如何使用TSS.NET从TPM导出公钥

Question

我已经从这里获得了Signing样本，以与TPM模拟器进行运行。

看来我在打电话后对公共密钥有某种引用：

TpmPublic keyPublic; //This seems to have what we're looking for
CreationData creationData;
TkCreation creationTicket;
byte[] creationHash;
// 
// Ask the TPM to create a new primary RSA signing key.
// 
TpmHandle keyHandle = tpm[ownerAuth].CreatePrimary(
  TpmRh.Owner, // In the owner-hierarchy
  new SensitiveCreate(keyAuth, null), // With this auth-value
  keyTemplate, // Describes key
  null, // Extra data for creation ticket
  new PcrSelection[0], // Non-PCR-bound
  out keyPublic, // PubKey and attributes
  out creationData, out creationHash, out creationTicket); 

在以前的方法中，有一些提示的进一步评论代码：

：

// (Note that serialization is not supported on WinRT)
// 
// Demonstrate the use of XML persistence by saving keyPublic to 
// a file and making a copy by reading it back into a new object
// 
// NOTE: 12-JAN-2016: May be removing support for policy
//       serialization. We'd like to get feedback on whether
//       this is a desirable feature and should be retained.
//
// {
//     const string fileName = "sample.xml";
//     string xmlVersionOfObject = keyPublic.GetXml();
//     keyPublic.XmlSerializeToFile(fileName);
//     var copyOfPublic = TpmStructureBase.XmlDeserializeFromFile<TpmPublic>(fileName);

TpmPublic.GetXml()似乎不再存在，因此可以根据注释将其删除。

Answer 1

尚不完全清楚您需要什么；您的公钥类型是什么？您想处理什么？因此，此答案是假设您正在尝试获取指数的原始字节和RSA公共密钥的模量，以便您可以将其导出到一个键，然后可以通过，例如OpenSSL。p>您看到的" XML导出"功能是指序列化和隔离TpmPublic对象，并且并没有真正接近您的目标：您只需将原始对象恢复。它可能被删除，因为它运行不佳。

假设keyPublic是代表RSA键的TpmPublic对象，以获取您要做的指数：

var rsaParams = (RsaParms)keyPublic.parameters;
var exponent = rsaParams.exponent != 0
             ? Globs.HostToNet(rsaParams.exponent)
             : RsaParms.DefaultExponent;

并获得模量：

var modulus = (keyPublic.unique as Tpm2bPublicKeyRsa).buffer;

要查看如何处理ECC密钥，请看一下AsymCryptoSystem.CreateFrom()：

public static AsymCryptoSystem CreateFrom(TpmPublic pubKey, TpmPrivate privKey = null)
{
    var cs = new AsymCryptoSystem();
    TpmAlgId keyAlgId = pubKey.type;
    cs.PublicParms = pubKey.Copy();
    // Create an algorithm provider from the provided PubKey
    switch (keyAlgId)
    {
        case TpmAlgId.Rsa:
            {
                RawRsa rr = null;
                byte[] prime1 = null,
                        prime2 = null;
                if (privKey != null)
                {
                    rr = new RawRsa(pubKey, privKey);
                    prime1 = RawRsa.ToBigEndian(rr.P);
                    prime2 = RawRsa.ToBigEndian(rr.Q);
                }
                var rsaParams = (RsaParms)pubKey.parameters;
                var exponent = rsaParams.exponent != 0
                                        ? Globs.HostToNet(rsaParams.exponent)
                                        : RsaParms.DefaultExponent;
                var modulus = (pubKey.unique as Tpm2bPublicKeyRsa).buffer;
                AsymmetricKeyAlgorithmProvider rsaProvider = AsymmetricKeyAlgorithmProvider.OpenAlgorithm(AsymmetricAlgorithmNames.RsaOaepSha256);
                uint primeLen1 = 0, primeLen2 = 0;
                // Compute the size of BCRYPT_RSAKEY_BLOB
                int rsaKeySize = exponent.Length + modulus.Length + 24;
                if (prime1 != null && prime1.Length > 0)
                {
                    if (prime2 == null || prime2.Length == 0)
                    {
                        Globs.Throw<ArgumentException>("LoadRSAKey(): The second prime is missing");
                        return null;
                    }
                    primeLen1 = (uint)prime1.Length;
                    primeLen2 = (uint)prime2.Length;
                    rsaKeySize += prime1.Length + prime2.Length;
                }
                else if (prime2 != null && prime2.Length > 0)
                {
                    Globs.Throw<ArgumentException>("LoadRSAKey(): The first prime is missing");
                    return null;
                }
                var rsaKey = new byte[rsaKeySize];
                // Initialize BCRYPT_RSAKEY_BLOB
                int offset = 0;
                WriteToBuffer(ref rsaKey, ref offset, primeLen1 == 0 ?
                                BCRYPT_RSAPUBLIC_MAGIC : BCRYPT_RSAPRIVATE_MAGIC);
                WriteToBuffer(ref rsaKey, ref offset, (uint)modulus.Length * 8);
                WriteToBuffer(ref rsaKey, ref offset, (uint)exponent.Length);
                WriteToBuffer(ref rsaKey, ref offset, (uint)modulus.Length);
                WriteToBuffer(ref rsaKey, ref offset, primeLen1);
                WriteToBuffer(ref rsaKey, ref offset, primeLen1);
                WriteToBuffer(ref rsaKey, ref offset, exponent);
                WriteToBuffer(ref rsaKey, ref offset, modulus);
                if (primeLen1 != 0)
                {
                    WriteToBuffer(ref rsaKey, ref offset, prime1);
                    WriteToBuffer(ref rsaKey, ref offset, prime2);
                }
                IBuffer rsaBuffer = CryptographicBuffer.CreateFromByteArray(rsaKey);
                if (primeLen1 == 0)
                {
                    cs.Key = rsaProvider.ImportPublicKey(rsaBuffer, CryptographicPublicKeyBlobType.BCryptPublicKey);
                }
                else
                {
                    cs.Key = rsaProvider.ImportKeyPair(rsaBuffer, CryptographicPrivateKeyBlobType.BCryptPrivateKey);
                }
                break;
            }
        case TpmAlgId.Ecc:
            {
                var eccParms = (EccParms)pubKey.parameters;
                var eccPub = (EccPoint)pubKey.unique;
                var algId = RawEccKey.GetEccAlg(pubKey);
                if (algId == null)
                {
                    return null;
                }
                bool isEcdsa = eccParms.scheme.GetUnionSelector() == TpmAlgId.Ecdsa;
                byte[] keyBlob = RawEccKey.GetKeyBlob(eccPub.x, eccPub.y, keyAlgId,
                                                        !isEcdsa, eccParms.curveID);
                AsymmetricKeyAlgorithmProvider eccProvider = AsymmetricKeyAlgorithmProvider.OpenAlgorithm(algId);
                cs.Key = eccProvider.ImportKeyPair(CryptographicBuffer.CreateFromByteArray(keyBlob));
                break;
            }
        default:
            Globs.Throw<ArgumentException>("Algorithm not supported");
            cs = null;
            break;
    }
    return cs;
}