From 541a85ca5f225caac9f1d381e99faaa20b007328 Mon Sep 17 00:00:00 2001 From: David Garske Date: Wed, 23 Jul 2025 13:33:37 -0700 Subject: [PATCH] Improve crypto callback key gen hash algorithm selection. --- examples/wrap/wrap_test.c | 4 ++-- src/tpm2_cryptocb.c | 23 ++++++++++++----------- 2 files changed, 14 insertions(+), 13 deletions(-) diff --git a/examples/wrap/wrap_test.c b/examples/wrap/wrap_test.c index 72a19301..ac03ebcf 100644 --- a/examples/wrap/wrap_test.c +++ b/examples/wrap/wrap_test.c @@ -124,6 +124,8 @@ int TPM2_Wrapper_TestArgs(void* userCtx, int argc, char *argv[]) TPM_ALG_ID paramEncAlg = TPM_ALG_NULL; WOLFTPM2_SESSION tpmSession; + XMEMSET(&rsaKey, 0, sizeof(rsaKey)); + XMEMSET(&eccKey, 0, sizeof(eccKey)); XMEMSET(&aesKey, 0, sizeof(aesKey)); XMEMSET(&publicKey, 0, sizeof(publicKey)); #ifndef WOLFTPM2_NO_WOLFCRYPT @@ -172,11 +174,9 @@ int TPM2_Wrapper_TestArgs(void* userCtx, int argc, char *argv[]) /* Setup the wolf crypto device callback */ XMEMSET(&tpmCtx, 0, sizeof(tpmCtx)); #ifndef NO_RSA - XMEMSET(&rsaKey, 0, sizeof(rsaKey)); tpmCtx.rsaKey = &rsaKey; #endif #ifdef HAVE_ECC - XMEMSET(&eccKey, 0, sizeof(eccKey)); tpmCtx.eccKey = &eccKey; #endif tpmCtx.storageKey = &storageKey; diff --git a/src/tpm2_cryptocb.c b/src/tpm2_cryptocb.c index ec97117c..457cc968 100644 --- a/src/tpm2_cryptocb.c +++ b/src/tpm2_cryptocb.c @@ -220,23 +220,24 @@ int wolfTPM2_CryptoDevCb(int devId, wc_CryptoInfo* info, void* ctx) key->handle.hndl == TPM_RH_NULL ) { TPMT_PUBLIC publicTemplate; - XMEMSET(&publicTemplate, 0, sizeof(publicTemplate)); + TPMI_ALG_HASH hashAlg; - rc = wolfTPM2_GetKeyTemplate_ECC(&publicTemplate, + if (curve_id == TPM_ECC_NIST_P521) + hashAlg = TPM_ALG_SHA512; + else if (curve_id == TPM_ECC_NIST_P384) + hashAlg = TPM_ALG_SHA384; + else + hashAlg = TPM_ALG_SHA256; + + XMEMSET(&publicTemplate, 0, sizeof(publicTemplate)); + rc = wolfTPM2_GetKeyTemplate_ECC_ex(&publicTemplate, hashAlg, TPMA_OBJECT_sensitiveDataOrigin | TPMA_OBJECT_userWithAuth | TPMA_OBJECT_sign | TPMA_OBJECT_noDA, - curve_id, TPM_ALG_ECDSA); + curve_id, TPM_ALG_ECDSA, hashAlg); if (rc == 0) { - if (curve_id == TPM_ECC_NIST_P521) - publicTemplate.nameAlg = TPM_ALG_SHA512; - else if (curve_id == TPM_ECC_NIST_P384) - publicTemplate.nameAlg = TPM_ALG_SHA384; - else - publicTemplate.nameAlg = TPM_ALG_SHA256; - if (tlsCtx->ecdsaKey != NULL) { /* Use create key and load key directly instead to make - * sure the private portion is populated */ + * sure the private portion is populated */ rc = wolfTPM2_CreateKey(tlsCtx->dev, tlsCtx->ecdsaKey, &tlsCtx->storageKey->handle, &publicTemplate, (byte*)key->handle.auth.buffer,