Validate max size of import blob.

[mikedanese]

Import blob appears to only handle sensitive data with a max of 128 bytes. See this test:

package client_test

import (
	"fmt"
	"io"
	"strings"
	"testing"

	"github.com/google/go-cmp/cmp"
	tpmclient "github.com/google/go-tpm-tools/client"
	tpmserver "github.com/google/go-tpm-tools/server"
	"github.com/google/go-tpm-tools/simulator"
)

func TestImportE2E(t *testing.T) {
	sim, err := simulator.Get()
	if err != nil {
		t.Fatal(err)
	}
	defer sim.Close()

	for i := 0; i < 256; i++ {
		t.Run(fmt.Sprint(i), func(t *testing.T) {
			testImport(t, sim, i)
		})
	}

}

func testImport(t *testing.T, tpmDev io.ReadWriteCloser, size int) {
	ek, err := tpmclient.EndorsementKeyRSA(tpmDev)
	if err != nil {
		t.Fatal(err)
	}
	defer ek.Close()

	secret := strings.Repeat("s", size)
	blob, err := tpmserver.CreateImportBlob(ek.PublicKey(), []byte(secret), nil)
	if err != nil {
		t.Fatal(err)
	}

	out, err := ek.Import(blob)
	if err != nil {
		t.Fatalf("Import failed: size=%v, err=%v", size, err)
	}
	if diff := cmp.Diff(string(out), secret); diff != "" {
		t.Errorf("unexpected output (-got +want): %s", diff)
	}
}

At message size of 129 bytes and beyond, this test starts failing with:

Import failed: size=129, err=import failed: parameter 3, error code 0x15 : structure is the wrong size

Is that by the TPM spec or is there a something wrong with the encoding?

[salrashid123]

i think its the limit of 128 max as its bytes used is what gets encoded as the sensitive bit here. which i think is this in the specs 11.1.13 for

11.1.13 TPMU_SENSITIVE_CREATE
This structure allows a TPM2B_SENSITIVE_CREATE structure to carry either a
TPM2B_SENSITVE_DATA or a TPM2B_DERIVE structure. The contents of the union are determined by
context. When an object is being derived, the derivation values are present.
MAX_SYM_DATA shall be 128.

if you want to transfer anything larger, i think you'll need to do two layers of encryption KEK/DEK

---

though not directly related to the question but akin to tpm-based wrap/unwrap stuff

• go-tpm-wrapping << this uses the non-legacy tpm2 'direct' mechanism.
• gcp-vtpm-ek-ak << seal/unseal and sign/verify using endorsement and attestation keys.
• tpm_kubernetes << on gke directly on pod
• tpm_daemonset << on gke as daemonset
• tls_ak << unreviewed TLS with attested keys