Re: [tboot-devel] Create LCP_PCONF_ELEMENT with TPM 2.0

Hawrylko, Lukasz Tue, 04 Jun 2019 05:02:03 -0700

Great, I will check your patch. Did you try to provision TPM with that policy 
and check if it works?


Thanks,
Lukasz

-----Original Message-----
From: Dirk <xanthein...@gmail.com>
To: tboot-devel@lists.sourceforge.net <tboot-devel@lists.sourceforge.net>
Subject: Re: [tboot-devel] Create LCP_PCONF_ELEMENT with TPM 2.0
Date: Tue, 04 Jun 2019 10:33:37 +0800

Hi Lukasz,

I try to add PCONF element type support to lcptools-v2. It can worked with 
tpm2-tools
to generate PCONF element by following commands.

sudo tpm2_pcrlist -L sha256:0,1,2,3,4,5,6,7 --tcti=device | awk 'NR!=1 {print 
$3}' | sed 's/0x//g' |
sed -E 's/(.{2})/\1\ /g' > pcr
lcp2_crtpolelt --create --type pconf --alg sha256 --pcr_hash sha256 --pcr 
0,1,2,3,4,5,6,7 --ctrl
0x00 --out pconf.elt pcr

Regards,
Dirk


Hawrylko, Lukasz <lukasz.hawry...@intel.com> 於 2019年6月3日 週一 下午5:23寫道：
> Hi Dirk
> I don't know if there any any official, public accessible tool for dumping 
> PCRs. However structure
> of file required by lcp-gen2 is quite simple, it is described in util.py line 
> 355.
> Thanks,Lukasz
> -----Original Message-----From: Dirk <xanthein...@gmail.com>To: 
> tboot-devel@lists.sourceforge.net
> <tboot-devel@lists.sourceforge.net>Subject: Re: [tboot-devel] Create 
> LCP_PCONF_ELEMENT with TPM
> 2.0Date: Tue, 28 May 2019 17:11:13 +0800
> Hi Lukasz,
> 
> Thanks for the reply. I tried to run lcp-gen2 tool and found I can't create 
> valid PCR dump 
> file. In UserGuide.txt of lcp-gen2, mentioned that the PCR dump file can be 
> created by
> PCRDump2. But I can't find the tool. Do you have any suggestion which tool I 
> can use
> to dump the PCR file?
> 
> Regards,
> Dirk
>  
> 
> Hawrylko, Lukasz <lukasz.hawry...@intel.com> 於 2019年5月27日 週一 下午2:24寫道：
> > Hi Dirk
> > 
> > 
> > 
> > LCP for TPM 2.0 is supported by lcp-gen2 tool. This tool allows to add 
> > PCONF element.
> > 
> > 
> > 
> > Thanks,
> > 
> > Lukasz
> > 
> > 
> > 
> > -----Original Message-----
> > 
> > From: Dirk <xanthein...@gmail.com>
> > 
> > To: tboot-devel@lists.sourceforge.net
> > 
> > Subject: [tboot-devel] Create LCP_PCONF_ELEMENT with TPM 2.0
> > 
> > Date: Fri, 24 May 2019 10:13:27 +0800
> > 
> > 
> > 
> > Hi,
> > 
> > 
> > 
> > I am using tboot 1.9.9 and find there seems no way to create 
> > LCP_PCONF_ELEMENT
> > 
> > with TPM 2.0. Tool lcp2_crtpolelt only support mle, custom, sbios and stm. 
> > Is there any
> > 
> > way to create pconf element?
> > 
> > 
> > 
> > Regards,
> > 
> > Dirk
> > 
> > 
> > 
> > _______________________________________________
> > 
> > tboot-devel mailing list
> > 
> > tboot-devel@lists.sourceforge.net
> > 
> > 
> > 
> > https://lists.sourceforge.net/lists/listinfo/tboot-devel
> > 
> > 
> > 
> > 
> > 
> > ---------------------------------------------------------------------
> > 
> > Intel
> > Technology Poland sp. z o.o.
> > ul. S&#322owackiego 173 | 80-298 Gda&#324sk | S&#261d Rejonowy Gda&#324sk
> > P&#243&#322noc
> > | VII Wydzia&#322 Gospodarczy Krajowego Rejestru S&#261dowego - KRS 101882 
> > | NIP
> > 957-07-52-316 | Kapita&#322 zak&#322adowy 200.000 PLN.
> > 
