Skip to content

tpm2: Make it possible to customize the name algorithm for TPM sealed keys #374

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
kukrimate wants to merge 1 commit into
base: master
Choose a base branch
from
Open

tpm2: Make it possible to customize the name algorithm for TPM sealed keys #374

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
26 changes: 23 additions & 3 deletions tpm2/platform_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -77,6 +77,7 @@ func (s *platformSuite) TestRecoverKeysIntegrated(c *C) {
PCRProfile: tpm2test.NewPCRProfileFromCurrentValues(tpm2.HashAlgorithmSHA256, []int{7}),
PCRPolicyCounterHandle: s.NextAvailableHandle(c, 0x0181fff0),
Role: "foo",
NameAlg: tpm2.HashAlgorithmSHA256,
}

k, primaryKey, unlockKey, err := NewTPMProtectedKey(s.TPM(), params)
Expand All @@ -95,6 +96,7 @@ func (s *platformSuite) TestRecoverKeysWithPassphraseIntegrated(c *C) {
PCRProfile: tpm2test.NewPCRProfileFromCurrentValues(tpm2.HashAlgorithmSHA256, []int{7}),
PCRPolicyCounterHandle: s.NextAvailableHandle(c, 0x0181fff0),
Role: "bar",
NameAlg: tpm2.HashAlgorithmSHA256,
}

passphraseParams := &PassphraseProtectKeyParams{
Expand All @@ -117,6 +119,7 @@ func (s *platformSuite) TestRecoverKeysWithPassphraseIntegratedPBKDF2(c *C) {
PCRProfile: tpm2test.NewPCRProfileFromCurrentValues(tpm2.HashAlgorithmSHA256, []int{7}),
PCRPolicyCounterHandle: s.NextAvailableHandle(c, 0x0181fff0),
Role: "foo",
NameAlg: tpm2.HashAlgorithmSHA256,
}

passphraseParams := &PassphraseProtectKeyParams{
Expand All @@ -143,6 +146,7 @@ func (s *platformSuite) TestRecoverKeysWithBadPassphraseIntegrated(c *C) {
PCRProfile: tpm2test.NewPCRProfileFromCurrentValues(tpm2.HashAlgorithmSHA256, []int{7}),
PCRPolicyCounterHandle: s.NextAvailableHandle(c, 0x0181fff0),
Role: "foo",
NameAlg: tpm2.HashAlgorithmSHA256,
}

passphraseParams := &PassphraseProtectKeyParams{
Expand All @@ -163,6 +167,7 @@ func (s *platformSuite) TestChangePassphraseIntegrated(c *C) {
PCRProfile: tpm2test.NewPCRProfileFromCurrentValues(tpm2.HashAlgorithmSHA256, []int{7}),
PCRPolicyCounterHandle: s.NextAvailableHandle(c, 0x0181fff0),
Role: "foo",
NameAlg: tpm2.HashAlgorithmSHA256,
}

passphraseParams := &PassphraseProtectKeyParams{
Expand All @@ -187,6 +192,7 @@ func (s *platformSuite) TestChangePassphraseWithBadPassphraseIntegrated(c *C) {
PCRProfile: tpm2test.NewPCRProfileFromCurrentValues(tpm2.HashAlgorithmSHA256, []int{7}),
PCRPolicyCounterHandle: s.NextAvailableHandle(c, 0x0181fff0),
Role: "foo",
NameAlg: tpm2.HashAlgorithmSHA256,
}

passphraseParams := &PassphraseProtectKeyParams{
Expand Down Expand Up @@ -255,13 +261,15 @@ func (s *platformSuite) TestRecoverKeysSimplePCRProfile(c *C) {
PCRProfile: tpm2test.NewPCRProfileFromCurrentValues(tpm2.HashAlgorithmSHA256, []int{7}),
PCRPolicyCounterHandle: s.NextAvailableHandle(c, 0x0181fff0),
Role: "foo",
NameAlg: tpm2.HashAlgorithmSHA256,
})
}

func (s *platformSuite) TestRecoverKeysNilPCRProfile(c *C) {
s.testRecoverKeys(c, &ProtectKeyParams{
PCRPolicyCounterHandle: s.NextAvailableHandle(c, 0x0181fff0),
Role: "foo",
NameAlg: tpm2.HashAlgorithmSHA256,
})
}

