Proxmox-Port/libtpms
1
0
Fork 0
mirror of https://github.com/stefanberger/libtpms synced 2026-08-08 07:55:30 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

tpm2: Enable DRBG continous test: drbg-continous-test

Browse Source 
drbg-continous-test enables an existing code block that was previously
only enabled when FIPS_COMPLIANT #define was set. This code block
ensures that previous 4 consecutive random numbers do not appear again
at the beginning of a 16-byte block.

Extend an existing test case with this new attribute.

Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
This commit is contained in:
Stefan Berger 2024-08-26 09:15:19 -04:00
parent 363cbae3b0
commit add23edcdd
6 changed files with 23 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
man/man3/TPMLIB_SetProfile.pod
View File

@ -255,6 +255,14 @@ above (reference is RHEL 9.4+, but varies by distro). Note that usage of this
verb does not make a TPM 2 instance compliant with FIPS-140. Also see the
section on 'FIPS mode on the host'.
=item B<drbg-continous-test>: (since v0.10)
=over 2
=item * Turns on continous testing of the DRBG
=back
=back
=head1 FIPS mode on the host

2
src/tpm2/RuntimeAttributes.c
View File

@ -74,6 +74,8 @@ static const struct {
RUNTIME_ATTRIBUTE_NO_SHA1_SIGNING |
RUNTIME_ATTRIBUTE_NO_SHA1_VERIFICATION,
7),
ATTRIBUTE("drbg-continous-test", RUNTIME_ATTRIBUTE_DRBG_CONTINOUS_TEST,
7),
};
LIB_EXPORT void

3
src/tpm2/RuntimeAttributes_fp.h
View File

@ -42,13 +42,14 @@
#ifndef RUNTIME_ATTRIBUTES_H
#define RUNTIME_ATTRIBUTES_H
#define NUM_ENTRIES_ATTRIBUTE_PROPERTIES 7
#define NUM_ENTRIES_ATTRIBUTE_PROPERTIES 8
#define RUNTIME_ATTRIBUTE_NO_UNPADDED_ENCRYPTION (1 << 0)
#define RUNTIME_ATTRIBUTE_NO_SHA1_SIGNING (1 << 1)
#define RUNTIME_ATTRIBUTE_NO_SHA1_VERIFICATION (1 << 2)
#define RUNTIME_ATTRIBUTE_NO_SHA1_HMAC_CREATION (1 << 3)
#define RUNTIME_ATTRIBUTE_NO_SHA1_HMAC_VERIFICATION (1 << 4)
#define RUNTIME_ATTRIBUTE_DRBG_CONTINOUS_TEST (1 << 5)
struct RuntimeAttributes {
/* */

1
src/tpm2/RuntimeProfile.c
View File

@ -98,6 +98,7 @@ static const struct RuntimeProfileDesc {
* - no-sha1-signing
* - no-sha1-verification
* - fips-host
* - drbg-continous-test
*/
const char *description;
#define DESCRIPTION_MAX_SIZE 250

11
src/tpm2/crypto/openssl/CryptRand.c
View File

@ -359,7 +359,10 @@ static BOOL EncryptDRBG(BYTE* dOut,
UINT32* lastValue // Points to the last output value
)
{
#if FIPS_COMPLIANT
//#if FIPS_COMPLIANT // libtpms changed
if(RuntimeProfileRequiresAttributeFlags(&g_RuntimeProfile, // libtpms added
RUNTIME_ATTRIBUTE_DRBG_CONTINOUS_TEST)) // libtpms added
{
// For FIPS compliance, the DRBG has to do a continuous self-test to make sure that
// no two consecutive values are the same. This overhead is not incurred if the TPM
// is not required to be FIPS compliant
@ -392,7 +395,8 @@ static BOOL EncryptDRBG(BYTE* dOut,
for(p = (BYTE*)temp; i > 0; i--)
*dOut++ = *p++;
}
#else // version without continuous self-test
//#else // version without continuous self-test // libtpms changed
} else { // libtpms added
NOT_REFERENCED(lastValue);
for(; dOutBytes >= DRBG_IV_SIZE_BYTES;
dOut = &dOut[DRBG_IV_SIZE_BYTES], dOutBytes -= DRBG_IV_SIZE_BYTES)
@ -411,7 +415,8 @@ static BOOL EncryptDRBG(BYTE* dOut,
DRBG_ENCRYPT(keySchedule, iv, temp);
memcpy(dOut, temp, dOutBytes);
}
#endif
} // libtpms added
//#endif // libtpms changed
return TRUE;
}

4
tests/tpm2_setprofile.c
View File

@ -329,7 +329,7 @@ static const struct {
"0x15b-0x15e,0x160-0x165,0x167-0x174,0x176-0x178,"
"0x17a-0x193,0x197\","
"\"Attributes\":\"no-unpadded-encryption,no-sha1-signing,"
"no-sha1-verification\","
"no-sha1-verification,drbg-continous-test\","
"\"Description\":\"test\""
"}",
.exp_fail = false,
@ -348,7 +348,7 @@ static const struct {
"ecc-nist,ecc-bn,ecc-sm2-p256,symcipher,camellia,"
"camellia-min-size=128,cmac,ctr,ofb,cbc,cfb,ecb\","
"\"Attributes\":\"no-unpadded-encryption,no-sha1-signing,"
"no-sha1-verification\","
"no-sha1-verification,drbg-continous-test\","
"\"Description\":\"test\""
"}}",
}, {