Proxmox-Port/libtpms
1
0
Fork 0
mirror of https://github.com/stefanberger/libtpms synced 2026-08-07 05:59:50 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

tpm2: Add missing check for disallowed SHA1 HMAC creation

Browse Source 
CryptSelectMac is called (only) from TPM2_HMAC and TPM2_Mac_Start and needs
to check whether the creation of an HMAC with SHA1 is not allowed per the
profile attribute no-sha1-hmac-creation and/or no-sha1-hmac.

Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
This commit is contained in:
Stefan Berger 2026-03-19 15:45:05 -04:00
parent 77104fbfbd
commit b9eee494b7
1 changed files with 6 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/tpm2/TPMCmd/tpm/src/crypt/CryptUtil.c
View File

@ -1961,6 +1961,12 @@ CryptSelectMac(TPMT_PUBLIC* publicArea, TPMI_ALG_MAC_SCHEME* inMac)
}
if(!CryptMacIsValidForKey(publicArea->type, *inMac, FALSE))
return TPM_RCS_SCHEME;
if(macAlg == TPM_ALG_SHA1 && // libtpms added begin
RuntimeProfileRequiresAttributeFlags(&g_RuntimeProfile,
RUNTIME_ATTRIBUTE_NO_SHA1_HMAC_CREATION))
return TPM_RC_HASH; // libtpms added end
return TPM_RC_SUCCESS;
}