Enable swtpm_cert to sign EK certificates with ML-DSA and EdDSA keys.
An ML-DSA-87 EK signed by an ML-DSA-87 private key (currently) leads to
an EK certificate of ~7567 bytes. Therefore, large NVRAM spaces are needed
to store such certificates.
Also allow signing of the certificates with EdDSA keys, such as Ed25519 and
Ed448.
Add a recommendation for CA keys to the swtpm_setup man page.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Enable the creation of EK and platform certificates where the
to-be-certified key is an ML-DSA-44/65/87 key.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Enable the creation of EK and platform certificates where the
to-be-certified key is an ML-KEM-512/768/1024 key.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
The IAK/IDevID certificate did not pass certificate chain verification due
to malformed ASN.1 in the SAN. Fix the ASN.1 that is put into the SAN to
have proper nesting of sequences.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
X509_time_adj_ex will return a NULL pointer if the days parameter is too
far in the future. Therefore adjust the error message. Also avoid a
memory leak when the return value was NULL.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Allows virtqemud_t to:
- Signal and control swtpm_t processes (noatsecure, rlimitinh, siginh, signull, setsched)
- Create and listen on Unix stream sockets with swtpm_t processes
This enables libvirt to properly control swtpm instances,
including sending signals and managing process scheduling attributes,
when the system is using cockpit-machines interface to manage and start VMs.
Fixes: https://github.com/stefanberger/swtpm/issues/1131
Signed-off-by: JMarcosHP <jehuherrerap@hotmail.com>
The (unsigned char[SCHEMEDATA_SIZE]) casts are not necessary for the
initialization of the schemedata byte arrays and clang does not accept
them. Therefore, remove them.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Remove the SOCK_CLOEXEC flag from the socket call since it is not necessary
(no fork+execve will be run with it) and per user-report may not compile on
Darwin.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
To query for the buffer size, use the TPMPROP_TPM2_BUFFER_MAX when
using a TPM 2. This is a new property introduced in libtpms v0.11.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Use openssl CLI tool now for creating the local root and intermediate CAs.
Create the CAs with an RSA-3072 key for as long as OpenSSL >= v3.5 is not
required.
Adjust one test case to have a longer password since openssl requirew at
least 4 characters for a key password.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Create the IAK hwSerialNum from the authority key identifier (AKID) and
serial number extracted from the EK certificate.
Adjust a test script that now needs to use a valid certificate for the EK
so that we can get the AKID and serial from it to create the serial number
for the IAK certificate.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Extend swtpm_setup to create IAK and IDevID keys and certificates using
command line options --iakkeyalgo and --idevidkeyalgo to choose the
key algorithms for those types of keys.
Use the same CA for signing the IAK and IDevID certificates as used for
the EK and platform certificates since all these certificates are issued
at the same time anyway.
Persist IDevID and IAK keys at 0x81020000 and 0x81020001 respectively.
Add documentation to the man page.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Prepare for primary EC keys for IAK and IDevID to be created with 2
different nonce (one containing the unique string, the other being empty).
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Move the ECC SPK offsets where the public key can be found in the response
into the table along with the keyflags for SPKs. Also move the SPK RSA
parameters into this same table.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Add support for the --tpm-serial-num command line option to pass it on to
swtpm_cert.
Make the vmid part of the serialNumber of the subject passed to
swtpm_cert (following an email exchange with TCG IWG).
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
swtpm_localca will pass the serialNumber in the subject command line option
and we can use this rather than the TPM serial number.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Add support for certificate types iak and idevid. Both require the new
command line option --tpm-serial-num to be passed.
Add support for creating the ASN.1 for the SAN for the new certificates.
Advertise the support for the new certificate types using the capabilities
JSON with entries "cmdarg-tpm-serial-num" and "supports-iak-idevid".
Add documentation to the man page and extend test cases.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
ecc_nist_p384 is a name that the Intel TSS2 tools are using for command
line option. Add secp384r1 as an alternative for it.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Remove support for parentkey_password for TPM 1.2 SRK since swtpm_cert
does not support it anymore.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Introduce a 'keychoice' variable and set it when the user provides an
option for a particular type of key, such as the modulus or exponent for an
RSA key or the x and y parameters for an EC key. Check that no conflicting
parameters are provided.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
The serial number is now converted from its byte form using
bn_serial = BN_bin2bn(ser_number, ser_number_len, NULL);
and then later on this BN is converted to its ASN.1 representation using
asn1_serial = BN_to_ASN1_INTEGER(bn_serial, NULL);
Therefore it is not necessary to prepend a 0 to a number that has its
highest bit set (code was previously wrong and unnecessary).
