mirror of https://github.com/wolfSSL/wolfTPM.git
Added new example for sealing a secret using TPM key
Signed-off-by: Dimitar Tomov <dimi@wolfssl.com>pull/157/head
Dimitar Tomov
parent
b9e93c2238
commit
b7600a9348
|
|
@ -13,6 +13,7 @@ include examples/management/include.am
|
|||
include examples/keygen/include.am
|
||||
include examples/nvram/include.am
|
||||
include examples/gpio/include.am
|
||||
include examples/seal/include.am
|
||||
|
||||
dist_example_DATA+= examples/README.md \
|
||||
examples/tpm_io.c \
|
||||
|
|
|
|||
|
|
@ -0,0 +1,27 @@
|
|||
# vim:ft=automake
|
||||
# All paths should be given relative to the root
|
||||
|
||||
if BUILD_EXAMPLES
|
||||
noinst_PROGRAMS += examples/seal/seal \
|
||||
examples/seal/unseal
|
||||
|
||||
noinst_HEADERS += examples/seal/seal.h
|
||||
|
||||
examples_seal_seal_SOURCES = examples/seal/seal.c \
|
||||
examples/tpm_test_keys.c \
|
||||
examples/tpm_io.c
|
||||
examples_seal_seal_LDADD = src/libwolftpm.la $(LIB_STATIC_ADD)
|
||||
examples_seal_seal_DEPENDENCIES = src/libwolftpm.la
|
||||
|
||||
examples_seal_unseal_SOURCES = examples/seal/unseal.c \
|
||||
examples/tpm_io.c
|
||||
examples_seal_unseal_LDADD = src/libwolftpm.la $(LIB_STATIC_ADD)
|
||||
examples_seal_unseal_DEPENDENCIES = src/libwolftpm.la
|
||||
|
||||
endif
|
||||
|
||||
dist_example_DATA+= examples/seal/seal.c
|
||||
dist_example_DATA+= examples/seal/unseal.c
|
||||
|
||||
DISTCLEANFILES+= examples/seal/.libs/seal
|
||||
DISTCLEANFILES+= examples/seal/.libs/unseal
|
||||
|
|
@ -0,0 +1,182 @@
|
|||
/* seal.c
|
||||
*
|
||||
* Copyright (C) 2006-2021 wolfSSL Inc.
|
||||
*
|
||||
* This file is part of wolfTPM.
|
||||
*
|
||||
* wolfTPM is free software; you can redistribute it and/or modify
|
||||
* it under the terms of the GNU General Public License as published by
|
||||
* the Free Software Foundation; either version 2 of the License, or
|
||||
* (at your option) any later version.
|
||||
*
|
||||
* wolfTPM is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA
|
||||
*/
|
||||
|
||||
/* Example for TPM 2.0 sealing a user secret using TPM key */
|
||||
|
||||
#include <wolftpm/tpm2_wrap.h>
|
||||
|
||||
#include <examples/seal/seal.h>
|
||||
#include <examples/tpm_io.h>
|
||||
#include <examples/tpm_test.h>
|
||||
#include <examples/tpm_test_keys.h>
|
||||
|
||||
#ifndef WOLFTPM2_NO_WRAPPER
|
||||
|
||||
/******************************************************************************/
|
||||
/* --- BEGIN TPM2.0 Seal Example -- */
|
||||
/******************************************************************************/
|
||||
static void usage(void)
|
||||
{
|
||||
printf("Expected usage:\n");
|
||||
printf("./examples/seal/seal [filename] [userdata]\n");
|
||||
printf("* filename: Name of the file where the TPM key will be stored\n");
|
||||
