Halo Loïc! It is very interesting to come across your work on collecting TPM EK CA roots, to gain trust in TPMs (and using transparency logging as part of that!).
While looking around your repos, I also tried running tpm-trust audit on my AMD laptop, but got error=EK certificate does not contain AIA extension with issuing certificate URL -- I think because the code that is used for audit does not extract intermediates stored in TPM NV (starting at index 0x01c00100, called EKCertChainIndexStart in the attest module). The attest module (your fork) has code for doing that in its info pkg, but that's just for informative use?
The extraction of any and all intermediates in TPM NV should be done in the attest module, or if it's rather in the tpm pkg of this tpm-trust module, and those then added to the EK struct. So that they then can be used for chainbuilding up in the ekchecker.check. Something like that :)
The TPM of this AMD laptop has 2 intermediates in TPM NV, and then an AIA URL in the last one, which needs to be followed recursively, fetching in total 2 more intermediates. Then the last intermediate is signed by the elusive CN=AMD Root CA R4 (Authority Key Identifier FE:C2:62:87:86:20:D2:92:61:A6:F1:ED:A6:4F:0D:E6:6D:C4:D3:F1), which I was also stumped by how it just can't seem to be found anywhere.
Halo Loïc! It is very interesting to come across your work on collecting TPM EK CA roots, to gain trust in TPMs (and using transparency logging as part of that!).
While looking around your repos, I also tried running
tpm-trust auditon my AMD laptop, but goterror=EK certificate does not contain AIA extension with issuing certificate URL-- I think because the code that is used for audit does not extract intermediates stored in TPM NV (starting at index 0x01c00100, calledEKCertChainIndexStartin the attest module). The attest module (your fork) has code for doing that in its info pkg, but that's just for informative use?The extraction of any and all intermediates in TPM NV should be done in the attest module, or if it's rather in the tpm pkg of this tpm-trust module, and those then added to the EK struct. So that they then can be used for chainbuilding up in the
ekchecker.check. Something like that :)The TPM of this AMD laptop has 2 intermediates in TPM NV, and then an AIA URL in the last one, which needs to be followed recursively, fetching in total 2 more intermediates. Then the last intermediate is signed by the elusive
CN=AMD Root CA R4(Authority Key Identifier FE:C2:62:87:86:20:D2:92:61:A6:F1:ED:A6:4F:0D:E6:6D:C4:D3:F1), which I was also stumped by how it just can't seem to be found anywhere.