Add back key_type for TPM 2.0 without IDevID implementation.

Author: Chounoki

README.md

@@ -585,8 +585,8 @@ while TPM 1.2 systems are not supported.
         `TPM2_Import` command to import the received HMAC-SHA256 key into TPM,
         finally invoke `TPM2_Certify` command to certify any TPM residing key
         using the imported HMAC-SHA256 key. When invoking `TPM2_Certify`
-        command, the `qualifyingData` argument must hold a TPMT_HA structure,
-        with TPMT_HA.hashAlg field set to TPM_ALG_SHA256 and TPMT_HA.digest
+        command, the `qualifyingData` argument must hold a `TPMT_HA` structure,
+        with `TPMT_HA.hashAlg` field set to TPM_ALG_SHA256 and `TPMT_HA.digest`
         field set to the SHA256 hash over the `serialized_transport_key`.
       - For TPM 1.2, populate the `tpm12_ek` field of this message. First
         create a `TransportKey` message by generating an ephemeral HPKE key

proto/bootz.proto

@@ -565,11 +565,12 @@ message BootstrapStreamResponseV1 {
       bytes nonce = 1;
     }
     message ChallengeRequestTPM20HMAC {
+      // The encryption key type: EK or PPK.
+      openconfig.attestz.Key key_type = 1;
       // The HMAC key encrypted to EK/PPK.
       // The device should invoke TPM2_Import command to import this HMAC key
       // into the TPM.
-      // NOTE: Whether it is encrypted to EK or PPK is decided by the identity
-      // (tpm20_ek_pub or tpm20_ppk_pub) presented by the device.
+      // NOTE: Whether it is encrypted to EK or PPK is decided by the key_type.
       openconfig.attestz.HMACChallenge hmac_encrypted = 2;
     }
     message ChallengeRequestTPM12EK {

proto/bootz/bootz.pb.go

@@ -68,7 +68,8 @@ func (m *InMemoryEntityManager) ResolveChassis(ctx context.Context, chassis *typ
 	}
 	var key *rsa.PublicKey
 	var keyType tpb.Key
-	if _, ok := chassis.Identity.GetType().(*bpb.Identity_EkPpkPub); ok {
+	switch chassis.Identity.GetType().(type) {
+	case *bpb.Identity_Tpm20EkPub, *bpb.Identity_Tpm20PpkPub, *bpb.Identity_Tpm12EkPub, *bpb.Identity_EkPpkPub:
 		for _, c := range inventory.GetControllerCards() {
 			if c.GetSerialNumber() == chassis.ActiveSerial {
 				block, _ := pem.Decode([]byte(c.GetPublicKey()))

proto/bootz/bootz_grpc.pb.go

@@ -733,6 +733,7 @@ func (s *Service) createChallengeRequest(session *streamSessionV1, message proto
 				ChallengeRequest: &bpb.BootstrapStreamResponseV1_ChallengeRequest{
 					Type: &bpb.BootstrapStreamResponseV1_ChallengeRequest_Tpm20Hmac{
 						Tpm20Hmac: &bpb.BootstrapStreamResponseV1_ChallengeRequest_ChallengeRequestTPM20HMAC{
+							KeyType: chassis.ActivePublicKeyType,
 							HmacEncrypted: &epb.HMACChallenge{
 								HmacPubKey: tpm2.Marshal(tpm2.New2B(*hmacPub)),
 								Duplicate:  tpm2.Marshal(&tpm2.TPM2BPrivate{Buffer: duplicate}),