salrashid123

install golang go 1.25.1 and override handshake_server_tls13.go
create a restricted rsapss key and make it persistent

The following describes how to run the GCE Metadata Server Emulator with the GCP OpsAgent

Note that the opsAgent is only supported on specific GCP VMs as described here ("The Ops Agent is not supported on Amazon Elastic Compute Cloud (Amazon EC2) instances or on-premises machines.")

However, if you really want to, you can coax it to run with this emulator and the following steps details such a configuration where the ops agent run in a local docker container alongside the emulator.

(Needless to say, this is unsupported and can result in unpredictable results (eg, the logs appear as if from a gce_vm). Forr on-prem, you should use bindplane)).

get the TPM "name" from the RSA or ECC PEM public key

RSA EK

tpm2_createek -c /tmp/ek.ctx -G rsa -u /tmp/ek.pub 
tpm2_readpublic -c /tmp/ek.ctx -o /tmp/ek.pem -f PEM -n /tmp/ek.name

PolicyDuplicateSelect and PolicyAuthValue bound PolicyDuplicate

The following transfer a key from TPM-A to TPM-B and demonstrates policies that prevent further duplication to TPM-C

ref:

The following diff extracts the EKM value for a given TLS connection and then surfaces that to LUA (which emits the EKM as a header to the backend)

the LUA config will log the EKM in trace logs

# envoy -c envoy_server.yaml -l trace
[2025-04-04 08:36:29.396][3334775][info][lua] [source/extensions/filters/common/lua/lua.cc:26] script log: >>>>>>>>>>>> EKM: XGurfnlqXyjXphhJrrCmHRoKXAwC7CjrD7vixHdqOIo=

which has the same derived EKM value as a sample client app (eg, golang)

	package main

	import (
	"crypto/rand"
	"encoding/base64"
	"flag"
	"io"
	"log"
	"net"
	"slices"

	package main

	import (
	"crypto/tls"
	"crypto/x509"
	"encoding/hex"
	"encoding/pem"
	"flag"
	"fmt"
	"io"

	// Copyright 2018 The Go Authors. All rights reserved.
	// Use of this source code is governed by a BSD-style
	// license that can be found in the LICENSE file.

	package tls

	import (
	"bytes"
	"context"
	"crypto"

	package main

	import (
	"crypto/x509"
	"encoding/hex"
	"encoding/pem"
	"flag"
	"io"
	"log"
	"net"

	import google.auth
	from google.oauth2 import service_account
	from google.cloud import storage
	from google.cloud import pubsub_v1

	## requirements.txt
	# google-cloud-storage
	# google-cloud-pubsub
	# requests
	# google-api-python-client