Re: [PATCH v8 16/22] tpm2: Support authorized policy

From: James Bottomley <jejb@linux.ibm.com>
To: The development of GNU GRUB <grub-devel@gnu.org>
Cc: Gary Lin <glin@suse.com>,
	Hernan Gatta <hegatta@linux.microsoft.com>,
	Daniel Axtens <dja@axtens.net>,
	Daniel Kiper <daniel.kiper@oracle.com>,
	shkhisti@microsoft.com, jaskaran.khurana@microsoft.com,
	christopher.co@microsoft.com, daniel.mihai@microsoft.com,
	jaredz@redhat.com, development@efficientek.com, mchang@suse.com
Subject: Re: [PATCH v8 16/22] tpm2: Support authorized policy
Date: Wed, 07 Feb 2024 09:45:41 +0000	[thread overview]
Message-ID: <83b60c5a18db39f79fa6a48df0d8c89911ff0cfa.camel@linux.ibm.com> (raw)
In-Reply-To: <20240206061211.nmri5s6vcjdceh7i@GaryLaptop>

On Tue, 2024-02-06 at 14:12 +0800, Gary Lin via Grub-devel wrote:
> On Mon, Feb 05, 2024 at 08:48:53AM +0000, James Bottomley wrote:
[...]
> > It was for two reasons: 1) so we all derive the same parent for
> > interoperability and 2) because some TPMs take forever to derive an
> > RSA primary (my current one takes 7s and my previous one took 50s)
> > 
> The default template of SRK is inherited from the original TPM
> patches. Besides, we got some opinions against ECC during internal
> review, so RSA remains default. As for grub2, there is an option for
> the SRK algorithm:
> 
> https://github.com/lcp/grub2/blob/tpm2-unlock-v9/grub-core/tpm2/module.c#L134-L145
> https://github.com/lcp/grub2/blob/tpm2-unlock-v9/grub-core/tpm2/args.c#L79-L138
> 
> So that the user can choose the preferred SRK algorithm like this:
> 
> tpm2_key_protector_init -a ECC_NIST_P256 -T sealed.tpm
> 
> Although the user still can specify the SRK template with the
> persistent handles, I'd try not to occupy those handles since those
> are limited resources. Is it possible to relax the standard a bit to
> allow the SRK algorithm to be chosen?

It's still an evolving standard, so anything reasonable can be added. 
However, what I (and the other people using it) want is that everything
be seamless (the key file says everything and the user doesn't need to
select anything), so if we add an RSA EC primary derivation, everything
just works without the user having to know (so it needs to be a
property in the key file).  If you can come up with a way of doing
this, absolutely it can be added.

James

_______________________________________________
Grub-devel mailing list
Grub-devel@gnu.org
https://lists.gnu.org/mailman/listinfo/grub-devel