mirror of https://github.com/wolfSSL/wolfTPM.git
Add example of generating a TPM2.0 Quote using wolfTPM
Signed-off-by: Dimitar Tomov <dimi@designfirst.ee>pull/107/head
Dimitar Tomov
parent
ee3dc75d3e
commit
c4339fbb5a
|
|
@ -34,6 +34,7 @@ examples/csr/csr
|
||||||
examples/tls/tls_client
|
examples/tls/tls_client
|
||||||
examples/pkcs7/pkcs7
|
examples/pkcs7/pkcs7
|
||||||
examples/timestamp/signed_timestamp
|
examples/timestamp/signed_timestamp
|
||||||
|
examples/timestamp/pcr
|
||||||
pkcs7tpmsigned.p7s
|
pkcs7tpmsigned.p7s
|
||||||
pkcs7tpmsignedex.p7s
|
pkcs7tpmsignedex.p7s
|
||||||
examples/tls/tls_server
|
examples/tls/tls_server
|
||||||
|
|
|
||||||
|
|
@ -20,7 +20,9 @@ Demonstrates calling the wolfTPM2_* wrapper API's.
|
||||||
`./examples/wrap/wrap_test`
|
`./examples/wrap/wrap_test`
|
||||||
|
|
||||||
|
|
||||||
## Attestation Use Case (TPM signed timestamp)
|
## Attestation Use Cases
|
||||||
|
|
||||||
|
# TPM signed timestamp, TPM2.0 GetTime
|
||||||
|
|
||||||
Demonstrates creation of Attestation Identity Keys(AIK) and the generation of TPM signed timestamp that can be later used as protected report of the current system uptime.
|
Demonstrates creation of Attestation Identity Keys(AIK) and the generation of TPM signed timestamp that can be later used as protected report of the current system uptime.
|
||||||
|
|
||||||
|
|
@ -28,6 +30,11 @@ This example demonstrates the use of authSession(authorization Session) and poli
|
||||||
|
|
||||||
`./examples/timestamp/signed_timestamp`
|
`./examples/timestamp/signed_timestamp`
|
||||||
|
|
||||||
|
# TPM signed PCR(system) measurement, TPM2.0 Quote
|
||||||
|
|
||||||
|
Demonstrates the generation of TPM2.0 Quote used for attestation of the system state by putting PCR value(s) in a TPM signed structure.
|
||||||
|
|
||||||
|
`./examples/pcr/quote`
|
||||||
|
|
||||||
## CSR
|
## CSR
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -8,6 +8,7 @@ include examples/tls/include.am
|
||||||
include examples/csr/include.am
|
include examples/csr/include.am
|
||||||
include examples/pkcs7/include.am
|
include examples/pkcs7/include.am
|
||||||
include examples/timestamp/include.am
|
include examples/timestamp/include.am
|
||||||
|
include examples/pcr/include.am
|
||||||
|
|
||||||
dist_example_DATA+= examples/README.md \
|
dist_example_DATA+= examples/README.md \
|
||||||
examples/tpm_io.c \
|
examples/tpm_io.c \
|
||||||
|
|
|
||||||
|
|
@ -0,0 +1,14 @@
|
||||||
|
# vim:ft=automake
|
||||||
|
# All paths should be given relative to the root
|
||||||
|
|
||||||
|
if BUILD_EXAMPLES
|
||||||
|
noinst_PROGRAMS += examples/pcr/quote
|
||||||
|
noinst_HEADERS += examples/pcr/quote.h
|
||||||
|
examples_pcr_quote_SOURCES = examples/pcr/quote.c \
|
||||||
|
examples/tpm_io.c
|
||||||
|
examples_pcr_quote_LDADD = src/libwolftpm.la $(LIB_STATIC_ADD)
|
||||||
|
examples_pcr_quote_DEPENDENCIES = src/libwolftpm.la
|
||||||
|
endif
|
||||||
|
|
||||||
|
dist_example_DATA+= examples/pcr/quote.c
|
||||||
|
DISTCLEANFILES+= examples/pcr/.libs/quote
|
||||||
|
|
@ -0,0 +1,236 @@
|
||||||
|
/* quote.c
|
||||||
|
*
|
||||||
|
* Copyright (C) 2006-2020 wolfSSL Inc.
