salrashid123

get the TPM "name" from the RSA or ECC PEM public key

RSA EK

tpm2_createek -c /tmp/ek.ctx -G rsa -u /tmp/ek.pub 
tpm2_readpublic -c /tmp/ek.ctx -o /tmp/ek.pem -f PEM -n /tmp/ek.name

PolicyDuplicateSelect and PolicyAuthValue bound PolicyDuplicate

The following transfer a key from TPM-A to TPM-B and demonstrates policies that prevent further duplication to TPM-C

ref:

The following diff extracts the EKM value for a given TLS connection and then surfaces that to LUA (which emits the EKM as a header to the backend)

the LUA config will log the EKM in trace logs

# envoy -c envoy_server.yaml -l trace
[2025-04-04 08:36:29.396][3334775][info][lua] [source/extensions/filters/common/lua/lua.cc:26] script log: >>>>>>>>>>>> EKM: XGurfnlqXyjXphhJrrCmHRoKXAwC7CjrD7vixHdqOIo=

which has the same derived EKM value as a sample client app (eg, golang)

Simple openssl c client/server which prints the Exported Key Material (EKM)

https://docs.openssl.org/1.1.1/man3/SSL_export_keying_material/

also see https://github.com/salrashid123/go_ekm_tls

$  gcc server.c -lcrypto -lssl -o server

$ ./server

TLS with TPM based private key

Requires openssl-tpm2 provider

# export OPENSSL_MODULES=/usr/lib/x86_64-linux-gnu/ossl-modules/
# 
# cat /etc/ssl/openssl.cnf
# [openssl_init]

Simple demo of istio authorization rules using GCP OIDC tokens

Basically, this will allow inbound OIDC authentication and authorization for a service using a google issued id_token

Setup

First install minikube (i'm using kvm2 but you can use anything)

	package main

	import (
	"crypto/x509"
	"encoding/hex"
	"encoding/pem"
	"flag"
	"io"
	"log"
	"net"

	import google.auth
	from google.oauth2 import service_account
	from google.cloud import storage
	from google.cloud import pubsub_v1

	## requirements.txt
	# google-cloud-storage
	# google-cloud-pubsub
	# requests
	# google-api-python-client

	package main
	/*
	Authenticate to GCP using the GCP embedded vTPM AttestationKey

	this specific implementation acquires a JWTAccessToken with scopes

	https://github.com/salrashid123/gcp-vtpm-ek-ak/tree/main?tab=readme-ov-file#sign-jwt-with-tpm

	1. first create a gce instance with confidentialcompute and vtpm enabled


	#include <stdio.h>
	#include <unistd.h>
	#include <string.h>
	#include <sys/socket.h>
	#include <arpa/inet.h>
	#include <openssl/ssl.h>
	#include <openssl/err.h>
	#include <openssl/hmac.h>