Commit Graph

627 Commits (fc511714d37e8052a089e602ddaaf6b8c4af5ce7)

Author SHA1 Message Date
David Garske cfceb4e8b4 Improve get_ek_certs to handle indices 2026-02-19 13:11:50 -08:00
aidan garske d6ba3812a9 Upgrade wolfTPM CI testing 2026-02-16 11:06:33 -08:00
Aidan Garske 0b50f632ae Add stm33ktpm support LMS and non-LMS 2026-01-27 15:57:09 -08:00
jackctj117 2f4cd41edc Add TPM support for wc_SignCert_cb callback API 2026-01-08 15:20:21 -07:00
David Garske 5a70253d03 A few more minor Coverity fixes. 2025-12-03 15:54:21 -08:00
David Garske 27d1a22144 Various minor coverity fixes 2025-12-03 12:47:21 -08:00
David Garske a88d7ba6e0 Add note about ifx_fw_update tool requirements 2025-11-21 14:32:44 -08:00
David Garske d936b8f551 Fix for cast warning. Fix for WOLFTPM_DEBUG to show verbose/io also. 2025-11-21 14:02:51 -08:00
David Garske 545c6b3df1 Fix for RSA private key import with PKCS8 header 2025-11-21 13:53:17 -08:00
David Garske 3120dac297 Add new `make cppcheck` option. Fixes for cppcheck. Added missing `wolfssl-v4.7.0.patch` 2025-11-21 13:26:47 -08:00
David Garske b042e4da67 Fixes for build and testing with `--enable-infineon=9670`. Additional build tests. 2025-11-21 19:57:58 +00:00
David Garske 5217ca54ff Finishing up the CMake options to sync with configure 2025-11-20 13:30:47 -08:00
David Garske 5604e3d23d Add test case 2025-08-25 09:46:43 -07:00
David Garske bf1d5c7bca Improve the TLS bidirectional shutdown 2025-08-14 23:58:42 +01:00
David Garske 1402d0d132 wolfTPM Release v3.9.2 prep. Migrating to GPLv3. 2025-07-30 07:29:31 -07:00
David Garske 2fbbef40fd Fix using default wolfSSL ./configure. 2025-07-23 15:10:34 -07:00
David Garske 085e486cd8 Helpers for importing an external private key and creating an encrypted key blob. 2025-07-23 14:28:48 -07:00
David Garske 541a85ca5f Improve crypto callback key gen hash algorithm selection. 2025-07-23 13:33:37 -07:00
David Garske fde0571e6f Fix for session index in `hmac -aes` test. 2025-06-26 14:30:06 -07:00
David Garske 2d5a27d238 Example for HMAC with persistent key. ZD 20109. 2025-06-26 11:06:28 -07:00
David Garske 47193894e8 Cleanups for make_credential and `keygen -rsa` test case 2025-06-04 14:45:30 -07:00
David Garske d5872221ba Fix `TPM2_ParsePublic` size argument. 2025-06-02 16:33:18 -07:00
David Garske c364166542 Fix for missing `TPM2_ReleaseLock` in `TPM2_GetProductInfo`. 2025-05-28 16:04:51 -07:00
David Garske 7411bc115f Refactor the TPM2_GetNonce to support a non-locking version for internal use. This avoids all possible recursive mutex calls. 2025-05-27 14:42:43 -07:00
David Garske 32f0ef5107 Static analysis cleanups from scan-build. 2025-05-14 16:14:50 -07:00
David Garske 6fbb49a94f wolfTPM Release v3.9.0. Updated copyright and version. 2025-05-14 15:31:07 -07:00
Aidan Garske 8b8bd479a4 wolfTPM Zephyr Project Port #395 - Work by @aidangarske, @night1rider, and @dgarske 2025-05-14 13:56:08 -07:00
Zackery 33a5f47eaf
Merge pull request #398 from aidangarske/uboot_support
wolfTPM Support For Das U-Boot Bootloader
2025-05-06 18:17:56 -06:00
David Garske 985abb5eae Updated docs. Add test case for `TPM2_GetAlgId`. 2025-05-06 16:52:28 -07:00
David Garske 9c2ada8a7a Fixes for spelling and debug. 2025-05-06 16:41:34 -07:00
David Garske 0c2b0a43ed Fix location for TPM simulator `/tmp`. 2025-05-06 16:29:38 -07:00
Eric Blankenhorn 91ea3684b5
Merge pull request #412 from dgarske/bench_cleanup
