Proxmox-Port/libtpms
1
0
Fork 0
mirror of https://github.com/stefanberger/libtpms synced 2026-08-08 11:56:52 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

tpm2: Run PCT test on RSA keys and EC signing keys: pct

Browse Source 
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
This commit is contained in:
Stefan Berger 2024-08-26 08:39:20 -04:00 committed by Stefan Berger
parent 81fbc10a7e
commit 21e19ffe8d
6 changed files with 24 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
man/man3/TPMLIB_SetProfile.pod
View File

@ -263,6 +263,15 @@ section on 'FIPS mode on the host'.
=back
=item B<pct>: (since v0.10)
=over 2
=item * Turns on pairwise consistency test (pct) for RSA keys and EC signing
keys
=back
=back
=head1 FIPS mode on the host

2
src/tpm2/RuntimeAttributes.c
View File

@ -76,6 +76,8 @@ static const struct {
7),
ATTRIBUTE("drbg-continous-test", RUNTIME_ATTRIBUTE_DRBG_CONTINOUS_TEST,
7),
ATTRIBUTE("pct", RUNTIME_ATTRIBUTE_PAIRWISE_CONSISTENCY_TEST,
7),
};
LIB_EXPORT void

3
src/tpm2/RuntimeAttributes_fp.h
View File

@ -42,7 +42,7 @@
#ifndef RUNTIME_ATTRIBUTES_H
#define RUNTIME_ATTRIBUTES_H
#define NUM_ENTRIES_ATTRIBUTE_PROPERTIES 8
#define NUM_ENTRIES_ATTRIBUTE_PROPERTIES 9
#define RUNTIME_ATTRIBUTE_NO_UNPADDED_ENCRYPTION (1 << 0)
#define RUNTIME_ATTRIBUTE_NO_SHA1_SIGNING (1 << 1)
@ -50,6 +50,7 @@
#define RUNTIME_ATTRIBUTE_NO_SHA1_HMAC_CREATION (1 << 3)
#define RUNTIME_ATTRIBUTE_NO_SHA1_HMAC_VERIFICATION (1 << 4)
#define RUNTIME_ATTRIBUTE_DRBG_CONTINOUS_TEST (1 << 5)
#define RUNTIME_ATTRIBUTE_PAIRWISE_CONSISTENCY_TEST (1 << 6)
struct RuntimeAttributes {
/* */

1
src/tpm2/RuntimeProfile.c
View File

@ -99,6 +99,7 @@ static const struct RuntimeProfileDesc {
* - no-sha1-verification
* - fips-host
* - drbg-continous-test
* - pct
*/
const char *description;
#define DESCRIPTION_MAX_SIZE 250

8
src/tpm2/crypto/openssl/CryptEccMain.c
View File

@ -792,9 +792,11 @@ LIB_EXPORT TPM_RC CryptEccGenerateKey(
TpmMath_IntTo2B(
bnD, &sensitive->sensitive.ecc.b, publicArea->unique.ecc.x.t.size);
}
# if FIPS_COMPLIANT
//# if FIPS_COMPLIANT // libtpms changed
// See if PWCT is required
if(OK && IS_ATTRIBUTE(publicArea->objectAttributes, TPMA_OBJECT, sign))
if(OK && IS_ATTRIBUTE(publicArea->objectAttributes, TPMA_OBJECT, sign) && // libtpms changed begin
RuntimeProfileRequiresAttributeFlags(&g_RuntimeProfile,
RUNTIME_ATTRIBUTE_PAIRWISE_CONSISTENCY_TEST)) // libtpms changed end
{
CRYPT_ECC_NUM(bnT);
CRYPT_ECC_NUM(bnS);
@ -811,7 +813,7 @@ LIB_EXPORT TPM_RC CryptEccGenerateKey(
OK = TpmEcc_ValidateSignatureEcdsa(bnT, bnS, E, ecQ, &digest)
== TPM_RC_SUCCESS;
}
# endif
//# endif // libtpms changed
retVal = (OK) ? TPM_RC_SUCCESS : TPM_RC_NO_RESULT;
Exit:
CRYPT_CURVE_FREE(E);

12
src/tpm2/crypto/openssl/CryptRsa.c
View File

@ -1052,8 +1052,7 @@ CryptRsaLoadPrivateExponent(TPMT_PUBLIC* publicArea, TPMT_SENSITIVE* sensitive,
return TPM_RC_BINDING;
}
#if FIPS_COMPLIANT // libtpms added begin
static TPM_RC
static TPM_RC // libtpms added begin
CryptRSAPairwiseConsistencyTest(OBJECT *key)
{
TPM2B_PUBLIC_KEY_RSA enc = {
@ -1102,8 +1101,7 @@ CryptRSAPairwiseConsistencyTest(OBJECT *key)
if (retVal)
return retVal;
return CryptRsaValidateSignature(&sigOut, key, &digest);
}
#endif /* FIPS_COMPLIANT */ // libtpms added end
} // libtpms added end
#if !USE_OPENSSL_FUNCTIONS_RSA // libtpms added
@ -1581,13 +1579,13 @@ LIB_EXPORT TPM_RC CryptRsaGenerateKey(
#if USE_OPENSSL_FUNCTIONS_RSA // libtpms added begin
pct:
#endif
#if FIPS_COMLIANT
if(retVal == TPM_RC_SUCCESS) {
if(retVal == TPM_RC_SUCCESS &&
RuntimeProfileRequiresAttributeFlags(&g_RuntimeProfile,
RUNTIME_ATTRIBUTE_PAIRWISE_CONSISTENCY_TEST)) {
retVal = CryptRSAPairwiseConsistencyTest(rsaKey);
if (retVal)
retVal = TPM_RC_FAILURE;
} // libtpms added end
#endif
return retVal;
}