Skip to content

Commit 9ca231e

Browse files
justinelc-stmjustinelc-stm
committed
Add pqc support
Signed-off-by: justinelc-stm* <justine.lecoq@st.com>
1 parent 844a611 commit 9ca231e

32 files changed

Lines changed: 3389 additions & 15 deletions

‎Makefile.am‎

Lines changed: 18 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,8 @@ endif
1111

1212
include src_vars.mk
1313

14+
ACLOCAL_AMFLAGS = -I m4 --install
15+
1416
INCLUDE_DIRS = -I$(top_srcdir)/tools -I$(top_srcdir)/lib
1517
LIB_COMMON := lib/libcommon.a
1618

@@ -201,7 +203,13 @@ tpm2_tools = \
201203
tools/tpm2_ecdhzgen.c \
202204
tools/tpm2_zgen2phase.c \
203205
tools/tpm2_sessionconfig.c \
204-
tools/tpm2_getpolicydigest.c
206+
tools/tpm2_getpolicydigest.c \
207+
tools/tpm2_encapsulate.c \
208+
tools/tpm2_decapsulate.c \
209+
tools/tpm2_signsequenceflow.c \
210+
tools/tpm2_verifysequenceflow.c \
211+
tools/tpm2_signdigest.c \
212+
tools/tpm2_verifydigestsignature.c
205213

206214
# Create the symlinks for each tool to the tpm2 and optional tss2 bundled executables
207215
install-exec-hook:
@@ -275,7 +283,7 @@ test_unit_test_tpm2_auth_util_LDFLAGS = -Wl,--wrap=Esys_TR_SetAuth \
275283
-Wl,--wrap=fread \
276284
-Wl,--wrap=fseek \
277285
-Wl,--wrap=ftell \
278-
-Wl,--wrap=feof \
286+
-Wl,--wrap=feof, \
279287
-Wl,--wrap=fclose
280288
test_unit_test_tpm2_auth_util_LDADD = $(CMOCKA_LIBS) $(LDADD)
281289

@@ -475,6 +483,12 @@ if HAVE_MAN_PAGES
475483
man/man1/tpm2_zgen2phase.1 \
476484
man/man1/tpm2_sessionconfig.1 \
477485
man/man1/tpm2_getpolicydigest.1 \
486+
man/man1/tpm2_encapsulate.1 \
487+
man/man1/tpm2_decapsulate.1 \
488+
man/man1/tpm2_signsequenceflow.1 \
489+
man/man1/tpm2_verifysequenceflow.1 \
490+
man/man1/tpm2_signdigest.1 \
491+
man/man1/tpm2_verifydigestsignature.1 \
478492
man/man1/tpm2.1
479493

480494
if HAVE_FAPI
@@ -648,20 +662,14 @@ dist-hook:
648662
done;
649663

650664
prepare-check:
651-
if HAVE_EFIVAR_GE_39
652-
cp $(abs_top_srcdir)/test/integration/fixtures/event-pretty-39/event-*.yaml \
653-
$(abs_top_srcdir)/test/integration/fixtures/
654-
endif
655-
if HAVE_EFIVAR_L_39
665+
if HAVE_EFIVAR_H
656666
cp $(abs_top_srcdir)/test/integration/fixtures/event-pretty/event-*.yaml \
657667
$(abs_top_srcdir)/test/integration/fixtures/
658-
endif
659-
if HAVE_EFIVAR_NO
668+
else
660669
cp $(abs_top_srcdir)/test/integration/fixtures/event-raw/event-*.yaml \
661670
$(abs_top_srcdir)/test/integration/fixtures/
662671
endif
663672

664-
665673
check: prepare-check
666674

667675
if !HAVE_PANDOC

‎lib/tpm2.c‎

Lines changed: 111 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,117 @@ static inline UINT16 tpm2_error_get(TSS2_RC rc) {
2121
return ((rc & TPM2_ERROR_TSS2_RC_ERROR_MASK));
2222
}
2323

