Skip to content

Add pqc support #3590

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
justinelc-stm wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Add pqc support #3590

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 18 additions & 10 deletions Makefile.am
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,8 @@ endif

include src_vars.mk

ACLOCAL_AMFLAGS = -I m4 --install

INCLUDE_DIRS = -I$(top_srcdir)/tools -I$(top_srcdir)/lib
LIB_COMMON := lib/libcommon.a

Expand Down Expand Up @@ -201,7 +203,13 @@ tpm2_tools = \
tools/tpm2_ecdhzgen.c \
tools/tpm2_zgen2phase.c \
tools/tpm2_sessionconfig.c \
tools/tpm2_getpolicydigest.c
tools/tpm2_getpolicydigest.c \
tools/tpm2_encapsulate.c \
tools/tpm2_decapsulate.c \
tools/tpm2_signsequenceflow.c \
tools/tpm2_verifysequenceflow.c \
tools/tpm2_signdigest.c \
tools/tpm2_verifydigestsignature.c

# Create the symlinks for each tool to the tpm2 and optional tss2 bundled executables
install-exec-hook:
Expand Down Expand Up @@ -275,7 +283,7 @@ test_unit_test_tpm2_auth_util_LDFLAGS = -Wl,--wrap=Esys_TR_SetAuth \
-Wl,--wrap=fread \
-Wl,--wrap=fseek \
-Wl,--wrap=ftell \
-Wl,--wrap=feof \
-Wl,--wrap=feof, \
-Wl,--wrap=fclose
test_unit_test_tpm2_auth_util_LDADD = $(CMOCKA_LIBS) $(LDADD)

Expand Down Expand Up @@ -475,6 +483,12 @@ if HAVE_MAN_PAGES
man/man1/tpm2_zgen2phase.1 \
man/man1/tpm2_sessionconfig.1 \
man/man1/tpm2_getpolicydigest.1 \
man/man1/tpm2_encapsulate.1 \
man/man1/tpm2_decapsulate.1 \
man/man1/tpm2_signsequenceflow.1 \
man/man1/tpm2_verifysequenceflow.1 \
man/man1/tpm2_signdigest.1 \
man/man1/tpm2_verifydigestsignature.1 \
man/man1/tpm2.1

if HAVE_FAPI
Expand Down Expand Up @@ -648,20 +662,14 @@ dist-hook:
done;

prepare-check:
if HAVE_EFIVAR_GE_39
cp $(abs_top_srcdir)/test/integration/fixtures/event-pretty-39/event-*.yaml \
$(abs_top_srcdir)/test/integration/fixtures/
endif
if HAVE_EFIVAR_L_39
if HAVE_EFIVAR_H
cp $(abs_top_srcdir)/test/integration/fixtures/event-pretty/event-*.yaml \
$(abs_top_srcdir)/test/integration/fixtures/
endif
if HAVE_EFIVAR_NO
else
cp $(abs_top_srcdir)/test/integration/fixtures/event-raw/event-*.yaml \
$(abs_top_srcdir)/test/integration/fixtures/
endif


check: prepare-check

if !HAVE_PANDOC
Expand Down
111 changes: 111 additions & 0 deletions lib/tpm2.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,117 @@ static inline UINT16 tpm2_error_get(TSS2_RC rc) {
return ((rc & TPM2_ERROR_TSS2_RC_ERROR_MASK));
}

tool_rc tpm2_encapsulate(ESYS_CONTEXT *esys_context, ESYS_TR object_handle,
TPM2B_KEM_CIPHERTEXT **ciphertext, TPM2B_SHARED_SECRET **sharedSecret) {

TSS2_RC rval = Esys_Encapsulate(esys_context, object_handle,
ESYS_TR_NONE, ESYS_TR_NONE, ESYS_TR_NONE,
ciphertext, sharedSecret);
if (rval != TPM2_RC_SUCCESS) {
LOG_PERR(Esys_Encapsulate, rval);
return tool_rc_from_tpm(rval);
}

return tool_rc_success;
}

tool_rc tpm2_decapsulate(ESYS_CONTEXT *esys_context, ESYS_TR object_handle,
TPM2B_KEM_CIPHERTEXT *ciphertext, TPM2B_SHARED_SECRET **sharedSecret) {