> > Ta wiadomo&#347&#263 wraz z za&#322&#261cznikami jest przeznaczona dla 
> > okre&#347lonego
> > adresata i mo&#380e zawiera&#263 informacje poufne. W razie przypadkowego 
> > otrzymania
> > tej wiadomo&#347ci, prosimy o powiadomienie nadawcy oraz trwa&#322e jej 
> > usuni&#281cie;
> > jakiekolwiek przegl&#261danie lub rozpowszechnianie jest zabronione.
> > 
> > This e-mail and any attachments may contain confidential material for the 
> > sole
> > use of the intended recipient(s). If you are not the intended recipient,
> > please
> > contact the sender and delete all copies; any review or distribution by 
> > others
> > is strictly prohibited.
> > _______________________________________________
> > 
> > tboot-devel mailing list
> > 
> > tboot-devel@lists.sourceforge.net
> > 
> > https://lists.sourceforge.net/lists/listinfo/tboot-devel
> > 
> 
> _______________________________________________tboot-devel mailing 
> listtboot-de...@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/tboot-devel
> 
> ---------------------------------------------------------------------
> 
> Intel
> Technology Poland sp. z o.o.
> ul. S&#322owackiego 173 | 80-298 Gda&#324sk | S&#261d Rejonowy Gda&#324sk
> P&#243&#322noc
> | VII Wydzia&#322 Gospodarczy Krajowego Rejestru S&#261dowego - KRS 101882 | 
> NIP
> 957-07-52-316 | Kapita&#322 zak&#322adowy 200.000 PLN.
> 
> Ta wiadomo&#347&#263 wraz z za&#322&#261cznikami jest przeznaczona dla 
> okre&#347lonego
> adresata i mo&#380e zawiera&#263 informacje poufne. W razie przypadkowego 
> otrzymania
> tej wiadomo&#347ci, prosimy o powiadomienie nadawcy oraz trwa&#322e jej 
> usuni&#281cie;
> jakiekolwiek przegl&#261danie lub rozpowszechnianie jest zabronione.
> 
> This e-mail and any attachments may contain confidential material for the sole
> use of the intended recipient(s). If you are not the intended recipient,
> please
> contact the sender and delete all copies; any review or distribution by others
> is strictly prohibited.

_______________________________________________tboot-devel mailing 
listtboot-de...@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/tboot-devel

smime.p7s
Description: S/MIME cryptographic signature

--------------------------------------------------------------------

Intel Technology Poland sp. z o.o.
ul. Slowackiego 173 | 80-298 Gdansk | Sad Rejonowy Gdansk Polnoc | VII Wydzial 
Gospodarczy Krajowego Rejestru Sadowego - KRS 101882 | NIP 957-07-52-316 | 
Kapital zakladowy 200.000 PLN.

Ta wiadomosc wraz z zalacznikami jest przeznaczona dla okreslonego adresata i 
moze zawierac informacje poufne. W razie przypadkowego otrzymania tej 
wiadomosci, prosimy o powiadomienie nadawcy oraz trwale jej usuniecie; 
jakiekolwiek
przegladanie lub rozpowszechnianie jest zabronione.
This e-mail and any attachments may contain confidential material for the sole 
use of the intended recipient(s). If you are not the intended recipient, please 
contact the sender and delete all copies; any review or distribution by
others is strictly prohibited.

_______________________________________________
tboot-devel mailing list
tboot-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/tboot-devel

Re: [tboot-devel] Create LCP_PCONF_ELEMENT with TPM 2.0

Reply via email to