Limit the variable indicating to the caller how many bytes were returned
in a TPM response to the size returned from TPM2_GetBufferSize(). This
then reflects the buffer size that was negotiated with the
TPMLIB_SetBufferSize() call and for which the recipient of the buffer
should have enough space for.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
CryptSelectMac is called (only) from TPM2_HMAC and TPM2_Mac_Start and needs
to check whether the creation of an HMAC with SHA1 is not allowed per the
profile attribute no-sha1-hmac-creation and/or no-sha1-hmac.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Only write the necessary number of bytes of the ppList and auditCommands
bitmaps. The entries in both of these bitmaps are set by a command's
index and the necessary number of bytes can be determined by finding the
command with the highest command code that is enabled in the current
profile (1). This in turn can be found by by searching for the last byte
in the enableCommandsByIdx bitmap that has any bit set.
1) It would be possible to skip writing these arrays entirely if they have
no bits set. The unmarshalling functions would clear the arrays.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Base the enabledCommands array on the command index rather than the command
code since the latter left the first few bytes always unused since command
codes start at 0x11f only.
After this change, ppList, auditCommands, and enabledCommandsByIdx bitmaps
are all based on command indices.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Use the marshalled size of an OBJECT to check whether it still fits into
NVRAM rather than using the size of the OBJECT (sizeof(obj), which is much
bigger. Using the marshalled size also handles the case where the OBJECT is
still copied into NVRAM using memcpy for the NULL profile case of
libtpms v0.9. This should have been converted once NvObjectToBuffer()
was started to be called there.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
The current libtpms v0.10.2 does not accept a TPM 2 state that was written
with a more recent version of libtpms if the sizes of ppList and/or
auditCommands increased. Remove the asserts that trigger state reading
failures and limit array_size to the sizeof(data->ppList) and
sizeof(data->auditCommands) respectively . More recent versions of libtpms,
if they support more TPM 2 commands, will extend these arrays but those new
commands will not be usable by older versions of libtpms (via profile and
StateFormatLevel) and can therefore be ignored by truncating those arrays.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Fix a compilation error that newer gcc versions may complain about:
tpm_library.c: In function 'TPMLIB_GetPlaintext':
tpm_library.c:441:11: error: assignment discards 'const' qualifier from pointer target type [-Werror=discarded-qualifiers]
441 | start = strstr(stream, starttag);
| ^
At top level:
cc1: note: unrecognized command-line option '-Wno-self-assign' may have been intended to silence earlier diagnostics
cc1: all warnings being treated as errors
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Fix the retrieval of the updated IV for when OpenSSL >= 3.0 is used.
The previously used OSSL_PARAM_octet_ptr allocated a new buffer and then
returned the IV but this newly allocated buffer did not make it back to
the caller. We have to use OSSL_PARAM_octet_string instead to write the
data into the buffer.
Resolves: https://github.com/stefanberger/libtpms/issues/541
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Fix an HMAC signing issue that may causes an out-of-bounds access in a
TPM2B that in turn was running into an assert() in libtpms causing an
abort. The signing issue was due to an inconsistent pairing of the signKey
and signScheme parameters, where the signKey is ALG_KEYEDHASH key and
inScheme is an ECC or RSA scheme.
This fixes CVE-2025-49133.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
In CheckLockedOut replace the return code of TPM_RC_RETRY with
TPM_RC_SUCCESS since it does not seem to be necessary to run the TPM2
command again but the TPM2 can continue executing the current command.
If NVRAM wasn't available then the code in CheckLockedOut would return
with an error already.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Fix the following bugs in RuntimeProfileDedupStrItems:
- RuntimeProfileDedupStrItems did not memmove the correct number of bytes,
leading to potential crashes.