|
||||||
|
*
|
||||||
|
* This file is part of wolfTPM.
|
||||||
|
*
|
||||||
|
* wolfTPM is free software; you can redistribute it and/or modify
|
||||||
|
* it under the terms of the GNU General Public License as published by
|
||||||
|
* the Free Software Foundation; either version 2 of the License, or
|
||||||
|
* (at your option) any later version.
|
||||||
|
*
|
||||||
|
* wolfTPM is distributed in the hope that it will be useful,
|
||||||
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||||
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||||
|
* GNU General Public License for more details.
|
||||||
|
*
|
||||||
|
* You should have received a copy of the GNU General Public License
|
||||||
|
* along with this program; if not, write to the Free Software
|
||||||
|
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA
|
||||||
|
*/
|
||||||
|
|
||||||
|
/* This example shows how to generate a TPM2.0 Quote that holds a signed
|
||||||
|
* PCR measurement. PCR values are used as basis for system integrity.
|
||||||
|
*/
|
||||||
|
|
||||||
|
#include <wolftpm/tpm2_wrap.h>
|
||||||
|
|
||||||
|
#include <examples/pcr/quote.h>
|
||||||
|
#include <examples/tpm_io.h>
|
||||||
|
#include <examples/tpm_test.h>
|
||||||
|
|
||||||
|
#include <stdio.h>
|
||||||
|
|
||||||
|
|
||||||
|
#define SET_PCR_SELECT_BIT( pcrSelection, pcr ) \
|
||||||
|
(pcrSelection).pcrSelect[( (pcr)/8 )] |= ( 1 << ( (pcr) % 8) );
|
||||||
|
|
||||||
|
/******************************************************************************/
|
||||||
|
/* --- BEGIN TPM2.0 Quote Test -- */
|
||||||
|
/******************************************************************************/
|
||||||
|
|
||||||
|
int TPM2_Quote_Test(void* userCtx)
|
||||||
|
{
|
||||||
|
int rc;
|
||||||
|
/* UINT32 i; */
|
||||||
|
WOLFTPM2_DEV dev;
|
||||||
|
TPMS_ATTEST attestedData;
|
||||||
|
|
||||||
|
union {
|
||||||
|
Quote_In quoteAsk;
|
||||||
|
/* For managing TPM session */
|
||||||
|
StartAuthSession_In authSes;
|
||||||
|
PolicySecret_In policySecret;
|
||||||
|
/* For removing keys after use */
|
||||||
|
FlushContext_In flushCtx;
|
||||||
|
byte maxInput[MAX_COMMAND_SIZE];
|
||||||
|
} cmdIn;
|
||||||
|
union {
|
||||||
|
Quote_Out quoteResult;
|
||||||
|
/* Output from session operations */
|
||||||
|
StartAuthSession_Out authSes;
|
||||||
|
PolicySecret_Out policySecret;
|
||||||
|
byte maxOutput[MAX_RESPONSE_SIZE];
|
||||||
|
} cmdOut;
|
||||||
|
|
||||||
|
TPM_HANDLE sessionHandle = TPM_RH_NULL;
|
||||||
|
|
||||||
|
WOLFTPM2_KEY endorse; /* EK */
|
||||||
|
WOLFTPM2_KEY storage; /* SRK */
|
||||||
|
WOLFTPM2_KEY rsaKey; /* AIK */
|
||||||
|
|
||||||
|
const byte storagePwd[] = "WolfTPMpassword";
