WolfSSL
/
wolfTPM
mirror of https://github.com/wolfSSL/wolfTPM.git
1
0
Fork 0
Code Issues Releases Wiki Activity

Added TPM2 wrappers for symmetric AES encrypt and decrypt. Moved common test parameters into examples/tpm_test.h.

pull/53/head
David Garske 2018-12-28 12:15:58 -08:00
parent 6132965a55
commit d28e63c72f
12 changed files with 220 additions and 40 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
examples/bench/bench.c
View File

@ -28,6 +28,7 @@
#ifndef WOLFTPM2_NO_WRAPPER
#include <examples/tpm_io.h>
#include <examples/tpm_test.h>
#include <examples/bench/bench.h>
/* Configuration */

1
examples/csr/csr.c
View File

@ -27,6 +27,7 @@
defined(WOLF_CRYPTO_DEV) && !defined(WOLFTPM2_NO_WOLFCRYPT)
#include <examples/tpm_io.h>
#include <examples/tpm_test.h>
#include <examples/csr/csr.h>
#include <wolfssl/wolfcrypt/asn_public.h>

13
examples/native/native_test.c
View File

@ -25,7 +25,7 @@
#include <examples/native/native_test.h>
#include <examples/tpm_io.h>
#include <examples/tpm_test.h>
/******************************************************************************/
/* --- BEGIN TPM Native API Tests -- */
@ -50,23 +50,12 @@ typedef struct tmpHandle {
TPM2B_AUTH auth;
} TpmHandle;
#ifndef WOLFTPM_ST33
#define TEST_AES_MODE TPM_ALG_CFB
#else
#define TEST_AES_MODE TPM_ALG_CBC
#endif
int TPM2_Native_Test(void* userCtx)
{
int rc;
TPM2_CTX tpm2Ctx;
const BYTE TPM_20_EK_AUTH_POLICY[] = {
0x83, 0x71, 0x97, 0x67, 0x44, 0x84, 0xb3, 0xf8, 0x1a, 0x90, 0xcc,
0x8d, 0x46, 0xa5, 0xd7, 0x24, 0xfd, 0x52, 0xd7, 0x6e, 0x06, 0x52,
0x0b, 0x64, 0xf2, 0xa1, 0xda, 0x1b, 0x33, 0x14, 0x69, 0xaa,
};
union {
Startup_In startup;
Shutdown_In shutdown;

1
examples/pkcs7/pkcs7.c
View File

@ -27,6 +27,7 @@
defined(WOLF_CRYPTO_DEV)
#include <examples/tpm_io.h>
#include <examples/tpm_test.h>
#include <examples/pkcs7/pkcs7.h>
#include <wolfssl/wolfcrypt/pkcs7.h>

1
examples/tls/tls_client.c
View File

@ -27,6 +27,7 @@
!defined(WOLFTPM2_NO_WOLFCRYPT)
#include <examples/tpm_io.h>
#include <examples/tpm_test.h>
#include <examples/tls/tls_client.h>
#include <wolfssl/ssl.h>

1
examples/tls/tls_server.c
View File

@ -27,6 +27,7 @@
!defined(WOLFTPM2_NO_WOLFCRYPT)
#include <examples/tpm_io.h>
#include <examples/tpm_test.h>
#include <examples/tls/tls_server.h>
#include <wolfssl/ssl.h>

15
examples/tpm_io.h
View File

@ -24,21 +24,6 @@
#include <wolftpm/tpm2.h>
/* Configuration */
#define TPM2_DEMO_STORAGE_KEY_HANDLE 0x81000200 /* Persistent Storage Key Handle */
#define TPM2_DEMO_RSA_IDX 0x20 /* offset handle to unused index */
#define TPM2_DEMO_RSA_KEY_HANDLE (0x81000000 + TPM2_DEMO_RSA_IDX) /* Persistent Key Handle */
#define TPM2_DEMO_RSA_CERT_HANDLE (0x01800000 + TPM2_DEMO_RSA_IDX) /* NV Handle */
#define TPM2_DEMO_ECC_IDX 0x21 /* offset handle to unused index */
#define TPM2_DEMO_ECC_KEY_HANDLE (0x81000000 + TPM2_DEMO_ECC_IDX) /* Persistent Key Handle */
#define TPM2_DEMO_ECC_CERT_HANDLE (0x01800000 + TPM2_DEMO_ECC_IDX) /* NV Handle */
static const char gStorageKeyAuth[] = "ThisIsMyStorageKeyAuth";
static const char gKeyAuth[] = "ThisIsMyKeyAuth";
static const char gUsageAuth[] = "ThisIsASecretUsageAuth";
/* TPM2 IO Examples */
#ifdef WOLFTPM_ADV_IO
int TPM2_IoCb(TPM2_CTX*, int isRead, word32 addr, byte* buf, word16 size,

