Fix TSS formatting

tpm/ak.go

@@ -15,7 +15,6 @@ import (
 	x509ext "github.com/smallstep/go-attestation/x509"
 
 	"go.step.sm/crypto/tpm/storage"
-	"go.step.sm/crypto/tpm/tss2"
 )
 
 // AK models a TPM 2.0 Attestation Key. An AK can be used
@@ -458,15 +457,6 @@ func (ak *AK) HasValidPermanentIdentifier(permanentIdentifier string) bool {
 	return false
 }
 
-// ToTSS2 gets the public and private blobs and returns a [*tss2.TPMKey].
-func (ak *AK) ToTSS2(ctx context.Context) (*tss2.TPMKey, error) {
-	blobs, err := ak.Blobs(ctx)
-	if err != nil {
-		return nil, err
-	}
-	return tss2.New(blobs.public, blobs.private), nil
-}
-
 // toStorage transforms the AK to the struct used for
 // persisting AKs.
 func (ak *AK) toStorage() *storage.AK {

tpm/key.go

@@ -12,7 +12,6 @@ import (
 	"github.com/smallstep/go-attestation/attest"
 	internalkey "go.step.sm/crypto/tpm/internal/key"
 	"go.step.sm/crypto/tpm/storage"
-	"go.step.sm/crypto/tpm/tss2"
 )
 
 // Key models a TPM 2.0 Key. A Key can be used
@@ -105,15 +104,6 @@ func (k *Key) MarshalJSON() ([]byte, error) {
 	return json.Marshal(o)
 }
 
-// ToTSS2 gets the public and private blobs and returns a [*tss2.TPMKey].
-func (k *Key) ToTSS2(ctx context.Context) (*tss2.TPMKey, error) {
-	blobs, err := k.Blobs(ctx)
-	if err != nil {
-		return nil, err
-	}
-	return tss2.New(blobs.public, blobs.private), nil
-}
-
 // comparablePublicKey is an interface that allows a crypto.PublicKey to be
 // compared to another crypto.PublicKey.
 type comparablePublicKey interface {

tpm/tss2.go

@@ -0,0 +1,30 @@
+package tpm
+
+import (
+	"context"
+
+	"go.step.sm/crypto/tpm/tss2"
+)
+
+const (
+	// Defined in "Registry of reserved TPM 2.0 handles and localities", and checked on a glinux machine.
+	commonSrkEquivalentHandle = 0x81000001
+)
+
+// ToTSS2 gets the public and private blobs and returns a [*tss2.TPMKey].
+func (ak *AK) ToTSS2(ctx context.Context) (*tss2.TPMKey, error) {
+	blobs, err := ak.Blobs(ctx)
+	if err != nil {
+		return nil, err
+	}
+	return tss2.New(blobs.public, blobs.private, tss2.WithParent(commonSrkEquivalentHandle)), nil
+}
+
+// ToTSS2 gets the public and private blobs and returns a [*tss2.TPMKey].
+func (k *Key) ToTSS2(ctx context.Context) (*tss2.TPMKey, error) {
+	blobs, err := k.Blobs(ctx)
+	if err != nil {
+		return nil, err
+	}
+	return tss2.New(blobs.public, blobs.private, tss2.WithParent(commonSrkEquivalentHandle)), nil
+}

tpm/tss2/encode.go

@@ -10,14 +10,21 @@ const handleOwner = 0x40000001
 // TPMOption is the type used to modify a [TPMKey].
 type TPMOption func(*TPMKey)
 
+// WithParent sets the [TPMKey] parent's handle
+func WithParent(parent int) TPMOption {
+	return func(t *TPMKey) {
+		t.Parent = parent
+	}
+}
+
 // New creates a new [TPMKey] with the given public and private keys.
 func New(pub, priv []byte, opts ...TPMOption) *TPMKey {
 	key := &TPMKey{
 		Type:       oidLoadableKey,
 		EmptyAuth:  true,
 		Parent:     handleOwner,
-		PublicKey:  addPrefixLength(pub),
-		PrivateKey: addPrefixLength(priv),
+		PublicKey:  pub,
+		PrivateKey: priv,
 	}
 	for _, fn := range opts {
 		fn(key)
@@ -56,8 +63,3 @@ func Encode(pub, priv []byte, opts ...TPMOption) (*pem.Block, error) {
 func EncodeToMemory(pub, priv []byte, opts ...TPMOption) ([]byte, error) {
 	return New(pub, priv, opts...).EncodeToMemory()
 }
-
-func addPrefixLength(b []byte) []byte {
-	s := len(b)
-	return append([]byte{byte(s >> 8 & 0xFF), byte(s & 0xFF)}, b...)
-}

