Enhancements for the simulators-based unit tests about tpm2-pytss HOT 7 CLOSED

Toggling physical presence is needed for testing PolicyPhysicalPresence and PP_Commands, I'm looking into a solution for the IBM simulator, but I'm unsure how to do it for swtpm.

I have no idea, maybe @stefanberger knows?

Adding an EK certs with matching EK primary keys and keeping them in the standard NV indices would be useful for testing a standard MakeCredential and ActivateCredential setup as well as EK cert parsing.

If we weren't hooking into bindings I'd be more concerned with this test case. Here we're mostly looking that we can call into the api and get the responses that we want. If theirs a bug, it would likely be in the C library.

from tpm2-pytss.

I have no idea, maybe @stefanberger knows?

Afaik it's not possible.

from tpm2-pytss.

Further thought, we just have to test that command works, so we don't actually have to test the TPM accepts the policy. So just call the command, and optionally verify you get a hash back (length). For extra points, check the hash value is as expected. It should be a static policy hash.

from tpm2-pytss.

For PP_Commands, just call them and expect a specific failure.

from tpm2-pytss.

I'll skip the physical presence part then and just check the RC

from tpm2-pytss.

Adding an EK certs with matching EK primary keys and keeping them in the standard NV indices would be useful for testing a standard MakeCredential and ActivateCredential setup as well as EK cert parsing.

If we weren't hooking into bindings I'd be more concerned with this test case. Here we're mostly looking that we can call into the api and get the responses that we want. If theirs a bug, it would likely be in the C library.

The reason for the EK cert combined with a matching EK pub is that I'll add a pure python MakeCredential and would like to add a TPM cert parser using asn1crypto as they are both common pain points for people setting up remote attestation.
While both can be solved without an matching EK cert and EK pub it would be nice being able to test a common flow

from tpm2-pytss.

We test make credential without a TPM backend in the tools, for example. We output the public key in PEM format and use that over the EK Certificate. If you wanted to test against an x509 certificate, you could generate a certificate using tpm2-pkcs11 or tpm2-openssl-engine and the x509 command.

You could separately grab some actual EK certificates, and just run a unit test that you can convert/read them into this and mock any other parts.

from tpm2-pytss.