Improve tpm2.verify_ek to speed up cert matching

Currently we are brute forcing the entire list of signing certs by TPM manufacturers: see https://github.com/mit-ll/python-keylime/blob/master/keylime/tpm2.py#L625

for signer in trusted_certs:
   signcert = M2Crypto.X509.load_cert_string(trusted_certs[signer])
   signkey = signcert.get_pubkey()
   if ek509.verify(signkey) == 1:
       logger.debug("EK cert matched signer %s"%signer)
       return True

This can be improved by determining the correct CA to check against based on info from the EK certificate, saving the trouble of a brute force.

[donky106]

Thanks for assigning. I appreciate that.

currently you extract the CA=certificate authority, i.e. the signer from each certificate in the array [trusted_certs].

With a public key of that CA you verify the X.509 certificate.

To avoid a brute force trying each trusted certificate you would like to determine the correct CA first. And verify with the correct CA.

The X.509 certificates are PEM-encoded.

[github-actions[bot]]

🎉 This issue has been resolved in version 4.0.1 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