Expand All @@ -270,6 +278,7 @@ func (s *platformSuite) TestRecoverKeysNoPCRPolicyCounter(c *C) {
PCRProfile: tpm2test.NewPCRProfileFromCurrentValues(tpm2.HashAlgorithmSHA256, []int{7}),
PCRPolicyCounterHandle: tpm2.HandleNull,
Role: "foo",
NameAlg: tpm2.HashAlgorithmSHA256,
})
}

Expand All @@ -278,6 +287,7 @@ func (s *platformSuite) TestRecoverKeysDifferentRole(c *C) {
PCRProfile: tpm2test.NewPCRProfileFromCurrentValues(tpm2.HashAlgorithmSHA256, []int{7}),
PCRPolicyCounterHandle: s.NextAvailableHandle(c, 0x0181fff0),
Role: "bar",
NameAlg: tpm2.HashAlgorithmSHA256,
})
}

Expand All @@ -289,6 +299,7 @@ func (s *platformSuite) TestRecoverKeysTPMLockout(c *C) {
PCRProfile: tpm2test.NewPCRProfileFromCurrentValues(tpm2.HashAlgorithmSHA256, []int{7}),
PCRPolicyCounterHandle: s.NextAvailableHandle(c, 0x0181fff0),
Role: "",
NameAlg: tpm2.HashAlgorithmSHA256,
})
}

Expand All @@ -297,6 +308,7 @@ func (s *platformSuite) testRecoverKeysNoValidSRK(c *C, prepareSrk func()) {
PCRProfile: tpm2test.NewPCRProfileFromCurrentValues(tpm2.HashAlgorithmSHA256, []int{7}),
PCRPolicyCounterHandle: s.NextAvailableHandle(c, 0x0181fff0),
Role: "foo",
NameAlg: tpm2.HashAlgorithmSHA256,
}

k, primaryKey, unlockKey, err := NewTPMProtectedKey(s.TPM(), params)
Expand Down Expand Up @@ -387,13 +399,15 @@ func (s *platformSuite) testRecoverKeysImportable(c *C, params *ProtectKeyParams
func (s *platformSuite) TestRecoverKeysImportableSimplePCRProfile(c *C) {
s.testRecoverKeysImportable(c, &ProtectKeyParams{
PCRProfile: tpm2test.NewResolvedPCRProfileFromCurrentValues(c, s.TPM().TPMContext, tpm2.HashAlgorithmSHA256, []int{7}),
PCRPolicyCounterHandle: tpm2.HandleNull})
PCRPolicyCounterHandle: tpm2.HandleNull,
NameAlg: tpm2.HashAlgorithmSHA256})
}

func (s *platformSuite) TestRecoverKeysImportableNilPCRProfile(c *C) {
s.testRecoverKeysImportable(c, &ProtectKeyParams{
PCRPolicyCounterHandle: tpm2.HandleNull,
Role: ""})
Role: "",
NameAlg: tpm2.HashAlgorithmSHA256})
}

func (s *platformSuite) TestRecoverKeysNoTPMConnection(c *C) {
Expand All @@ -404,6 +418,7 @@ func (s *platformSuite) TestRecoverKeysNoTPMConnection(c *C) {
PCRProfile: tpm2test.NewPCRProfileFromCurrentValues(tpm2.HashAlgorithmSHA256, []int{7}),
PCRPolicyCounterHandle: tpm2.HandleNull,
Role: "",
NameAlg: tpm2.HashAlgorithmSHA256,
})
c.Check(err, IsNil)

