Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add basic ACME device-attest-01 support #712

Merged
merged 43 commits into from
Apr 6, 2023
Merged

Add basic ACME device-attest-01 support #712

Show file tree
Hide file tree
Changes from 42 commits
Commits
Show all changes
43 commits
Select commit Hold shift + click to select a range
ba8aef6
Add basic ACME `device-attest-01` support
hslatman Aug 4, 2022
32c66b5
Add TPM info to output and add account public key to attested data
hslatman Aug 5, 2022
0026346
Improve Device Attestation flow
hslatman Aug 12, 2022
c11f1d9
Merge branch 'master' into acme-attestation
hslatman Aug 30, 2022
71d7f32
Change to `ac.ValidateWithPayload`
hslatman Sep 2, 2022
f17a194
Remove dependency on TPM simulator
hslatman Sep 2, 2022
8c06e36
Merge branch 'master' into acme-attestation
hslatman Nov 3, 2022
d6d0a95
Merge branch 'master' into acme-attestation
hslatman Nov 3, 2022
0d71003
Tidy modules
hslatman Nov 3, 2022
8d356c5
Add support for TPMs without EK certificate
hslatman Nov 15, 2022
aa561c3
Merge branch 'master' into acme-attestation
hslatman Jan 24, 2023
5331051
Update replaced modules
hslatman Jan 24, 2023
f0a7ae0
Update attestation JSON properties
hslatman Jan 24, 2023
c46f86c
Refactor into using the `tpm` package
hslatman Feb 2, 2023
ad4bb2f
Merge branch 'master' into acme-attestation
hslatman Feb 2, 2023
6df0797
Refactor all TPM operations to be performed by `tpm` package
hslatman Feb 2, 2023
4a34947
Return errors instead of logging TPM failures
hslatman Feb 2, 2023
a285b42
Make the `akCert` optional
hslatman Feb 6, 2023
dc6ffe6
Depend on `go.step.sm/crypto/tpm`
hslatman Feb 14, 2023
877d740
Merge branch 'master' into acme-attestation
hslatman Feb 14, 2023
ff55055
Cleanup
hslatman Mar 6, 2023
cd8d1d3
Merge branch 'master' into acme-attestation
hslatman Mar 6, 2023
b149898
Update to latest `go.step.sm/crypto/tpm`
hslatman Mar 7, 2023
b19c55c
Check if `AK` for identifier exists before creating a new one
hslatman Mar 7, 2023
6d8982f
Merge branch 'master' into acme-attestation
hslatman Mar 7, 2023
6b5505d
Refactor attestation enrollment process
hslatman Mar 8, 2023
1d54c92
Clean up TPM attestation flow
hslatman Mar 13, 2023
30b2d92
Merge branch 'master' into acme-attestation
hslatman Mar 13, 2023
030a267
Fix some linting issues for TPM
hslatman Mar 13, 2023
b1cef14
Change the way the key authorization is hashed
hslatman Mar 14, 2023
ea33be7
Only perform attestation flow if `AK` isn't certified
hslatman Mar 14, 2023
b4d6427
Refactor attestation HTTP client
hslatman Mar 21, 2023
e642396
Refactor attestation client
hslatman Mar 23, 2023
18c681c
Merge branch 'master' into acme-attestation
hslatman Mar 23, 2023
f114885
Update replaced `github.com/google/go-attestation`
hslatman Mar 23, 2023
55d89fc
Fix linting issues
hslatman Mar 23, 2023
ae12907
Add parsing of `attestation-uri` for key name
hslatman Mar 24, 2023
e73db5c
Include TPM info in attestation request
hslatman Apr 6, 2023
bab5c65
Merge branch 'master' into acme-attestation
hslatman Apr 6, 2023
eb9bc22
Add some more docs to the TPM flow
hslatman Apr 6, 2023
c3beee7
Support `kty`, `crv` and `size` with ACME `device-attest-01`
hslatman Apr 6, 2023
0cbf9fe
Add `--attestation-ca-insecure` flag for disabling TLS validation
hslatman Apr 6, 2023
57914ea
Fix PR comments
hslatman Apr 6, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 20 additions & 0 deletions command/ca/certificate.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
package ca

import (
"path/filepath"
"strings"

"github.com/pkg/errors"
Expand All @@ -10,6 +11,7 @@ import (
"github.com/urfave/cli"
"go.step.sm/cli-utils/command"
"go.step.sm/cli-utils/errs"
"go.step.sm/cli-utils/step"
"go.step.sm/cli-utils/ui"
"go.step.sm/crypto/pemutil"
)
Expand Down Expand Up @@ -153,6 +155,24 @@ $ step ca certificate foo.internal foo.crt foo.key \
that should be authorized. Use the '--san' flag multiple times to configure
multiple SANs. The '--san' flag and the '--token' flag are mutually exclusive.`,
},
cli.StringFlag{
Name: "attestation-ca-url",
Usage: "The base url of the Attestation CA to use",
},
cli.StringFlag{
Name: "attestation-ca-root",
Usage: "The path to the PEM <file> with trusted roots when connecting to the Attestation CA",
},
Comment on lines +158 to +165
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In the future, we might want to add some defaults for this, ok for now.

