Proxmox-Port/swtpm
1
0
Fork 0
mirror of https://github.com/stefanberger/swtpm.git synced 2026-08-23 21:01:04 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

swtpm_setup: Add support for choosing the cipher

Browse Source 
Implement command line support for choosing the cipher to use for
the TPM state encryption. Either aes-128-cbc or aes-256-cbc can be
used. The same cipher has to be passed on the swtpm command line
when using the TPM.

Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
This commit is contained in:
Stefan Berger 2018-09-15 14:21:52 -04:00
parent 8ce50494c7
commit 2e260468cb
3 changed files with 29 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
man/man8/swtpm_setup.8
View File

@ -129,7 +129,7 @@
.\" ========================================================================
.\"
.IX Title "swtpm_setup 8"
.TH swtpm_setup 8 "2018-06-25" "swtpm" ""
.TH swtpm_setup 8 "2018-09-15" "swtpm" ""
.\" For nroff, turn off justification. Always turn off hyphenation; it makes
.\" way too many mistakes in technical documents.
.if n .ad l
@ -232,6 +232,11 @@ for encrypting the state of the \s-1TPM.\s0
The passpharse file contains a passphrase from which the \s-1TPM\s0 emulator
will derive the encyrption key from and use the key for encrypting the \s-1TPM\s0
state.
.IP "\fB\-\-ciper <cipher\fR>" 4
.IX Item "--ciper <cipher>"
The cipher may be either aes-cbc or aes\-128\-cbc for 128 bit \s-1AES\s0 encryption,
or aes\-256\-cbc for 256 bit \s-1AES\s0 encryption. The same cipher must be used
on the \fIswtpm\fR command line later on.
.IP "\fB\-\-overwrite\fR" 4
.IX Item "--overwrite"
Overwrite existing \s-1TPM\s0 state. All previous state will be erased.

6
man/man8/swtpm_setup.pod
View File

@ -123,6 +123,12 @@ The passpharse file contains a passphrase from which the TPM emulator
will derive the encyrption key from and use the key for encrypting the TPM
state.
=item B<--ciper <cipher>>
The cipher may be either aes-cbc or aes-128-cbc for 128 bit AES encryption,
or aes-256-cbc for 256 bit AES encryption. The same cipher must be used
on the I<swtpm> command line later on.
=item B<--overwrite>
Overwrite existing TPM state. All previous state will be erased.

20
src/swtpm_setup/swtpm_setup.sh.in
View File

@ -1983,6 +1983,10 @@ The following options are supported:
This parameter will be passed to the TPM using
'--key pwdfile=<file>'.
--cipher <cipher>: The cipher to use; either aes-128-cbc or aes-256-cbc;
the default is aes-128-cbc; the same cipher must be
used on the swtpm command line
--overwrite : Overwrite existing TPM state be re-initializing it; if this
option is not given, this program will return an error if
existing state is detected
@ -2007,7 +2011,7 @@ main()
local config_file="$DEFAULT_CONFIG_FILE"
local vmid=""
local ret
local keyfile pwdfile
local keyfile pwdfile cipher="aes-128-cbc"
local got_ownerpass=0 got_srkpass=0
local pcr_banks=""
@ -2036,6 +2040,7 @@ main()
--vmid) shift; vmid="$1";;
--keyfile) shift; keyfile="$1";;
--pwdfile) shift; pwdfile="$1";;
--cipher) shift; cipher="$1";;
--runas) shift;; # ignore here
--logfile) shift; LOGFILE="$1";;
--overwrite) flags=$((flags | SETUP_STATE_OVERWRITE_F));;
@ -2171,19 +2176,28 @@ main()
exit 1
fi
if [ -n "$cipher" ]; then
if ! [[ "$cipher" =~ ^(aes-128-cbc|aes-cbc|aes-256-cbc)$ ]];
then
logerr "Unsupported cipher $cipher."
exit 1
fi
cipher=",mode=$cipher"
fi
if [ -n "$keyfile" ]; then
if [ ! -r "$keyfile" ]; then
logerr "Cannot access keyfile $keyfile."
exit 1
fi
SWTPM="$SWTPM --key file=$keyfile"
SWTPM="$SWTPM --key file=${keyfile}${cipher}"
logit " The TPM's state will be encrypted with a provided key."
elif [ -n "$pwdfile" ]; then
if [ ! -r "$pwdfile" ]; then
logerr "Cannot access passphrase file $pwdfile."
exit 1
fi
SWTPM="$SWTPM --key pwdfile=$pwdfile"
SWTPM="$SWTPM --key pwdfile=${pwdfile}${cipher}"
logit " The TPM's state will be encrypted using a key derived from a passphrase."
fi