mirror of
https://github.com/stefanberger/libtpms
synced 2026-01-11 16:51:29 +00:00
36d1e03368
Also use the new privatExponent for dP, dQ and qInv. There are two functions that need to be adapted: - ComputePrivateExponent: producer of these parameters - RsaPrivateKeyOp : consumer of these parameters ComputePrivateExponent is converted to store the results into Z->dP, Z->dQ, and Z->qInv. Therefore, remove the old privateExponent parameter *pExp, that was previously used to store them, from the signature of this function and pull out the initialization of pExp and preservation of Q to be done before calling this function. This is done in the 2 calling functions. After returning from the function copy the values of Z->dP, Z->dQ, and Z->qInv to the old privateExponent where the results had been stored previously and where we need to have them. This change results in a sequence like this for the 2 callers: RsaInitializeExponentOld(&rsaKey->privateExponent); BnCopy((bigNum)&rsaKey->privateExponent.Q, Z->Q); // preserve Q VERIFY(ComputePrivateExponent(bnE, Z)); RsaSetExponentOld(&rsaKey->privateExponent, Z); // duplicate dP, dQ, qInv The values for dP, dQ, ad qInv are consumed by RsaPrivateKeyOp. Therefore, adjust this functions signature by removing the old privateExponent parameter *pExp from it and make sure that callers initialize Z->dP, Z->dQ, and Z->qInv before calling this functions. There are two call-sites where the one in RSADP looks like this: RsaSetExponentFromOld(Z, &key->privateExponent); // copy Q, dP, dQ, qInv to Z VERIFY(RsaPrivateKeyOp(bnM, Z)); The call site in CryptRsaGenerateKey has called ComputePrivateExponent before, therefore it already holds the values in Z. Signed-off-by: Stefan Berger <stefanb@linux.ibm.com> |
||
|---|---|---|
| .github/ISSUE_TEMPLATE | ||
| debian | ||
| dist | ||
| include | ||
| m4 | ||
| man | ||
| src | ||
| tests | ||
| .gitignore | ||
| .travis.yml | ||
| autogen.sh | ||
| bootstrap.sh | ||
| CHANGES | ||
| configure.ac | ||
| CREDITS | ||
| DCO1.1.txt | ||
| INSTALL | ||
| libtpms.pc.in | ||
| LICENSE | ||
| MAINTAINERS | ||
| Makefile.am | ||
| README | ||
What is libtpms?
----------------
Libtpms is a library that targets the integration of TPM functionality
into hypervisors, primarily into Qemu. Libtpms provides a very narrow
public API for this purpose so that integration is possible. Only the
minimum of necessary APIs are made publicly available.
It is assumed that the user of libtpms is familiar with the concepts
of the Trusted Platform Module (TPM). For the interaction with libtpms
it is necessary to know how to construct valid TPM commands and to
be able to parse their results. It is not within the scope of libtpms's
documentation to provide background on this. See the section on references
below.
What files does the libtpms package provide?
--------------------------------------------
The main libtpms package provides the following files:
/usr/lib64/libtpms.so.0
/usr/lib64/libtpms.so.0.5.1
/usr/share/doc/libtpms-0.5.1
/usr/share/doc/libtpms-0.5.1/CHANGES
/usr/share/doc/libtpms-0.5.1/LICENSE
/usr/share/doc/libtpms-0.5.1/README
Applications can link with -ltpms.
What files does the libtpms development package provide?
--------------------------------------------------------
The libtpms development package (libtpms-devel) provides the following
include files for applications to use:
tpm_error.h
tpm_library.h
tpm_memory.h
tpm_nvfilename.h
tpm_tis.h
tpm_types.h
These files contain the data structures, data types and API calls supported
by libtpms. It is recommended to not use any other API calls than those
provided in these include files.
All APIs are described in man pages. The man pages are part of the libtpms
development package as well:
TPMLIB_DecodeBlob
TPMLIB_GetTPMProperty
TPMLIB_GetVersion
TPMLIB_MainInit
TPMLIB_Process
TPMLIB_RegisterCallbacks
TPMLIB_Terminate
TPMLIB_VolatileAll_Store
TPM_Free
TPM_IO_Hash_Data
TPM_IO_Hash_End
TPM_IO_Hash_Start
TPM_IO_TpmEstablished_Get
TPM_Malloc
TPM_Realloc
How to contribute?
------------------
The mailing list for libtpms is libtpms@googlegroups.com.
For patch submissions, please use a Signed-off-by: <your email> to indicate
agreement to the DCO1.1.txt.
Fuzzing
-------
Initial fuzzing is possible with clang & libfuzzer.
You have to configure the project with --enable-fuzzer
(--enable-sanitizer can also help spot more issues). Then you can
build fuzz and run it with the testing corpus.
Fuzz testing is known to work with Fedora 28 or later. It requires that the
'clang' package is installed.
Ex:
$ ./configure --with-openssl --with-tpm2 --enable-sanitizers --enable-fuzzer \
CC=clang CXX=clang++
$ make && make -C tests fuzz
$ tests/run-fuzzer.sh
oss-fuzz builds with its own fuzzer flags, and set $LIB_FUZZING_ENGINE
to be linked with. The script run by oss-fuzz is tests/oss-fuzz.sh.
Maintainers
-----------
libtpms is currently being maintained by Stefan Berger <stefanb@us.ibm.com>.
References:
-----------
Documentation about the Trusted Platform Module (TPM) can be downloaded
from the Trusted Computing Group's website at
http://www.trustedcomputinggroup.org