The keypair that ties a licence to one install. The licensing server stores its public half and names it in the signed licence; the app proves it holds the private half by signing a fresh random value.
The key is ECDSA on NIST P-256, because TPM 2.0 chips sign on that curve and few sign Ed25519. A public key travels as the 65-byte uncompressed point, base64; a signature as DER, the form OpenSSL and the TPM tools write.
Aker.InstallKey.Software keeps the private key in a file;
Aker.InstallKey.Tpm keeps it in the chip.
Summary
Types
Where the implementation keeps its key, such as dir:.
The uncompressed P-256 point: 0x04, then X and Y.
Callbacks
Makes the key when there is none, and answers its public half.
Which kind of key this is, as an activation request names it.
The public half of the key that exists, without making one.
The DER ECDSA SHA-256 signature of message.
Functions
The install key for the licence folder dir, as {module, opts}.
Whether public_key is an uncompressed point on P-256.
Signs a fresh 32-byte random value with the key {module, opts} names
and checks the signature against public_key. True only when the key
in hand is the one public_key describes.
Whether signature is public_key's DER signature of message.
Types
@type opts() :: keyword()
Where the implementation keeps its key, such as dir:.
@type public_key() :: <<_::520>>
The uncompressed P-256 point: 0x04, then X and Y.
Callbacks
@callback ensure(opts()) :: {:ok, public_key()} | {:error, atom()}
Makes the key when there is none, and answers its public half.
@callback kind() :: :software | :tpm
Which kind of key this is, as an activation request names it.
@callback public_key(opts()) :: {:ok, public_key()} | {:error, atom()}
The public half of the key that exists, without making one.
The DER ECDSA SHA-256 signature of message.
Functions
The install key for the licence folder dir, as {module, opts}.
The key stays the kind that made it, since the licence names that key: a key made in the chip stays the chip's, so a machine whose chip is gone refuses rather than making a new key, and a key made in a file is never moved into a chip that appears later. A new install uses the chip when the machine has one, and a file otherwise.
Options:
:tpm_device- the chip's device (default/dev/tpmrm0);:tpm_options- options passed toAker.InstallKey.Tpm.
Whether public_key is an uncompressed point on P-256.
Signs a fresh 32-byte random value with the key {module, opts} names
and checks the signature against public_key. True only when the key
in hand is the one public_key describes.
Whether signature is public_key's DER signature of message.