Merge pull request #955 from smallstep/mariano/key-public

Add a Public method to the tpm.Key

Author: maraino

tpm/key.go

@@ -63,6 +63,28 @@ func (k *Key) WasAttestedBy(ak *AK) bool {
 	return k.attestedBy == ak.name
 }
 
+// Public returns the Key public key. This is backed
+// by a call to the TPM, so it can fail. If it fails,
+// nil is returned.
+func (k *Key) Public() crypto.PublicKey {
+	var (
+		err error
+		ctx = context.Background()
+	)
+	if err = k.tpm.open(ctx); err != nil {
+		return nil
+	}
+	defer closeTPM(context.Background(), k.tpm, &err)
+
+	key, err := k.tpm.attestTPM.LoadKey(k.data)
+	if err != nil {
+		return nil
+	}
+	defer key.Close()
+
+	return key.Public()
+}
+
 // Certificate returns the certificate for the Key, if set.
 // Will return nil in case no AK certificate is available.
 func (k *Key) Certificate() *x509.Certificate {

tpm/tpm_simulator_test.go

@@ -6,6 +6,7 @@ import (
 	"context"
 	"crypto"
 	"crypto/ecdsa"
+	"crypto/elliptic"
 	"crypto/rand"
 	"crypto/rsa"
 	"crypto/x509"
@@ -16,6 +17,7 @@ import (
 	"fmt"
 	"io"
 	"math"
+	"strconv"
 	"strings"
 	"testing"
 
@@ -693,6 +695,58 @@ func TestKey_CertificationParameters(t *testing.T) {
 	require.NoError(t, err)
 }
 
+func TestKey_Public(t *testing.T) {
+	ctx := t.Context()
+	tpm := newSimulatedTPM(t)
+
+	t.Run("RSA", func(t *testing.T) {
+		for _, size := range []int{1024, 2048} {
+			sizeStr := strconv.Itoa(size)
+			t.Run(sizeStr, func(t *testing.T) {
+				key, err := tpm.CreateKey(ctx, "rsa-key-"+sizeStr, CreateKeyConfig{
+					Algorithm: "RSA",
+					Size:      size,
+				})
+				require.NoError(t, err)
+
+				signer, err := key.Signer(ctx)
+				require.NoError(t, err)
+
+				pub := key.Public()
+				assert.Equal(t, signer.Public(), pub)
+				if assert.IsType(t, &rsa.PublicKey{}, pub) {
+					assert.Equal(t, size/8, pub.(*rsa.PublicKey).Size())
+				}
+			})
+		}
+	})
+
+	t.Run("ECDSA", func(t *testing.T) {
+		for _, crv := range []elliptic.Curve{
+			elliptic.P256(), elliptic.P384(), elliptic.P521(),
+		} {
+			size := crv.Params().BitSize
+			sizeStr := strconv.Itoa(size)
+			t.Run("P-"+sizeStr, func(t *testing.T) {
+				key, err := tpm.CreateKey(ctx, "ecdsa-key-"+sizeStr, CreateKeyConfig{
+					Algorithm: "ECDSA",
+					Size:      size,
+				})
+				require.NoError(t, err)
+
+				signer, err := key.Signer(ctx)
+				require.NoError(t, err)
+
+				pub := key.Public()
+				assert.Equal(t, signer.Public(), pub)
+				if assert.IsType(t, &ecdsa.PublicKey{}, pub) {
+					assert.Equal(t, crv, pub.(*ecdsa.PublicKey).Curve)
+				}
+			})
+		}
+	})
+}
+
 func TestKey_Blobs(t *testing.T) {
 	tpm := newSimulatedTPM(t)
 	config := CreateKeyConfig{