Add quote example, add note to Activation.Generate() about use of subtle to prevent timing attacks (#84)

attest/activation.go

@@ -206,6 +206,11 @@ func (p *ActivationParameters) checkTPM20AIKParameters() error {
 // Generate returns a credential activation challenge, which can be provided
 // to the TPM to verify the AIK parameters given are authentic & the AIK
 // is present on the same TPM as the EK.
+//
+// The caller is expected to verify the secret returned from the TPM as
+// as result of calling ActivateCredential() matches the secret returned here.
+// The caller should use subtle.ConstantTimeCompare to avoid potential
+// timing attack vectors.
 func (p *ActivationParameters) Generate() (secret []byte, ec *EncryptedCredential, err error) {
 	if err := p.checkAIKParameters(); err != nil {
 		return nil, nil, err

attest/example_test.go

@@ -45,7 +45,7 @@ func ExampleAIK() {
 	}
 }
 
-func Example_credentialActivation() {
+func ExampleAIK_credentialActivation() {
 	tpm, err := attest.OpenTPM(nil)
 	if err != nil {
 		log.Fatalf("Failed to open TPM: %v", err)
@@ -91,10 +91,41 @@ func Example_credentialActivation() {
 	}
 }
 
+func ExampleAIK_quote() {
+	tpm, err := attest.OpenTPM(nil)
+	if err != nil {
+		log.Fatalf("Failed to open TPM: %v", err)
+	}
+	defer tpm.Close()
+
+	// Create a new AIK.
+	aik, err := tpm.MintAIK(nil)
+	if err != nil {
+		log.Fatalf("Failed to create AIK: %v", err)
+	}
+	defer aik.Close(tpm)
+
+	// The nonce would typically be provided by the server.
+	nonce := []byte{1, 2, 3, 4, 5, 6, 7, 8}
+
+	// Perform the quote & gather information necessary to verify it.
+	quote, err := aik.Quote(tpm, nonce, attest.HashSHA1)
+	if err != nil {
+		log.Fatalf("Failed to generate quote: %v", err)
+	}
+	pcrs, err := tpm.PCRs(attest.HashSHA1)
+	if err != nil {
+		log.Fatalf("Failed to collect PCR values: %v", err)
+	}
+	log.Printf("quote = %+v", quote)
+	log.Printf("PCRs = %+v", pcrs)
+}
+
 func TestExampleAIK(t *testing.T) {
 	if !*testExamples {
 		t.SkipNow()
 	}
 	ExampleAIK()
-	Example_credentialActivation()
+	ExampleAIK_credentialActivation()
+	ExampleAIK_quote()
 }