github.com/jlmucb/cloudproxy@v0.0.0-20170830161738-b5aa0b619bc4/go/tpm2/tpm2_attest_protocol_test.go (about)

     1  // Copyright (c) 2016, Google Inc. All rights reserved.
     2  //
     3  // Licensed under the Apache License, Version 2.0 (the "License");
     4  // you may not use this file except in compliance with the License.
     5  // You may obtain a copy of the License at
     6  //
     7  //     http://www.apache.org/licenses/LICENSE-2.0
     8  //
     9  // Unless required by applicable law or agreed to in writing, software
    10  // distributed under the License is distributed on an "AS IS" BASIS,
    11  // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    12  // See the License for the specific language governing permissions and
    13  // limitations under the License.
    14  
    15  package tpm2
    16  
    17  import (
    18  	"crypto/ecdsa"
    19  	"crypto/elliptic"
    20  	"crypto/rand"
    21  	"crypto/x509"
    22  	"crypto/x509/pkix"
    23  	"fmt"
    24  	"math/big"
    25  	"testing"
    26  	"time"
    27  )
    28  
    29  func TestAttestProtocol(t *testing.T) {
    30  	rw, err := OpenTPM("/dev/tpm0")
    31  	if err != nil {
    32  		t.Fatal("Can't open tpm")
    33  	}
    34  	defer rw.Close()
    35  
    36  	policyKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
    37  	if err != nil {
    38  		t.Fatal("Can't generate policy key")
    39  	}
    40  
    41  	notBefore := time.Now()
    42  	validFor := 365 * 24 * time.Hour
    43  	notAfter := notBefore.Add(validFor)
    44  
    45  	us := "US"
    46  	issuerName := "CloudProxyPolicy"
    47  	x509SubjectName := &pkix.Name{
    48  		Organization:       []string{issuerName},
    49  		OrganizationalUnit: []string{issuerName},
    50  		CommonName:         issuerName,
    51  		Country:            []string{us},
    52  	}
    53  	var sn big.Int
    54  	sn.SetUint64(1)
    55  	certificateTemplate := x509.Certificate{
    56  		SerialNumber: &sn,
    57  		Issuer:       *x509SubjectName,
    58  		Subject:      *x509SubjectName,
    59  		NotBefore:    notBefore,
    60  		NotAfter:     notAfter,
    61  		KeyUsage: x509.KeyUsageCertSign |
    62  			x509.KeyUsageKeyAgreement | x509.KeyUsageDigitalSignature,
    63  		BasicConstraintsValid: true,
    64  		IsCA: true,
    65  	}
    66  
    67  	var priv interface{}
    68  	var pub interface{}
    69  	priv = policyKey
    70  	pub = policyKey.Public()
    71  	derPolicyCert, err := x509.CreateCertificate(rand.Reader, &certificateTemplate,
    72  		&certificateTemplate, pub, priv)
    73  	if err != nil {
    74  		t.Fatal("Can't self sign policy key ", err)
    75  	}
    76  	pcrs := []int{7}
    77  
    78  	policyCert, err := x509.ParseCertificate(derPolicyCert)
    79  	if err != nil {
    80  		t.Fatal("Can't parse policy cert")
    81  	}
    82  
    83  	rootHandle, quoteHandle, storageHandle, err := CreateTpm2KeyHierarchy(rw, pcrs,
    84  		2048, uint16(AlgTPM_ALG_SHA1), "01020304")
    85  	if err != nil {
    86  		t.Fatal("Can't create keys")
    87  	}
    88  	FlushContext(rw, storageHandle)
    89  	FlushContext(rw, rootHandle)
    90  	defer FlushContext(rw, quoteHandle)
    91  
    92  	ekHandle, _, err := CreateEndorsement(rw, 2048, []int{7})
    93  	if err != nil {
    94  		t.Fatal("Can't create endorsement cert")
    95  	}
    96  	defer FlushContext(rw, ekHandle)
    97  
    98  	ekPublicKey, err := GetRsaKeyFromHandle(rw, ekHandle)
    99  	if err != nil {
   100  		t.Fatal("Can't Create endorsement public key")
   101  	}
   102  	ekSubjectName := &pkix.Name{
   103  		Organization:       []string{"Endorsement"},
   104  		OrganizationalUnit: []string{"Endorsement"},
   105  		CommonName:         "Endorsement",
   106  		Country:            []string{us},
   107  	}
   108  	sn.SetUint64(2)
   109  	ekTemplate := x509.Certificate{
   110  		SerialNumber: &sn,
   111  		Issuer:       *x509SubjectName,
   112  		Subject:      *ekSubjectName,
   113  		NotBefore:    notBefore,
   114  		NotAfter:     notAfter,
   115  		KeyUsage: x509.KeyUsageCertSign |
   116  			x509.KeyUsageKeyAgreement | x509.KeyUsageDigitalSignature,
   117  	}
   118  	derEndorsementCert, err := x509.CreateCertificate(rand.Reader,
   119  		&ekTemplate, policyCert, ekPublicKey, policyKey)
   120  	if err != nil {
   121  		t.Fatal("Can't sign endorsement key")
   122  	}
   123  
   124  	// Todo: make taoname
   125  	taoName := "MachineCert"
   126  
   127  	request, err := BuildAttestCertRequest(rw, quoteHandle, ekHandle, derEndorsementCert,
   128  		taoName, "01020304")
   129  	if err != nil {
   130  		t.Fatal("Can't BuildAttestCertRequest")
   131  	}
   132  
   133  	response, err := ProcessQuoteDomainRequest(*request, policyKey, derPolicyCert)
   134  	if err != nil {
   135  		t.Fatal("Can't ProcessQuoteDomainRequest")
   136  	}
   137  
   138  	cert, err := GetCertFromAttestResponse(rw, quoteHandle, ekHandle, "01020304", *response)
   139  	if err != nil {
   140  		t.Fatal("Can't GetCertFromAttestResponse")
   141  	}
   142  	fmt.Printf("\nCert: %x\n", cert)
   143  }