tree 0dbebeb12a8be1de9f19d31d6c6319e005af749e
parent 74440ac441be981eb570dc37036e71bf25a04492
author Lorenz Brun <lorenz@monogon.tech> 1646917608 +0100
committer Lorenz Brun <lorenz@monogon.tech> 1646929474 +0000

m/p/tpm: use secretbox with seal/unseal for larger payloads

Natively the Seal/Unseal operation in the TPM 2.0 specification only
supports up to 128 bytes of payload. If you need to seal more than that
the specification tells you to generate and seal a key and use that to
encrypt and authenticate the rest of the data. This CL implements said
mechanism transparently as part of the Seal and Unseal functions using
a nacl-compatible secretbox as the authenticated encryption primitive.

Change-Id: I0a724b12aae5e5151d103b52ed13b71c864076ab
Reviewed-on: https://review.monogon.dev/c/monogon/+/626
Reviewed-by: Sergiusz Bazanski <serge@monogon.tech>