23
examples/tpm_test.h
View File

@ -23,6 +23,29 @@
#ifndef _TPM_TEST_H_
#define _TPM_TEST_H_
/* Test Configuration */
#define TPM2_DEMO_STORAGE_KEY_HANDLE 0x81000200 /* Persistent Storage Key Handle */
#define TPM2_DEMO_RSA_IDX 0x20 /* offset handle to unused index */
#define TPM2_DEMO_RSA_KEY_HANDLE (0x81000000 + TPM2_DEMO_RSA_IDX) /* Persistent Key Handle */
#define TPM2_DEMO_RSA_CERT_HANDLE (0x01800000 + TPM2_DEMO_RSA_IDX) /* NV Handle */
#define TPM2_DEMO_ECC_IDX 0x21 /* offset handle to unused index */
#define TPM2_DEMO_ECC_KEY_HANDLE (0x81000000 + TPM2_DEMO_ECC_IDX) /* Persistent Key Handle */
#define TPM2_DEMO_ECC_CERT_HANDLE (0x01800000 + TPM2_DEMO_ECC_IDX) /* NV Handle */
static const char gStorageKeyAuth[] = "ThisIsMyStorageKeyAuth";
static const char gKeyAuth[] = "ThisIsMyKeyAuth";
static const char gUsageAuth[] = "ThisIsASecretUsageAuth";
#ifndef WOLFTPM_ST33
#define TEST_AES_MODE TPM_ALG_CFB
#else
#define TEST_AES_MODE TPM_ALG_CBC
#endif
/* RAW KEY MATERIAL */
/* from wolfSSL ./certs/client-key.der */

