Question

我从here获得了Signing样本，以与TPM Simulator对抗。

在调用后，我似乎对公钥有某种引用：

TpmPublic keyPublic; //This seems to have what we're looking for
CreationData creationData;
TkCreation creationTicket;
byte[] creationHash;

// 
// Ask the TPM to create a new primary RSA signing key.
// 
TpmHandle keyHandle = tpm[ownerAuth].CreatePrimary(
  TpmRh.Owner, // In the owner-hierarchy
  new SensitiveCreate(keyAuth, null), // With this auth-value
  keyTemplate, // Describes key
  null, // Extra data for creation ticket
  new PcrSelection[0], // Non-PCR-bound
  out keyPublic, // PubKey and attributes
  out creationData, out creationHash, out creationTicket);

在此提示下，还有一些注释掉的代码，用于导出公钥的先前方法：

// (Note that serialization is not supported on WinRT)
// 
// Demonstrate the use of XML persistence by saving keyPublic to 
// a file and making a copy by reading it back into a new object
// 
// NOTE: 12-JAN-2016: May be removing support for policy
//       serialization. We'd like to get feedback on whether
//       this is a desirable feature and should be retained.
//
// {
//     const string fileName = "sample.xml";
//     string xmlVersionOfObject = keyPublic.GetXml();
//     keyPublic.XmlSerializeToFile(fileName);
//     var copyOfPublic = TpmStructureBase.XmlDeserializeFromFile<TpmPublic>(fileName);

TpmPublic.GetXml()似乎不再存在，因此可能已根据注释删除了。

Answer 1

目前尚不清楚您需要什么；您的公钥类型是什么？您要如何使用它？因此，此答案假设您正在尝试获取RSA原始密钥的指数的原始字节和模数，以便可以将其导出到可以供OpenSSL使用的密钥。

您看到的“ XML导出”功能是指对TpmPublic对象进行序列化和反序列化，并不能使您更接近目标：您只需将原始对象取回即可。它可能已删除，因为它无法很好地工作。

假设keyPublic是代表RSA密钥的TpmPublic对象，要获取指数，您将执行以下操作：

var rsaParams = (RsaParms)keyPublic.parameters;
var exponent = rsaParams.exponent != 0
             ? Globs.HostToNet(rsaParams.exponent)
             : RsaParms.DefaultExponent;

并获得模量：

var modulus = (keyPublic.unique as Tpm2bPublicKeyRsa).buffer;

要查看如何处理ECC密钥，请查看AsymCryptoSystem.CreateFrom()：

public static AsymCryptoSystem CreateFrom(TpmPublic pubKey, TpmPrivate privKey = null)
{
    var cs = new AsymCryptoSystem();

    TpmAlgId keyAlgId = pubKey.type;
    cs.PublicParms = pubKey.Copy();

    // Create an algorithm provider from the provided PubKey
    switch (keyAlgId)
    {
        case TpmAlgId.Rsa:
            {
                RawRsa rr = null;
                byte[] prime1 = null,
                        prime2 = null;
                if (privKey != null)
                {
                    rr = new RawRsa(pubKey, privKey);
                    prime1 = RawRsa.ToBigEndian(rr.P);
                    prime2 = RawRsa.ToBigEndian(rr.Q);
                }
                var rsaParams = (RsaParms)pubKey.parameters;
                var exponent = rsaParams.exponent != 0
                                        ? Globs.HostToNet(rsaParams.exponent)
                                        : RsaParms.DefaultExponent;
                var modulus = (pubKey.unique as Tpm2bPublicKeyRsa).buffer;
                AsymmetricKeyAlgorithmProvider rsaProvider = AsymmetricKeyAlgorithmProvider.OpenAlgorithm(AsymmetricAlgorithmNames.RsaOaepSha256);

                uint primeLen1 = 0, primeLen2 = 0;
                // Compute the size of BCRYPT_RSAKEY_BLOB
                int rsaKeySize = exponent.Length + modulus.Length + 24;
                if (prime1 != null && prime1.Length > 0)
                {
                    if (prime2 == null || prime2.Length == 0)
                    {
                        Globs.Throw<ArgumentException>("LoadRSAKey(): The second prime is missing");
                        return null;
                    }
                    primeLen1 = (uint)prime1.Length;
                    primeLen2 = (uint)prime2.Length;
                    rsaKeySize += prime1.Length + prime2.Length;
                }
                else if (prime2 != null && prime2.Length > 0)
                {
                    Globs.Throw<ArgumentException>("LoadRSAKey(): The first prime is missing");
                    return null;
                }

                var rsaKey = new byte[rsaKeySize];

                // Initialize BCRYPT_RSAKEY_BLOB
                int offset = 0;
                WriteToBuffer(ref rsaKey, ref offset, primeLen1 == 0 ?
                                BCRYPT_RSAPUBLIC_MAGIC : BCRYPT_RSAPRIVATE_MAGIC);
                WriteToBuffer(ref rsaKey, ref offset, (uint)modulus.Length * 8);
                WriteToBuffer(ref rsaKey, ref offset, (uint)exponent.Length);
                WriteToBuffer(ref rsaKey, ref offset, (uint)modulus.Length);
                WriteToBuffer(ref rsaKey, ref offset, primeLen1);
                WriteToBuffer(ref rsaKey, ref offset, primeLen1);
                WriteToBuffer(ref rsaKey, ref offset, exponent);
                WriteToBuffer(ref rsaKey, ref offset, modulus);
                if (primeLen1 != 0)
                {
                    WriteToBuffer(ref rsaKey, ref offset, prime1);
                    WriteToBuffer(ref rsaKey, ref offset, prime2);
                }

                IBuffer rsaBuffer = CryptographicBuffer.CreateFromByteArray(rsaKey);

                if (primeLen1 == 0)
                {
                    cs.Key = rsaProvider.ImportPublicKey(rsaBuffer, CryptographicPublicKeyBlobType.BCryptPublicKey);
                }
                else
                {
                    cs.Key = rsaProvider.ImportKeyPair(rsaBuffer, CryptographicPrivateKeyBlobType.BCryptPrivateKey);
                }
                break;
            }
        case TpmAlgId.Ecc:
            {
                var eccParms = (EccParms)pubKey.parameters;
                var eccPub = (EccPoint)pubKey.unique;
                var algId = RawEccKey.GetEccAlg(pubKey);
                if (algId == null)
                {
                    return null;
                }
                bool isEcdsa = eccParms.scheme.GetUnionSelector() == TpmAlgId.Ecdsa;
                byte[] keyBlob = RawEccKey.GetKeyBlob(eccPub.x, eccPub.y, keyAlgId,
                                                        !isEcdsa, eccParms.curveID);
                AsymmetricKeyAlgorithmProvider eccProvider = AsymmetricKeyAlgorithmProvider.OpenAlgorithm(algId);
                cs.Key = eccProvider.ImportKeyPair(CryptographicBuffer.CreateFromByteArray(keyBlob));
                break;
            }
        default:
            Globs.Throw<ArgumentException>("Algorithm not supported");
            cs = null;
            break;
    }
    return cs;
}

如何使用TSS.net从TPM导出公钥？

1 个答案: