQADggIBAKNipPkkgRUMAyTJh8xWRAmOP2put6d/DEuVsYRn\nhvsVwJPUYc2Ki1hm8fy8OCnRAcChwQDj0tgcyAjol1qusSG5Z+pkIwdet4WLcYiE\n0uf/EWMz4xvsmIDDIpn38flbAM+5XjsVczGC8/WM2DFxSllmmD5BpZDm0tBDnwCU\n3bpBNoeUZ/gGoYNdDxWPnwqc5Zy1+AheaigQzGUPFKRU2xMuBkOTmdJgY357dvLZ\nvVrJUWGSJq8Ee/bRgj/UFFPABLFQgV8S8x7HnMxmwUUwgHC3F94wEs5/mo/VQXbU\nuJ2TlKhT3Dy/3ssKjNgVOnIOb7G54yjg2CzR8ncI9oz0QGJm4P243Zv+iBSsKTXb\n2di1CxWuuE7s23ajExBnTKTfnERfeHbtiT8MUqre02kDHX8ql/xrM0fOq02+JODZ\nU0DnsZI3wXDEvjRy8X+GyiDGU+wnpgycSNzoSAWvvIRxRdqcaZ4QJh9diABX41CE\nteI4QdS32b7LejPcbJH566NhlPReZDFgssIEGjdYYLaGFZdya3YEqgZMfyRfVL16\n93DBivvYwgtyqQj+aKAhAGLJTQEXqdQh662hMPZ5bBQS8FZ8MncS6CodLYvsXJUw\nqYloxK9lcNDk0rkIibqzSUL1+lPbpQwE2xV+LQZbNIyj2hQ6XTYmwrsT+C8Fp/vU\nCfz7\n-----END CERTIFICATE-----\n\nI1004 15:17:10.516782 3468104 grpc_verifier.go:251]      EKCert  Issuer CN=STSAFE TPM RSA Intermediate CA 10,O=STMicroelectronics NV,C=CH\nI1004 15:17:10.516869 3468104 grpc_verifier.go:252]      EKCert  IssuingCertificateURL [http://sw-center.st.com/STSAFE/stsafetpmrsaint10.crt]\nI1004 15:17:10.516898 3468104 grpc_verifier.go:257]     Verifying EKCert\nI1004 15:17:10.517241 3468104 grpc_verifier.go:285]      EKCert Includes tcg-kp-EKCertificate ExtendedKeyUsage 2.23.133.8.1\nI1004 15:17:10.519039 3468104 grpc_verifier.go:312]     EKCert Verified\nI1004 15:17:10.519095 3468104 grpc_verifier.go:314]      EKPub: \n-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0shjU+4tGz+FRFoe4SVx\nNtZA7hGxA1MeC891SLmnOMiXGZGgBJGPv+USVLY2OJFln4X94vvNE1Rh06HFG9Fo\nPBA//coeFavi7cjV9GUh3beY8wX6ergOMTxl38xbiBN6LKYuqwQ51wuMrOB5Q0n8\nXIJwjCfnSWGCAo16FadUxteEixOuWbHW+If7T/j3FsHzD+QCbCYrQ1AzrHCHNsiw\nMAyKXdIncJnNaKi8qLDlD4IXT2RbjijSoAFWO086Li5gwtVVoMULN4B4d83309EI\n11LvCiNCWGAJZ7pxTME7+WJMurXcJec19c9M4YrjEAEggxfxKc+Bktv1ibCCeOeg\nVwIDAQAB\n-----END PUBLIC KEY-----\n\nI1004 15:17:10.519175 3468104 grpc_verifier.go:330] =============== end GetEKCert ===============\nI1004 15:17:10.519211 3468104 grpc_verifier.go:333] =============== start GetAK ===============\nI1004 15:17:10.941154 3468104 grpc_verifier.go:366]       ak public \n-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzIVIhExwXD6mAWq2DDNm\nSOCQgbJjgBAhXocB3X92QAb2Mq9/uq7qCuUelpKkJG0yXg47XDWb5HwiME67lZZX\nYwOfPufTcyEZGZtoZ7HPYaGE1P8tToMsvBcL7B72f0LsRTovT2z/0eUhu3qZYUk4\npJTjGA2Avp6q6oRL8LvXZu/663Z9tpA1N636PISYaqfIDjF96/C3Zs21FAByZuGP\nAUbMkIBTKbohTET+3ub0jAJC4lluoj5IHvh2DDFntKkp3IrWkFDYsr7Er718aaXO\n+WqNQlD6+rSe96Xriuupuepl69MILBBi6/EUblsainMiqnlD3U6bOOUSMtKFyaUm\nfQIDAQAB\n-----END PUBLIC KEY-----\n\nI1004 15:17:10.941248 3468104 grpc_verifier.go:367] =============== end GetAK ===============\nI1004 