Proxmox-Port/libtpms
1
0
Fork 0
mirror of https://github.com/stefanberger/libtpms synced 2026-08-07 05:34:49 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

tpm2: Extend TPM2_GetInfo with info about runtime-enabled algorithms

Browse Source 
Extend TPM2_GetInfo() to return information about runtime-enabled
algorithms like this:

$ swtpm_ioctl --info 8 --tcp :2322  | jq
{
  "RuntimeAlgorithms": {
    "Implemented": "rsa,rsa-min-size=1024,tdes,tdes-min-size=128,sha1,hmac,aes,aes-min-size=128,mgf1,keyedhash,xor,sha256,sha384,sha512,null,rsassa,rsaes,rsapss,oaep,ecdsa,ecdh,ecdaa,sm2,ecschnorr,ecmqv,kdf1-sp800-56a,kdf2,kdf1-sp800-108,ecc,ecc-min-size=192,ecc-nist,ecc-bn,ecc-nist-p192,ecc-nist-p224,ecc-nist-p256,ecc-nist-p384,ecc-nist-p521,ecc-bn-p256,ecc-bn-p638,ecc-sm2-p256,symcipher,camellia,camellia-min-size=128,cmac,ctr,ofb,cbc,cfb,ecb",
    "CanBeDisabled": "tdes,sha1,sha512,rsassa,rsaes,rsapss,ecmqv,ecc-nist,ecc-bn,ecc-nist-p192,ecc-nist-p224,ecc-nist-p521,ecc-bn-p256,ecc-bn-p638,ecc-sm2-p256,camellia,cmac,ctr,ofb,cbc,ecb",
    "Enabled": "rsa,rsa-min-size=1024,hmac,aes,aes-min-size=128,mgf1,keyedhash,xor,sha256,sha384,null,oaep,ecdsa,ecdh,ecdaa,sm2,ecschnorr,kdf1-sp800-56a,kdf2,kdf1-sp800-108,ecc,ecc-min-size=192,ecc-bn,ecc-nist-p192,ecc-nist-p224,ecc-nist-p256,ecc-nist-p384,ecc-nist-p521,ecc-bn-p256,ecc-bn-p638,ecc-sm2-p256,symcipher,camellia,camellia-min-size=128,cmac,ctr,ofb,cbc,cfb,ecb",
    "Disabled": "tdes,sha1,sha512,rsassa,rsaes,rsapss,ecmqv,ecc-nist"
  }
}

Also describe the JSON object in the TPMLIB_GetInfo man page.

Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
This commit is contained in:
Stefan Berger 2022-06-13 12:31:06 -04:00 committed by Stefan Berger
parent f6bd75b6d0
commit 3cb8d4d22a
4 changed files with 86 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
include/libtpms/tpm_library.h
View File

@ -106,6 +106,7 @@ enum TPMLIB_InfoFlags {
TPMLIB_INFO_TPMSPECIFICATION = 1,
TPMLIB_INFO_TPMATTRIBUTES = 2,
TPMLIB_INFO_TPMFEATURES = 4,
TPMLIB_INFO_RUNTIME_ALGORITHMS = 8,
};
char *TPMLIB_GetInfo(enum TPMLIB_InfoFlags flags);

1
include/libtpms/tpm_library.h.in
View File

@ -106,6 +106,7 @@ enum TPMLIB_InfoFlags {
TPMLIB_INFO_TPMSPECIFICATION = 1,
TPMLIB_INFO_TPMATTRIBUTES = 2,
TPMLIB_INFO_TPMFEATURES = 4,
TPMLIB_INFO_RUNTIME_ALGORITHMS = 8,
};
char *TPMLIB_GetInfo(enum TPMLIB_InfoFlags flags);