50
examples/wrap/wrap_test.c
View File

@ -27,8 +27,8 @@
#ifndef WOLFTPM2_NO_WRAPPER
#include <examples/tpm_io.h>
#include <examples/wrap/wrap_test.h>
#include <examples/tpm_test.h>
#include <examples/wrap/wrap_test.h>
/* Configuration */
#define TPM2_DEMO_NV_TEST_INDEX 0x01800200
@ -51,7 +51,7 @@ void TPM2_Wrapper_SetReset(int reset)
int TPM2_Wrapper_Test(void* userCtx)
{
int rc;
int rc, i;
WOLFTPM2_DEV dev;
WOLFTPM2_CAPS caps;
WOLFTPM2_KEY ekKey;
@ -59,6 +59,7 @@ int TPM2_Wrapper_Test(void* userCtx)
WOLFTPM2_KEY rsaKey;
WOLFTPM2_KEY eccKey;
WOLFTPM2_KEY publicKey;
WOLFTPM2_KEY aesKey;
WOLFTPM2_BUFFER message;
WOLFTPM2_BUFFER cipher;
WOLFTPM2_BUFFER plain;
@ -70,7 +71,6 @@ int TPM2_Wrapper_Test(void* userCtx)
#endif
WOLFTPM2_HASH hash;
#ifdef ENABLE_LARGE_HASH_TEST
int i;
const char* hashTestDig =
"\x27\x78\x3e\x87\x96\x3a\x4e\xfb\x68\x29\xb5\x31\xc9\xba\x57\xb4"
"\x4f\x45\x79\x7f\x67\x70\xbd\x63\x7f\xbf\x0d\x80\x7c\xbd\xba\xe0";
@ -535,12 +535,56 @@ int TPM2_Wrapper_Test(void* userCtx)
printf("Hash SHA256 test success\n");
/*------------------------------------------------------------------------*/
/* ENCRYPT/DECRYPT TESTS */
/*------------------------------------------------------------------------*/
rc = wolfTPM2_GetKeyTemplate_Symmetric(&publicTemplate, 128, TEST_AES_MODE,
YES, YES);
if (rc != 0) goto exit;
rc = wolfTPM2_CreateAndLoadKey(&dev, &aesKey, &storageKey.handle,
&publicTemplate, (byte*)gUsageAuth, sizeof(gUsageAuth)-1);
if (rc != 0) goto exit;
/* Test data */
message.size = sizeof(message.buffer);
for (i=0; i<message.size; i++) {
message.buffer[i] = (byte)(i & 0xff);
}
XMEMSET(cipher.buffer, 0, sizeof(cipher.buffer));
cipher.size = sizeof(cipher.buffer);
rc = wolfTPM2_EncryptDecrypt(&dev, &aesKey, message.buffer, cipher.buffer,
message.size, NULL, 0, WOLFTPM2_ENCRYPT);
if (rc != 0 && rc != TPM_RC_COMMAND_CODE) goto exit;
XMEMSET(plain.buffer, 0, sizeof(plain.buffer));
plain.size = sizeof(plain.buffer);
rc = wolfTPM2_EncryptDecrypt(&dev, &aesKey, cipher.buffer, plain.buffer,
cipher.size, NULL, 0, WOLFTPM2_DECRYPT);
wolfTPM2_UnloadHandle(&dev, &aesKey.handle);
if (rc == TPM_RC_SUCCESS &&
message.size == plain.size &&
XMEMCMP(message.buffer, plain.buffer, message.size) == 0) {
printf("Encrypt/Decrypt test success\n");
}
else if (rc == TPM_RC_COMMAND_CODE) {
printf("Encrypt/Decrypt: Is not a supported feature due to export controls\n");
rc = TPM_RC_SUCCESS; /* clear error code */
}
else {
printf("Encrypt/Decrypt test failed, result not as expected!\n");
goto exit;
}
exit:
if (rc != 0) {
printf("Failure 0x%x: %s\n", rc, wolfTPM2_GetRCString(rc));
}
wolfTPM2_UnloadHandle(&dev, &aesKey.handle);
wolfTPM2_UnloadHandle(&dev, &publicKey.handle);
wolfTPM2_UnloadHandle(&dev, &rsaKey.handle);
wolfTPM2_UnloadHandle(&dev, &eccKey.handle);