Since previously a 0-byte was prepended to the number if it was found to be
negative, now only 20 bytes are necessary for the ser_number.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Remove dead support for --parentkey-password/pwd that allowed to provide a
password for the TPM 1.2 SRK if a TPM 1.2 was used for signing.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
- Use a macro to report (unlikley) errors from ASN functions
- Clean up error messages
- Remove early exit()s and use jump to cleanup instead
- Only display cert if PEM output format was chosen
- Fix a memory leak in 'ext'
- Use a #define for maximum password size
- Use a #define to initialize and check spec_level and spec_revision
- Introduce and use macro BITS_TO_BYTES convert number of bits to number
of bytes
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Check the return values of OSSL_PARAM_BLD_push functions and convert other
functions that haven't reported OSSL error to report them in case of
failure. Also check return code of X509_NAME_add_entry_by_txt.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Set an upper limit of 10kb for a hexstring that we would allocate memory
for for convering it into a byte array.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Add cmdarg-ek1keyalgo and cmdarg-ek2keyalgo to the capabilities JSON and
mention them in the man page. Adjust test cases.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Implement options --ek1keyalgo and --ek2keyalgo to allow the user to
choose the EK key types for the 1st and 2nd EK key.
If the user chooses the same type of key twice then only 1 key is created.
For the SPK: If --ecc was passed, create an ecc_nist_p384 storage key as
before, otherwise created an RSA-3072 key.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Move the symkeydata creation into a common function furter down the call
path of RSA primary key creation
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Move the symkeydata creation into a common function furter down the call
path of ECC primary key creation.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Refactor the code so that a common function for RSA and ECC for creating a
primary key can be called.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Move the code that was parsing the RSA key size and checking the key size
for TPM support, into functions. Have the code RSA key size parsed and
checked only if a TPM 2 is used and only if the ek1keyalgo indicates an
RSA key and the eky1keyalgo_param is 0, which is always the case for now.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Move yet more key algorithm and size/curve-specific parameters into the
table and convert the existing RSA end ECC key generating functions to use
the entries from the table.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Convert code related to getting EK parameters to use a table holding
per key algorithm parameters rather than switch statements. Implement
a function looking up the entry in the table relvant for the given key
algorithm and size or curve id (keyalgo_param).
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Convert the rsa_keysize parameter to keyalgo_param where it does not
specifically indicate an RSA key's size. This is to enable other types
of keys to be supported with this 'additional' parameter that can for
example provide a code for the ECC curve. Start with the conversion in
main() where the 1st EK is currently always an RSA key and the 2nd EK is
currently always an ECC key. On this level introduce two variables, one
for each EK. Initialize the 2nd one for secp384r1 curve, which is the
current default for the 2nd EK. Pass the variables through the functions.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
To describe the algorithm of an EK to create, replace the previously used
'isecc' flag with an enum keyalgo. This provides more flexibility later on
when ML-KEM or ML-DSA keys can also be chosen.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Following "TCG EK Credential Profile For TPM Family 2.0; Level 0
Version 2.7, RC1 Nov 7, 2025" the NIST-P384 key flags also have the
'restricted' bit (0x10000) set, but it cannot be set on primary keys
since this returns error codes 0x2d2 & 0x2c2. Therefore, add a comment
to the listed flags about the 'restricted' flag.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
The previous code attempted to detect symlinks using stat(), which is
ineffective since it follows symlinks and never reports S_IFLNK.
Instead, open() is now called with O_NOFOLLOW to enforce the intended security
property (same as in append_to_file() function), and errors are reported based
on errno (e.g., ELOOP, EACCES, EISDIR) to preserve user-facing diagnostics.
This removes the redundant preflight check and aligns validation with the
actual write path.
Signed-off-by: Takuma IMAMURA <209989118+hyperfinitism@users.noreply.github.com>
The previous code attempted to detect symlinks using stat(), which is
ineffective since it follows symlinks and never reports S_IFLNK.
Instead, open() is now called with O_NOFOLLOW to enforce the intended security
property (same as in append_to_file() function), and errors are reported based
on errno (e.g., ELOOP, EACCES, EISDIR) to preserve user-facing diagnostics.
This removes the redundant preflight check and aligns validation with the
actual write path.
Also move the logfile validation earlier, before any logerr(gl_LOGFILE, ...) calls,
so that invalid logfile paths are detected before the logfile is first used.
This avoids falling back to generic error messages from append_to_file() and ensures
consistent diagnostics.
Signed-off-by: Takuma IMAMURA <209989118+hyperfinitism@users.noreply.github.com>
Cygwin requires an explicit cast of the char parameter passed to isspace
to int to fix this issue:
ek-cert.c: In function ‘main’:
ek-cert.c:1605:28: error: array subscript has type ‘char’ [-Werror=char-subscripts]
1605 | while (isspace(*token))
| ^~~~~~
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