Fix issue with possible handle leak in bench example
2025-05-05 15:13:58 -05:00
David Garske 5a5a7e2d25 Fix issue with possible handle leak in bench example. Reported in #411. 2025-05-02 15:31:06 -07:00
Aidan Garske d463f70975 Removed options.h not used, added TPM2_GetHierarchyDesc, and fixed indentation error 2025-04-30 11:22:13 -07:00
Aidan Garske f31929609f Rebase wolfTPM Support For Das U-Boot Bootloader 2025-04-25 13:28:09 -07:00
aidan garske 8e03c40fba removed test, only needs to be tested when actually used in wolfTPM 2025-03-28 14:31:00 -07:00
aidan garske 688ce722d3 Fix typo - default is used.. 2025-03-28 13:57:21 -07:00
aidan garske f10a27bb47 Add keygen test for AIK and defualt 2025-03-28 13:29:43 -07:00
aidan garske 942bbe7f03 removed testing 2025-03-28 13:22:52 -07:00
aidan garske 50c5f10277 Added keygen optional authentication password -auth=<yourpassword> 2025-03-28 12:50:22 -07:00
Tesfa Mael 7400f0f369 Review comment 2025-03-05 11:52:53 -08:00
Tesfa Mael 63385223ca Refactor ASN.1 parsing for RSA cert 2025-03-03 11:31:43 -08:00
David Garske 00749ad551 Fix run_examples.sh run.out location variable. 2025-02-21 16:53:23 -08:00
David Garske c42fff4f7f EK Cert Verification with TPM only (no wolfCrypt). Example assumes ST33KTPM2X. `./configure --disable-wolfcrypt && make && ./examples/endorsement/verify_ek_cert` 2025-01-24 09:54:11 -08:00
David Garske 2069ed7976 Fixes for scan-build and g++ warnings. 2025-01-07 10:47:26 -08:00
Eric Blankenhorn 80da56728c
Merge pull request #389 from dgarske/nv_extend
Fix issue with session binding / add NV extend example
2024-12-17 17:00:58 -06:00
Eric Blankenhorn cb645d3a21
Merge pull request #390 from dgarske/oldcrypt
Support for building wolfTPM against older wolfCrypt (like v4.7.0)
2024-12-17 17:00:50 -06:00
David Garske 15add23dcf Add code for calculating NV extend policies. Fixed issue with `wolfTPM2_PolicyHash` where input digest could be too large. 2024-12-17 11:30:47 -08:00
David Garske 671b702786 Allow extend with RSA or ECC. 2024-12-16 14:17:15 -08:00
David Garske 580b3a779e Fix issue with session binding. Add example for NV extend based on the TCG "bus protection guidance". 2024-12-16 11:53:52 -08:00
David Garske 8177ba8c1d Create separate tool for performing the TPM2_Clear (don't use args to wrap_test). 2024-12-13 14:52:38 -08:00
David Garske 7c48b76548 Support for building wolfTPM against older wolfCrypt (like v4.7.0). 2024-12-13 09:45:52 -08:00
JacobBarthelmeh d0618adaf3
Merge pull request #388 from dgarske/various_20241206
Various cleanups
2024-12-09 10:58:45 -07:00
David Garske 87edf3d840 Cleanup the `SensitiveToPrivate` function stack variables. Switch `wolfTPM2_LoadSymmetricKey` to default to the `WOLFTPM2_WRAP_DIGEST` for hash algorithm and not try to use SHA1. Cleanup comments on EK/SRK. Tab and formatting. 2024-12-06 16:56:03 -08:00
msi-debian 599998d827 Fixing PKCS7 Type delclaration 2024-11-18 10:18:05 -07:00
David Garske 6cb101da14 Remove execute bit on code/header files. 2024-11-11 06:59:10 -08:00
David Garske 3617abca97 Fix warning: `cannot convert argument of incomplete type 'void *' to 'WOLFTPM2_KEY *'`. Fix `extend.c:158:9: warning: Value stored to 'rc' is never read`. Fix `src/tpm2_wrap.c:2193:5: warning: Value stored to 'sensSz' is never read`. 2024-11-05 11:34:54 -08:00
David Garske 53feb3fb96 Add support for TPM2_GetCapability for TPM_CAP_PCRS. ZD 18881
Improve PCR extend to support -alg option.
