Enable different key sizes and curves for EK and AK

[THS-on]

This implements a selection of the different key sizes for RSA and curves for ECC for EK and AK using the backported changes in rust-tss-esapi.

Further this then also enables us to use EK certs for non default key types.

Note this is currently blocked until https://github.com/parallaxsecond/rust-tss-esapi/pull/546 gets merged and we have a new release.

[THS-on]

Note that this now outputs in the quote rsa2048 instead of rsa, so we would probably need to update also something on the server side.

Edit: decided to make the string encoding for RSA 2024 just rsa

[codecov[bot]]

Codecov Report

Attention: Patch coverage is 56.25000% with 56 lines in your changes missing coverage. Please review.

Project coverage is 69.32%. Comparing base (36600c4) to head (a99bb40). Report is 5 commits behind head on master.

Files with missing lines	Patch %	Lines
keylime/src/algorithms.rs	50.00%	26 Missing :warning:
keylime/src/tpm.rs	68.65%	21 Missing :warning:
keylime-push-model-agent/src/registration.rs	0.00%	5 Missing :warning:
keylime-agent/src/config.rs	0.00%	4 Missing :warning:

Additional details and impacted files

Flag	Coverage Δ
e2e-testsuite	69.32% <56.25%> (-0.35%)	:arrow_down:
upstream-unit-tests	69.32% <56.25%> (-0.35%)	:arrow_down:

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
keylime-agent/src/agent_handler.rs	58.69% <ø> (ø)
keylime-agent/src/common.rs	33.89% <ø> (ø)
keylime-agent/src/main.rs	19.33% <ø> (ø)
keylime-agent/src/config.rs	81.39% <0.00%> (-0.28%)	:arrow_down:
keylime-push-model-agent/src/registration.rs	6.81% <0.00%> (-0.50%)	:arrow_down:
keylime/src/tpm.rs	72.99% <68.65%> (-0.63%)	:arrow_down:
keylime/src/algorithms.rs	66.16% <50.00%> (-10.85%)	:arrow_down:

... and 3 files with indirect coverage changes

:rocket: New features to boost your workflow:

• :snowflake: Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[THS-on]

This is now mostly blocked on a new stable release of the tss-esapi create.

There is also the issue that the parsing of the EK TPM structure goes somewhere wrong, as the verifier says that the EK public key in the TSS structure and the one in the EK certificate don't match. I'll investigate where this goes wrong.

[THS-on]

This PR is also blocked on https://github.com/parallaxsecond/rust-tss-esapi/pull/552 being backported, otherwise the EK verification will always fail.

[THS-on]

@ansasaki this is now fully working. We still need to wait for a new release of tss-esapi bindings to actually use it.

[THS-on]

Registration and EK verification using swtpm with the Nist384 curve works. Unfortunatly something with is broken when trying to verify the actual quote:

2024-12-23 16:16:17.166 - keylime.tpm - ERROR - Error verifying quote: 
2024-12-23 16:16:17.166 - keylime.tpm - ERROR - 
Traceback (most recent call last):
  File "/usr/local/lib/python3.13/site-packages/keylime/tpm/tpm_main.py", line 176, in _tpm2_checkquote
    pcrs_dict = tpm_util.checkquote(aikFromRegistrar, nonce, sigblob, quoteblob, pcrblob, hash_alg)
  File "/usr/local/lib/python3.13/site-packages/keylime/tpm/tpm_util.py", line 249, in checkquote
    verify(pubkey, signature, quote_digest, hashfunc)
    ~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.13/site-packages/keylime/tpm/tpm_util.py", line 82, in verify
    pubkey.verify(sig, digest, ec.ECDSA(Prehashed(hashfunc)))
    ~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
cryptography.exceptions.InvalidSignature
2024-12-23 16:16:17.167 - keylime.tpm - WARNING - Quote for agent d432fbb3-d2f1-4a97-9ef7-75bd81c00000 does not contain any PCRs. Make sure that the TPM supports sha256 PCR banks
2024-12-23 16:16:17.167 - keylime.tpm - ERROR - Binding PCR #16 was not included in the quote (from agent d432fbb3-d2f1-4a97-9ef7-75bd81c00000), but is required
2024-12-23 16:16:17.167 - keylime.tenant - ERROR - TPM Quote from Agent d432fbb3-d2f1-4a97-9ef7-75bd81c00000 (127.0.0.1:9002) is invalid for nonce: aY76KkOhWwK53FlNocI1

Might be an padding issue or something else that we missed.

[THS-on]

This code is tested against latest Keylime version + https://github.com/keylime/keylime/pull/1746