15:17:10.941291 3468104 grpc_verifier.go:370] =============== start Attest ===============\nI1004 15:17:10.941821 3468104 grpc_verifier.go:383]       Outbound Secret: 0aoYEFewrDlouNNFVg352om8xeKlmG2YXfQnn0fZiww=\nI1004 15:17:12.944150 3468104 grpc_verifier.go:399]       Inbound Secret: 0aoYEFewrDlouNNFVg352om8xeKlmG2YXfQnn0fZiww=\nI1004 15:17:12.944252 3468104 grpc_verifier.go:402]       inbound/outbound Secrets Match; accepting AK\nI1004 15:17:12.944296 3468104 grpc_verifier.go:407] =============== end Attest ===============\nI1004 15:17:12.944328 3468104 grpc_verifier.go:410] =============== start Quote/Verify ===============\nI1004 15:17:19.159058 3468104 grpc_verifier.go:455]       quote-attested public \n-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzIVIhExwXD6mAWq2DDNm\nSOCQgbJjgBAhXocB3X92QAb2Mq9/uq7qCuUelpKkJG0yXg47XDWb5HwiME67lZZX\nYwOfPufTcyEZGZtoZ7HPYaGE1P8tToMsvBcL7B72f0LsRTovT2z/0eUhu3qZYUk4\npJTjGA2Avp6q6oRL8LvXZu/663Z9tpA1N636PISYaqfIDjF96/C3Zs21FAByZuGP\nAUbMkIBTKbohTET+3ub0jAJC4lluoj5IHvh2DDFntKkp3IrWkFDYsr7Er718aaXO\n+WqNQlD6+rSe96Xriuupuepl69MILBBi6/EUblsainMiqnlD3U6bOOUSMtKFyaUm\nfQIDAQAB\n-----END PUBLIC KEY-----\n\nI1004 15:17:19.159315 3468104 grpc_verifier.go:482]      quotes verified\nI1004 15:17:19.159671 3468104 grpc_verifier.go:518] =============== end Quote/Verify ===============\nI1004 15:17:19.159734 3468104 grpc_verifier.go:521] =============== start NewKey ===============\nI1004 15:17:19.571076 3468104 grpc_verifier.go:533]         TLSCertificate ========\n-----BEGIN CERTIFICATE-----\nMIIDdDCCAlygAwIBAgIQf3NkrwTMf3NuYmgaPXKNFTANBgkqhkiG9w0BAQsFADBX\nMQswCQYDVQQGEwJVUzEPMA0GA1UECgwGR29vZ2xlMRMwEQYDVQQLDApFbnRlcnBy\naXNlMSIwIAYDVQQDDBlTaW5nbGUgUm9vdCBUTFMgSXNzdWVyIENBMB4XDTI1MTAw\nNDA2MTcwMloXDTI1MTAwNTA2MTcwMlowgcoxCzAJBgNVBAYTAlVTMRMwEQYDVQQI\nEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1Nb3VudGFpbiBWaWV3MRAwDgYDVQQKEwdB\nY21lIENvMRMwEQYDVQQLEwpFbnRlcnByaXNlMTgwNgYDVQQDDC90cG1fc2VydmVy\nIDY2YjU1YTNkLWUxY2ItNDZkNi05MjhmLWM4MjRhZjI4ZjdjZjEtMCsGA1UEBRMk\nNjZiNTVhM2QtZTFjYi00NmQ2LTkyOGYtYzgyNGFmMjhmN2NmMFkwEwYHKoZIzj0C\nAQYIKoZIzj0DAQcDQgAEJzdCPv9URzkVwuehzHfVbvLSF8wykTHu5ZEzf49yC8Cg\n6UOqe+JR5B/mgFCgCxY/hZzPwOgvS3SIVyGHQWU4sKOBkjCBjzAOBgNVHQ8BAf8E\nBAMCB4AwEwYDVR0lBAwwCgYIKwYBBQUHAwEwDAYDVR0TAQH/BAIwADAfBgNVHSME\nGDAWgBRbzaql97VlJoV0gg2BK5pBDzb68DAaBgNVHREEEzARgg9lY2hvLmRvbWFp\nbi5jb20wHQYDVR0gBBYwFDAIBgZngQULAQEwCAYGZ4EFCwECMA0GCSqGSIb3DQEB\nCwUAA4IBAQAlM++WRmMPtQuBuLVxYPI07mp/1TFjm5xPKZMGvIif6UMxGHsqhSyt\n3XRS+crVV1Apx2ZdOJvZ3keNvfp9yyyFTiL+iX2/S9//9DkB5XuHbshFK0vv4uxC\noF+7qoe4iZSNi8hUmr+dZElLR/VVC3Qlbxqchq7aZs0cyTBo80JaL7tWNVSZwgR8\nNYeimADu6dfIWfr2Jrf7pO9MSvvT6yLwMPeVCmEAXIzruuaSpaIUjmN7aHAlOxsa\nHeLD6WHFmpdnloEawW0Q8D15yDi8iwyGdIDDpY4Cu9vcqQwAm8k+6229mhlsvBkG\nVyXrQ9YSVBCmRBuVxNG7bpOwMLmYFRnQ\n-----END