Proxmox-Port/libtpms
1
0
Fork 0
mirror of https://github.com/stefanberger/libtpms synced 2026-08-10 01:50:04 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
736 Commits 27 Branches 46 Tags 12 MiB
d5e419ea34
Commit Graph

736 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Stefan Berger
d5e419ea34 rpm/debian: Add 0.8.0-1 entry to changelog 
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
 2020-06-15 11:55:41 -04:00
Stefan Berger
c762ca4aa6 CHANGES: Update CHANGES file for 0.8.0 
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
 2020-06-02 09:00:46 -04:00
Stefan Berger
5d7a04c624 [build-sys] Add -Wmissing-prototypes to CFLAGS and clean up 
Add -Wmissing-prototypes to CFLAGS and make functions static add #include
where necessary.

Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
 2020-06-01 18:23:07 -04:00
Stefan Berger
cb956cfdeb tpm2: Restrict setting the PSS salt length to the digest length 
In corner cases where the size of the salt and the size of the hash
to sign + 2 exceed the signature size we cannot use the salt length =
hash length but have to resort to using the maximum possible salt
length.

Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
 2020-05-27 15:53:54 -04:00
Stefan Berger
06eff9ee55 tpm2: rev162: Have TPM2 show spec revision 162 
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
 2020-05-27 07:45:29 -04:00
Stefan Berger
8ce417c647 tpm2: rev162: Sync up on HASH_ALIGNMENT 
Sync up on the #define's for HASH_ALIGNMENT, which does not have much
relevance for the OpenSSL implementation.

The affected 32 or 64 bit align field in the ANY_HASH_STATE doesn't carry
any significance. It can be commented without side effects.

Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
 2020-05-27 07:45:29 -04:00
Stefan Berger
b10772dbd0 tpm2: rev162: Add (unused) macros for ECC curves 
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
 2020-05-27 07:45:29 -04:00
Stefan Berger
40f7362401 tpm2: rev162: Remove CURVE_NAME_DEF from ECC_CURVE (trivial) 
Remove CURVE_NAME_DEF field from ECC_CURVE structure and add
  #define CURVE_NAME(N)
so that nothing misses the removed field, which wasn't used
before, either.

Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
 2020-05-27 07:45:29 -04:00
Stefan Berger
e9c1c15fbd tpm2: rev162: Sync code related to NVChip file size 
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
 2020-05-27 07:45:29 -04:00
Stefan Berger
deef829344 tpm2: rev162: Removed unused CryptDataEcc.c file 
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
 2020-05-27 07:45:29 -04:00
Stefan Berger
f0e2424a38 tpm2: rev162: Add (unused) macros for bignums 2020-05-27 07:45:29 -04:00
Stefan Berger
77222e4314 tpm2: rev162: Add support for new (unsed) ECC decrypt/encrypt functions 2020-05-27 07:45:29 -04:00
Stefan Berger
1a28680af7 tpm2: rev162: Add unused field anyKdf to union TPMU_KDF_SCHEME 
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
 2020-05-27 07:45:29 -04:00
Stefan Berger
1f7202decd tpm2: rev162: Cast values produced by initializer to proper type 
Cast the values produced by the #define'd initializers to the proper
type.

Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
 2020-05-27 07:45:29 -04:00
Stefan Berger
e4e403d4c3 tpm2: rev162: Rename (unused) '#if ALG_SM3' to '#if ALG_SM3_256' 
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
 2020-05-27 07:45:29 -04:00
Stefan Berger
5003daf7a6 tpm2: rev162: Add (unused) SM4 related data structures and prototypes 
Add SM4 related data structures and prototypes. We are not using SM4,
so this change is harmless.

Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
 2020-05-27 07:45:29 -04:00
Stefan Berger
07eb437319 tpm2: rev162: Add #define SYMMETRIC_ALIGNMENT 
Add the #define SYMMETRIC_ALIGNMENT that aligns the tpmCryptKeySchedule_t
size. Since this tpmCryptKeySchedule_t only seems to be used as a stack
variable and the alignment field is never accessed nor the size of the
structre taken, it shouldn't affect anything.

Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
 2020-05-27 07:45:29 -04:00
Stefan Berger
0f553bafb2 tpm2: rev162: Add (unused) RSA_16384 
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
 2020-05-27 07:45:29 -04:00
Stefan Berger
133a119892 tpm2: rev162: Reorder functions in Marshal.c to match rev162 
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
 2020-05-27 07:45:29 -04:00
Stefan Berger
5819ba69c5 tpm2: rev162: Rename ALG_<xyz>_VALUE to synonymous TPM_ALG_<xyz> 
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
 2020-05-27 07:45:29 -04:00
Stefan Berger
a4ba69caaa tpm2: rev162: Sync largely unused ACT_spt.c 
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
 2020-05-27 07:45:29 -04:00
Stefan Berger
232b00cef4 tpm2: rev162: Rename MAX_DERIVATION_BITS to TPM_MAX_DERIVATION_BITS 
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
 2020-05-27 07:45:29 -04:00
Stefan Berger
198c723f0b tpm2: rev162: Remove inactive block of RADIX_BITS defines 
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
 2020-05-27 07:45:29 -04:00
Stefan Berger
d2b31d8140 tpm2: Add missing 'libtpms added' comments 2020-05-27 07:45:29 -04:00
Stefan Berger
01cc2d07b4 tpm2: rev162: Rename TPM_SYM_MODE_FIRST/LAST to SYM_MODE_FIRST/LAST 
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
 2020-05-27 07:45:29 -04:00
Stefan Berger
b8883ba55e tpm2: rev162: Use TPM_ALG_LAST rather than synonymous ALG_LAST_VALUE 
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
 2020-05-27 07:45:29 -04:00
Stefan Berger
9c757607ce tpm2: rev162: Use TPM_ALG_<asym> rather than synonymous TPM_<asym>_VALUE 
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
 2020-05-27 07:45:29 -04:00
Stefan Berger
e9f48a8bd7 tpm2: rev162: Use TPM_ALG_<SYM> rather than synonymous ALG_<SYM>_VALUE 2020-05-27 07:45:29 -04:00
Stefan Berger
44325fb94b tpm2: rev162: Use TPM_ALG_NULL rather than synonymous ALG_NULL_VALUE 
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
 2020-05-27 07:45:29 -04:00
Stefan Berger
58fc790f6d tpm2: rev162: Add TPMT_KDF_SCHEME_P_UNMARSHAL to CommandDispatchData.h 
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
 2020-05-27 07:45:29 -04:00
Stefan Berger
b51bd9efdf tpm2: rev162: Refactor CryptMGF1 and rename to CryptMGF_KDF 
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
 2020-05-27 07:45:29 -04:00
Stefan Berger
ed6a8d8cbf tpm2: rev162: Sync unused TpmSizeChecks.c 
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
 2020-05-27 07:45:29 -04:00
Stefan Berger
a2f0265879 tpm2: rev162: Surround #include's with #if ALG_XYZ to make conditional 
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
 2020-05-27 07:45:29 -04:00
Stefan Berger
1ae74993cf tpm2: rev162: Fix algorithm cap initialize for ECDSA (bugfix?) 
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
 2020-05-27 07:45:29 -04:00
Stefan Berger
9420f06753 tpm2: rev162: Fix typos related to (unused) SHA3 constants 
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
 2020-05-27 07:45:29 -04:00
Stefan Berger
99607d5426 tpm2: rev162: Give anonymous struct the type KDF_STRUCT 
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
 2020-05-27 07:45:29 -04:00
Stefan Berger
4521d02dc5 tpm2: rev162: Rename TPM_GENERATED to TPM_CONSTANTS32 
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
 2020-05-27 07:45:29 -04:00
Stefan Berger
c3b7295941 tpm2: rev162: Refactor code in ComputeContextProtectionKey 
Do some simple code refactoring.

Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
 2020-05-27 07:45:29 -04:00
Stefan Berger
1e3b70543f tpm2: rev162: Change SCHEME to KDF_SCHEME in datatypes related to KDF 
A simple renaming operation.

Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
 2020-05-27 07:45:29 -04:00
Stefan Berger
05c032777f tpm2: rev162: Trivial whitespace and comment changes 
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
 2020-05-27 07:45:29 -04:00
Stefan Berger
ae710d3872 tpm2: Set the PSS salt length to the digest length 
Call EVP_PKEY_CTX_set_rsa_pss_saltlen(ctx, -1) when creating an RSA
signature to set the PSS salt length to the digest length. Without
this call we previously set the salt length to the maximum
permissible value, but this is not how TPM 2 implements it.

Per interoperability testing between signatures created previously
with the max. permissible value and the new code, which does not
modify the signature verification code, old signatures still verify.
New signatures also verify.

This patch may solve interoperability with hardware TPMs that signatures
created following this patch now verify on hardware TPMs as well.

Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
 2020-05-27 07:24:47 -04:00
Stefan Berger
78de69d2d4 tpm2: Always use a temporary buffer for decryption 
Always use a temporary buffer large enough to meet the requirements of the
EVP_DecryptUpdate() call.

Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
 2020-05-27 07:24:47 -04:00
Stefan Berger
2233af9ca1 tpm2: Add call to EVP_CIPHER_CTX_set_padding(ctx, 0) in sym. decryption 
Add missing call of EVP_CIPHER_CTX_set_padding(ctx, 0) in the symmetric
decryption case. This was missing and failed some decryption cases.

Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
 2020-05-27 07:24:47 -04:00
Stefan Berger
dc1365a77e tpm2: Add missing input size check for CryptSymmetricDecrypt 
Add a missing input size check for CryptSymmetricDecrypt so that we return
the proper error code TPM_RC_SIZE in case the input size is not a multiple
of the block size. Before TPM_RC_FAILURE was returned.

Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
 2020-05-27 07:24:47 -04:00
Stefan Berger
505ef841c0 tpm2: Fix output buffer parameter and size for RSA decyrption 
For the RSA decryption we have to use an output buffer of the size of the
(largest possible) RSA key for the decryption to always work.

This fixes a stack corruption bug that caused a SIGBUS and termination of
'swtpm'.

Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
 2020-05-23 09:36:51 -04:00
Stefan Berger
819caa4be8 tpm2: Remove space after 'IBM' in MANUFACTURER 
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
 2020-05-18 11:22:21 -04:00
Stefan Berger
a9900d4128 tpm2: Add missing EC Curve cases in Unmarshal function 
Add missing EC Curve cases in Unmarshal function.
Also, don't accept curves that are not usable during runtime because OpenSSL
may not support them.

Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
 2020-05-15 12:55:43 -04:00
Stefan Berger
9f915067fe tpm2: Runtime filter useable EC Curves before advertising them 
Runtime filter useable EC Curves before advertising them as being
supported.

Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
 2020-05-15 12:55:43 -04:00
Stefan Berger
f3f78c72a5 tpm2: Fix a gcc 10.1.0 complaint 
This PR addresses issue 133: https://github.com/stefanberger/libtpms/issues/133

bin/sh ../libtool  --tag=CC   --mode=compile x86_64-pc-linux-gnu-gcc \
  -DHAVE_CONFIG_H -I. -I..    -include tpm_library_conf.h \
  -I../include/libtpms -I../include/libtpms -fstack-protector-strong \
  -D_POSIX_ -DTPM_POSIX -DTPM_LIBTPMS_CALLBACKS -I ./tpm2 \
  -I ./tpm2/crypto -I ./tpm2/crypto/openssl -g -O2 \
  -DUSE_OPENSSL_FUNCTIONS_SYMMETRIC=1 -DUSE_OPENSSL_FUNCTIONS_EC=1 \
  -DUSE_OPENSSL_FUNCTIONS_ECDSA=1 -DUSE_OPENSSL_FUNCTIONS_RSA=1 \
  -Wall -Werror -Wreturn-type -Wsign-compare -Wno-self-assign \
  -c -o tpm2/libtpms_tpm2_la-NVDynamic.lo `test -f 'tpm2/NVDynamic.c' \
  || echo './'`tpm2/NVDynamic.c
libtool: compile:  x86_64-pc-linux-gnu-gcc -DHAVE_CONFIG_H -I. \
  -I.. -include tpm_library_conf.h -I../include/libtpms \
  -I../include/libtpms -fstack-protector-strong -D_POSIX_ -DTPM_POSIX \
  -DTPM_LIBTPMS_CALLBACKS -I ./tpm2 -I ./tpm2/crypto \
  -I ./tpm2/crypto/openssl -g -O2 -DUSE_OPENSSL_FUNCTIONS_SYMMETRIC=1 \
  -DUSE_OPENSSL_FUNCTIONS_EC=1 -DUSE_OPENSSL_FUNCTIONS_ECDSA=1 \
  -DUSE_OPENSSL_FUNCTIONS_RSA=1 -Wall -Werror -Wreturn-type -Wsign-compare \
  -Wno-self-assign -c tpm2/NVDynamic.c  -fPIC -DPIC \
  -o tpm2/.libs/libtpms_tpm2_la-NVDynamic.o
tpm2/NVDynamic.c: In function ?NvNextByType?:
tpm2/NVDynamic.c:126:10: error: ?nvHandle? may be used uninitialized in this function [-Werror=maybe-uninitialized]
  126 |  *handle = nvHandle;
      |  ~~~~~~~~^~~~~~~~~~
tpm2/NVDynamic.c: At top level:

Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
 2020-05-12 14:02:57 -04:00
Stefan Berger
62f66e5c37 tpm2: Prevent RSA 3072 related out-of-bounds access to sieveMarks[5] 
PrimeSieve was accessing the sieveMarks array at out-of-bounds index 5
due to a bug in other parts of the code. This patch fixes the issue
and prevents this access by limiting the values that 'next' can take on.

Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
 2020-05-04 17:56:17 -04:00