Remove the -s parameter to tpm2_nv_define since it was causing
a 0-size NVRAM location to be created for the platform cert.
Also use the nvindex parameter rather than TPM2_NV_INDEX_PlatformCert
for addressing the platform NVRAM index.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Test that a key written to volatile state is properly loaded again
and produces the same signature as before.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Adjust the flags for the TPM 2 NVRAM locations to adhere to the
specification:
TCG PC Client Platform: TPM Profile (PTP) Specification
Family "2.0"; Level 00; Rev 01.03 v22; May 22, 2017
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
To prepare for writing data into different locations for ECC keys,
assign a variable the location of the NVRAM to write RSA related data
into.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
We write the EK template into the NVRAM location when it is non-standard.
It's non-standard once the EK can be used for signing.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Test the certs created by swtpm_localca by verifying the certificate
chain and checking their key usage.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Add the --decryption option to enable key encipherment separately
from enabling signing for the EK. The key encipherment is not set
but needs to be set if --allow-signing is used and key encipherment
is also requested.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
To allow the creation of EKs with signing and/or key encipherment
capabilities, add the --allow-signing and --decryption options
to swtpm-localca program.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
In case of a TPM 2 we allow the creation of a signing key by passing
--allow signing. To also enable key encipherment, we add the --decryption
option to allow key encipherment and signing at the same time.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Use the standard EK and SRK handles per IWG spec
"TCG TPM v2.0 Provisioning Guidance"; Version 1.0, Rev 1.0, March 15 2017
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Create the tpm2_createprimary_rsa_params function that has common code
for creating a primary RSA key with parameters.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Don't require root privileges to run swtpm_setup with a TPM 2 target.
For TPM 1.2 we need the high privilges due to TrouSerS wanting to be
started as root (or 'tss'), but for TPM 2 we do not use any tools
to manufacture the initial state that would require high privileges.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Add a test case that tests the TPM 2 volatile state. This test
requires the latest TPM2 version of libtpms that also writes the
TPM Established bit into the volatile state.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Check the TPM2 state using the TPM2 utilities, if available.
Create persistent state and check it, then shut down the TPM 2 and
restart it, and check the persistent state again.
Use previously created state and have the TPM 2 start with it
and check the persistent state. The persistent state must be
readable on little and big endian machines.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
libtpms preview branch tpm2-preview.rev142 enables volatile state
marshalling and unmarshalling which in turn enables the suspending
and resumption of the TPM state. This patch enables the capabilty
bits and adds test cases for testing the TPM state suspending and
resumption.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Provide support for creating certificates for TPM2 ECC type of keys.
Extend the test cases and the man pages.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Support TPM 2 in swtpm_setup and swtpm_setup.sh.
Implement support for all command line options except for:
o --take-ownership and anything related to ownership passwords
o --lock-nvram
o --display
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
TPM2 allows the primary key to also be a signing key, so in case
--tpm2 is provided, --allow-signing can be provided as well in
case the primary can also be used for signing operations.
We use SHA256 for the signing algorithm when TPM 2 is being used.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Extend the swtpm_bios tool with a --tpm2 command line parameter
to support TPM 2 initialization.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Call the libtpms API for resetting the TPM Established flag rather
than sending a TPM command, which only works for TPM1.2.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Implement support for TPM2. Some of the capabilities are not supported yet in
this patch.
Extend the man pages with description for --tpm2.
Missing: configure should probe for needed API calls in libtpms
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
The subject alternative name need to have a special sequence of
bytes prepended to them for certtool to accept the data. Also TCG's
sample certificate does show the sequence. The byte sequence is of
the form: 0x30 <subsequent length> 0xa4 <subsequent length> <data>
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
The previous patch's reversal was partially wrong. The authority
key id needs to be set explicitly from the key id of the signing
key of the issuing CA.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Remove the copying of the authority key id from the given issuer
cert to the created cert since this copies the wrong key id and
besides that it will be set automatically when the certificate is
created.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Create a .lock file in the directory with the TPM state and get
a lock on this file and hold on to the lock until swtpm ends.
This precludes other swtpm instances to step on the same state.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Have the test cases wait for the process to be gone after 1s using
wait_process_gone rather than trying use kill -0 once after 0.5s.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Whenever we encrypt the data we generate a new random IV and append a
tlv block with the IV to the byte stream. We mark the IV with different
tags depending on whether they are for the migration data or the (TPM)
data directly. All IVs are part of the HMAC and are added to it after
the data blob.
Adjust test cases that now return larger sizes of data. A constant
checksum over the data cannot be expected anymore, thus we have to remove
the verification of the checksum over the returned state (IV changes
every time).
The size of the blobs grow by 22 bytes, 6 for the tlv header, 16 bytes
for the IV (128 bit AES key).
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Get the IV from a tlv block in the data stream. If none is found, which
is the case when reading older state, we get a NULL pointer for the IV
and call the functions with the NULL pointer, which provides backwards
compatibility.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Enable a caller to pass an IV into the AES CBC encryption/decryption
function. If the caller passes NULL, we use the IV with all zeroes.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Refactor the functions calculating the HMAC so that we can later on
pass the IV for the AES CBC encryption as well.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Prepend tag-length-value (tlv) headers in front of all data being stored in
the byte stream following the header. This lets us uniquely identify plain
data (= TPM state), encrypted data (= encrytped TPM state), migration data
(which is wrapped plain or encrytped TPM state), and an HMAC block to
validate the plain data.
We keep support for version 1 for reading the data but convert them to
version 2 when writing them out. This way we loose backwards compatibility
(downgrading of swtpm is not possible), but it allows us to extend the state
in the future by adding addition blocks with tlv headers.
Version 1 of the encryption was prepending the hash on the plaintext data
then encrypting all of it. This method is not so good. In version 2 we now
use Encrypt-then-MAC (EtM) where we encrypt the data and then calculate an
HMAC on the encrypted data.
Files written by the swtpm didn't have a header before. Now they also get a
header. This means that the state written into files and the state retrieved
using the API (swtpm_ioctl --save) have the same format, but still differ
in so far as the API wraps the data in a tlv header for migration, which the
files written out as state would never get.
Adapt a couple of test cases show file sizes and hashes have changed now.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
