Proxmox-Port/libtpms
1
0
Fork 0
mirror of https://github.com/stefanberger/libtpms synced 2026-08-12 18:28:32 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

tpm2: Start supporting RSA 3072 keys

Browse Source 
Start supporting RSA 3072 keys.

NVMarshal.c: We now accept state that was written by libtpms when RSA keys
sizes were 2048 or are 3072, basically less-or-equal than 3072.

Also increase the NVRAM memory size by ~45 kb to accommodate the worst
case where the USER NVRAM is full of 65 2048 bit persisted keys whose 65
OBJECTs are now expanding and need to again fit into the NVRAM. We have
to add exactly 45760 bytes to accomodate this case. See swtpm test
case test_tpm2_save_load_state_2. 65 * 704 = 45760.

NOTE: BETTER TO NOT BACKPORT!!! MAY NEGATIVELY AFFECT UPGRADE PATH!

Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
This commit is contained in:
Stefan Berger 2020-04-17 14:35:31 -04:00 committed by Stefan Berger
parent 8016592b34
commit 61cb823169
7 changed files with 19 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/tpm2/NVMarshal.c
View File

@ -3565,7 +3565,7 @@ static const struct _entry {
{ COMPILE_CONSTANT(ALG_CBC, EQ) },
{ COMPILE_CONSTANT(ALG_CFB, EQ) },
{ COMPILE_CONSTANT(ALG_ECB, EQ) },
{ COMPILE_CONSTANT(MAX_RSA_KEY_BITS, EQ) },
{ COMPILE_CONSTANT(MAX_RSA_KEY_BITS, LE) }, /* old: 2048 */
{ COMPILE_CONSTANT(MAX_TDES_KEY_BITS, EQ) },
{ COMPILE_CONSTANT(MAX_AES_KEY_BITS, EQ) },
{ COMPILE_CONSTANT(128, EQ) }, /* MAX_SM4_KEY_BITS in older code was 128 also with SM4 not active */

6
src/tpm2/TpmProfile.h
View File

@ -277,7 +277,9 @@
#define MAX_CAP_BUFFER 1024
#endif
#ifndef NV_MEMORY_SIZE
#define NV_MEMORY_SIZE (128 * 1024) /* libtpms changed */
/* libtmps: 65 OBJECTs in USER NVRAM expanded by 704 bytes due to size
* increase of OBJECT from 2048 bit RSA keys to 3072 bit by 704 bytes*/
#define NV_MEMORY_SIZE (128 * 1024 + 65 * 704) /* libtpms changed */
#endif
#ifndef MIN_COUNTER_INDICES
#define MIN_COUNTER_INDICES 8
@ -469,7 +471,7 @@
#define RSA_2048 (ALG_RSA && YES)
#endif
#ifndef RSA_3072
#define RSA_3072 (ALG_RSA && NO)
#define RSA_3072 (ALG_RSA && YES)
#endif
#ifndef RSA_4096
#define RSA_4096 (ALG_RSA && NO)

1
src/tpm2/Unmarshal.c
View File

@ -3461,6 +3461,7 @@ TPMI_RSA_KEY_BITS_Unmarshal(TPMI_RSA_KEY_BITS *target, BYTE **buffer, INT32 *siz
switch (*target) {
case 1024:
case 2048:
case 3072:
break;
default:
rc = TPM_RC_VALUE;

14
tests/nvram_offsets.c
View File

@ -59,16 +59,22 @@ int main(void)
* size of the OBJECT is the same on all architectures so that a full
* NVRAM fits on all architectures
*/
#define OBJECT_EXP_SIZE 1896
#if RSA_4096
# error Unsuported RSA key size
#elif RSA_3072
# define OBJECT_EXP_SIZE 2600
#elif RSA_2048
# define OBJECT_EXP_SIZE 1896
#endif
if (sizeof(OBJECT) != OBJECT_EXP_SIZE) {
fprintf(stderr, "sizeof(OBJECT) does not have expected size of %u bytes"
"but %zu bytes\n", OBJECT_EXP_SIZE, sizeof(OBJECT));
fprintf(stderr, "sizeof(TPMT_PUBLIC) is now %zu bytes;"
"was 356 bytes for 2048 bit RSA keys\n", sizeof(TPMT_PUBLIC));
"was 356/484 bytes for 2048/3072 bit RSA keys\n", sizeof(TPMT_PUBLIC));
fprintf(stderr, "sizeof(TPMT_SENSITIVE) is now %zu bytes;"
"was 776 bytes for 2048 bit RSA keys\n", sizeof(TPMT_SENSITIVE));
"was 776/1096 bytes for 2048/3072 bit RSA keys\n", sizeof(TPMT_SENSITIVE));
fprintf(stderr, "sizeof(privateExponent_t) is now %zu bytes;"
"was 608 bytes for 2048 bit RSA keys\n", sizeof(privateExponent_t));
"was 608/864 bytes for 2048/3072 bit RSA keys\n", sizeof(privateExponent_t));
return EXIT_FAILURE;
}

2
tests/tpm2_createprimary.sh
View File

@ -24,7 +24,7 @@ rc=$?
fs=$(get_filesize NVChip)
[ $? -ne 0 ] && exit 1
if [ $fs -ne 131072 ]; then
if [ $fs -ne 176832 ]; then
echo "Error: Unexpected size of NVChip file."
echo "Expected: 131072"
echo "Got : $fs"

2
tests/tpm2_pcr_read.sh
View File

@ -24,7 +24,7 @@ rc=$?
fs=$(get_filesize NVChip)
[ $? -ne 0 ] && exit 1
if [ $fs -ne 131072 ]; then
if [ $fs -ne 176832 ]; then
echo "Error: Unexpected size of NVChip file."
echo "Expected: 131072"
echo "Got : $fs"

2
tests/tpm2_selftest.sh
View File

@ -24,7 +24,7 @@ rc=$?
fs=$(get_filesize NVChip)
[ $? -ne 0 ] && exit 1
if [ $fs -ne 131072 ]; then
if [ $fs -ne 176832 ]; then
echo "Error: Unexpected size of NVChip file."
echo "Expected: 131072"
echo "Got : $fs"