Lennart Poettering c30e3d7290 creds-util: add automatic mode for tpm2 based creds ...

This reworkds TPM2 based creds a bit. Instead of mapping the key type
"tpm2" directly to a TPM2 key without PK, let's map it to an "automatic"
key type that either picks PK or doesn't, depending on what's available.
That should make things easier to grok for people, as the nitty gritty
details of PK or not PK are made autmatic. Moreover it gives us more
leverage to change the TPM2 enrollment types later (for example, we
definitely want to start pinning SRK, and hook up pcrlock too, for
creds, which we currently don't).

This hence adds a new _CRED_AUTO_TPM2
pseudo-type we automatically maps to CRED_AES256_GCM_BY_TPM2_HMAC_WITH_PK
or CRED_AES256_GCM_BY_TPM2_HMAC depending if PK as available. Similar,
_CRED_AUTO_HOST_AND_TPM2 is added, which does the same for the
host/nonhost cred type.

This does not introduce any new type on the wire, it just changes how we
select the right key type.

To make the code more readable this also adds some categorization macros
for the keys, instead of repeating the list of key types at multiple
places.

2025-11-02 21:14:35 +01:00

28 KiB

Raw Permalink Blame History

View Raw