printf("* userdata: Arbitrary data to seal inside the TPM key (no whitespaces)\n");
|
||||
printf("Demo usage, without parameters, uses keyblob.bin as a filename\n");
|
||||
}
|
||||
|
||||
int TPM2_Seal_Example(void* userCtx, int argc, char *argv[])
|
||||
{
|
||||
int rc;
|
||||
WOLFTPM2_DEV dev;
|
||||
WOLFTPM2_KEY storage; /* SRK */
|
||||
WOLFTPM2_KEYBLOB newKey;
|
||||
TPMT_PUBLIC publicTemplate;
|
||||
TPM_ALG_ID paramEncAlg = TPM_ALG_NULL;
|
||||
WOLFTPM2_SESSION tpmSession;
|
||||
TPM2B_AUTH auth;
|
||||
const char* outputFile = "keyblob.bin";
|
||||
char defaultData[] = "My1Pass2Phrase3";
|
||||
char *userData = defaultData;
|
||||
|
||||
if (argc >= 2) {
|
||||
if (XSTRNCMP(argv[1], "-?", 2) == 0 ||
|
||||
XSTRNCMP(argv[1], "-h", 2) == 0 ||
|
||||
XSTRNCMP(argv[1], "--help", 6) == 0) {
|
||||
usage();
|
||||
return 0;
|
||||
}
|
||||
if (argv[1][0] != '-') {
|
||||
outputFile = argv[1];
|
||||
}
|
||||
}
|
||||
if (argc >= 3) {
|
||||
if (argv[2][0] != '-') {
|
||||
userData = argv[2];
|
||||
}
|
||||
}
|
||||
while (argc > 1) {
|
||||
if (XSTRNCMP(argv[argc-1], "-aes", 4) == 0) {
|
||||
paramEncAlg = TPM_ALG_CFB;
|
||||
}
|
||||
if (XSTRNCMP(argv[argc-1], "-xor", 4) == 0) {
|
||||
paramEncAlg = TPM_ALG_XOR;
|
||||
}
|
||||
argc--;
|
||||
}
|
||||
|
||||
XMEMSET(&storage, 0, sizeof(storage));
|
||||
XMEMSET(&newKey, 0, sizeof(newKey));
|
||||
XMEMSET(&tpmSession, 0, sizeof(tpmSession));
|
||||
XMEMSET(&auth, 0, sizeof(auth));
|
||||
|
||||
printf("TPM2.0 Simple Seal example\n");
|
||||
printf("\tKey Blob: %s\n", outputFile);
|
||||
printf("\tUse Parameter Encryption: %s\n", TPM2_GetAlgName(paramEncAlg));
|
||||
|
||||
rc = wolfTPM2_Init(&dev, TPM2_IoCb, userCtx);
|
||||
if (rc != TPM_RC_SUCCESS) {
|
||||
printf("\nwolfTPM2_Init failed\n");
|
||||
goto exit;
|
||||
}
|
||||
|
||||
/* get SRK */
|
||||
rc = getPrimaryStoragekey(&dev, &storage, TPM_ALG_RSA);
|
||||
if (rc != 0) goto exit;
|
||||
|
||||
if (paramEncAlg != TPM_ALG_NULL) {
|
||||
/* Start an authenticated session (salted / unbound) with parameter encryption */
|
||||
rc = wolfTPM2_StartSession(&dev, &tpmSession, &storage, NULL,
|
||||
TPM_SE_HMAC, paramEncAlg);
|
||||
if (rc != 0) goto exit;
|
||||
printf("TPM2_StartAuthSession: sessionHandle 0x%x\n",
|
||||
(word32)tpmSession.handle.hndl);
|
||||
|
||||
/* set session for authorization of the storage key */
|
||||
rc = wolfTPM2_SetAuthSession(&dev, 1, &tpmSession,
|
||||
(TPMA_SESSION_decrypt | TPMA_SESSION_encrypt | TPMA_SESSION_continueSession));
|
||||
if (rc != 0) goto exit;
|
||||
|
||||
}
|
||||
|
||||
wolfTPM2_GetKeyTemplate_KeySeal(&publicTemplate);
|
||||
|
||||
/* set session for authorization key */
|
||||
auth.size = (int)sizeof(gKeyAuth)-1;
|
||||
XMEMCPY(auth.buffer, gKeyAuth, auth.size);
|
||||
|
||||
printf("Sealing the user secret into a new TPM key\n");
|
||||
