Proxmox-Port/libtpms
1
0
Fork 0
mirror of https://github.com/stefanberger/libtpms synced 2026-08-13 04:45:12 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

tpm2: rev155: Add support for x509 in TPM2_Sign

Browse Source 
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
This commit is contained in:
Stefan Berger 2019-06-12 20:16:29 -04:00 committed by Stefan Berger
parent b1bac6d212
commit f743d7faae
2 changed files with 19 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
src/tpm2/SigningCommands.c
View File

@ -3,7 +3,7 @@
/* Signing and Signature Verification */
/* Written by Ken Goldman */
/* IBM Thomas J. Watson Research Center */
/* $Id: SigningCommands.c 1259 2018-07-10 19:11:09Z kgoldman $ */
/* $Id: SigningCommands.c 1476 2019-06-10 19:32:03Z kgoldman $ */
/* */
/* Licenses and Notices */
/* */
@ -55,7 +55,7 @@
/* arising in any way out of use or reliance upon this specification or any */
/* information herein. */
/* */
/* (c) Copyright IBM Corp. and others, 2016 - 2018 */
/* (c) Copyright IBM Corp. and others, 2016 - 2019 */
/* */
/********************************************************************************/
@ -117,6 +117,11 @@ TPM2_Sign(
// Input Validation
if(!IsSigningObject(signObject))
return TPM_RCS_KEY + RC_Sign_keyHandle;
// A key that will be used for x.509 signatures can't be used in TPM2_Sign().
if(IS_ATTRIBUTE(signObject->publicArea.objectAttributes, TPMA_OBJECT, x509sign))
return TPM_RCS_ATTRIBUTES + RC_Sign_keyHandle;
// pick a scheme for sign. If the input sign scheme is not compatible with
// the default scheme, return an error.
if(!CryptSelectSignScheme(signObject, &in->inScheme))

22
src/tpm2/TpmTypes.h
View File

@ -814,7 +814,8 @@ typedef struct TPMA_OBJECT { // Table 2:31
unsigned restricted : 1;
unsigned decrypt : 1;
unsigned sign : 1;
unsigned Reserved_bits_at_19 : 13;
unsigned x509sign : 1;
unsigned Reserved_bits_at_20 : 12;
} TPMA_OBJECT;
// This is the initializer for a TPMA_OBJECT structure
#define TPMA_OBJECT_INITIALIZER( \
@ -823,13 +824,13 @@ typedef struct TPMA_OBJECT { // Table 2:31
userwithauth, adminwithpolicy, bits_at_8, \
noda, encryptedduplication, bits_at_12, \
restricted, decrypt, sign, \
bits_at_19) \
x509sign, bits_at_20) \
{bit_at_0, fixedtpm, stclear, \
bit_at_3, fixedparent, sensitivedataorigin, \
userwithauth, adminwithpolicy, bits_at_8, \
noda, encryptedduplication, bits_at_12, \
restricted, decrypt, sign, \
bits_at_19}
x509sign, bits_at_20}
#else // USE_BIT_FIELD_STRUCTURES
// This implements Table 2:31 TPMA_OBJECT using bit masking
typedef UINT32 TPMA_OBJECT;
@ -845,7 +846,8 @@ typedef UINT32 TPMA_OBJECT;
#define TPMA_OBJECT_restricted ((TPMA_OBJECT)1 << 16)
#define TPMA_OBJECT_decrypt ((TPMA_OBJECT)1 << 17)
#define TPMA_OBJECT_sign ((TPMA_OBJECT)1 << 18)
#define TPMA_OBJECT_reserved 0xfff8f309
#define TPMA_OBJECT_x509sign ((TPMA_OBJECT)1 << 19)
#define TPMA_OBJECT_reserved 0xfff0f309
// This is the initializer for a TPMA_OBJECT bit array.
#define TPMA_OBJECT_INITIALIZER( \
bit_at_0, fixedtpm, stclear, \
@ -854,12 +856,12 @@ typedef UINT32 TPMA_OBJECT;
noda, encryptedduplication, bits_at_12, \
restricted, decrypt, sign, \
bits_at_19) \
((fixedtpm << 1) + (stclear << 2) + \
(fixedparent << 4) + (sensitivedataorigin << 5) + \
(userwithauth << 6) + (adminwithpolicy << 7) + \
(noda << 10) + (encryptedduplication << 11) + \
(restricted << 16) + (decrypt << 17) + \
(sign << 18))
{(fixedtpm << 1) + (stclear << 2) + \
(fixedparent << 4) + (sensitivedataorigin << 5) + \
(userwithauth << 6) + (adminwithpolicy << 7) + \
(noda << 10) + (encryptedduplication << 11) + \
(restricted << 16) + (decrypt << 17) + \
(sign << 18) + (x509sign << 19)}
#endif // USE_BIT_FIELD_STRUCTURES
/* Table 2:32 - Definition of TPMA_SESSION Bits */