2024-10-30 12:57:08 -07:00
David Garske 78457bebb7 Tested support for Nations NS350. Added simple capabilities example. 2024-10-04 08:35:35 -07:00
David Garske 034306a49c Fix macros to match. Resolves `error: unused variable 'pubKeySz'` and `examples/pcr/quote.c:336:9: error: use of undeclared identifier 'pubKey'`. 2024-09-20 17:15:08 -07:00
JacobBarthelmeh 388e32912e use XMALLOC/XFREE and update macro guards 2024-09-20 10:02:45 -07:00
JacobBarthelmeh a3beae82ee re-create correct hash before verify attempt 2024-09-13 14:53:56 -06:00
JacobBarthelmeh 4115da0b96 add example manual verification of quote signature with ecc 2024-09-13 12:09:53 -06:00
philljj 6020acfe4e
Merge pull request #376 from dgarske/tls_idevid
Improve the TPM TLS examples for use with `WOLFTPM_MFG_IDENTITY`
2024-09-11 15:35:10 -04:00
David Garske 8b5c5fe897 Peer review feedback. Cleanups for code comments, logging and white-space. 2024-09-11 12:12:15 -07:00
David Garske 460e6003c9 Added tests for policy seal/unseal with multiple PCR's. 2024-09-10 11:53:13 -07:00
David Garske 03070dabd7 Improve the TPM TLS examples for use with `WOLFTPM_MFG_IDENTITY`. Tested with ST33KTPM2X SEMI-CUSTOM DEVICE ID. 2024-09-09 10:35:22 -07:00
David Garske 1603cfdaaf More fixes for no filesystem. 2024-08-30 09:58:04 -07:00
David Garske 2a5e74113b Fix and test for no filesystem. 2024-08-30 08:02:39 -07:00
David Garske a6d7ed8695 Added example for `TPM2_Certify`:
* Added new build option for TPM provisioning (`--enable-provisioning` on by default).
* Added new `wolfTPM2_CreatePrimaryKey_ex` and `WOLFTPM2_PKEY` that supports returning creation ticket/hash.
* Added key templates for initial device (IDevID) and attestation keys (IAK).
* Extended `create_primary` example to support creation or IDevID and IAK.
* Added new policy hash helper API `wolfTPM2_PolicyHash`
* Switch handle/nvIndex string parsing to use `strtoul`.

ZD 18347
2024-08-22 10:38:01 -07:00
David Garske 070232104e Fixes for keygen with `-sym=`. 2024-08-21 11:55:17 -07:00
David Garske 026c82f799 Fixes and new tests for building wolfCrypt/wolfTPM without ECC or RSA. Fixes ZD 18470. Improved smallstack (eliminated `WOLFTPM2_MAX_BUFFER`). Fixes for building with NO_ASN. 2024-08-19 09:55:15 -07:00
David Garske 6951b8d307 Fix for /dev/tpm0 file descriptor check (fixes #365). Added documentation for /dev/tpm0 permissions (fixes #358). Various spelling and documentation cleanups. 2024-07-31 11:21:53 -07:00
David Garske a441646682 Fixes for wolfTPM documentation generation. 2024-07-30 14:52:34 -07:00
David Garske 95ae2f7459 wolfTPM v3.4.0 release.
* Fixes for building without wolfCrypt or heap.
* Fix for building wolfTPM DLL (was missing tbs.lib).
* Fix for `wolfTPM2_New` to provide default TPM2 HAL IO callback.