CERTIFICATE-----\n\nI1004 15:17:19.571295 3468104 grpc_verifier.go:541]         TLCertificate Issuer CN: Single Root TLS Issuer CA\nI1004 15:17:19.571385 3468104 grpc_verifier.go:542]         TLCertificate Subjec : SERIALNUMBER=66b55a3d-e1cb-46d6-928f-c824af28f7cf,CN=tpm_server 66b55a3d-e1cb-46d6-928f-c824af28f7cf,OU=Enterprise,O=Acme Co,L=Mountain View,ST=California,C=US\nI1004 15:17:19.571445 3468104 grpc_verifier.go:545]         Extension: OID: 2.5.29.15, Critical: true, Value (DER): 03020780\nI1004 15:17:19.571509 3468104 grpc_verifier.go:545]         Extension: OID: 2.5.29.37, Critical: false, Value (DER): 300a06082b06010505070301\nI1004 15:17:19.571542 3468104 grpc_verifier.go:545]         Extension: OID: 2.5.29.19, Critical: true, Value (DER): 3000\nI1004 15:17:19.571562 3468104 grpc_verifier.go:545]         Extension: OID: 2.5.29.35, Critical: false, Value (DER): 301680145bcdaaa5f7b565268574820d812b9a410f36faf0\nI1004 15:17:19.571584 3468104 grpc_verifier.go:545]         Extension: OID: 2.5.29.17, Critical: false, Value (DER): 3011820f6563686f2e646f6d61696e2e636f6d\nI1004 15:17:19.571600 3468104 grpc_verifier.go:545]         Extension: OID: 2.5.29.32, Critical: false, Value (DER): 3014300806066781050b0101300806066781050b0102\nI1004 15:17:19.571642 3468104 grpc_verifier.go:558]        public key from cert \n-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEJzdCPv9URzkVwuehzHfVbvLSF8wy\nkTHu5ZEzf49yC8Cg6UOqe+JR5B/mgFCgCxY/hZzPwOgvS3SIVyGHQWU4sA==\n-----END PUBLIC KEY-----\n\nI1004 15:17:19.571957 3468104 grpc_verifier.go:629]      Certified TPMNTPublic key matches public key in x509 certificate\nI1004 15:17:19.572022 3468104 grpc_verifier.go:635]      TLS key verified\nI1004 15:17:19.572090 3468104 grpc_verifier.go:636] =============== end NewKey ===============\nI1004 15:17:19.572155 3468104 grpc_verifier.go:639] =============== start http client ===============\nI1004 15:17:19.697417 3468104 grpc_verifier.go:704]       Issuer CN=Single Root TLS Issuer CA,OU=Enterprise,O=Google,C=US\nI1004 15:17:19.697540 3468104 grpc_verifier.go:717]        peer public key \n-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEJzdCPv9URzkVwuehzHfVbvLSF8wy\nkTHu5ZEzf49yC8Cg6UOqe+JR5B/mgFCgCxY/hZzPwOgvS3SIVyGHQWU4sA==\n-----END PUBLIC KEY-----\n\nI1004 15:17:19.697575 3468104 grpc_verifier.go:726]      peer tls public key matched attested key\nI1004 15:17:19.697605 