rc = wolfTPM2_CreateKeySeal(&dev, &newKey, &storage.handle,
|
||||
&publicTemplate, auth.buffer, auth.size,
|
||||
(BYTE*)userData, (int)strlen(userData));
|
||||
if (rc != TPM_RC_SUCCESS) {
|
||||
printf("wolfTPM2_CreateKey failed\n");
|
||||
goto exit;
|
||||
}
|
||||
printf("Created new TPM seal key (pub %d, priv %d bytes)\n",
|
||||
newKey.pub.size, newKey.priv.size);
|
||||
|
||||
/* Save key as encrypted blob to the disk */
|
||||
#if !defined(WOLFTPM2_NO_WOLFCRYPT) && !defined(NO_FILESYSTEM)
|
||||
rc = writeKeyBlob(outputFile, &newKey);
|
||||
#endif
|
||||
//#else
|
||||
printf("Key Public Blob %d\n", newKey.pub.size);
|
||||
TPM2_PrintBin((const byte*)&newKey.pub.publicArea, newKey.pub.size);
|
||||
printf("Key Private Blob %d\n", newKey.priv.size);
|
||||
TPM2_PrintBin(newKey.priv.buffer, newKey.priv.size);
|
||||
//#endif
|
||||
|
||||
exit:
|
||||
|
||||
if (rc != 0) {
|
||||
printf("\nFailure 0x%x: %s\n\n", rc, wolfTPM2_GetRCString(rc));
|
||||
}
|
||||
|
||||
/* Close handles */
|
||||
wolfTPM2_UnloadHandle(&dev, &storage.handle);
|
||||
wolfTPM2_UnloadHandle(&dev, &newKey.handle);
|
||||
wolfTPM2_UnloadHandle(&dev, &tpmSession.handle);
|
||||
|
||||
wolfTPM2_Cleanup(&dev);
|
||||
return rc;
|
||||
}
|
||||
|
||||
/******************************************************************************/
|
||||
/* --- END TPM2.0 Seal Example -- */
|
||||
/******************************************************************************/
|
||||
#endif /* !WOLFTPM2_NO_WRAPPER */
|
||||
|
||||
#ifndef NO_MAIN_DRIVER
|
||||
int main(int argc, char *argv[])
|
||||
{
|
||||
int rc = NOT_COMPILED_IN;
|
||||
|
||||
#ifndef WOLFTPM2_NO_WRAPPER
|
||||
rc = TPM2_Seal_Example(NULL, argc, argv);
|
||||
#else
|
||||
printf("KeyGen code not compiled in\n");
|
||||
(void)argc;
|
||||
(void)argv;
|
||||
#endif
|
||||
|
||||
return rc;
|
||||
}
|
||||
#endif
|
||||
|
|
@ -0,0 +1,36 @@
|
|||
/* seal.h
|
||||
*
|
||||
* Copyright (C) 2006-2021 wolfSSL Inc.
|
||||
*
|
||||
* This file is part of wolfTPM.
|
||||
*
|
||||
* wolfTPM is free software; you can redistribute it and/or modify
|
||||
* it under the terms of the GNU General Public License as published by
|
||||
* the Free Software Foundation; either version 2 of the License, or
|
||||
* (at your option) any later version.
|
||||
*
|
||||
* wolfTPM is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA
|
||||
*/
|
||||
|
||||
#ifndef _SEAL_H_
|
||||
#define _SEAL_H_
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
#endif
|
||||
|
||||
int TPM2_Seal_Example(void* userCtx, int argc, char *argv[]);
|
||||
int TPM2_Unseal_Example(void* userCtx, int argc, char *argv[]);
|
||||
|
||||
#ifdef __cplusplus
|
||||
} /* extern "C" */
|
||||
#endif
|
||||
|
||||
#endif /* _SEAL_H_ */
|
||||
|
|
@ -0,0 +1,152 @@
|
|||
/* unseal.c
|
||||
*
|
||||
* Copyright (C) 2006-2021 wolfSSL Inc.