2024-07-30 09:09:24 -07:00
David Garske 65d0e6aa76 Documentation and minor fixes. Tested with older SLB9670 and ST33TPH. 2024-07-26 14:38:29 -07:00
David Garske 57f12df97b Support for getting TPM EK Certificates. Added `wolfTPM2_GetKeyTemplate_EK` and `wolfTPM2_GetKeyTemplate_EK` API's for getting EK public templates for generating the EK primary key. Fix TLS example build issues with wolfSSL not having crypto callback or PK callback enabled. 2024-07-26 13:02:57 -07:00
Eric Blankenhorn 61abbc1073
Merge pull request #350 from dgarske/policyauth
Improvements in auth handling to support Policy Password and Policy Auth Value
2024-05-24 09:37:37 -05:00
gojimmypi fb19d7a0e1 Initial Infineon I2C TPM support for Espressif ESP32 2024-05-10 14:16:39 -07:00
David Garske 81c837189c Refactor to eliminate confusing cast between TPMS_AUTH_COMMAND and TPM2_AUTH_SESSION. 2024-05-08 15:58:59 -07:00
David Garske a839e8166a Add missing tests for create_primary. 2024-04-25 14:15:13 -07:00
David Garske c98ee9a71e Update copyright date. 2024-04-24 10:42:27 -07:00
David Garske 4157ed5689 Release v3.2.0 prep. 2024-04-24 10:42:25 -07:00
JacobBarthelmeh eede95dcd3
Merge pull request #342 from dgarske/infineon_fw_recovery
Add Infineon firmware update recovery support
2024-04-22 11:00:12 -06:00
David Garske 4a2e2506a4 Add Infineon firmware update recovery support. 2024-04-18 11:02:34 -07:00
Zackery Backman b16a2b133c OPenSSL Coexist 2024-04-05 13:37:06 -06:00
David Garske d9152872d3 Peer review cleanups. 2024-04-02 08:29:04 -07:00
David Garske 892726e6b5 Added support for Infineon SLB9672/SLB9673 Firmware upgrade (see examples/firmware/README.md)
Added Infineon Modus Toolbox support. See `wolfssl/IDE/Infineon/README.md` for setup instructions.
Added support for Infineon CyHal I2C support.
Added Firmware extraction tool
Added Firmware update example application `examples/firmware/ifx_fw_update`.
Added support for vendor capabilities `TPM_CAP_VENDOR_PROPERTY`.
Added `XSLEEP_MS` macro for firmware update delay.
Added support for getting key group id, operational mode and update counts.
Added support for abandoning an update.
Added support for firmware update done, but not finalized
Fix auto-detect to not define SLB9672/SLB9673.
2024-04-01 17:21:18 -07:00
philljj 2cde4102b2
Merge pull request #336 from dgarske/st33_getprodinfo
Added ST33 support for pre-provisioned device identity key and certificate
2024-04-01 13:42:47 -05:00
David Garske eed7803e96 Fixes for building wolfTPM examples with NO_FILESYSTEM. Tested with `./configure --enable-swtpm CFLAGS="-DNO_FILESYSTEM" && make`. 2024-03-22 14:24:18 -07:00
David Garske 626beaf4d7 Fixes for native_test with ST33 and `TPM2_GetRandom2`. 2024-03-20 15:23:44 -07:00
David Garske 551d7da51d Add example for using TPM pre-provisioned device identity to TLS client example. 2024-03-20 15:11:58 -07:00
David Garske 0b60fae993 Fix for netdb.h. 2024-03-01 11:51:27 -08:00
Eric Blankenhorn 46ef684106
Merge pull request #328 from dgarske/cap_handles
Added support for getting handles from capabilities
2024-02-09 09:33:08 -06:00
David Garske ada472113c Fix for two missed files for config.h. Found using `git grep -L "HAVE_CONFIG_H" -- **/*.c`. 2024-02-08 17:11:36 -08:00
David Garske b395b65287 Fix for config.h, which should only be included from .c files, not headers. ZD 17473 2024-02-07 14:28:33 -08:00
David Garske e078e15f56 Added new API `wolfTPM2_GetHandles` to get list of handles from the TPM capabilities. ZD 17328 2024-02-06 10:48:16 -08:00
David Garske c34a0c2786 Fixes and improvements for secret sealing/unsealing:
* Do not set userWithAuth by default when creating sealed objects. That flag allows password auth for the sealed object. Without the flag it only allows policy auth.
* Allow setting policy auth with flags.
* Fix secret_unseal to use policy session and valid sealed name.
* Added expected failure test cases for seal/unseal with policy.