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Or we can bootstrap them.

cli.BoolFlag{
Name: "attestation-ca-insecure",
Usage: "Disables TLS server validation when connecting to the Attestation CA",
Hidden: true,
},
cli.StringFlag{
Name: "tpm-storage-directory",
Usage: "The directory where TPM keys and certificates will be stored",
Value: filepath.Join(step.Path(), "tpm"),
},
flags.TemplateSet,
flags.TemplateSetFile,
flags.CaConfig,
Expand Down
68 changes: 38 additions & 30 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,26 +6,27 @@ require (
github.com/Microsoft/go-winio v0.6.0
github.com/ThomasRooney/gexpect v0.0.0-20161231170123-5482f0350944
github.com/fxamacker/cbor/v2 v2.4.0
github.com/google/go-attestation v0.4.4-0.20220404204839-8820d49b18d9
github.com/google/go-cmp v0.5.9
github.com/google/uuid v1.3.0
github.com/icrowley/fake v0.0.0-20180203215853-4178557ae428
github.com/icrowley/fake v0.0.0-20221112152111-d7b7e2276db2
github.com/manifoldco/promptui v0.9.0
github.com/pkg/errors v0.9.1
github.com/pquerna/otp v1.4.0
github.com/samfoo/ansi v0.0.0-20160124022901-b6bd2ded7189
github.com/shurcooL/sanitized_anchor_name v1.0.0
github.com/slackhq/nebula v1.6.1
github.com/smallstep/assert v0.0.0-20200723003110-82e2b9b3b262
github.com/smallstep/certificates v0.23.2
github.com/smallstep/certificates v0.23.2-0.20230131224934-3a6fc5e0b4d7
github.com/smallstep/certinfo v1.11.0
github.com/smallstep/truststore v0.12.1
github.com/smallstep/zcrypto v0.0.0-20210924233136-66c2600f6e71
github.com/smallstep/zlint v0.0.0-20180727184541-d84eaafe274f
github.com/smallstep/zcrypto v0.0.0-20221001003018-1ab2364d2a91
github.com/smallstep/zlint v0.0.0-20220930192201-67fb4aa21910
github.com/stretchr/testify v1.8.2
github.com/urfave/cli v1.22.12
go.mozilla.org/pkcs7 v0.0.0-20210826202110-33d05740a352
go.step.sm/cli-utils v0.7.5
go.step.sm/crypto v0.28.0
go.step.sm/crypto v0.28.1-0.20230404230013-4e7c14d93fcc
go.step.sm/linkedca v0.19.0
golang.org/x/crypto v0.7.0
golang.org/x/net v0.8.0
Expand Down Expand Up @@ -54,67 +55,72 @@ require (
github.com/Masterminds/goutils v1.1.1 // indirect
github.com/Masterminds/semver/v3 v3.2.0 // indirect
github.com/Masterminds/sprig/v3 v3.2.3 // indirect
github.com/asaskevich/govalidator v0.0.0-20180720115003-f9ffefc3facf // indirect
github.com/asaskevich/govalidator v0.0.0-20210307081110-f21760c49a8d // indirect
github.com/boombuler/barcode v1.0.1 // indirect
github.com/cespare/xxhash v1.1.0 // indirect
github.com/cespare/xxhash/v2 v2.2.0 // indirect
github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e // indirect
github.com/corpix/uarand v0.1.1 // indirect
github.com/chzyer/readline v1.5.1 // indirect
github.com/corpix/uarand v0.2.0 // indirect
github.com/cpuguy83/go-md2man/v2 v2.0.2 // indirect
github.com/creack/pty v1.1.11 // indirect
github.com/creack/pty v1.1.18 // indirect
github.com/davecgh/go-spew v1.1.1 // indirect
github.com/dgraph-io/badger v1.6.2 // indirect
github.com/dgraph-io/badger/v2 v2.2007.4 // indirect
github.com/dgraph-io/ristretto v0.1.0 // indirect
github.com/dgraph-io/ristretto v0.1.1 // indirect
github.com/dgryski/go-farm v0.0.0-20200201041132-a6ae2369ad13 // indirect
github.com/dustin/go-humanize v1.0.0 // indirect
github.com/dustin/go-humanize v1.0.1 // indirect
github.com/go-chi/chi v4.1.2+incompatible // indirect
github.com/go-kit/kit v0.10.0 // indirect
github.com/go-logfmt/logfmt v0.5.1 // indirect
github.com/go-logr/logr v1.2.0 // indirect
github.com/go-sql-driver/mysql v1.6.0 // indirect
github.com/go-kit/kit v0.12.0 // indirect
github.com/go-kit/log v0.2.1 // indirect
github.com/go-logfmt/logfmt v0.6.0 // indirect
github.com/go-logr/logr v1.2.3 // indirect
github.com/go-sql-driver/mysql v1.7.0 // indirect
