Improve key sealing code

- fix incorrect algorithm used. SHA256 is now used - Add PCR 14 to the list Signed-off-by: Mikhail Malyshev <mikem@zededa.com>
lf-edge · Jan 26, 2023 · 4b94a6e · 4b94a6e
1 parent c01abf6
commit 4b94a6e
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/pkg/pillar/evetpm/tpm.go b/pkg/pillar/evetpm/tpm.go
@@ -93,7 +93,7 @@ var (
 	pcrBank256Status = PCRBank256StatusUnknown
 
 	//DiskKeySealingPCRs represents PCRs that we use for sealing
-	DiskKeySealingPCRs = tpm2.PCRSelection{Hash: tpm2.AlgSHA1, PCRs: []int{0, 1, 2, 3, 4, 6, 7, 8, 9, 13}}
+	DiskKeySealingPCRs = tpm2.PCRSelection{Hash: tpm2.AlgSHA256, PCRs: []int{0, 1, 2, 3, 4, 6, 7, 8, 9, 13, 14}}
 )
 
 //SealedKeyType holds different types of sealed key