|
||||||
|
const byte usageAuth[] = "ThisIsASecretUsageAuth";
|
||||||
|
|
||||||
|
TPMS_AUTH_COMMAND session[MAX_SESSION_NUM];
|
||||||
|
|
||||||
|
XMEMSET(&endorse, 0, sizeof(endorse));
|
||||||
|
XMEMSET(&storage, 0, sizeof(storage));
|
||||||
|
XMEMSET(&rsaKey, 0, sizeof(rsaKey));
|
||||||
|
|
||||||
|
printf("Demo of generating signed PCR measurement (TPM2.0 Quote)\n");
|
||||||
|
rc = wolfTPM2_Init(&dev, TPM2_IoCb, userCtx);
|
||||||
|
if (rc != TPM_RC_SUCCESS) {
|
||||||
|
printf("wolfTPM2_Init failed 0x%x: %s\n", rc, TPM2_GetRCString(rc));
|
||||||
|
goto exit;
|
||||||
|
}
|
||||||
|
printf("wolfTPM2_Init: success\n");
|
||||||
|
|
||||||
|
|
||||||
|
/* Define the default session auth that has NULL password */
|
||||||
|
XMEMSET(session, 0, sizeof(session));
|
||||||
|
session[0].sessionHandle = TPM_RS_PW;
|
||||||
|
session[0].auth.size = 0; /* NULL Password */
|
||||||
|
TPM2_SetSessionAuth(session);
|
||||||
|
|
||||||
|
|
||||||
|
/* Create Endorsement Key, also called EK */
|
||||||
|
rc = wolfTPM2_CreateEK(&dev, &endorse, TPM_ALG_RSA);
|
||||||
|
if (rc != TPM_RC_SUCCESS) {
|
||||||
|
printf("wolfTPM2_CreateEK: Endorsement failed 0x%x: %s\n",
|
||||||
|
rc, TPM2_GetRCString(rc));
|
||||||
|
goto exit;
|
||||||
|
}
|
||||||
|
printf("wolfTPM2_CreateEK: Endorsement 0x%x (%d bytes)\n",
|
||||||
|
(word32)endorse.handle.hndl, endorse.pub.size);
|
||||||
|
|
||||||
|
|
||||||
|
/* Create Storage Key, also called SRK */
|
||||||
|
rc = wolfTPM2_CreateSRK(&dev, &storage, TPM_ALG_RSA, storagePwd,
|
||||||
|
sizeof(storagePwd)-1);
|
||||||
|
if (rc != TPM_RC_SUCCESS) {
|
||||||
|
printf("wolfTPM2_CreateSRK: Storage failed 0x%x: %s\n", rc,
|
||||||
|
TPM2_GetRCString(rc));
|
||||||
|
goto exit;
|
||||||
|
}
|
||||||
|
printf("wolfTPM2_CreateSRK: Storage 0x%x (%d bytes)\n",
|
||||||
|
(word32)storage.handle.hndl, storage.pub.size);
|
||||||
|
|
||||||
|
|
||||||
|
/* Start Auth Session */
|
||||||
|
XMEMSET(&cmdIn.authSes, 0, sizeof(cmdIn.authSes));
|
||||||
|
cmdIn.authSes.sessionType = TPM_SE_POLICY;
|
||||||
|
cmdIn.authSes.tpmKey = TPM_RH_NULL;
|
||||||
|
cmdIn.authSes.bind = TPM_RH_NULL;
|
||||||
|
cmdIn.authSes.symmetric.algorithm = TPM_ALG_NULL;
|
||||||
|
cmdIn.authSes.authHash = TPM_ALG_SHA256;
|
||||||
|
cmdIn.authSes.nonceCaller.size = TPM_SHA256_DIGEST_SIZE;
|
||||||
|
rc = TPM2_GetNonce(cmdIn.authSes.nonceCaller.buffer,
|
||||||
|
cmdIn.authSes.nonceCaller.size);
|
||||||
|
if (rc < 0) {
|
||||||
|
printf("TPM2_GetNonce failed 0x%x: %s\n", rc,
|
||||||
|
TPM2_GetRCString(rc));
|
||||||
|
goto exit;
|
||||||
|
}
|
||||||
|
rc = TPM2_StartAuthSession(&cmdIn.authSes, &cmdOut.authSes);
|
||||||
|
if (rc != TPM_RC_SUCCESS) {
|
||||||
