ReadPCRs returns a maximum of 8 results

[google]

ReadPCRs returns a maximum of 8 results

[ElMostafaIdrassi]

From the spec, a TPM2_PCR_Read command only returns 1 single TPML_DIGEST. Knowing that a TPML_DIGEST can contain at most 8 digests, I think it is safe to say that the TPM can at most return 8 PCRs Digests per TPM2_PCR_Read command.

go-tpm/tpm2/tpm2.go

Lines 180 to 191 in ac5b427

	func ReadPCRs(rw io.ReadWriter, sel PCRSelection) (map[int][]byte, error) {
	Cmd, err := encodeTPMLPCRSelection(sel)
	if err != nil {
	return nil, err
	}
	resp, err := runCommand(rw, TagNoSessions, CmdPCRRead, tpmutil.RawBytes(Cmd))
	if err != nil {
	return nil, err
	}
	return decodeReadPCRs(resp)
	}

As you can see, the current implementation only runs the command once and expects the TPM to return all the selected PCRs. This works fine when you select up to 8 PCRs, but will return only the first 8 PCRs digests if you select more, as explained above.

In order to fix this, a similar approach to what tpm2-tools does is needed, that is, in the first call, send the whole TPML_PCR_SELECTION with all the wanted PCR bits set. After getting and parsing the first response, null out the bits of the PCRs we just retrieved in the TPML_PCR_SELECTION, check that it is not all zeroed out, then call TPM2_PCR_READ once more on the new TPML_PCR_SELECTION, etc...

[twitchy-jsonp]

As @ElMostafaIdrassi explained, a single call to read PCRs can only read a few PCRs at a time. In go-attestation, we read all the PCRs using a loop, like this:

https://github.com/google/go-attestation/blob/2453c8f39a4ff46009f6a9db6fb7c6cca789d9a1/attest/tpm.go#L232