Proxmox-Port/libtpms
1
0
Fork 0
mirror of https://github.com/stefanberger/libtpms synced 2025-08-25 01:41:06 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

tpm2: Prevent HMAC creation with sha1: no-sha1-hmac-creation

Browse Source 
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
This commit is contained in:
Stefan Berger 2024-09-04 10:26:10 -04:00 committed by Stefan Berger
parent e983cdf05c
commit b389781f49
4 changed files with 17 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
man/man3/TPMLIB_SetProfile.pod
View File

@ -211,6 +211,14 @@ algorithms
=back
=item B<no-sha1-hmac-creation>: (since v0.10)
=over 2
=item * Prevents creation of an HMAC using SHA1
=back
=item B<fips-host>: (since v0.10)
=over 2

5
src/tpm2/CryptUtil.c
View File

@ -1537,6 +1537,11 @@ CryptSign(OBJECT* signKey, // IN: signing key
RuntimeProfileRequiresAttributeFlags(&g_RuntimeProfile,
RUNTIME_ATTRIBUTE_NO_SHA1_SIGNING))
return TPM_RC_HASH;
case TPM_ALG_KEYEDHASH:
if (signScheme->details.any.hashAlg == TPM_ALG_SHA1 &&
RuntimeProfileRequiresAttributeFlags(&g_RuntimeProfile,
RUNTIME_ATTRIBUTE_NO_SHA1_HMAC_CREATION))
return TPM_RC_HASH;
break;
} // libtpms added end

2
src/tpm2/RuntimeAttributes.c
View File

@ -63,6 +63,8 @@ static const struct {
7),
ATTRIBUTE("no-sha1-verification", RUNTIME_ATTRIBUTE_NO_SHA1_VERIFICATION,
7),
ATTRIBUTE("no-sha1-hmac-creation", RUNTIME_ATTRIBUTE_NO_SHA1_HMAC_CREATION,
7),
ATTRIBUTE("fips-host", RUNTIME_ATTRIBUTE_NO_UNPADDED_ENCRYPTION |
RUNTIME_ATTRIBUTE_NO_SHA1_SIGNING |
RUNTIME_ATTRIBUTE_NO_SHA1_VERIFICATION,

3
src/tpm2/RuntimeAttributes_fp.h
View File

@ -42,11 +42,12 @@
#ifndef RUNTIME_ATTRIBUTES_H
#define RUNTIME_ATTRIBUTES_H
#define NUM_ENTRIES_ATTRIBUTE_PROPERTIES 4
#define NUM_ENTRIES_ATTRIBUTE_PROPERTIES 5
#define RUNTIME_ATTRIBUTE_NO_UNPADDED_ENCRYPTION (1 << 0)
#define RUNTIME_ATTRIBUTE_NO_SHA1_SIGNING (1 << 1)
#define RUNTIME_ATTRIBUTE_NO_SHA1_VERIFICATION (1 << 2)
#define RUNTIME_ATTRIBUTE_NO_SHA1_HMAC_CREATION (1 << 3)
struct RuntimeAttributes {
/* */