On Tue, Aug 23, 2022 at 03:25:26PM -0700, Evan Green wrote: > The key blob is not secret, and by default the TPM will happily unseal > it regardless of system state. We can protect against that by sealing > the secret with a PCR policy - if the current PCR state doesn't match, > the TPM will refuse to release the secret. For now let's just seal it to > PCR 23. In the long term we may want a more flexible policy around this, > such as including PCR 7 for PCs or 0 for Chrome OS. > > Sourced-from: Matthew Garrett <mjg59@xxxxxxxxxx> If it's a total rewrite, I'd say use: Suggested-by: Matthew Garrett <...> Link: https://lore.kernel.org/of/what/it/was/based/on If it's built on an existing patch, I'd say use: Co-developed-by: Matthew Garrett <...> Signed-off-by: Matthew Garrett <...> But I defer to what Matthew thinks. :) Also, if you don't hear from Matthew, maybe ping his mjg59@xxxxxxxxxxxxx address. -Kees -- Kees Cook