TSS2_RC rval = Esys_Decapsulate(esys_context, object_handle,
ESYS_TR_NONE, ESYS_TR_NONE, ESYS_TR_NONE,
ciphertext, sharedSecret);
if (rval != TPM2_RC_SUCCESS) {
LOG_PERR(Esys_Decapsulate, rval);
return tool_rc_from_tpm(rval);
}

return tool_rc_success;
}

tool_rc tpm2_signsequencestart(ESYS_CONTEXT *esys_context, ESYS_TR keyHandle,
TPM2B_AUTH *auth, TPM2B_SIGNATURE_CTX *context, ESYS_TR *sequenceHandle) {

TSS2_RC rval = Esys_SignSequenceStart(esys_context, keyHandle,
ESYS_TR_NONE, ESYS_TR_NONE, ESYS_TR_NONE,
auth, context, sequenceHandle);
if (rval != TPM2_RC_SUCCESS) {
LOG_PERR(Esys_SignSequenceStart, rval);
return tool_rc_from_tpm(rval);
}

return tool_rc_success;
}

tool_rc tpm2_signsequencecomplete(ESYS_CONTEXT *esys_context, ESYS_TR sequence_handle,
ESYS_TR key_handle, TPM2B_MAX_BUFFER *buffer, TPMT_SIGNATURE **signature) {

TSS2_RC rval = Esys_SignSequenceComplete(esys_context, sequence_handle,
key_handle, ESYS_TR_PASSWORD, ESYS_TR_PASSWORD, ESYS_TR_NONE,
buffer, signature);
if (rval != TPM2_RC_SUCCESS) {
LOG_PERR(Esys_SignSequenceComplete, rval);
return tool_rc_from_tpm(rval);
}

return tool_rc_success;
}

tool_rc tpm2_verifysequencestart(ESYS_CONTEXT *esys_context, ESYS_TR keyHandle,
TPM2B_AUTH *auth, TPM2B_SIGNATURE_HINT *hint, TPM2B_SIGNATURE_CTX *context, ESYS_TR *sequenceHandle) {

TSS2_RC rval = Esys_VerifySequenceStart(esys_context, keyHandle,
ESYS_TR_NONE, ESYS_TR_NONE, ESYS_TR_NONE,
auth, hint, context, sequenceHandle);
if (rval != TPM2_RC_SUCCESS) {
LOG_PERR(Esys_VerifySequenceStart, rval);
return tool_rc_from_tpm(rval);
}

return tool_rc_success;
}

tool_rc tpm2_verifysequencecomplete(ESYS_CONTEXT *esys_context, ESYS_TR sequenceHandle,
ESYS_TR keyHandle, TPMT_SIGNATURE *signature, TPMT_TK_VERIFIED **validation) {

TSS2_RC rval = Esys_VerifySequenceComplete(esys_context, sequenceHandle, keyHandle,
ESYS_TR_PASSWORD, ESYS_TR_NONE, ESYS_TR_NONE,
signature, validation);
if (rval != TPM2_RC_SUCCESS) {
LOG_PERR(Esys_VerifySequenceComplete, rval);
return tool_rc_from_tpm(rval);
}
return tool_rc_success;
}

tool_rc tpm2_signdigest(ESYS_CONTEXT *esys_context, ESYS_TR keyHandle,
TPM2B_SIGNATURE_CTX *context, TPM2B_DIGEST *digest, TPMT_TK_HASHCHECK *validation,
TPMT_SIGNATURE **signature) {

