Add support for TPM1.2 enrollment.

[marcushines]

Create the identity request. This takes the public key of the attestation certificate authority as input and returns a TPM struct with AIK (note: TPM structures are different for TPM1.2 & TPM2.0) Send the AIK cert encrypted by the EK back to the TPM. If the TPM can successfully decrypt the payload, the enrollment is complete.

[coveralls]

Pull Request Test Coverage Report for Build 12834135710

Details

• 0 of 0 changed or added relevant lines in 0 files are covered.
• No unchanged relevant lines lost coverage.
• Overall coverage remained the same at 86.885%

---

Totals
Change from base Build 12834112673:	0.0%
Covered Lines:	318
Relevant Lines:	366

---

💛 - Coveralls

[betuls]

I checked with the service side and attestation key is not stored by the service. It is sent by the device in AttestResponse. So we need an additional API to get the attestation key from the device.
In this case would it make sense to have GetAIKKey (or cert), GenerateAIK and RotateAIKCert where GenerateAIKRequest will send issuer_public_key and RotateAIKCert will send the aik_cert instead of having single RotateAIKCert?

[nmahabaleshwar]

I checked with the service side and attestation key is not stored by the service. It is sent by the device in AttestResponse. So we need an additional API to get the attestation key from the device. In this case would it make sense to have GetAIKKey (or cert), GenerateAIK and RotateAIKCert where GenerateAIKRequest will send issuer_public_key and RotateAIKCert will send the aik_cert instead of having single RotateAIKCert?

We don't think the public portion of the AIK is required. In the AttestResponse, the AIK certificate should be returned which can be used by the issuer to verify the validity. Does this sound right ?

Proposing a minor change to the AttestResponse.

message AttestResponse {
   message AttestationCert {
      oneof value {
         string oiak_cert = 1;
         string aik_cert = 2;
      }
   }
   
   ControlCardVendorId control_card_id = 1;
   string oiak_cert = 2 [deprecated = true];
   map<int32, bytes> pcr_values = 3;
   bytes quoted = 4;
   bytes quote_signature = 5;
   string oidevid_cert = 6;
   AttestationCert attestation_cert = 7;
}

[marcushines]

I checked with the service side and attestation key is not stored by the service. It is sent by the device in AttestResponse. So we need an additional API to get the attestation key from the device. In this case would it make sense to have GetAIKKey (or cert), GenerateAIK and RotateAIKCert where GenerateAIKRequest will send issuer_public_key and RotateAIKCert will send the aik_cert instead of having single RotateAIKCert?

We don't think the public portion of the AIK is required. In the AttestResponse, the AIK certificate should be returned which can be used by the issuer to verify the validity. Does this sound right ?

Proposing a minor change to the AttestResponse.

message AttestResponse {
   message AttestationCert {
      oneof value {
         string oiak_cert = 1;
         string aik_cert = 2;
      }
   }
   
   ControlCardVendorId control_card_id = 1;
   string oiak_cert = 2 [deprecated = true];
   map<int32, bytes> pcr_values = 3;
   bytes quoted = 4;
   bytes quote_signature = 5;
   string oidevid_cert = 6;
   AttestationCert attestation_cert = 7;
}

Completely agree that was going to be the implementation

[betuls]

I checked with the service side and attestation key is not stored by the service. It is sent by the device in AttestResponse. So we need an additional API to get the attestation key from the device. In this case would it make sense to have GetAIKKey (or cert), GenerateAIK and RotateAIKCert where GenerateAIKRequest will send issuer_public_key and RotateAIKCert will send the aik_cert instead of having single RotateAIKCert?

We don't think the public portion of the AIK is required. In the AttestResponse, the AIK certificate should be returned which can be used by the issuer to verify the validity. Does this sound right ?
Proposing a minor change to the AttestResponse.

message AttestResponse {
   message AttestationCert {
      oneof value {
         string oiak_cert = 1;
         string aik_cert = 2;
      }
   }
   
   ControlCardVendorId control_card_id = 1;
   string oiak_cert = 2 [deprecated = true];
   map<int32, bytes> pcr_values = 3;
   bytes quoted = 4;
   bytes quote_signature = 5;
   string oidevid_cert = 6;
   AttestationCert attestation_cert = 7;
}

Completely agree that was going to be the implementation

This sounds right.

To my initial comment about separating the API, seems like TPM 1.2 doesn't provide any command to return AIK cert. Per offline discussion with Marcus RotateAIKCert will generate a new AIK each time. Therefore we don't need the additional API to request the cert.