24+
tool_rc tpm2_encapsulate(ESYS_CONTEXT *esys_context, ESYS_TR object_handle,
25+
TPM2B_KEM_CIPHERTEXT **ciphertext, TPM2B_SHARED_SECRET **sharedSecret) {
26+
27+
TSS2_RC rval = Esys_Encapsulate(esys_context, object_handle,
28+
ESYS_TR_NONE, ESYS_TR_NONE, ESYS_TR_NONE,
29+
ciphertext, sharedSecret);
30+
if (rval != TPM2_RC_SUCCESS) {
31+
LOG_PERR(Esys_Encapsulate, rval);
32+
return tool_rc_from_tpm(rval);
33+
}
34+
35+
return tool_rc_success;
36+
}
37+
38+
tool_rc tpm2_decapsulate(ESYS_CONTEXT *esys_context, ESYS_TR object_handle,
39+
TPM2B_KEM_CIPHERTEXT *ciphertext, TPM2B_SHARED_SECRET **sharedSecret) {
40+
41+
TSS2_RC rval = Esys_Decapsulate(esys_context, object_handle,
42+
ESYS_TR_NONE, ESYS_TR_NONE, ESYS_TR_NONE,
43+
ciphertext, sharedSecret);
44+
if (rval != TPM2_RC_SUCCESS) {
45+
LOG_PERR(Esys_Decapsulate, rval);
46+
return tool_rc_from_tpm(rval);
47+
}
48+
49+
return tool_rc_success;
50+
}
51+
52+
tool_rc tpm2_signsequencestart(ESYS_CONTEXT *esys_context, ESYS_TR keyHandle,
53+
TPM2B_AUTH *auth, TPM2B_SIGNATURE_CTX *context, ESYS_TR *sequenceHandle) {
54+
55+
TSS2_RC rval = Esys_SignSequenceStart(esys_context, keyHandle,
56+
ESYS_TR_NONE, ESYS_TR_NONE, ESYS_TR_NONE,
57+
auth, context, sequenceHandle);
58+
if (rval != TPM2_RC_SUCCESS) {
59+
LOG_PERR(Esys_SignSequenceStart, rval);
60+
return tool_rc_from_tpm(rval);
61+
}
62+
63+
return tool_rc_success;
64+
}
65+
66+
tool_rc tpm2_signsequencecomplete(ESYS_CONTEXT *esys_context, ESYS_TR sequence_handle,
67+
ESYS_TR key_handle, TPM2B_MAX_BUFFER *buffer, TPMT_SIGNATURE **signature) {
68+
69+
TSS2_RC rval = Esys_SignSequenceComplete(esys_context, sequence_handle,
70+
key_handle, ESYS_TR_PASSWORD, ESYS_TR_PASSWORD, ESYS_TR_NONE,
71+
buffer, signature);
72+
if (rval != TPM2_RC_SUCCESS) {
73+
LOG_PERR(Esys_SignSequenceComplete, rval);
74+
return tool_rc_from_tpm(rval);
75+
}
76+
77+
return tool_rc_success;
78+
}
79+
80+
tool_rc tpm2_verifysequencestart(ESYS_CONTEXT *esys_context, ESYS_TR keyHandle,
81+
TPM2B_AUTH *auth, TPM2B_SIGNATURE_HINT *hint, TPM2B_SIGNATURE_CTX *context, ESYS_TR *sequenceHandle) {
82+
83+
TSS2_RC rval = Esys_VerifySequenceStart(esys_context, keyHandle,
84+
ESYS_TR_NONE, ESYS_TR_NONE, ESYS_TR_NONE,
85+
auth, hint, context, sequenceHandle);
86+
if (rval != TPM2_RC_SUCCESS) {
87+
LOG_PERR(Esys_VerifySequenceStart, rval);
88+
return tool_rc_from_tpm(rval);
89+
}
90+
91+
return tool_rc_success;
92+
}
93+
94+
tool_rc tpm2_verifysequencecomplete(ESYS_CONTEXT *esys_context, ESYS_TR sequenceHandle,
95+
ESYS_TR keyHandle, TPMT_SIGNATURE *signature, TPMT_TK_VERIFIED **validation) {
96+
97+
TSS2_RC rval = Esys_VerifySequenceComplete(esys_context, sequenceHandle, keyHandle,
98+
ESYS_TR_PASSWORD, ESYS_TR_NONE, ESYS_TR_NONE,
99+
signature, validation);
100+
if (rval != TPM2_RC_SUCCESS) {
101+
LOG_PERR(Esys_VerifySequenceComplete, rval);
102+
return tool_rc_from_tpm(rval);
103+
}
104+
return tool_rc_success;
105+
}
106+
107+
tool_rc tpm2_signdigest(ESYS_CONTEXT *esys_context, ESYS_TR keyHandle,
108+
TPM2B_SIGNATURE_CTX *context, TPM2B_DIGEST *digest, TPMT_TK_HASHCHECK *validation,
109+
TPMT_SIGNATURE **signature) {
110+
111+
TSS2_RC rval = Esys_SignDigest(esys_context, keyHandle, ESYS_TR_NONE,
112+
ESYS_TR_NONE, ESYS_TR_NONE,
113+
context, digest, validation, signature);
114+
if (rval != TPM2_RC_SUCCESS) {
115+
LOG_PERR(Esys_SignDigest, rval);
116+
return tool_rc_from_tpm(rval);
117+
}
118+
return tool_rc_success;
119+
}
120+
121+
tool_rc tpm2_verifydigestsignature(ESYS_CONTEXT *esys_context, ESYS_TR keyHandle,
122+
TPM2B_SIGNATURE_CTX *context, TPM2B_DIGEST *digest, TPMT_SIGNATURE *signature,
123+
TPMT_TK_VERIFIED **validation) {
124+
125+
TSS2_RC rval = Esys_VerifyDigestSignature(esys_context, keyHandle, ESYS_TR_NONE,
126+
ESYS_TR_NONE, ESYS_TR_NONE,
127+
context, digest, signature, validation);
128+
if (rval != TPM2_RC_SUCCESS) {
129+
LOG_PERR(Esys_VerifyDigestSignature, rval);
130+
return tool_rc_from_tpm(rval);
131+
}
132+
return tool_rc_success;
133+
}
134+
24135
tool_rc tpm2_readpublic(ESYS_CONTEXT *esys_context, ESYS_TR object_handle,
25136
TPM2B_PUBLIC **out_public, TPM2B_NAME **name,
26137
TPM2B_NAME **qualified_name) {

