persist AK, NK and mTLS certificate to disk

[THS-on]

A new file in /var/lib/keylime is created called "agent_data.json which
holds all those keys and certificates. This allows the agent to be
restarted mid attestation without failing due to wrong keys.

Fixes: #382

[lkatalin]

Thanks for the PR! I'm trying to understand the security implications of this. I went back to read your comment on #293 about loading the AK from disk, I assume that's applicable here as well?

The TPM store operation encrypts the private data with a (symmetric?) key before dumping it to disk, so that only the TPM can actually do something useful with that data. The load operation then decrypts the private data again inside the TPM.

I assume that encryption operation was happening with the ctx.context_save() function before (could be wrong here) and I don't see that being called anymore in this change. Is that happening somewhere else? Do we not need it?

[THS-on]

I went back to read your #293 (comment) on #293 about loading the AK from disk, I assume that's applicable here as well?

Yes the Private struct returned by create_ak(..) is symmetricly encrypted from the TPM.

I assume that encryption operation was happening with the #391 (comment) function before (could be wrong here) and I don't see that being called anymore in this change. Is that happening somewhere else? Do we not need it?

The old implementation first dumped and then serialized the context with the AK, the new one directly serializes the Private struct (TPM2_PRIVATE) which has the advantage that the AK can be loaded after a TPM reset (this is not possible with context objects).
The encryption happens on AK key creation.

What has changed is that we also dump the NK to disk, which is fine because it is used for transport security and the payload mechanism, not the actual attestation. The worst case that happens if someone gets this key (by having read access to /var/lib/keylime) is that they can decrypt payloads which the agent anyway does and stores under the secure tmp mount with the same permissions.

[lkatalin]

@THS-on Thanks for the explanation.