- Also, it did not handle deduplicating the last item in the comma-
separated list correctly.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
The following error occurrs on Fedora build servers. To silence the
compiler warning add runtime asserts:
tpm2/crypto/openssl/CryptCmac.c: In function 'CryptCmacEnd':
tpm2/crypto/openssl/CryptCmac.c:194:48: error: writing 1 byte into a region of size 0 [-Werror=stringop-overflow=]
194 | subkey.t.buffer[subkey.t.size - 1] ^= xorVal;
| ^
tpm2/TpmTypes.h:1477:33: note: at offset -1 into destination object 'buffer' of size 16
1477 | BYTE buffer[MAX_SYM_BLOCK_SIZE];
| ^
lto1: all warnings being treated as errors
In CryptCmacStart the following initialization is done:
cState->iv.t.size = CryptGetSymmetricBlockSize(def->algorithm, def->keyBits.sym);
Also ensure that CryptGetSymmetricBlockSize in this case also always returns
a valid size to the TPM2B_IV that it is initializing, which would be the root
cause of any error.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
The nvram_offsets test fails on 32bit targets due to an unexpected size
of an OBJECT. This was due to missing padding.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
If the user provides no Attributes field in the profile then do not copy
the attributes from the internal profile if that profile may be modified.
In this case assume that the the user wanted no attributes. It now is
also unnecessary that any Attributes be set in a modifyable profile ever,
since they will not be copied.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Adjust the regex checking the JSON input to allow for empty string values,
which will be only used by 'Attributes' since they are all optional.
Then, allow the user to provide an empty string with the Attributes in the
JSON like this: {...,"Attributes":"", ...}
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Per "TCG FIPS 140-3 guidance for TPM 2.0" document the following functions
must prevent an asymmetric ECC key derivation:
- Table 14: TPM2_CreateLoaded
- Table 18: TPM2_ZGen_2Phase
- Table 26: TPM2_Commit
- Table 26: TPM2_EC_Ephemeral
Return TPM_RC_TYPE as a return code to indicate failure of deriving a key.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Restrict profile names to 32 characters to avoid having to carry
excessively long names in the TPM's state file.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Allow setting the minimum HMAC key size and add enforcement gates.
Check that the value of hmac=min-key-size given in the profile is not
larger than 1024. This value is taken from the maximum size of
TPM2B_SENSITIVE, which is MAX_SYM_DATA (=128), which can be provided as
key to an HMAC.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Some function parameters are unused due to OpenSSL usage and other changes
by libtpms. Mark those as unused to avoid static analyzer warnings.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
To avoid static analyzer warnings due to non-literal format strings being
used, wrap asprintf in TPMLIB_asprintf and call vasprintf from there.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Implemewnt a pairwise consistency test for RSA keys that is to be enabled
with FIPS_COMPLIANT #define temporarily. Test encryption+decryption and
sign+verify with the created key on random input data.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
drbg-continous-test enables an existing code block that was previously
only enabled when FIPS_COMPLIANT #define was set. This code block
ensures that previous 4 consecutive random numbers do not appear again
at the beginning of a 16-byte block.
Extend an existing test case with this new attribute.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Only constant strings will be assigned to the static array, so make the
name field also a const char *.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
When a non-modifyable profile is chosen then copy the StateFormatLevel
(SFL) from the internal profile as before. A reason for copying the SFL
is also because the user is not allowed to make modifications to this
type of profile. Otherwise, if the user chooses a modifyable profile,
then let the user choose the StateFormatLevel.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Deduplicate verbs in Commands, Algorithms, and Attributes strings in a
profile and when a verb with an '=' sign is found, such as
ecc-min-size=224, and there is a duplicate later in the string, such as
ecc-min-size=256, then keep the last one.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Remove the test case and renaming of the reference implementation of
CryptKDFe. Reverting this patch would bring the test case back in case
it was necessary.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
To still be able to run the KDFe test case when the OpenSSL replacement
for the KDFe is to be used, rename the reference implemention to
ReferenceCryptKDFe that coexists with the CryptKDFe function that then
calls OSSLCryptKDFe.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Implement a KDFe replacement using OpenSSL's SSKDF and add a test
case that compares the current implementation against the one based
on the OpenSSL SSKDF.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
