salrashid123

TPM Key Wrapping

Plugin provides the ability to use a Trusted Platform Module (TPM) to seal and unseal keys

The sealed data can only get recovered on the same TPM it was sealed against.

This library also supports sealing data and binding it to a certain passphrase or TPM PCRs values

For an example of standalone usage, see the example below.

snippet cloud build which uses imerpsonation to get a drive-enabled access token

uses a customer cloud build service account and impersonation

https://docs.cloud.google.com/build/docs/securing-builds/configure-user-specified-service-accounts

also see

Cosign local sign-blob with MLDSA

Simple demo of using MLDSA signatures with cosign.

Before you do anything, please note this is just a POC, nothing more, nothing less. Do not use other than just to test.

plase note

go does not support MLDSA but it will in crypto/mldsa after golang/go#77626

Cosign SignBlob with GCP Identity Token from TPM

Snippet which uses a TPM based service account key to acquire an identity_token used to sign-blob using cosin

Normally, if you want to use cosign and a TPM, you would use the built in pkcs11 capability as described here:

Container Signing with Cosign and TPM PKCS-11

However, this snippet encodes the service account private key into a TPM and then making it issue an id_token directly using:

Decoding `ENCRYPTED SIGSTORE PRIVATE KEY` cosign key format

basically, -----BEGIN ENCRYPTED SIGSTORE PRIVATE KEY----- is not ans1 encoded but a JSON struct which looks like the follwoing

You need to decode/decrypt the EC key thats embedded inside it. The following keypair in the code does not have passphrase

also see cosign signature-specification

Sign and Verify TPM based JWT using `github.com/lestrrat-go/jwx`

Using a crypto.Signer from github.com/salrashid123/tpmsigner

Following using a swtpm

rm -rf /tmp/myvtpm && mkdir /tmp/myvtpm
swtpm_setup --tpmstate /tmp/myvtpm --tpm2 --create-ek-cert

GCP Python Workload Federation TPM based mTLS

If you want to use a TPM with GCP mTLS Workload Federation where the private key is embeded in a TPM.

GCP's native workload federation support in the SDK uses python request library which will autmoatically load and use a TPM based private key through openssl's provider interface.

For detailes about that, see:

Issue a JWT using github.com/lestrrat-go/jwx/v3/jwt

basically, you just have to pass in a crypto.Signer that represents the TPM-based key

there are several crypto.Signers around, i'm just using my own from

https://github.com/salrashid123/tpmsigner