136
src/tpm2_wrap.c
View File

@ -503,7 +503,7 @@ int wolfTPM2_ComputeName(const TPM2B_PUBLIC* pub, TPM2B_NAME* out)
return rc;
hashSz = rc;
/* Encode hash alorithm in first 2 bytes */
/* Encode hash algorithm in first 2 bytes */
nameAlg = TPM2_Packet_SwapU16(nameAlg);
XMEMCPY(&out->name[0], &nameAlg, sizeof(UINT16));
@ -872,7 +872,7 @@ int wolfTPM2_RsaKey_TpmToWolf(WOLFTPM2_DEV* dev, WOLFTPM2_KEY* tpmKey,
XMEMSET(e, 0, sizeof(e));
XMEMSET(n, 0, sizeof(n));
/* load exponenet */
/* load exponent */
exponent = tpmKey->pub.publicArea.parameters.rsaDetail.exponent;
if (exponent == 0)
exponent = RSA_DEFAULT_PUBLIC_EXPONENT;
@ -2055,7 +2055,7 @@ int wolfTPM2_HashUpdate(WOLFTPM2_DEV* dev, WOLFTPM2_HASH* hash,
return BAD_FUNC_ARG;
}
/* set session auth for key */
/* set session auth for hash handle */
dev->session[0].auth = hash->handle.auth;
XMEMSET(&in, 0, sizeof(in));
@ -2098,7 +2098,7 @@ int wolfTPM2_HashFinish(WOLFTPM2_DEV* dev, WOLFTPM2_HASH* hash,
return BAD_FUNC_ARG;
}
/* set session auth for key */
/* set session auth for hash handle */
dev->session[0].auth = hash->handle.auth;
XMEMSET(&in, 0, sizeof(in));
@ -2126,6 +2126,128 @@ int wolfTPM2_HashFinish(WOLFTPM2_DEV* dev, WOLFTPM2_HASH* hash,
return rc;
}
/* EncryptDecrypt */
int wolfTPM2_EncryptDecryptBlock(WOLFTPM2_DEV* dev, WOLFTPM2_KEY* key,
const byte* in, byte* out, word32 inOutSz, const byte* iv, word32 ivSz,
int isDecrypt)
{
int rc;
EncryptDecrypt2_In encDecIn;
EncryptDecrypt2_Out encDecOut;
if (dev == NULL || key == NULL || in == NULL || out == NULL || inOutSz == 0) {
return BAD_FUNC_ARG;
}
/* this function expects block size */
/* use wolfTPM2_Encrypt and wolfTPM2_Decrypt for other sizes */
if (inOutSz > MAX_AES_BLOCK_SIZE_BYTES) {
#ifdef DEBUG_WOLFTPM
printf("wolfTPM2_EncryptDecryptBlock expects %d size blocks\n",
MAX_AES_BLOCK_SIZE_BYTES);
#endif
return BAD_FUNC_ARG;
}
/* set session auth for key */
dev->session[0].auth = key->handle.auth;
XMEMSET(&encDecIn, 0, sizeof(encDecIn));
encDecIn.keyHandle = key->handle.hndl;
if (iv == NULL || ivSz == 0) {
encDecIn.ivIn.size = MAX_AES_BLOCK_SIZE_BYTES; /* zeros */
}
else {
encDecIn.ivIn.size = ivSz;
XMEMCPY(encDecIn.ivIn.buffer, iv, ivSz);
}
encDecIn.decrypt = isDecrypt;
/* use symmetric algorithm from key */
encDecIn.mode = key->pub.publicArea.parameters.symDetail.sym.mode.aes;
encDecIn.inData.size = inOutSz;
XMEMCPY(encDecIn.inData.buffer, in, inOutSz);
/* make sure this is a block */
if (encDecIn.inData.size < MAX_AES_BLOCK_SIZE_BYTES)
encDecIn.inData.size = MAX_AES_BLOCK_SIZE_BYTES;
rc = TPM2_EncryptDecrypt2(&encDecIn, &encDecOut);
if (rc == TPM_RC_COMMAND_CODE) { /* some TPM's may not support command */
/* try to enable support */
rc = wolfTPM2_SetCommand(dev, TPM_CC_EncryptDecrypt2, YES);
if (rc == TPM_RC_SUCCESS) {
/* try command again */
rc = TPM2_EncryptDecrypt2(&encDecIn, &encDecOut);
}
}
if (rc != TPM_RC_SUCCESS) {
#ifdef DEBUG_WOLFTPM
printf("TPM2_EncryptDecrypt2 failed 0x%x: %s\n", rc,
TPM2_GetRCString(rc));
#endif
return rc;
}
/* return block */
if (inOutSz > encDecOut.outData.size)
inOutSz = encDecOut.outData.size;
XMEMCPY(out, encDecOut.outData.buffer, inOutSz);
return rc;
}
int wolfTPM2_EncryptDecrypt(WOLFTPM2_DEV* dev, WOLFTPM2_KEY* key,
const byte* in, byte* out, word32 inOutSz,
const byte* iv, word32 ivSz, int isDecrypt)
{
int rc;
word32 pos = 0, xfer;
while (pos < inOutSz) {
xfer = inOutSz - pos;
if (xfer > MAX_AES_BLOCK_SIZE_BYTES)
xfer = MAX_AES_BLOCK_SIZE_BYTES;
rc = wolfTPM2_EncryptDecryptBlock(dev, key, &in[pos], &out[pos],
xfer, iv, ivSz, isDecrypt);
if (rc != TPM_RC_SUCCESS)
break;
pos += xfer;
}
return rc;
}
int wolfTPM2_SetCommand(WOLFTPM2_DEV* dev, TPM_CC commandCode, int enableFlag)
{
int rc;
#ifdef WOLFTPM_ST33
SetCommandSet_In in;
/* Enable TPM2_EncryptDecrypt2 command */
XMEMSET(&in, 0, sizeof(in));
in.authHandle = TPM_RH_PLATFORM;
in.commandCode = commandCode;
in.enableFlag = enableFlag;
rc = TPM2_SetCommandSet(&in);
if (rc != TPM_RC_SUCCESS) {
#ifdef DEBUG_WOLFTPM
printf("TPM2_SetCommandSet failed 0x%x: %s\n", rc,
TPM2_GetRCString(rc));
#endif
}
#else
(void)commandCode;
(void)enableFlag;
rc = TPM_RC_COMMAND_CODE; /* not supported */
#endif
(void)dev;
return rc;
}
/******************************************************************************/
/* --- END Wrapper Device Functions-- */
@ -2210,12 +2332,6 @@ int wolfTPM2_GetKeyTemplate_Symmetric(TPMT_PUBLIC* publicTemplate, int keyBits,
return 0;
}
static const BYTE TPM_20_EK_AUTH_POLICY[] = {
0x83, 0x71, 0x97, 0x67, 0x44, 0x84, 0xb3, 0xf8, 0x1a, 0x90, 0xcc,
0x8d, 0x46, 0xa5, 0xd7, 0x24, 0xfd, 0x52, 0xd7, 0x6e, 0x06, 0x52,
0x0b, 0x64, 0xf2, 0xa1, 0xda, 0x1b, 0x33, 0x14, 0x69, 0xaa,
};
int wolfTPM2_GetKeyTemplate_RSA_EK(TPMT_PUBLIC* publicTemplate)
{
if (publicTemplate == NULL)