47
man/man3/TPMLIB_GetInfo.pod
View File

@ -38,6 +38,53 @@ The following flags are defined and return JSON objects as shown:
This JSON object may be extended in the future.
=item B<TPMLIB_INFO_RUNTIME_ALGORITHMS> (since v0.10.0)
{
"RuntimeAlgorithms": {
"Implemented": "rsa,rsa-min-size=1024,tdes,tdes-min-size=128,sha1,hmac," \
"aes,aes-min-size=128,mgf1,keyedhash,xor,sha256,sha384," \
"sha512,null,rsassa,rsaes,rsapss,oaep,ecdsa,ecdh,ecdaa," \
"sm2,ecschnorr,ecmqv,kdf1-sp800-56a,kdf2,kdf1-sp800-108," \
"ecc,ecc-min-size=192,ecc-nist,ecc-bn,ecc-nist-p192," \
"ecc-nist-p224,ecc-nist-p256,ecc-nist-p384," \
"ecc-nist-p521,"ecc-bn-p256,ecc-bn-p638,ecc-sm2-p256," \
"symcipher,camellia,camellia-min-size=128,cmac,ctr,ofb," \
"cbc,cfb,ecb",
"CanBeDisabled": "tdes,sha1,sha512,rsassa,rsaes,rsapss,ecmqv,ecc-nist," \
"ecc-bn,ecc-nist-p192,ecc-nist-p224,ecc-nist-p521," \
"ecc-bn-p256,ecc-bn-p638,ecc-sm2-p256,camellia,cmac," \
"ctr,ofb,cbc,ecb",
"Enabled": "rsa,rsa-min-size=1024,hmac,aes,aes-min-size=128,mgf1," \
"keyedhash,xor,sha256,sha384,null,oaep,ecdsa,ecdh,ecdaa," \
"sm2,ecschnorr,kdf1-sp800-56a,kdf2,kdf1-sp800-108,ecc," \
"ecc-min-size=192,ecc-bn,ecc-nist-p192,ecc-nist-p224," \
"ecc-nist-p256,ecc-nist-p384,ecc-nist-p521,ecc-bn-p256," \
"ecc-bn-p638,ecc-sm2-p256,symcipher,camellia," \
"camellia-min-size=128,cmac,ctr,ofb,cbc,cfb,ecb",
"Disabled": "tdes,sha1,sha512,rsassa,rsaes,rsapss,ecmqv,ecc-nist"
}
}
This JSON object enumerates all I<implemented> algorithms as well as supported
elliptic curve cryptography (ECC) curves. Those verbs enumerated under
I<CanBeDisabled> represent algorithms and ECC curves that a user may omit from
a profile, thus making them unavailable to applications. The verbs enumerated
under I<Enabled> and I<Disabled> represent algorithms that are enabled and
disabled in the currently active profile.
The verbs I<ecc-nist> and I<ecc-bn> are shortcuts enabling all currently
implemented ECC NIST curves (ecc-nist-p192, ecc-nist-p256, ...) and BN
(Baretto-Naehrig) curves (ecc-bn-p256, ecc-bn-p638). If omitted then the
individual curves can still be enumerated individually to enable them.
Since I<ecc-nist-p256> and I<ecc-nist-p384> cannot be disabled, they must
be enumerated if the I<ecc-nist> shortcut is not used.
Minimum key sizes for rsa, ecc, tdes, aes, and camellia are also described.
When new algorithms and ECC curves are added to the TPM in the future, then
this JSON object will return more algorithms.
=back
=head1 RETURN VALUE

42
src/tpm_tpm2_interface.c
View File

@ -379,12 +379,22 @@ static char *TPM2_GetInfo(enum TPMLIB_InfoFlags flags)
", \"SM4KeySizes\":[128]"
#endif
"}";
const char *runtimeAlgorithms_temp =
"\"RuntimeAlgorithms\":{"
"\"Implemented\":%s,"
"\"CanBeDisabled\":%s,"
"\"Enabled\":%s,"
"\"Disabled\":%s"
"}";
char *fmt = NULL, *buffer;
bool printed = false;
char *tpmattrs = NULL;
char *tpmfeatures = NULL;
char rsakeys[32];
char camelliakeys[16];
char *runtimeAlgos[RUNTIME_ALGO_NUM] = { NULL, };
enum RuntimeAlgorithmType rat;
char *runtimeAlgorithms = NULL;
size_t n;
if (!(buffer = strdup("{%s%s%s}")))
@ -438,25 +448,47 @@ static char *TPM2_GetInfo(enum TPMLIB_InfoFlags flags)
printed = true;
}
if ((flags & TPMLIB_INFO_RUNTIME_ALGORITHMS)) {
fmt = buffer;
buffer = NULL;
for (rat = RUNTIME_ALGO_IMPLEMENTED; rat < RUNTIME_ALGO_NUM; rat++) {
runtimeAlgos[rat] = RuntimeAlgorithmPrint(&g_RuntimeProfile.RuntimeAlgorithm, rat);
if (!runtimeAlgos[rat])
goto error;
}
if (asprintf(&runtimeAlgorithms, runtimeAlgorithms_temp,
runtimeAlgos[RUNTIME_ALGO_IMPLEMENTED],
runtimeAlgos[RUNTIME_ALGO_CAN_BE_DISABLED],
runtimeAlgos[RUNTIME_ALGO_ENABLED],
runtimeAlgos[RUNTIME_ALGO_DISABLED]) < 0)
goto error;
if (asprintf(&buffer, fmt, printed ? "," : "",
runtimeAlgorithms, "%s%s%s") < 0)
goto error;
free(fmt);
printed = true;
}
/* nothing else to add */
fmt = buffer;
buffer = NULL;
if (asprintf(&buffer, fmt, "", "", "") < 0)
goto error;
exit:
free(fmt);
free(tpmattrs);
free(tpmfeatures);
for (rat = RUNTIME_ALGO_IMPLEMENTED; rat < RUNTIME_ALGO_NUM; rat++)
free(runtimeAlgos[rat]);
free(runtimeAlgorithms);
return buffer;
error:
free(fmt);
free(buffer);
free(tpmattrs);
free(tpmfeatures);
return NULL;
buffer = NULL;
goto exit;
}
static uint32_t tpm2_buffersize = TPM_BUFFER_MAX;