|
||||
*
|
||||
* This file is part of wolfTPM.
|
||||
*
|
||||
* wolfTPM is free software; you can redistribute it and/or modify
|
||||
* it under the terms of the GNU General Public License as published by
|
||||
* the Free Software Foundation; either version 2 of the License, or
|
||||
* (at your option) any later version.
|
||||
*
|
||||
* wolfTPM is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA
|
||||
*/
|
||||
|
||||
/* This example demonstrates how to extract the data from a TPM seal object */
|
||||
|
||||
#include <wolftpm/tpm2_wrap.h>
|
||||
|
||||
#if !defined(WOLFTPM2_NO_WRAPPER) && !defined(NO_FILESYSTEM)
|
||||
|
||||
#include <examples/seal/seal.h>
|
||||
#include <examples/tpm_io.h>
|
||||
#include <examples/tpm_test.h>
|
||||
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h> /* atoi */
|
||||
|
||||
|
||||
/******************************************************************************/
|
||||
/* --- BEGIN TPM2.0 Unseal example --- */
|
||||
/******************************************************************************/
|
||||
|
||||
static void usage(void)
|
||||
{
|
||||
printf("Expected usage:\n");
|
||||
printf("./examples/seal/unseal [filename]\n");
|
||||
printf("* filename - File containg a TPM seal key\n");
|
||||
printf("Demo usage, without arguments, uses keyblob.bin file input.\n");
|
||||
}
|
||||
|
||||
int TPM2_Unseal_Example(void* userCtx, int argc, char *argv[])
|
||||
{
|
||||
int rc;
|
||||
WOLFTPM2_DEV dev;
|
||||
WOLFTPM2_KEY key;
|
||||
TPM2B_AUTH auth;
|
||||
const char *filename = "unseal.bin";
|
||||
XFILE fp = NULL;
|
||||
size_t len;
|
||||
Unseal_In cmdIn_unseal;
|
||||
Unseal_Out cmdOut_unseal;
|
||||
|
||||
XMEMSET(&cmdIn_unseal, 0, sizeof(cmdIn_unseal));
|
||||
XMEMSET(&cmdOut_unseal, 0, sizeof(cmdOut_unseal));
|
||||
XMEMSET(&key, 0, sizeof(key));
|
||||
XMEMSET(&auth, 0, sizeof(auth));
|
||||
|
||||
if (argc >= 2) {
|
||||
if (XSTRNCMP(argv[1], "-?", 2) == 0 ||
|
||||
XSTRNCMP(argv[1], "-h", 2) == 0 ||
|
||||
XSTRNCMP(argv[1], "--help", 6) == 0) {
|
||||
usage();
|
||||
return 0;
|
||||
}
|
||||
|
||||
if (argv[1][0] != '-') {
|
||||
filename = argv[1];
|
||||
}
|
||||
}
|
||||
|
||||
printf("Example how to unseal data using TPM2.0\n");
|
||||
rc = wolfTPM2_Init(&dev, TPM2_IoCb, userCtx);
|
||||
if (rc != TPM_RC_SUCCESS) {
|
||||
printf("wolfTPM2_Init failed 0x%x: %s\n", rc, TPM2_GetRCString(rc));
|
||||
goto exit;
|
||||
}
|
||||
printf("wolfTPM2_Init: success\n");
|
||||
|
||||
/* Set authorization for using the seal key */
|
||||
auth.size = (int)sizeof(gKeyAuth)-1;
|
||||
XMEMCPY(auth.buffer, gKeyAuth, auth.size);
|
||||
