WolfSSL
/
wolfBoot
mirror of https://github.com/wolfSSL/wolfBoot.git
1
0
Fork 0
Code Issues Releases Wiki Activity

tpm: rename masterPassword param to authOverride

pull/803/head
Marco Oliverio 2026-06-18 10:45:57 +02:00
parent 723fffebc8
commit 0438c54c9b
3 changed files with 17 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
docs/TPM.md
View File

@ -33,7 +33,7 @@ keys. There are two ways to supply the required `authValue`:
provisioned). Per-device values are computed off-device at provisioning
(`SHA-256(CPSN || master)`, low 16 bytes) and baked in via
`WOLFBOOT_TPM_MFG_AIK_AUTH` / `WOLFBOOT_TPM_MFG_EH_AUTH`. When `WOLFBOOT_TPM_MFG_AUTH_DERIVE`
is not enabled, the `masterPassword` argument to `wolfBoot_tpm2_get_aik()` is
is not enabled, the `authOverride` argument to `wolfBoot_tpm2_get_aik()` is
treated as an optional override for the final AIK `authValue` (not a master secret).
- **Derive mode (`WOLFBOOT_TPM_MFG_AUTH_DERIVE`).** The `authValue` is computed

11
include/tpm.h
View File

@ -64,11 +64,11 @@ int CSME_NSE_API wolfBoot_tpm2_read_cert(uint32_t handle, uint8_t* cert, uint32_
/* MFG identity auth provisioning.
* Precomputed mode (default): the final per-device authValue is set directly,
* no master secret on the device. In this mode, wolfBoot_tpm2_get_aik() treats
* the masterPassword argument as an optional *authValue* override.
* the authOverride argument as an optional *authValue* override.
* Derive mode (WOLFBOOT_TPM_MFG_AUTH_DERIVE): authValue = low 16 bytes of
* SHA-256(TPM serial || master); the master is shared across the reel.
* For wolfBoot_tpm2_get_aik() the master password is provided via the
* masterPassword argument (NULL = sample). */
* For wolfBoot_tpm2_get_aik() the master secret is provided via the
* authOverride argument (NULL = sample). */
#ifdef WOLFBOOT_TPM_MFG_AUTH_DERIVE
/* EH master for derive mode (sample - override in production) */
#ifndef WOLFBOOT_TPM_MFG_EH_MASTER
@ -91,8 +91,11 @@ int CSME_NSE_API wolfBoot_tpm2_read_cert(uint32_t handle, uint8_t* cert, uint32_
#endif
#endif
/* authOverride meaning depends on WOLFBOOT_TPM_MFG_AUTH_DERIVE:
* derive mode -> master secret hashed into the authValue (NULL = sample)
* precomputed mode -> optional literal authValue override (NULL = built-in) */
int CSME_NSE_API wolfBoot_tpm2_get_aik(WOLFTPM2_KEY* aik,
uint8_t* masterPassword, uint16_t masterPasswordSz);
uint8_t* authOverride, uint16_t authOverrideSz);
int CSME_NSE_API wolfBoot_tpm2_get_timestamp(WOLFTPM2_KEY* aik, GetTime_Out* getTime);
int CSME_NSE_API wolfBoot_tpm2_quote(WOLFTPM2_KEY* aik,
byte* pcrArray, word32 pcrArraySz, Quote_Out* quoteResult);

18
src/tpm.c
View File

@ -1360,7 +1360,7 @@ static int wolfBoot_tpm2_set_handle_auth(WOLFTPM2_HANDLE* handle,
#endif
int CSME_NSE_API wolfBoot_tpm2_get_aik(WOLFTPM2_KEY* aik,
uint8_t* masterPassword, uint16_t masterPasswordSz)
uint8_t* authOverride, uint16_t authOverrideSz)
{
int rc;
if (aik == NULL) {
@ -1369,8 +1369,8 @@ int CSME_NSE_API wolfBoot_tpm2_get_aik(WOLFTPM2_KEY* aik,
if (WOLFBOOT_TPM_NS_RW(aik, sizeof(*aik)) == NULL) {
return BAD_FUNC_ARG;
}
if (masterPassword != NULL &&
WOLFBOOT_TPM_NS_R(masterPassword, masterPasswordSz) == NULL) {
if (authOverride != NULL &&
WOLFBOOT_TPM_NS_R(authOverride, authOverrideSz) == NULL) {
return BAD_FUNC_ARG;
}
@ -1380,17 +1380,17 @@ int CSME_NSE_API wolfBoot_tpm2_get_aik(WOLFTPM2_KEY* aik,
#ifdef WOLFBOOT_TPM_MFG_AUTH_DERIVE
/* Derives the authValue on-device from a master secret shared across the
* reel; the precomputed default is preferred. Supply NULL for
* masterPassword to use the sample default. */
* authOverride to use the sample default. */
rc = wolfTPM2_SetIdentityAuth(&wolftpm_dev, &aik->handle,
masterPassword, masterPasswordSz);
authOverride, authOverrideSz);
#else
/* Precomputed (default): set the final per-device authValue directly (no
* master secret on device). Caller may override the default via
* masterPassword. */
* authOverride. */
static const uint8_t aikAuth[] = WOLFBOOT_TPM_MFG_AIK_AUTH;
const uint8_t* auth = (masterPassword != NULL) ? masterPassword : aikAuth;
uint16_t authSz = (masterPassword != NULL) ?
masterPasswordSz : (uint16_t)sizeof(aikAuth);
const uint8_t* auth = (authOverride != NULL) ? authOverride : aikAuth;
uint16_t authSz = (authOverride != NULL) ?
authOverrideSz : (uint16_t)sizeof(aikAuth);
rc = wolfBoot_tpm2_set_handle_auth(&aik->handle, auth, authSz);
#endif
}