‎lib/tpm2.h‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,32 @@ tool_rc tpm2_tr_deserialize(ESYS_CONTEXT *esys_context, uint8_t const *buffer,
2020
tool_rc tpm2_tr_serialize(ESYS_CONTEXT *esys_context, ESYS_TR object,
2121
uint8_t **buffer, size_t *buffer_size);
2222

23+
tool_rc tpm2_encapsulate(ESYS_CONTEXT *esys_context, ESYS_TR object_handle,
24+
TPM2B_KEM_CIPHERTEXT **ciphertext, TPM2B_SHARED_SECRET **sharedSecret);
25+
26+
tool_rc tpm2_decapsulate(ESYS_CONTEXT *esys_context, ESYS_TR object_handle,
27+
TPM2B_KEM_CIPHERTEXT *ciphertext, TPM2B_SHARED_SECRET **sharedSecret);
28+
29+
tool_rc tpm2_signsequencestart(ESYS_CONTEXT *esys_context, ESYS_TR keyHandle,
30+
TPM2B_AUTH *auth, TPM2B_SIGNATURE_CTX *context, ESYS_TR *sequenceHandle);
31+
32+
tool_rc tpm2_verifysequencestart(ESYS_CONTEXT *esys_context, ESYS_TR keyHandle,
33+
TPM2B_AUTH *auth, TPM2B_SIGNATURE_HINT *hint, TPM2B_SIGNATURE_CTX *context, ESYS_TR *sequenceHandle);
34+
35+
tool_rc tpm2_signsequencecomplete(ESYS_CONTEXT *esys_context, ESYS_TR sequence_handle,
36+
ESYS_TR key_handle, TPM2B_MAX_BUFFER *buffer, TPMT_SIGNATURE **signature);
37+
38+
tool_rc tpm2_verifysequencecomplete(ESYS_CONTEXT *esys_context, ESYS_TR sequenceHandle,
39+
ESYS_TR keyHandle, TPMT_SIGNATURE *signature, TPMT_TK_VERIFIED **validation);
40+
41+
tool_rc tpm2_signdigest(ESYS_CONTEXT *esys_context, ESYS_TR keyHandle,
42+
TPM2B_SIGNATURE_CTX *context, TPM2B_DIGEST *digest, TPMT_TK_HASHCHECK *validation,
43+
TPMT_SIGNATURE **signature);
44+
45+
tool_rc tpm2_verifydigestsignature(ESYS_CONTEXT *esys_context, ESYS_TR keyHandle,
46+
TPM2B_SIGNATURE_CTX *context, TPM2B_DIGEST *digest, TPMT_SIGNATURE *signature,
47+
TPMT_TK_VERIFIED **validation);
48+
2349
tool_rc tpm2_nv_readpublic(ESYS_CONTEXT *esys_context, TPMI_RH_NV_INDEX nv_index,
2450
TPM2B_NAME *precalc_nvname, TPM2B_NV_PUBLIC **nv_public,
2551
TPM2B_NAME **nv_name, TPM2B_DIGEST *cp_hash, TPM2B_DIGEST *rp_hash,

0 commit comments

Comments
 (0)