wolfTPM2_SetAuthPassword(&dev, 0, &auth);
|
||||
|
||||
cmdIn_unseal.itemHandle = TPM2_DEMO_PERSISTENT_KEY_HANDLE;
|
||||
rc = TPM2_Unseal(&cmdIn_unseal, &cmdOut_unseal);
|
||||
if (rc != TPM_RC_SUCCESS) {
|
||||
printf("TPM2_Unseal failed 0x%x: %s\n", rc, TPM2_GetRCString(rc));
|
||||
goto exit;
|
||||
}
|
||||
printf("Unsealing succeeded\n");
|
||||
|
||||
#ifdef DEBUG_WOLFTPM
|
||||
printf("Unsealed data:\n");
|
||||
TPM2_PrintBin(cmdOut_unseal.outData.buffer, cmdOut_unseal.outData.size);
|
||||
#endif
|
||||
|
||||
#if !defined(NO_FILESYSTEM)
|
||||
/* Output the unsealed data to a file */
|
||||
if (filename) {
|
||||
fp = XFOPEN(filename, "wb");
|
||||
if (fp) {
|
||||
len = XFWRITE(cmdOut_unseal.outData.buffer, 1, cmdOut_unseal.outData.size, fp);
|
||||
if (len != cmdOut_unseal.outData.size) {
|
||||
printf("Error while writing the unsealed data to a file.\n");
|
||||
goto exit;
|
||||
}
|
||||
}
|
||||
printf("Stored unsealed data to file = %s\n", filename);
|
||||
XFCLOSE(fp);
|
||||
}
|
||||
#endif
|
||||
|
||||
/* Remove the loaded TPM seal object */
|
||||
wolfTPM2_SetAuthPassword(&dev, 0, NULL);
|
||||
key.handle.hndl = TPM2_DEMO_PERSISTENT_KEY_HANDLE;
|
||||
wolfTPM2_NVDeleteKey(&dev, TPM_RH_OWNER, &key);
|
||||
|
||||
exit:
|
||||
|
||||
wolfTPM2_Cleanup(&dev);
|
||||
return rc;
|
||||
}
|
||||
|
||||
/******************************************************************************/
|
||||
/* --- END TPM2.0 Unseal example --- */
|
||||
/******************************************************************************/
|
||||
|
||||
#endif /* !WOLFTPM2_NO_WRAPPER */
|
||||
|
||||
#ifndef NO_MAIN_DRIVER
|
||||
int main(int argc, char *argv[])
|
||||
{
|
||||
int rc = -1;
|
||||
|
||||
#ifndef WOLFTPM2_NO_WRAPPER
|
||||
rc = TPM2_Unseal_Example(NULL, argc, argv);
|
||||
#else
|
||||
printf("Wrapper code not compiled in\n");
|
||||
(void)argc;
|
||||
(void)argv;
|
||||
#endif /* !WOLFTPM2_NO_WRAPPER */
|
||||
|
||||
return rc;
|
||||
}
|
||||
#endif
|
||||
|
|
@ -32,6 +32,7 @@
|
|||
/* Test Configuration */
|
||||
#define TPM2_DEMO_STORAGE_KEY_HANDLE 0x81000200 /* Persistent Storage Key Handle (RSA) */
|
||||
#define TPM2_DEMO_STORAGE_EC_KEY_HANDLE 0x81000201 /* Persistent Storage Key Handle (ECC) */
|
||||
#define TPM2_DEMO_PERSISTENT_KEY_HANDLE 0x81000202 /* Persistent Key Handle for common use */
|
||||
#define TPM2_DEMO_RSA_IDX 0x20 /* offset handle to unused index */
|
||||
#define TPM2_DEMO_RSA_KEY_HANDLE (0x81000000 + TPM2_DEMO_RSA_IDX) /* Persistent Key Handle */
|
||||
#define TPM2_DEMO_RSA_CERT_HANDLE (0x01800000 + TPM2_DEMO_RSA_IDX) /* NV Handle */
|
||||
|
|
|
|||
Loading…
Reference in New Issue