3468104 grpc_verifier.go:733]      Connected to IP: 127.0.0.1\nI1004 15:17:19.698565 3468104 grpc_verifier.go:752] 200 OK\nI1004 15:17:19.698690 3468104 grpc_verifier.go:753] ok\n```\n\n#### Attestor\n\n```bash\n$ sudo go run server/grpc_attestor.go --grpcport :50051 --applicationPort :8081  --v=30 -alsologtostderr\n\nI1004 15:17:00.757803 3467978 grpc_attestor.go:317] Getting EKCert\nI1004 15:17:00.775051 3467978 grpc_attestor.go:337] ECCert with available Issuer: CN=STSAFE TPM RSA Intermediate CA 10,O=STMicroelectronics NV,C=CH\nI1004 15:17:02.298713 3467978 grpc_attestor.go:433] Generated ECC Public \n-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEJzdCPv9URzkVwuehzHfVbvLSF8wy\nkTHu5ZEzf49yC8Cg6UOqe+JR5B/mgFCgCxY/hZzPwOgvS3SIVyGHQWU4sA==\n-----END PUBLIC KEY-----\nI1004 15:17:02.298775 3467978 grpc_attestor.go:446]         Issuing Cert ========\nI1004 15:17:02.421868 3467978 grpc_attestor.go:524]       CSR \n-----BEGIN CERTIFICATE REQUEST-----\nMIIBtDCCAVoCAQAwgcoxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlh\nMRYwFAYDVQQHEw1Nb3VudGFpbiBWaWV3MRAwDgYDVQQKEwdBY21lIENvMRMwEQYD\nVQQLEwpFbnRlcnByaXNlMTgwNgYDVQQDDC90cG1fc2VydmVyIDY2YjU1YTNkLWUx\nY2ItNDZkNi05MjhmLWM4MjRhZjI4ZjdjZjEtMCsGA1UEBRMkNjZiNTVhM2QtZTFj\nYi00NmQ2LTkyOGYtYzgyNGFmMjhmN2NmMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcD\nQgAEJzdCPv9URzkVwuehzHfVbvLSF8wykTHu5ZEzf49yC8Cg6UOqe+JR5B/mgFCg\nCxY/hZzPwOgvS3SIVyGHQWU4sKAtMCsGCSqGSIb3DQEJDjEeMBwwGgYDVR0RBBMw\nEYIPZWNoby5kb21haW4uY29tMAoGCCqGSM49BAMCA0gAMEUCIE/ZCjf7HEBjF2QE\nhxL4l2sgFq5sWlFCjHrzJmITQbSbAiEA1N8gmXtDQdpomKs3VtBh/rYkXNBIz6NG\n01uvVveXZN4=\n-----END CERTIFICATE REQUEST-----\n\nI1004 15:17:02.424826 3467978 grpc_attestor.go:583]         cert Issuer CN=Single Root TLS Issuer CA,OU=Enterprise,O=Google,C=US\nI1004 15:17:02.424876 3467978 grpc_attestor.go:586]         Issued Certificate ========\n-----BEGIN CERTIFICATE-----\nMIIDdDCCAlygAwIBAgIQf3NkrwTMf3NuYmgaPXKNFTANBgkqhkiG9w0BAQsFADBX\nMQswCQYDVQQGEwJVUzEPMA0GA1UECgwGR29vZ2xlMRMwEQYDVQQLDApFbnRlcnBy\naXNlMSIwIAYDVQQDDBlTaW5nbGUgUm9vdCBUTFMgSXNzdWVyIENBMB4XDTI1MTAw\nNDA2MTcwMloXDTI1MTAwNTA2MTcwMlowgcoxCzAJBgNVBAYTAlVTMRMwEQYDVQQI\nEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1Nb3VudGFpbiBWaWV3MRAwDgYDVQQKEwdB\nY21lIENvMRMwEQYDVQQLEwpFbnRlcnByaXNlMTgwNgYDVQQDDC90cG1fc2VydmVy\nIDY2YjU1YTNkLWUxY2ItNDZkNi05MjhmLWM4MjRhZjI4ZjdjZjEtMCsGA1UEBRMk\nNjZiNTVhM2QtZTFjYi00NmQ2LTkyOGYtYzgyNGFmMjhmN2NmMFkwEwYHKoZIzj0C\nAQYIKoZIzj0DAQcDQgAEJzdCPv9URzkVwuehzHfVbvLSF8wykTHu5ZEzf49yC8Cg\n6UOqe+JR5B/mgFCgCxY/hZzPwOgvS3SIVyGHQWU4sKOBkjCBjzAOBgNVHQ8BAf8E\nBAMCB4AwEwYDVR0lBAwwCgYIKwYBBQUHAwEwDAYDVR0TAQH/BAIwADAfBgNVHSME\nGDAWgBRbzaql97VlJoV0gg2BK5pBDzb68DAaBgNVHREEEzARgg9lY2hvLmRvbWFp\nbi5jb20wHQYDVR0gBBYwFDAIBgZngQULAQEwCAYGZ4EFCwECMA0GCSqGSIb3DQEB\nCwUAA4IBAQAlM++WRmMPtQuBuLVxYPI07mp/1TFjm5xPKZMGvIif6UMxGHsqhSyt\n3XRS+crVV1Apx2ZdOJvZ3keNvfp9yyyFTiL+iX2/S9//9DkB5XuHbshFK0vv4uxC\noF+7qoe4iZSNi8hUmr+dZElLR/VVC3Qlbxqchq7aZs0cyTBo80JaL7tWNVSZwgR8\nNYeimADu6dfIWfr2Jrf7pO9MSvvT6yLwMPeVCmEAXIzruuaSpaIUjmN7aHAlOxsa\nHeLD6WHFmpdnloEawW0Q8D15yDi8iwyGdIDDpY4Cu9vcqQwAm8k+6229mhlsvBkG\nVyXrQ9YSVBCmRBuVxNG7bpOwMLmYFRnQ\n-----END CERTIFICATE-----\n\nI1004 15:17:02.424957 3467978 grpc_attestor.go:600]         Issued certificate tied to PubicKey ========\n-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEJzdCPv9URzkVwuehzHfVbvLSF8wy\nkTHu5ZEzf49yC8Cg6UOqe+JR5B/mgFCgCxY/hZzPwOgvS3SIVyGHQWU4sA==\n-----END PUBLIC KEY-----\n\nI1004 15:17:02.425167 3467978 grpc_attestor.go:624] Starting HTTP Server on port :8081\nI1004 15:17:02.425843 3467978 grpc_attestor.go:664] Starting gRPC server on port :50051\n\nusign signer\nI1004 15:17:10.515854 3467978 grpc_attestor.go:171] ======= GetEK ========\nI1004 15:17:10.519842 3467978 grpc_attestor.go:183] ======= GetAK ========\nI1004 15:17:10.942363 3467978 grpc_attestor.go:206] ======= Attest ========\nI1004 15:17:12.945011 3467978 grpc_attestor.go:240] ======= Quote ========\nI1004 15:17:19.160295 3467978 grpc_attestor.go:277] ======= GetTLSKey ========\nusign signer\nI1004 15:17:19.698001 3467978 grpc_attestor.go:301] Inbound HTTP request from: 127.0.0.1\n```\n\nWhat you'll see in the output is the full remote attestation, then a certificate issued with a specific public key where the private key is on the TPM (and is attested by AK)\n\nThe client connects to the server and prints the public key....the fact the same public keys are shown confirms the attested key on the TPM is at the other end of the TLS session.\n\n---\n\nOnce the https server is running, you can continue to interact with it on port `:8081`\n\n```bash\n$ curl -vvv --cacert certs/issuer_ca.crt    --resolve  echo.domain.com:8081:$ATTESTOR_ADDRESS https://echo.domain.com:8081/\n\n$ openssl s_client --connect $ATTESTOR_ADDRESS:8081\n```\n\nNote the certificate specifications and public key matches the attested EC public key that was tied to the TPM\n\n```bash\n$ openssl s_client -connect $ATTESTOR_ADDRESS:8081 | openssl x509 -pubkey -noout\n\n-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEJzdCPv9URzkVwuehzHfVbvLSF8wy\nkTHu5ZEzf49yC8Cg6UOqe+JR5B/mgFCgCxY/hZzPwOgvS3SIVyGHQWU4sA==\n-----END PUBLIC KEY-----\n```\n\n---\n\n### GCP\n\nTo test on GCP, you