Handle "AttestedCertifyInfo" in ActivationParameter checks for TPM2.0 Challenges about go-attestation HOT 3 CLOSED

Does this require a change to the AK the way we generate the AK, or is this specifically only related to the challenge?

Would that look like adding a field to opt into attest certify rather than attest creation? E.g. if we had something like

type AttestationType int

const (
    AttestCreation AttestationType = iota // Default value
    AttestCertify
)

Then let you specify that field in ActivationParameters and CertificationParameters, would that work?

https://pkg.go.dev/github.com/google/go-attestation/attest#ActivationParameters
https://pkg.go.dev/github.com/google/go-attestation/attest#CertificationParameters

from go-attestation.

Does this require a change to the AK the way we generate the AK, or is this specifically only related to the challenge?

This is only specifically to the challenge.

Would that look like adding a field to opt into attest certify rather than attest creation? E.g. if we had something like

When we parse attestation data using tpm2.DecodeAttestationData, the bytes we initially receive for attestation data should already have a tag that matches one of the ones already present in the tpm2 library to determine whether we're dealing with AttestedCertify data or AttestedCreation data. So no further changes needed, especially given that the library already recognizes both tag-types we intend to handle here.

from go-attestation.

Cool. I will note that one of the explicit goals of this package is to avoid the need to use go-tpm2 directly. So if we add support for verifying a particular challenge type, we should also add support for generating it.

I don't think it makes sense for us to only support verification.

from go-attestation.