github.com/golang-jwt/jwt/v4 v4.5.0 // indirect
github.com/golang/glog v1.0.0 // indirect
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
github.com/golang/protobuf v1.5.2 // indirect
github.com/golang/snappy v0.0.4 // indirect
github.com/google/btree v1.1.2 // indirect
github.com/google/certificate-transparency-go v1.1.4 // indirect
github.com/google/go-tpm v0.3.3 // indirect
github.com/google/go-tpm-tools v0.3.10 // indirect
github.com/google/go-tspi v0.3.0 // indirect
github.com/googleapis/enterprise-certificate-proxy v0.2.3 // indirect
github.com/googleapis/gax-go/v2 v2.8.0 // indirect
github.com/huandu/xstrings v1.3.3 // indirect
github.com/imdario/mergo v0.3.12 // indirect
github.com/huandu/xstrings v1.4.0 // indirect
github.com/imdario/mergo v0.3.13 // indirect
github.com/jackc/chunkreader/v2 v2.0.1 // indirect
github.com/jackc/pgconn v1.13.0 // indirect
github.com/jackc/pgio v1.0.0 // indirect
github.com/jackc/pgpassfile v1.0.0 // indirect
github.com/jackc/pgproto3/v2 v2.3.1 // indirect
github.com/jackc/pgservicefile v0.0.0-20200714003250-2b9c44734f2b // indirect
github.com/jackc/pgtype v1.12.0 // indirect
github.com/jackc/pgservicefile v0.0.0-20221227161230-091c0ba34f0a // indirect
github.com/jackc/pgtype v1.13.0 // indirect
github.com/jackc/pgx/v4 v4.17.2 // indirect
github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 // indirect
github.com/klauspost/compress v1.15.11 // indirect
github.com/klauspost/compress v1.15.15 // indirect
github.com/kr/pty v1.1.8 // indirect
github.com/kr/text v0.2.0 // indirect
github.com/kylelemons/godebug v1.1.0 // indirect
github.com/mattn/go-colorable v0.1.8 // indirect
github.com/mattn/go-isatty v0.0.13 // indirect
github.com/mattn/go-colorable v0.1.13 // indirect
github.com/mattn/go-isatty v0.0.17 // indirect
github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d // indirect
github.com/micromdm/scep/v2 v2.1.0 // indirect
github.com/mitchellh/copystructure v1.2.0 // indirect
github.com/mitchellh/reflectwalk v1.0.2 // indirect
github.com/newrelic/go-agent/v3 v3.20.3 // indirect
github.com/peterbourgon/diskv/v3 v3.0.1 // indirect
github.com/pkg/browser v0.0.0-20210911075715-681adbf594b8 // indirect
github.com/pmezard/go-difflib v1.0.0 // indirect
github.com/rogpeppe/go-internal v1.9.0 // indirect
github.com/rs/xid v1.4.0 // indirect
github.com/russross/blackfriday/v2 v2.1.0 // indirect
github.com/shopspring/decimal v1.2.0 // indirect
github.com/schollz/jsonstore v1.1.0 // indirect
github.com/shopspring/decimal v1.3.1 // indirect
github.com/sirupsen/logrus v1.9.0 // indirect
github.com/smallstep/nosql v0.5.0 // indirect
github.com/spf13/cast v1.4.1 // indirect
github.com/weppos/publicsuffix-go v0.4.0 // indirect
github.com/spf13/cast v1.5.0 // indirect
github.com/weppos/publicsuffix-go v0.20.0 // indirect
github.com/x448/float16 v0.8.4 // indirect
go.etcd.io/bbolt v1.3.6 // indirect
go.etcd.io/bbolt v1.3.7 // indirect
go.opencensus.io v0.24.0 // indirect
golang.org/x/mod v0.8.0 // indirect
golang.org/x/oauth2 v0.6.0 // indirect
Expand All @@ -123,8 +129,10 @@ require (
google.golang.org/api v0.114.0 // indirect
google.golang.org/appengine v1.6.7 // indirect
google.golang.org/genproto v0.0.0-20230306155012-7f2fa6fef1f4 // indirect
google.golang.org/grpc v1.53.0 // indirect
google.golang.org/grpc v1.54.0 // indirect
gopkg.in/yaml.v3 v3.0.1 // indirect
howett.net/plist v1.0.0 // indirect
k8s.io/klog/v2 v2.80.1 // indirect
k8s.io/klog/v2 v2.90.0 // indirect
)

replace github.com/google/go-attestation v0.4.4-0.20220404204839-8820d49b18d9 => github.com/smallstep/go-attestation v0.4.4-0.20230224121042-1bcb20a75add
maraino marked this conversation as resolved.
Show resolved Hide resolved
Loading