have to do a similar flow except acqure the CA certs for your environment\n\n```bash\ngcloud compute instances create attestor   \\\n   --zone=us-central1-a --machine-type=n2d-standard-2 --no-service-account --no-scopes \\\n      --image-family=ubuntu-2404-lts-amd64 --image-project=ubuntu-os-cloud --maintenance-policy=MIGRATE --min-cpu-platform=\"AMD Milan\"  --confidential-compute-type=SEV \\\n      --shielded-secure-boot --shielded-vtpm --shielded-integrity-monitoring\n\n## allow grpc\ngcloud compute firewall-rules create allow-tpm-verifier  --action allow --direction INGRESS   --source-ranges 0.0.0.0/0    --rules tcp:50051\n\n## allow http\ngcloud compute firewall-rules create allow-tpm-verifier-https  --action allow --direction INGRESS   --source-ranges 0.0.0.0/0    --rules tcp:8081\n\n$ gcloud compute instances list\nNAME      ZONE           MACHINE_TYPE    PREEMPTIBLE  INTERNAL_IP    EXTERNAL_IP   STATUS\nattestor  us-central1-a  n2d-standard-2               10.128.15.225  34.30.250.78  RUNNING\n\nexport ATTESTOR_ADDRESS=34.30.250.78\n\n# optionally if you installed TPM2_TOOLS, you can print the PCR value\n# on the vm type above, PCR0 is\n# tpm2_pcrread sha256:0\n#  sha256:\n#    0 : 0xA0B5FF3383A1116BD7DC6DF177C0C2D433B9EE1813EA958FA5D166A202CB2A85\n```\n\nNow, since we're on GCP, get the EK Signing and intermediate certificates.  For other manufacturers, you can usually lookup the manufacturers CA out of band, eg for `CN=STM TPM EK Intermediate CA 06,O=STMicroelectronics NV,C=CH` they're listed [here](https://www.st.com/resource/en/technical_note/tn1330-st-trusted-platform-module-tpm-endorsement-key-ek-certificates-stmicroelectronics.pdf)\n\n```bash\n## get the EK\ngcloud compute instances get-shielded-identity attestor --format=json --zone=us-central1-a | jq -r '.encryptionKey.ekCert' \u003e certs/ekcert.pem\n\n## get the intermediate from the ek\ncurl -s $(openssl x509 -in certs/ekcert.pem -noout -text | grep -Po \"((?\u003c=CA Issuers - URI:)http://.*)$\") | openssl x509 -inform DER -outform PEM -out certs/ek_intermediate.pem\n\n## get the root from the intermediate\ncurl -s $(openssl x509 -in certs/ek_intermediate.pem -noout -text | grep -Po \"((?\u003c=CA Issuers - URI:)http://.