Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

FAPI: Add new profiles P_RSA3072SHA384 P_ECCP384SHA384 #2768

Merged
merged 5 commits into from
Feb 21, 2024
Merged

FAPI: Add new profiles P_RSA3072SHA384 P_ECCP384SHA384 #2768

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
2a99130
FAPI: Add new profiles P_RSA3072SHA256 P_ECCP384SHA384
JuergenReppSIT Feb 12, 2024
0a6e05d
FAPI Test: fix maybe unused variable.
JuergenReppSIT Feb 12, 2024
d98ea00
FAPI: Addapt tests to usage of P_RSA3072 profile without sha1 bank.
JuergenReppSIT Feb 12, 2024
0b19f25
FAPI: Add result check for json_object_object_add.
JuergenReppSIT Feb 17, 2024
f87820d
FAPI: Cleanup policy error handling.
JuergenReppSIT Feb 13, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 5 additions & 1 deletion Makefile.am
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -707,7 +707,9 @@ tpm2-tss-fapi.conf: dist/tmpfiles.d/tpm2-tss-fapi.conf.in

fapiprofilesdir = @sysconfdir@/tpm2-tss/fapi-profiles
fapiprofiles_DATA = dist/fapi-profiles/P_RSA2048SHA256.json \
dist/fapi-profiles/P_ECCP256SHA256.json
dist/fapi-profiles/P_ECCP256SHA256.json \
dist/fapi-profiles/P_RSA3072SHA384.json \
dist/fapi-profiles/P_ECCP384SHA384.json

libtss2_fapi = src/tss2-fapi/libtss2-fapi.la
tss2_HEADERS += $(srcdir)/include/tss2/tss2_fapi.h
Expand All @@ -717,6 +719,8 @@ EXTRA_DIST += \
dist/fapi-config.json.in \
dist/fapi-profiles/P_RSA2048SHA256.json \
dist/fapi-profiles/P_ECCP256SHA256.json \
dist/fapi-profiles/P_RSA3072SHA384.json \
dist/fapi-profiles/P_ECCP384SHA384.json \
dist/sysusers.d/tpm2-tss.conf \
dist/tmpfiles.d/tpm2-tss-fapi.conf.in \
doc/fapi-config.md \
Expand Down
4 changes: 2 additions & 2 deletions dist/fapi-profiles/P_ECCP256SHA256.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@
"scheme":"TPM2_ALG_ECDSA",
"details":{
"hashAlg":"TPM2_ALG_SHA256"
},
}
},
"sym_mode":"TPM2_ALG_CFB",
"sym_parameters": {
Expand All @@ -21,7 +21,7 @@
"sym_block_size": 16,
"pcr_selection": [
{ "hash": "TPM2_ALG_SHA1",
"pcrSelect": [ ],
"pcrSelect": [ ]
},
{ "hash": "TPM2_ALG_SHA256",
"pcrSelect": [ 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23 ]
Expand Down
99 changes: 99 additions & 0 deletions dist/fapi-profiles/P_ECCP384SHA384.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,99 @@
{
"type": "TPM2_ALG_ECC",
"nameAlg":"TPM2_ALG_SHA384",
"srk_template": "system,restricted,decrypt,0x81000001",
"srk_description": "Storage root key SRK",
"srk_persistent": 0,
"ek_template": "system,restricted,decrypt,user",
"ek_description": "Endorsement key EK",
"ecc_signing_scheme": {
"scheme":"TPM2_ALG_ECDSA",
"details":{
"hashAlg":"TPM2_ALG_SHA384"
}
},
"sym_mode":"TPM2_ALG_CFB",
"sym_parameters": {
"algorithm":"TPM2_ALG_AES",
"keyBits":"256",
"mode":"TPM2_ALG_CFB"
},
"sym_block_size": 16,
"pcr_selection": [
{ "hash": "TPM2_ALG_SHA1",
"pcrSelect": [ ]
},
{ "hash": "TPM2_ALG_SHA256",
"pcrSelect": [ 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23 ]
}
],
"curveID": "TPM2_ECC_NIST_P384",
"session_symmetric":{
"algorithm":"TPM2_ALG_AES",
"keyBits":"256",
"mode":"TPM2_ALG_CFB"
},
"ek_policy": {
"description": "Endorsement hierarchy used for policy secret.",
"policy":[
{
"type": "PolicyOR",
"branches": [
{
"name": "A",
"description": "",
"policy": [
{
"type":"POLICYSECRET",
"objectName": "4000000b"
}
]
},
{
"name": "B",
"description": "",
"policy": [
{
"type":"AUTHORIZENV",
"nvPublic": {
"size": 60,
"nvPublic": {
"nvIndex": 29392642,
"nameAlg":"SHA384",
"attributes":{
"PPWRITE":0,
"OWNERWRITE":0,
"AUTHWRITE":0,
"POLICYWRITE":1,
"POLICY_DELETE":0,
"WRITELOCKED":0,
"WRITEALL":1,
"WRITEDEFINE":0,
"WRITE_STCLEAR":0,
"GLOBALLOCK":0,
"PPREAD":1,
"OWNERREAD":1,
"AUTHREAD":1,
"POLICYREAD":1,
"NO_DA":1,
"ORDERLY":0,
"CLEAR_STCLEAR":0,
"READLOCKED":0,
"WRITTEN":1,
"PLATFORMCREATE":0,
"READ_STCLEAR":0,
"TPM2_NT":"ORDINARY"
},
"authPolicy":"8bbf2266537c171cb56e403c4dc1d4b64f432611dc386e6f532050c3278c930e143e8bb1133824ccb431053871c6db53",
"dataSize":50
}
}