|
printf("TPM2_StartAuthSession failed 0x%x: %s\n", rc,
|
||||||
|
TPM2_GetRCString(rc));
|
||||||
|
goto exit;
|
||||||
|
}
|
||||||
|
sessionHandle = cmdOut.authSes.sessionHandle;
|
||||||
|
printf("TPM2_StartAuthSession: sessionHandle 0x%x\n", (word32)sessionHandle);
|
||||||
|
|
||||||
|
|
||||||
|
/* set session auth for storage key */
|
||||||
|
session[0].auth.size = sizeof(storagePwd)-1;
|
||||||
|
XMEMCPY(session[0].auth.buffer, storagePwd, session[0].auth.size);
|
||||||
|
|
||||||
|
|
||||||
|
/* Create an RSA key for Attestation purposes */
|
||||||
|
rc = wolfTPM2_CreateAndLoadAIK(&dev, &rsaKey, TPM_ALG_RSA, &storage,
|
||||||
|
usageAuth, sizeof(usageAuth)-1);
|
||||||
|
if (rc != TPM_RC_SUCCESS) {
|
||||||
|
printf("wolfTPM2_CreateAndLoadAIK failed 0x%x: %s\n", rc,
|
||||||
|
TPM2_GetRCString(rc));
|
||||||
|
goto exit;
|
||||||
|
}
|
||||||
|
printf("wolfTPM2_CreateAndLoadAIK: AIK 0x%x (%d bytes)\n",
|
||||||
|
(word32)rsaKey.handle.hndl, rsaKey.pub.size);
|
||||||
|
|
||||||
|
|
||||||
|
/* set auth for using the AIK */
|
||||||
|
session[0].auth.size = sizeof(usageAuth)-1;
|
||||||
|
XMEMCPY(session[0].auth.buffer, usageAuth, session[0].auth.size);
|
||||||
|
|
||||||
|
/* Prepare Quote request */
|
||||||
|
XMEMSET(&cmdIn.quoteAsk, 0, sizeof(cmdIn.quoteAsk));
|
||||||
|
XMEMSET(&cmdOut.quoteResult, 0, sizeof(cmdOut.quoteResult));
|
||||||
|
cmdIn.quoteAsk.signHandle = rsaKey.handle.hndl;
|
||||||
|
cmdIn.quoteAsk.inScheme.scheme = TPM_ALG_RSASSA;
|
||||||
|
cmdIn.quoteAsk.inScheme.details.rsassa.hashAlg = TPM_ALG_SHA256;
|
||||||
|
cmdIn.quoteAsk.qualifyingData.size = 0; /* optional */
|
||||||
|
/* Set the PCR for signing */
|
||||||
|
cmdIn.quoteAsk.PCRselect.count = 1;
|
||||||
|
cmdIn.quoteAsk.PCRselect.pcrSelections[0].hash = TPM_ALG_SHA256;
|
||||||
|
cmdIn.quoteAsk.PCRselect.pcrSelections[0].sizeofSelect = 3;
|
||||||
|
/* PCR16 is for DEBUG purposes, therefore safe to use for a demo */
|
||||||
|
SET_PCR_SELECT_BIT(cmdIn.quoteAsk.PCRselect.pcrSelections[0], 16);
|
||||||
|
|
||||||
|
|
||||||
|
/* Get PCR measurement signed by the TPM using the AIK key */
|
||||||
|
rc = TPM2_Quote(&cmdIn.quoteAsk, &cmdOut.quoteResult);
|
||||||
|
if (rc != TPM_RC_SUCCESS) {
|
||||||
|
printf("TPM2_Quote failed 0x%x: %s\n", rc,
|
||||||
|
TPM2_GetRCString(rc));
|
||||||
|
goto exit;
|
||||||
|
}
|
||||||
|
printf("TPM2_Quote: success\n");
|
||||||
|
|
||||||
|
rc = TPM2_ParseAttest(&cmdOut.quoteResult.quoted, &attestedData);
|
||||||
|
if (rc != TPM_RC_SUCCESS) {
|
||||||
|
printf("TPM2_Packet_ParseAttest failed 0x%x: %s\n", rc,
|
||||||
|
TPM2_GetRCString(rc));
|
||||||
|
goto exit;
|
||||||
|
}
|
||||||
|
if (attestedData.magic != TPM_GENERATED_VALUE) {