* Improve the run_examples.sh script
2024-02-02 14:45:44 -08:00
JacobBarthelmeh 6fcac417ee
Merge pull request #322 from dgarske/pkcs7_ecc
Added PKCS7 ECC support to example
2024-01-18 14:22:24 -08:00
David Garske 0aa01f4f5a Added PKCS7 ECC support to example. Added wrapper function to export TPM public key as DER/ASN.1 or PEM. Fix for crypto callback ECC sign to handle getting keySz for unknown cases (like PKCS7 without privateKey set). 2024-01-17 15:50:30 -08:00
David Garske 6a32ed43ed Fix mixed variable declaration. 2024-01-09 13:19:31 -08:00
David Garske 310fe7cd5a Fix spelling error. Fix CMake build broken since cryptocb refactor in PR #304. Added CI tests for CMake. 2023-12-29 10:36:42 -08:00
David Garske 93a2493dbf Fixes for attestation with endorsement key. Enable the broken endorsement tests. 2023-12-29 09:32:49 -08:00
David Garske 4c753683c2 Fix native test `TPM2_PolicyPCR`. 2023-12-29 09:21:44 -08:00
David Garske 6322c91e53 Remove the `WOLFTPM2_KEYBLOB.name` (deprecated) and is in `handle.name` now. 2023-12-29 09:20:45 -08:00
Eric Blankenhorn 88bff510bb
Merge pull request #312 from dgarske/tls_pkcb
Added support for TLS PK callbacks with ECC and RSA Sign using PKCSv1.5 and PSS padding
2023-12-08 15:10:32 -06:00
Eric Blankenhorn 233bd33240
Merge pull request #315 from dgarske/keyblob_tests
Added tests for keyblob buffer export/import and support for getting sizes
2023-12-08 15:10:04 -06:00
David Garske a50e4fee6c Add tests for the TLS PK with TPM. 2023-12-08 11:44:00 -08:00
David Garske 65e03e15e6 Added Windows Visual Studio project for wolfTPM. 2023-12-06 15:10:44 -08:00
David Garske 53b043dafa Tests for keyblob buffer export/import. Added support for getting the keyblob sizes. 2023-12-06 11:20:18 -08:00
David Garske 53acf0bcbf Use localhost 127.0.0.1 for CSR. Add TLS server option `-self` to use the self signed certs. 2023-12-01 14:37:34 -08:00
David Garske 137a348c14 TLS PK callback RSA PSS Padding cleanups. TLS server/client cleanups. Added server `-i` option to keep running unless failure. 2023-12-01 14:12:57 -08:00
David Garske e601803f1b Added support for PK callbacks with RSA Sign using PKCSv1.5 and PSS.
Fixes for building wolfTPM without crypto callbacks.
Fixes for building/running with FIPS.
2023-12-01 08:25:53 -08:00
David Garske 50137547ed Fix for policy_sign issue when r or s is less than key size (needs zero padding). 2023-11-29 13:10:04 -08:00
David Garske 18531274da Fix TLS bidirectional shutdown socket issue. Just use 11111 for all TLS tests, to avoid real random port collision with SWTPM sockets. Resolves TLS issue with "ERROR: failed to bind! errno 98". 2023-11-29 12:34:06 -08:00
David Garske 4b433f24fb Troubleshooting issues with socket `tcp bind failed: Address already in use`. 2023-11-20 15:42:26 -08:00
David Garske 249f9d4942 Fixes for building wolfCrypt without PEM to DER support. 2023-11-15 21:53:50 -08:00
Tesfa Mael df89f497e5 Remove error-ssl.h 2023-11-01 17:17:28 -07:00
David Garske 9cad7f4e24 Fix some of the example TODO's. Fixes for seal/unseal example. Fixes for TLS with param enc. Fix signed_timestamp with ECC. 2023-10-30 12:00:37 -07:00
David Garske 2d14cd2297 Fixes for building wolfCrypt with no RSA (--disable-rsa / NO_RSA). 2023-10-23 14:05:10 -07:00
David Garske 1041898120 Compiler warning files with `NO_FILESYSTEM`. 2023-10-23 14:04:44 -07:00
David Garske 7a11cb2213 Fix support for ECC 384-bit only support. Tested with: `./configure --enable-wolftpm CFLAGS="-DECC_USER_CURVES -DNO_ECC256 -DHAVE_ECC384" --disable-examples --disable-crypttests && make` 2023-10-20 15:08:45 -07:00
David Garske f3e1bbbf3d Refactor of the command authentication. If command does not require auth do not supply it. ZD 16689 2023-10-12 13:48:04 -07:00
David Garske 0c7254d7c0 Fixes for building with C++. 2023-10-11 15:56:04 -07:00
David Garske 49699b08fb Fix for building without public MP. 2023-09-22 11:07:55 -07:00
David Garske 96cd17af1d Improvements/fixes to NV auth and session auth set/unset:
* Fix bug with NV name after first write (only appears when using HMAC session).