}
]
}
]
}
]
}
}
1 change: 0 additions & 1 deletion dist/fapi-profiles/P_RSA2048SHA256.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,6 @@
],
"exponent": 0,
"keyBits": 2048,
"session_hash_alg": "TPM2_ALG_SHA256",
"session_symmetric":{
"algorithm":"TPM2_ALG_AES",
"keyBits":"128",
Expand Down
107 changes: 107 additions & 0 deletions dist/fapi-profiles/P_RSA3072SHA384.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,107 @@
{
"type": "TPM2_ALG_RSA",
"nameAlg":"TPM2_ALG_SHA384",
"srk_template": "system,restricted,decrypt,0x81000001",
"srk_description": "Storage root key SRK",
"srk_persistent": 1,
"ek_template": "system,restricted,decrypt,user",
"ek_description": "Endorsement key EK",
"rsa_signing_scheme": {
"scheme":"TPM2_ALG_RSAPSS",
"details":{
"hashAlg":"TPM2_ALG_SHA384"
}
},
"rsa_decrypt_scheme": {
"scheme":"TPM2_ALG_OAEP",
"details":{
"hashAlg":"TPM2_ALG_SHA384"
}
},
"sym_mode":"TPM2_ALG_CFB",
"sym_parameters": {
"algorithm":"TPM2_ALG_AES",
"keyBits":"256",
"mode":"TPM2_ALG_CFB"
},
"sym_block_size": 16,
"pcr_selection": [
{ "hash": "TPM2_ALG_SHA1",
"pcrSelect": [ ]
},
{ "hash": "TPM2_ALG_SHA256",
"pcrSelect": [ 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23 ]
}
],
"exponent": 0,
"keyBits": 3072,
"session_symmetric":{
"algorithm":"TPM2_ALG_AES",
"keyBits":"256",
"mode":"TPM2_ALG_CFB"
},
"ek_policy": {
"description": "Endorsement hierarchy used for policy secret.",
"policy":[
{
"type": "PolicyOR",
"branches": [
{
"name": "A",
"description": "",
"policy": [
{
"type":"POLICYSECRET",
"objectName": "4000000b"
}
]
},
{
"name": "B",
"description": "",
"policy": [
{
"type":"AUTHORIZENV",
"nvPublic": {
"size": 60,
"nvPublic": {
"nvIndex": 29392642,
"nameAlg":"SHA384",
"attributes":{
"PPWRITE":0,
"OWNERWRITE":0,
"AUTHWRITE":0,
"POLICYWRITE":1,
"POLICY_DELETE":0,
"WRITELOCKED":0,
"WRITEALL":1,
"WRITEDEFINE":0,
"WRITE_STCLEAR":0,
"GLOBALLOCK":0,
"PPREAD":1,
"OWNERREAD":1,
"AUTHREAD":1,
"POLICYREAD":1,
"NO_DA":1,
"ORDERLY":0,
"CLEAR_STCLEAR":0,
"READLOCKED":0,
"WRITTEN":1,
"PLATFORMCREATE":0,
"READ_STCLEAR":0,
"TPM2_NT":"ORDINARY"
},
"authPolicy":"8bbf2266537c171cb56e403c4dc1d4b64f432611dc386e6f532050c3278c930e143e8bb1133824ccb431053871c6db53",
"dataSize":50
}
}