|
||||||
|
printf("\tError, attested data not generated by the TPM = 0x%X\n",
|
||||||
|
attestedData.magic);
|
||||||
|
}
|
||||||
|
|
||||||
|
printf("TPM with signature attests (type 0x%x):\n", attestedData.type);
|
||||||
|
printf("\tTPM signed %lu PCR\n",
|
||||||
|
(unsigned long)attestedData.attested.quote.pcrSelect.count);
|
||||||
|
|
||||||
|
exit:
|
||||||
|
|
||||||
|
/* Close session */
|
||||||
|
if (sessionHandle != TPM_RH_NULL) {
|
||||||
|
cmdIn.flushCtx.flushHandle = sessionHandle;
|
||||||
|
TPM2_FlushContext(&cmdIn.flushCtx);
|
||||||
|
}
|
||||||
|
|
||||||
|
/* Close key handles */
|
||||||
|
wolfTPM2_UnloadHandle(&dev, &rsaKey.handle);
|
||||||
|
wolfTPM2_UnloadHandle(&dev, &storage.handle);
|
||||||
|
wolfTPM2_UnloadHandle(&dev, &endorse.handle);
|
||||||
|
|
||||||
|
wolfTPM2_Cleanup(&dev);
|
||||||
|
return rc;
|
||||||
|
}
|
||||||
|
|
||||||
|
/******************************************************************************/
|
||||||
|
/* --- END TPM2.0 Quote Test -- */
|
||||||
|
/******************************************************************************/
|
||||||
|
|
||||||
|
|
||||||
|
#ifndef NO_MAIN_DRIVER
|
||||||
|
int main(void)
|
||||||
|
{
|
||||||
|
int rc;
|
||||||
|
|
||||||
|
rc = TPM2_Quote_Test(NULL);
|
||||||
|
|
||||||
|
return rc;
|
||||||
|
}
|
||||||
|
#endif
|
||||||
|
|
@ -0,0 +1,35 @@
|
||||||
|
/* quote.h
|
||||||
|
*
|
||||||
|
* Copyright (C) 2006-2020 wolfSSL Inc.
|
||||||
|
*
|
||||||
|
* This file is part of wolfTPM.
|
||||||
|
*
|
||||||
|
* wolfTPM is free software; you can redistribute it and/or modify
|
||||||
|
* it under the terms of the GNU General Public License as published by
|
||||||
|
* the Free Software Foundation; either version 2 of the License, or
|
||||||
|
* (at your option) any later version.
|
||||||
|
*
|
||||||
|
* wolfTPM is distributed in the hope that it will be useful,
|
||||||
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||||
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||||
|
* GNU General Public License for more details.
|
||||||
|
*
|
||||||
|
* You should have received a copy of the GNU General Public License
|
||||||
|
* along with this program; if not, write to the Free Software
|
||||||
|
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA
|
||||||
|
*/
|
||||||
|
|
||||||
|
#ifndef _QUOTE_H_
|
||||||
|
#define _QUOTE_H_
|
||||||
|
|
||||||
|
#ifdef __cplusplus
|
||||||
|
extern "C" {
|
||||||
|
#endif
|
||||||
|
|
||||||
|
int TPM2_Quote_Test(void* userCtx);
|
||||||
|
|
||||||
|
#ifdef __cplusplus
|
||||||
|
} /* extern "C" */
|
||||||
|
#endif
|
||||||
|
|
||||||
|
#endif /* _quote_H_ */
|
||||||
Loading…
Reference in New Issue