7
wolftpm/tpm2.h
View File

@ -1596,6 +1596,13 @@ typedef struct TPMS_AUTH_RESPONSE {
#define TPM_20_NV_INDEX_EK_NONCE (TPM_20_PLATFORM_MFG_NV_SPACE + 3)
#define TPM_20_NV_INDEX_EK_TEMPLATE (TPM_20_PLATFORM_MFG_NV_SPACE + 4)
/* Predetermined TPM 2.0 Endorsement policy auth template */
static const BYTE TPM_20_EK_AUTH_POLICY[] = {
0x83, 0x71, 0x97, 0x67, 0x44, 0x84, 0xb3, 0xf8, 0x1a, 0x90, 0xcc,
0x8d, 0x46, 0xa5, 0xd7, 0x24, 0xfd, 0x52, 0xd7, 0x6e, 0x06, 0x52,
0x0b, 0x64, 0xf2, 0xa1, 0xda, 0x1b, 0x33, 0x14, 0x69, 0xaa,
};
/* HAL IO Callbacks */

11
wolftpm/tpm2_wrap.h
View File

@ -211,6 +211,17 @@ WOLFTPM_API int wolfTPM2_HashUpdate(WOLFTPM2_DEV* dev, WOLFTPM2_HASH* hash,
WOLFTPM_API int wolfTPM2_HashFinish(WOLFTPM2_DEV* dev, WOLFTPM2_HASH* hash,
byte* digest, word32* digestSz);
#define WOLFTPM2_ENCRYPT NO
#define WOLFTPM2_DECRYPT YES
WOLFTPM_API int wolfTPM2_EncryptDecryptBlock(WOLFTPM2_DEV* dev, WOLFTPM2_KEY* key,
const byte* in, byte* out, word32 inOutSz, const byte* iv, word32 ivSz,
int isDecrypt);
WOLFTPM_API int wolfTPM2_EncryptDecrypt(WOLFTPM2_DEV* dev, WOLFTPM2_KEY* key,
const byte* in, byte* out, word32 inOutSz,
const byte* iv, word32 ivSz, int isDecrypt);
WOLFTPM_API int wolfTPM2_SetCommand(WOLFTPM2_DEV* dev, TPM_CC commandCode,
int enableFlag);
/* Utility functions */
WOLFTPM_API int wolfTPM2_GetKeyTemplate_RSA(TPMT_PUBLIC* publicTemplate,