TSS2_RC rval = Esys_SignDigest(esys_context, keyHandle, ESYS_TR_NONE,
ESYS_TR_NONE, ESYS_TR_NONE,
context, digest, validation, signature);
if (rval != TPM2_RC_SUCCESS) {
LOG_PERR(Esys_SignDigest, rval);
return tool_rc_from_tpm(rval);
}
return tool_rc_success;
}

tool_rc tpm2_verifydigestsignature(ESYS_CONTEXT *esys_context, ESYS_TR keyHandle,
TPM2B_SIGNATURE_CTX *context, TPM2B_DIGEST *digest, TPMT_SIGNATURE *signature,
TPMT_TK_VERIFIED **validation) {

TSS2_RC rval = Esys_VerifyDigestSignature(esys_context, keyHandle, ESYS_TR_NONE,
ESYS_TR_NONE, ESYS_TR_NONE,
context, digest, signature, validation);
if (rval != TPM2_RC_SUCCESS) {
LOG_PERR(Esys_VerifyDigestSignature, rval);
return tool_rc_from_tpm(rval);
}
return tool_rc_success;
}

tool_rc tpm2_readpublic(ESYS_CONTEXT *esys_context, ESYS_TR object_handle,
TPM2B_PUBLIC **out_public, TPM2B_NAME **name,
TPM2B_NAME **qualified_name) {
Expand Down
26 changes: 26 additions & 0 deletions lib/tpm2.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,32 @@ tool_rc tpm2_tr_deserialize(ESYS_CONTEXT *esys_context, uint8_t const *buffer,
tool_rc tpm2_tr_serialize(ESYS_CONTEXT *esys_context, ESYS_TR object,
uint8_t **buffer, size_t *buffer_size);

tool_rc tpm2_encapsulate(ESYS_CONTEXT *esys_context, ESYS_TR object_handle,
TPM2B_KEM_CIPHERTEXT **ciphertext, TPM2B_SHARED_SECRET **sharedSecret);

tool_rc tpm2_decapsulate(ESYS_CONTEXT *esys_context, ESYS_TR object_handle,
TPM2B_KEM_CIPHERTEXT *ciphertext, TPM2B_SHARED_SECRET **sharedSecret);

tool_rc tpm2_signsequencestart(ESYS_CONTEXT *esys_context, ESYS_TR keyHandle,
TPM2B_AUTH *auth, TPM2B_SIGNATURE_CTX *context, ESYS_TR *sequenceHandle);

tool_rc tpm2_verifysequencestart(ESYS_CONTEXT *esys_context, ESYS_TR keyHandle,
TPM2B_AUTH *auth, TPM2B_SIGNATURE_HINT *hint, TPM2B_SIGNATURE_CTX *context, ESYS_TR *sequenceHandle);

tool_rc tpm2_signsequencecomplete(ESYS_CONTEXT *esys_context, ESYS_TR sequence_handle,
ESYS_TR key_handle, TPM2B_MAX_BUFFER *buffer, TPMT_SIGNATURE **signature);

tool_rc tpm2_verifysequencecomplete(ESYS_CONTEXT *esys_context, ESYS_TR sequenceHandle,
ESYS_TR keyHandle, TPMT_SIGNATURE *signature, TPMT_TK_VERIFIED **validation);

tool_rc tpm2_signdigest(ESYS_CONTEXT *esys_context, ESYS_TR keyHandle,
TPM2B_SIGNATURE_CTX *context, TPM2B_DIGEST *digest, TPMT_TK_HASHCHECK *validation,
TPMT_SIGNATURE **signature);

tool_rc tpm2_verifydigestsignature(ESYS_CONTEXT *esys_context, ESYS_TR keyHandle,
TPM2B_SIGNATURE_CTX *context, TPM2B_DIGEST *digest, TPMT_SIGNATURE *signature,
TPMT_TK_VERIFIED **validation);

tool_rc tpm2_nv_readpublic(ESYS_CONTEXT *esys_context, TPMI_RH_NV_INDEX nv_index,
TPM2B_NAME *precalc_nvname, TPM2B_NV_PUBLIC **nv_public,
TPM2B_NAME **nv_name, TPM2B_DIGEST *cp_hash, TPM2B_DIGEST *rp_hash,
Expand Down
Loading
Loading