Derive key organized

[Stunkymonkey]

No description provided.

[dcoder42]

I tested this on Debian 13 with clevis to automatically decrypt the root partition at boot time. I had to do a few changes to get it work.

Clevis adds a / at the end of the adv request so extending the paths was needed

TangServer.h

    // --- Setup Server Routes ---
    server_http.on("/adv", HTTP_GET, handleAdv);
    server_http.on("/adv/", HTTP_GET, handleAdv);

Clevis sends a self calculated kid as request to the rec endpoint which is a hash over some values

verify_tang.py

import hashlib
...
    kid_data = {
        'crv': curve_name,
        'kty': 'EC',
        'x': base64url_encode(x),
        'y': base64url_encode(y)
    }
    kid_json = json.dumps(kid_data, separators=(',', ':')).encode('utf-8')
    kid_sha256_hash = hashlib.sha256(kid_json).digest()
    kid = base64.urlsafe_b64encode(kid_sha256_hash).decode('utf-8').rstrip('=')

Since kid can be calculated we can remove it from the handleAdv adv endpoint

handler.h

        //k["kid"] = key.kid;