*)$\") | openssl x509 -inform DER -outform PEM -out certs/ek_root.pem\n```\n\n#### Attestor\n\nSSH to the attestor, [install golang](https://go.dev/doc/install) and run\n\n```bash\n$ git clone https://github.com/salrashid123/tls_ak.git\n\n$ go run server/grpc_attestor.go --grpcport :50051 --applicationPort :8081 --v=10 -alsologtostderr\n```\n\ninstall [tpm2-tools](https://tpm2-tools.readthedocs.io/en/latest/INSTALL/) (`apt-get install tpm2-tools`) and print out the PCR=0 value. \n\nFor me on GCE VM, it was\n\n```bash\n$ tpm2_pcrread sha256:0\n  sha256:\n    0 : 0xA0B5FF3383A1116BD7DC6DF177C0C2D433B9EE1813EA958FA5D166A202CB2A85\n```\n\nThis PCR value is what the verifier checks via quote/verify later\n\n\n#### Verifier\n\nOn the laptop, run the verifier (remember to specify the expected lowercase PCR value)\n\n```bash\n$ go run client/grpc_verifier.go --host=$ATTESTOR_ADDRESS:50051 \\\n   --appaddress=$ATTESTOR_ADDRESS:8081 \\\n   --expectedPCRMapSHA256=0:a0b5ff3383a1116bd7dc6df177c0c2d433b9ee1813ea958fa5d166a202cb2a85 \\\n    --v=10 -alsologtostderr\n```\n\n---\n\n#### TLS-PSK\n\nAnother variation of this is to use [TLS-PSK](https://www.rfc-editor.org/rfc/rfc4279) between single client-\u003eserver.\n\nThis mode is designed for a single client to connect to a single server where the TLS session is created using a pre-shared key which is itself securely transferred from the client to the server after remote attestation.  That PSK is used to launch a new TLS session which does not involve certificates.\n\nUnfortunately, go does not yet support PSK: [issue 6379](https://github.com/golang/go/issues/6379#issuecomment-2079691128)\n\nJust note that this variant does not *ensure* the TLS remote peer terminates on a TPM but just that the EK associated with the TPM did at some point decrypt the PSK.  In other words, the PSK can get decrypted by the EK but then turn around and share that PSK with another system that does setup TLS.\n\n![images/pks.png](images/psk.png)\n\nAnyway, once its ready, you can securely transfer a PSK directly using \n\n* on client [server.CreateImportBlob()](https://pkg.go.dev/github.com/google/go-tpm-tools@v0.4.4/server#CreateImportBlob)\n* on server [client.Key.Import()](https://pkg.go.dev/github.com/google/go-tpm-tools/client#Key.Import)\n\n(yes, i know, the package names in the go library is inverted)\n\nfor further examples, see:\n\n- [Go-TPM-Wrapping - Go library for encrypting data using Trusted Platform Module (TPM)](https://github.com/salrashid123/go-tpm-wrapping)\n- [TPM Remote Attestation protocol using go-tpm and gRPC](https://github.com/salrashid123/go_tpm_remote_attestation?tab=readme-ov-file#aes)\n- [Multiparty Consent Based Networks (MCBN)](https://github.com/salrashid123/mcbn)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsalrashid123%2Ftls_ak","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsalrashid123%2Ftls_ak","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsalrashid123%2Ftls_ak/lists"}