Proxmox-Port/libtpms
1
0
Fork 0
mirror of https://github.com/stefanberger/libtpms synced 2026-08-08 07:55:30 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Revert "tpm2: Enable support for 4096 bit RSA keys"

Browse Source 
This reverts commit 63627b335e.

Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
This commit is contained in:
Stefan Berger 2025-05-07 11:32:28 -04:00 committed by Stefan Berger
parent 63d0d49a7f
commit f756952283
7 changed files with 13 additions and 24 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
man/man3/TPMLIB_SetProfile.pod
View File

@ -195,10 +195,6 @@ This I<StateFormatLevel> enabled the following profile attributes:
=back
=item 8: (since v0.11)
This I<StateFormatLevel> enabled 4096-bit RSA.
=back
A user may specify the I<StateFormatLevel> when using the I<custom> profile.

1
src/tpm2/RuntimeAlgorithm.c
View File

@ -86,7 +86,6 @@ static const struct KeySizes s_KeySizesRSA[] = {
{ .enabled = RSA_1024, .size = 1024, .stateFormatLevel = 1 },
{ .enabled = RSA_2048, .size = 2048, .stateFormatLevel = 1 },
{ .enabled = RSA_3072, .size = 3072, .stateFormatLevel = 1 },
{ .enabled = RSA_4096, .size = 4096, .stateFormatLevel = 8 },
{ .enabled = false , .size = 0 , .stateFormatLevel = 0 },
};
static const struct KeySizes s_KeySizesECC[] = {

7
src/tpm2/RuntimeProfile.c
View File

@ -78,7 +78,7 @@ static const struct RuntimeProfileDesc {
* This basically locks the name of the profile to the stateFormatLevel.
*/
unsigned int stateFormatLevel;
#define STATE_FORMAT_LEVEL_CURRENT 8
#define STATE_FORMAT_LEVEL_CURRENT 7
#define STATE_FORMAT_LEVEL_UNKNOWN 0 /* JSON didn't provide StateFormatLevel; this is only
allowed for the 'default' profile or when user
passed JSON via SetProfile() */
@ -105,7 +105,6 @@ static const struct RuntimeProfileDesc {
* - drbg-continous-test
* - pct
* - no-ecc-key-derivation
* 8 : Enabled 4096-bit RSA support
*/
const char *description;
#define DESCRIPTION_MAX_SIZE 250
@ -990,8 +989,8 @@ RuntimeProfileGetSeedCompatLevel(void)
case 1: /* profile runs on v0.9 */
return SEED_COMPAT_LEVEL_RSA_PRIME_ADJUST_FIX;
case 2 ... 8: /* profile runs on v0.10 */ {
MUST_BE(STATE_FORMAT_LEVEL_CURRENT == 8); // force update when this changes
case 2 ... 7: /* profile runs on v0.10 */ {
MUST_BE(STATE_FORMAT_LEVEL_CURRENT == 7); // force update when this changes
return SEED_COMPAT_LEVEL_LAST;
}

2
src/tpm2/TpmProfile_Common.h
View File

@ -162,7 +162,7 @@
#define RSA_1024 (YES * ALG_RSA)
#define RSA_2048 (YES * ALG_RSA)
#define RSA_3072 (YES * ALG_RSA)
#define RSA_4096 (YES * ALG_RSA) /* since libtpms v0.11 stateFormatLevel 8 */
#define RSA_4096 (NO * ALG_RSA) /* libtpms: NO */
#define RSA_16384 (NO * ALG_RSA)
#define ALG_RSASSA (YES * ALG_RSA)

13
tests/nvram_offsets.c
View File

@ -61,10 +61,8 @@ int main(void)
* size of the OBJECT is the same on all architectures so that a full
* NVRAM fits on all architectures
*/
#if RSA_16384
#if RSA_4096
# error Unsupported RSA key size
#elif RSA_4096
# define OBJECT_EXP_SIZE 3312
#elif RSA_3072
# define OBJECT_EXP_SIZE 2608
#elif RSA_2048
@ -74,14 +72,11 @@ int main(void)
fprintf(stderr, "sizeof(OBJECT) does not have expected size of %u bytes"
"but %zu bytes\n", OBJECT_EXP_SIZE, sizeof(OBJECT));
fprintf(stderr, "sizeof(TPMT_PUBLIC) is now %zu bytes;"
"was 356/484/612 bytes for 2048/3072/4096 bit RSA keys\n",
sizeof(TPMT_PUBLIC));
"was 356/484 bytes for 2048/3072 bit RSA keys\n", sizeof(TPMT_PUBLIC));
fprintf(stderr, "sizeof(TPMT_SENSITIVE) is now %zu bytes;"
"was 776/1096/1416 bytes for 2048/3072/4096 bit RSA keys\n",
sizeof(TPMT_SENSITIVE));
"was 776/1096 bytes for 2048/3072 bit RSA keys\n", sizeof(TPMT_SENSITIVE));
fprintf(stderr, "sizeof(privateExponent_t) is now %zu bytes;"
"was 608/864/1120 bytes for 2048/3072/4096 bit RSA keys\n",
sizeof(privateExponent_t));
"was 608/864 bytes for 2048/3072 bit RSA keys\n", sizeof(privateExponent_t));
return EXIT_FAILURE;
}

4
tests/object_size.c
View File

@ -72,7 +72,7 @@ int main(void)
};
#pragma GCC diagnostics pop
static const size_t exp_sizes[7] = {
0, 3284, 3284, 3284, 3284, 3284, 3288,
0, 2580, 2580, 2580, 2580, 2580, 2584,
};
BYTE buffer[2 * MAX_MARSHALLED_OBJECT_SIZE];
UINT32 stateFormatLevel;
@ -98,4 +98,4 @@ int main(void)
stateFormatLevel, written, MAX_MARSHALLED_OBJECT_SIZE);
}
return EXIT_SUCCESS;
}
}

6
tests/tpm2_setprofile.c
View File

@ -295,7 +295,7 @@ static const struct {
.exp_profile =
"{\"ActiveProfile\":{"
"\"Name\":\"custom\","
"\"StateFormatLevel\":8,"
"\"StateFormatLevel\":5,"
"\"Commands\":\"0x11f-0x122,0x124-0x12e,0x130-0x140,0x142-0x159,"
"0x15b-0x15e,0x160-0x165,0x167-0x174,0x176-0x178,"
"0x17a-0x193,0x197,0x19b-0x19c\","
@ -359,7 +359,7 @@ static const struct {
.exp_profile =
"{\"ActiveProfile\":{"
"\"Name\":\"custom\","
"\"StateFormatLevel\":8,"
"\"StateFormatLevel\":7,"
"\"Commands\":\"0x11f-0x122,0x124-0x12e,0x130-0x140,0x142-0x159,"
"0x15b-0x15e,0x160-0x165,0x167-0x174,0x176-0x178,"
"0x17a-0x193,0x197\","
@ -392,7 +392,7 @@ static const struct {
.exp_profile =
"{\"ActiveProfile\":{"
"\"Name\":\"custom:test\","
"\"StateFormatLevel\":8,"
"\"StateFormatLevel\":7,"
"\"Commands\":\"0x11f-0x122,0x124-0x12e,0x130-0x140,0x142-0x159,"
"0x15b-0x15e,0x160-0x165,0x167-0x174,0x176-0x178,"
"0x17a-0x193,0x197,0x199-0x19c\","