From ee1cd782ab0d91d34785c81425ee27217a66d0aa Mon Sep 17 00:00:00 2001 From: David Woodhouse Date: Thu, 13 May 2021 17:04:21 +0100 Subject: [PATCH] Update TPMv2 documentation a little, add changelog for TLSv1.3 and swtpm Signed-off-by: David Woodhouse --- www/changelog.xml | 1 + www/tpm.xml | 28 +++++++++++++++++++++++++++- 2 files changed, 28 insertions(+), 1 deletion(-) diff --git a/www/changelog.xml b/www/changelog.xml index 2aac3c8b..c84e0030 100644 --- a/www/changelog.xml +++ b/www/changelog.xml @@ -40,6 +40,7 @@
  • More gracefully handle Pulse/NC idle timeouts and other Pulse fatal errors (!187)
  • Ignore failures to fetch the NC landing page if the authentication was successful.
  • Add support for Array Networks SSL VPN (#102)
    • +
  • Support TLSv1.3 with TPMv2 EC and RSA keys, add test cases for swtpm and hardware TPM.

  • OpenConnect v8.10 diff --git a/www/tpm.xml b/www/tpm.xml index 3374a330..302174f9 100644 --- a/www/tpm.xml +++ b/www/tpm.xml @@ -50,8 +50,34 @@ based on different TSS libraries.

    Intel/TCG stack. OpenConnect can use either ENGINE.

    +

    + The GnuTLS build of OpenConnect can use either TSS library, with TPMv2 support + implemented natively in OpenConnect. GnuTLS does not have its own TPMv2 support yet + (GnuTLS issue #594). +

    + +

    Creating / importing keys

    + +

    + Each of the above-referenced OpenSSL ENGINE implementations comes with a tool to + create keys in the appropriate format. +

    +

    + The create_tpm2_key tool from the IBM version can be used to 'wrap' existing + keys, using its -w option. To take an existing key file and encrypt it for + use by the TPM, for example: +

    • create_tpm_key -w key_file.pem tpm_key.pem
    + Presumably you would then delete the original key file, since having the private key + protected by the TPM is a bit pointless if you just leave it lying around on disk + anyway. +

    +

    + The Intel version does not support importing existing keys; this is + tpm2-tss-engine issue #39. +

    + -

    The GnuTLS build of OpenConnect can use either TSS library.

    +

    Legacy TPMv2 key format

    Older keys from openssl_tpm2_engine may have the tag: 

    -----BEGIN TSS2 KEY BLOB-----

    -- 2.50.1