* Add new API `wolfTPM2_UnsetAuthSession` to unset auth index for a session and save off the nonce from the TPM. This allows auth to be unset/set again with the same session.
* Cleanup in the NV API's for unsetting of the auth to be handled by caller, not in API.
2023-09-15 14:03:11 -07:00
David Garske 31cd20e645 Added new policy_nv example. 2023-09-11 14:37:12 -07:00
David Garske 027ae8a4e9 Make sure PCR extend has the session auth cleared. Added -nvhandle argument to nvram examples. Cleanups for examples. 2023-09-08 08:14:39 -07:00
David Garske 23a5d2595b Fixes for small stack. 2023-08-31 13:37:22 -07:00
David Garske 8e1dce2c76 Take run_examples.sh out of make check and run manually in CI test to avoid parallel builds. 2023-08-31 13:04:33 -07:00
David Garske 8968d89f90 More CI fixes. 2023-08-31 12:29:13 -07:00
David Garske e2d502e773 Peer review fixes and getting CI to pass. 2023-08-31 09:53:39 -07:00
David Garske 97d8845c6f Added CI tests for all examples and additional build tests. 2023-08-30 15:11:24 -07:00
David Garske 78cd7190be Cleanups from testing. 2023-08-30 11:21:43 -07:00
David Garske a15260342f wolfTPM Support for sealing/unsealing based on a PCR that is signed externally. Use an external key to sign a PCR digest. Allows a new signed policy to be sent with updates to continue allowing a sealed secret to be unsealed when PCR's change. This resolves the issue with PCR brittleness. 2023-08-29 18:47:18 -07:00
David Garske d508180ee3 Fix custom -nvIndex= argument. 2023-08-16 08:08:10 -07:00
David Garske 5b6c7c0368 Improvements to the secure_rot example. Add support for manually placing hash. 2023-08-15 14:41:09 -07:00
David Garske 649c257093 Improve SRK ECC support detection / handling. 2023-08-15 10:51:53 -07:00
David Garske 6126d04be3 Support for importing and loading public ECC/RSA keys formatted as PEM or DER. 2023-08-15 08:27:00 -07:00
David Garske 3f29c59e87 Add support for encrypting secret using ECC key. Allows using ECC for parameter encryption and importing ECC keys with custom seed. Requires https://github.com/wolfSSL/wolfssl/pull/6683 2023-08-08 16:15:18 -07:00
David Garske bb18c4c550 Added `wolfTPM2_ChangePlatformAuth` wrapper to help set the platform auth. This is useful from the bootloader to make sure no one can use the platform hierarchy from application. 2023-08-07 11:08:02 -07:00
David Garske 5a20647313 Minor cleanups. Update wolfSSL test certs. Added TPM_TIS_MAX_WAIT. Fix build with WOLFTPM_DEBUG_VERBOSE only. 2023-08-07 11:08:02 -07:00
David Garske c35b532724 Add support for NV lock. 2023-08-07 11:08:02 -07:00
David Garske 14a331d648 Example for secure boot solution to store root of trust in NV. Provides authentication and tamper protection. Fixed uses of arg= in examples. 2023-08-07 11:08:02 -07:00
David Garske bb1ec4acc9 Add code to test external import between two TPM's. 2023-08-01 13:12:44 -07:00
David Garske e646c5701e Peer review fixes. Avoid using a struct for the seed. 2023-07-20 12:28:39 -07:00
David Garske 7fcbcab634 Fixes for edge case builds !HAVE_ECC or NO_RSA. 2023-07-20 09:29:45 -07:00
David Garske ae6bac26c5 Added documentation and tests. 2023-07-19 13:28:50 -07:00
John Bland d1cd4eff52 use correct session index for wrap test so parameter encryption works 2023-05-03 19:29:45 -04:00
David Garske 382ff91eb3 Support for disabling ASN.1 (--disable-asn) and still provide parameter encryption support. 2023-05-02 18:11:15 -07:00