tpm/tss2/encode_test.go

@@ -22,8 +22,8 @@ func TestNew(t *testing.T) {
 			Type:       oidLoadableKey,
 			EmptyAuth:  true,
 			Parent:     0x40000001,
-			PublicKey:  append([]byte{0, 6}, []byte("public")...),
-			PrivateKey: append([]byte{0, 7}, []byte("private")...),
+			PublicKey:  []byte("public"),
+			PrivateKey: []byte("private"),
 		}},
 		{"ok with options", args{[]byte("public"), []byte("private"), []TPMOption{
 			func(k *TPMKey) {
@@ -37,8 +37,8 @@ func TestNew(t *testing.T) {
 			EmptyAuth:  false,
 			Policy:     []TPMPolicy{{CommandCode: 1, CommandPolicy: []byte("command-policy")}},
 			Parent:     0x40000001,
-			PublicKey:  append([]byte{0, 6}, []byte("public")...),
-			PrivateKey: append([]byte{0, 7}, []byte("private")...),
+			PublicKey:  []byte("public"),
+			PrivateKey: []byte("private"),
 		}},
 	}
 	for _, tt := range tests {
@@ -58,12 +58,12 @@ func TestTPMKey_Encode(t *testing.T) {
 		{"ok", New([]byte("public"), []byte("private")), &pem.Block{
 			Type: "TSS2 PRIVATE KEY",
 			Bytes: []byte{
-				0x30, 0x28,
+				0x30, 0x24,
 				0x6, 0x6, 0x67, 0x81, 0x5, 0xa, 0x1, 0x3,
 				0xa0, 0x3, 0x1, 0x1, 0xff,
 				0x2, 0x4, 0x40, 0x0, 0x0, 0x1,
-				0x4, 0x8, 0x0, 0x6, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63,
-				0x4, 0x9, 0x0, 0x7, 0x70, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65,
+				0x4, 0x6, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63,
+				0x4, 0x7, 0x70, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65,
 			},
 		}, assert.NoError},
 		{"fail", nil, nil, assert.Error},
@@ -85,7 +85,7 @@ func TestTPMKey_EncodeToMemory(t *testing.T) {
 		assertion assert.ErrorAssertionFunc
 	}{
 		{"ok", New([]byte("public"), []byte("private")), []byte(`-----BEGIN TSS2 PRIVATE KEY-----
-MCgGBmeBBQoBA6ADAQH/AgRAAAABBAgABnB1YmxpYwQJAAdwcml2YXRl
+MCQGBmeBBQoBA6ADAQH/AgRAAAABBAZwdWJsaWMEB3ByaXZhdGU=
 -----END TSS2 PRIVATE KEY-----
 `), assert.NoError},
 		{"fail", nil, nil, assert.Error},
@@ -114,12 +114,12 @@ func TestEncode(t *testing.T) {
 		{"ok", args{[]byte("public"), []byte("private"), nil}, &pem.Block{
 			Type: "TSS2 PRIVATE KEY",
 			Bytes: []byte{
-				0x30, 0x28,
+				0x30, 0x24,
 				0x6, 0x6, 0x67, 0x81, 0x5, 0xa, 0x1, 0x3,
 				0xa0, 0x3, 0x1, 0x1, 0xff,
 				0x2, 0x4, 0x40, 0x0, 0x0, 0x1,
-				0x4, 0x8, 0x0, 0x6, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63,
-				0x4, 0x9, 0x0, 0x7, 0x70, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65,
+				0x4, 0x6, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63,
+				0x4, 0x7, 0x70, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65,
 			},
 		}, assert.NoError},
 	}
@@ -145,7 +145,7 @@ func TestEncodeToMemory(t *testing.T) {
 		assertion assert.ErrorAssertionFunc
 	}{
 		{"ok", args{[]byte("public"), []byte("private"), nil}, []byte(`-----BEGIN TSS2 PRIVATE KEY-----
-MCgGBmeBBQoBA6ADAQH/AgRAAAABBAgABnB1YmxpYwQJAAdwcml2YXRl
+MCQGBmeBBQoBA6ADAQH/AgRAAAABBAZwdWJsaWMEB3ByaXZhdGU=
 -----END TSS2 PRIVATE KEY-----
 `), assert.NoError},
 	}

tpm/tss2/signer_test.go

@@ -258,7 +258,7 @@ func TestCreateSigner(t *testing.T) {
 			}
 			b, err := p.Encode()
 			if assert.NoError(t, err) {
-				k.PublicKey = addPrefixLength(b)
+				k.PublicKey = b
 			}
 		})}, nil, assert.Error},
 	}