}
]
}
]
}
]
}

}
3 changes: 2 additions & 1 deletion src/tss2-fapi/api/Fapi_Encrypt.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -435,7 +435,8 @@ Fapi_Encrypt_Finish(

error_cleanup:
/* Cleanup any intermediate results and state stored in the context. */
if (command->key_handle != ESYS_TR_NONE)
if (command->key_handle != ESYS_TR_NONE &&
command->key_object && !command->key_object->misc.key.persistent_handle)
Esys_FlushContext(context->esys, command->key_handle);
if (r)
SAFE_FREE(command->cipherText);
Expand Down
4 changes: 4 additions & 0 deletions src/tss2-fapi/api/Fapi_ExportKey.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -430,6 +430,8 @@ Fapi_ExportKey_Finish(
return_try_again(r);
goto_if_error(r, "Flush key", cleanup);

command->key_object->public.handle = ESYS_TR_NONE;

fallthrough;

statecase(context->state, EXPORT_KEY_WAIT_FOR_FLUSH2);
Expand All @@ -438,6 +440,8 @@ Fapi_ExportKey_Finish(
return_try_again(r);
goto_if_error(r, "Flush key", cleanup);

command->handle_ext_key = ESYS_TR_NONE;

fallthrough;

statecase(context->state, EXPORT_KEY_CLEANUP)
Expand Down
4 changes: 0 additions & 4 deletions src/tss2-fapi/api/Fapi_GetEsysBlob.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -337,10 +337,6 @@ Fapi_GetEsysBlob_Finish(
SAFE_FREE(key_context);
goto_if_error(r, "Marshaling context", error_cleanup);

/* Cleanup policy session if an error did occur. */
ifapi_flush_policy_session(context, context->policy.session, r);
goto_if_error(r, "Cleanup policy session", error_cleanup);

/* Flush current object used for blob computation. */
if (!key_object->misc.key.persistent_handle) {
r = Esys_FlushContext_Async(context->esys, key_object->public.handle);
Expand Down
2 changes: 2 additions & 0 deletions src/tss2-fapi/api/Fapi_Import.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -652,6 +652,8 @@ Fapi_Import_Finish(
if (!command->parent_object->misc.key.persistent_handle) {
r = ifapi_flush_object(context, command->parent_object->public.handle);
return_try_again(r);

command->parent_object->public.handle = ESYS_TR_NONE;
ifapi_cleanup_ifapi_object(command->parent_object);
goto_if_error(r, "Flush key", error_cleanup);
} else {
Expand Down
8 changes: 6 additions & 2 deletions src/tss2-fapi/api/Fapi_NvExtend.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -410,7 +410,9 @@ Fapi_NvExtend_Finish(
/* libjson-c does not deliver an array if array has only one element */
if (jsoType != json_type_array) {
json_object *jsonArray = json_object_new_array();
json_object_array_add(jsonArray, command->jso_event_log);
if (json_object_array_add(jsonArray, command->jso_event_log)) {
return_error(TSS2_FAPI_RC_GENERAL_FAILURE, "Could not add json object.");
}
command->jso_event_log = jsonArray;
}
} else {
Expand All @@ -423,7 +425,9 @@ Fapi_NvExtend_Finish(
r = ifapi_json_IFAPI_EVENT_serialize(&command->pcr_event, &jso);
goto_if_error(r, "Error serialize event", error_cleanup);

json_object_array_add(command->jso_event_log, jso);
if (json_object_array_add(command->jso_event_log, jso)) {
return_error(TSS2_FAPI_RC_GENERAL_FAILURE, "Could not add json object.");
}
SAFE_FREE(object->misc.nv.event_log);
strdup_check(object->misc.nv.event_log,
json_object_to_json_string_ext(command->jso_event_log,
Expand Down
1 change: 1 addition & 0 deletions src/tss2-fapi/fapi_int.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -240,6 +240,7 @@ typedef struct {
TPM2B_AUTH auth; /**< The Password */
IFAPI_NV nv_obj; /**< The NV Object */
ESYS_TR auth_index; /**< The ESAPI handle of the authorization object */
ESYS_TR auth_session; /**< The autorization session for a nv object */
uint64_t bitmap; /**< The bitmask for the SetBits command */
IFAPI_NV_TEMPLATE public_templ; /**< The template for nv creation, adjusted
appropriate by the passed flags */
Expand Down
Loading
Loading