{"push_id":1845505771,"size":1,"distinct_size":1,"ref":"refs/heads/tpm2-pin","head":"4df8f3155045906c488e418cb0ea198c5f664076","before":"91173e7ca3f82d79cd3a4a194e3f401c6c12d714","commits":[{"sha":"4df8f3155045906c488e418cb0ea198c5f664076","author":{"name":"Javier Martinez Canillas","email":"edb33ff00530d2ee1bc5b09f7bee684ceb48ecbe@redhat.com"},"message":"Add Trusted Platform Module 2.0 (TPM2) pin support\n\nThis adds support for a Trusted Platform Module 2.0 (TPM2) clevis pin.\nIt encrypts the JWK using a TPM2 chip, and then at decryption time the\nJWK is decrypted using the same TPM2 chip to allow clevis to decrypt\nthe secret stored in the JWE. That way the ciphertext is bound to a TPM\nso it can only be decripted in a particular machine.\n\nEncrypting data using the tpm2 pin works the same than with other pins:\n\n$ clevis encrypt tpm2 '{\"auth\":\"e\",\"hash\":\"sha1\",\"key\":\"rsa\"}' < PT > JWE\n\nThe configuration must have the hierarchy used to create the primary\nobjects and the hash and key algorithms used when creating objects.\n\nDecryption also works the same than with other pins, only needs the JWE:\n\n$ clevis decrypt tpm2 < JWE > PT\n\nThe public and private key pair of the encrypted JWK are stored in the\nJWE object, so those can be fetched at decryption time to unseal the\nJWK using the TPM2 chip.\n\nSigned-off-by: Javier Martinez Canillas <javierm@redhat.com>","distinct":true,"url":"https://api.github.com/repos/martinezjavier/clevis/commits/4df8f3155045906c488e418cb0ea198c5f664076"}]}
{"actor":{"display_login":"martinezjavier"}}