// Sign signs the attestation report with private key 'priv' and appends the
// pem encoded certificate chain 'certsPem' to the JWS structure. The
// certificates must be handed over in the order they should be appended
// (Signing Certificate -> Intermediate Certificates -> Root CA Certificate)
// Parameter 'mu' is an optional mutex, in case the private key requires exclusive
// access (e.g. because it is located in a hardware module)
Sign signs the attestation report with private key 'priv' and appends the
pem encoded certificate chain 'certsPem' to the JWS structure. The
certificates must be handed over in the order they should be appended
(Signing Certificate -> Intermediate Certificates -> Root CA Certificate)
Parameter 'mu' is an optional mutex, in case the private key requires exclusive
access
// Sign signs the attestation report with private key ' priv ' and appends the // pem encoded certificate chain ' certsPem ' to the JWS structure . The // certificates must be handed over in the order they should be appended // ( Signing Certificate - > Intermediate Certificates - > Root CA Certificate ) // Parameter ' mu ' is an optional mutex in case the private key requires exclusive // access ( e . g . because it is located in a hardware module )
func Sign(mu *sync.Mutex, ar ArJws, priv crypto.PrivateKey, pub crypto.PublicKey, certsPem [][]byte) (bool, []byte) {
	var err error
	log.Trace("Signing attestation report")
	certsb64 := make([]string, 0)
	for i, certPem := range certsPem {
		cert := loadCert(certPem)
		if cert == nil {
			log.Errorf("Failed to load cert[%v]", i)
			return false, nil
		}
		certsb64 = append(certsb64, base64.StdEncoding.EncodeToString(cert.Raw))
	}
	var alg jose.SignatureAlgorithm
	alg, err = algFromKeyType(pub)
	if err != nil {
		log.Error(err)
		return false, nil
	}
	log.Trace("Chosen signature algorithm: ", alg)
	var hws *hwSigner
	var opaqueSigner jose.OpaqueSigner
	hws = &hwSigner{
		pk:      &jose.JSONWebKey{Key: pub},
		signer:  priv,
		alg:    alg,
	}
	opaqueSigner = jose.OpaqueSigner(hws)
	var opt jose.SignerOptions
	var signer jose.Signer
	signer, err = jose.NewSigner(jose.SigningKey{Algorithm: alg, Key: opaqueSigner}, opt.WithHeader("x5c", certsb64))
	if err != nil {
		log.Error("Failed to setup signer for the Attestation Report: ", err)
		return false, nil
	}
	data, err := json.Marshal(ar)
	if err != nil {
		log.Error("Failed to marshal the Attestation Report: ", err)
		return false, nil
	}
	if mu != nil {
		log.Trace("Trying to get lock on TPM for signing")
		mu.Lock()
		log.Trace("Got lock on TPM for signing")
		defer func() {
			log.Trace("Releasing TPM Lock for signing")
			mu.Unlock()
			log.Trace("Released TPM Lock for signing")
		}()
	}
	log.Trace("Performing Sign operation")
	obj, err := signer.Sign(data)
	if err != nil {
		log.Error("Failed to sign the Attestation Report: ", err)
		return false, nil
	}
	log.Trace("Signed attestation report")
	var msg string
	msg = obj.FullSerialize()
	return true, []byte(msg)
}
func Sign ( mu * sync . Mutex , ar ArJws , priv crypto . PrivateKey , pub crypto . PublicKey , certsPem [ ] [ ] byte ) ( bool , [ ] byte ) { var err error log . Trace ( " " ) certsb64 := make ( [ ] string , 0 ) for i , certPem := range certsPem { cert := loadCert ( certPem ) if cert == nil { log . Errorf ( " " , i ) return false , nil } certsb64 = append ( certsb64 , base64 . StdEncoding . EncodeToString ( cert . Raw ) ) } var alg jose . SignatureAlgorithm alg , err = algFromKeyType ( pub ) if err != nil { log . Error ( err ) return false , nil } log . Trace ( " " , alg ) var hws * hwSigner var opaqueSigner jose . OpaqueSigner hws = & hwSigner { pk : & jose . JSONWebKey { Key : pub } , signer : priv , alg : alg , } opaqueSigner = jose . OpaqueSigner ( hws ) var opt jose . SignerOptions var signer jose . Signer signer , err = jose . NewSigner ( jose . SigningKey { Algorithm : alg , Key : opaqueSigner } , opt . WithHeader ( " " , certsb64 ) ) if err != nil { log . Error ( " " , err ) return false , nil } data , err := json . Marshal ( ar ) if err != nil { log . Error ( " " , err ) return false , nil } if mu != nil { log . Trace ( " " ) mu . Lock ( ) log . Trace ( " " ) defer func ( ) { log . Trace ( " " ) mu . Unlock ( ) log . Trace ( " " ) } ( ) } log . Trace ( " " ) obj , err := signer . Sign ( data ) if err != nil { log . Error ( " " , err ) return false , nil } log . Trace ( " " ) var msg string msg = obj . FullSerialize ( ) return true , [ ] byte ( msg ) }
Sign signs the attestation report with private key 'priv' and appends the
pem encoded certificate chain 'certsPem' to the JWS structure.
Sign signs the attestation report with private key ' priv ' and appends the pem encoded certificate chain ' certsPem ' to the JWS structure .
// certificate chain in base64 encoding // Get jose.SignatureAlgorithm // Saltlength and further algorithms are set to the recommended default by x509 // we assume these defaults are correct // create jose.OpaqueSigner with hwSigner wrapper (tpm key) // Create jose.Signer with OpaqueSigner // x5c: adds Certificate Chain in later result // Marshal data to bytes // If a mutex is present, lock it to ensure exclusive access to the signing key // sign // return signature in bytes