Expand Down Expand Up @@ -431,7 +446,8 @@ func (s *platformSuite) testRecoverKeysUnsealErrorHandling(c *C, prepare func(*s
params := &ProtectKeyParams{
PCRProfile: tpm2test.NewPCRProfileFromCurrentValues(tpm2.HashAlgorithmSHA256, []int{7, 23}),
PCRPolicyCounterHandle: s.NextAvailableHandle(c, 0x0181fff0),
Role: "foo"}
Role: "foo",
NameAlg: tpm2.HashAlgorithmSHA256}

k, primaryKey, _, err := NewTPMProtectedKey(s.TPM(), params)
c.Assert(err, IsNil)
Expand Down Expand Up @@ -581,6 +597,7 @@ func (s *platformSuite) TestRecoverKeysWithAuthKey(c *C) {
PCRProfile: tpm2test.NewPCRProfileFromCurrentValues(tpm2.HashAlgorithmSHA256, []int{7}),
PCRPolicyCounterHandle: s.NextAvailableHandle(c, 0x0181fff0),
Role: "foo",
NameAlg: tpm2.HashAlgorithmSHA256,
}

k, primaryKey, unlockKey, err := NewTPMProtectedKey(s.TPM(), params)
Expand Down Expand Up @@ -671,6 +688,7 @@ func (s *platformSuite) TestRecoverKeysWithIncorrectAuthKey(c *C) {
PCRProfile: tpm2test.NewPCRProfileFromCurrentValues(tpm2.HashAlgorithmSHA256, []int{7}),
PCRPolicyCounterHandle: s.NextAvailableHandle(c, 0x0181fff0),
Role: "",
NameAlg: tpm2.HashAlgorithmSHA256,
}

k, _, _, err := NewTPMProtectedKey(s.TPM(), params)
Expand Down Expand Up @@ -754,6 +772,7 @@ func (s *platformSuite) TestChangeAuthKeyWithIncorrectAuthKey(c *C) {
PCRProfile: tpm2test.NewPCRProfileFromCurrentValues(tpm2.HashAlgorithmSHA256, []int{7}),
PCRPolicyCounterHandle: s.NextAvailableHandle(c, 0x0181fff0),
Role: "",
NameAlg: tpm2.HashAlgorithmSHA256,
}

k, _, _, err := NewTPMProtectedKey(s.TPM(), params)
Expand Down Expand Up @@ -839,6 +858,7 @@ func (s *platformSuite) TestRecoverKeysWithAuthKeyTPMLockout(c *C) {
PCRProfile: tpm2test.NewPCRProfileFromCurrentValues(tpm2.HashAlgorithmSHA256, []int{7}),
PCRPolicyCounterHandle: s.NextAvailableHandle(c, 0x0181fff0),
Role: "",
NameAlg: tpm2.HashAlgorithmSHA256,
}

k, _, _, err := NewTPMProtectedKey(s.TPM(), params)
Expand Down
16 changes: 13 additions & 3 deletions tpm2/seal.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,6 +59,8 @@ type ProtectKeyParams struct {
PCRPolicyCounterHandle tpm2.Handle

PrimaryKey secboot.PrimaryKey

NameAlg tpm2.HashAlgorithmId
}

type PassphraseProtectKeyParams struct {
Expand Down Expand Up @@ -102,6 +104,7 @@ type makeSealedKeyDataParams struct {
PcrPolicyCounterHandle tpm2.Handle
PrimaryKey secboot.PrimaryKey
AuthMode secboot.AuthMode
NameAlg tpm2.HashAlgorithmId
}

// makeSealedKeyData makes a sealed key data using the supplied parameters, keySealer implementation,
Expand All @@ -111,6 +114,11 @@ type makeSealedKeyDataParams struct {
// used for authenticating the storage hierarchy in order to avoid trasmitting the cleartext authorization
// value.
var makeSealedKeyData = func(tpm *tpm2.TPMContext, params *makeSealedKeyDataParams, sealer keySealer, constructor keyDataConstructor, session tpm2.SessionContext) (*secboot.KeyData, secboot.PrimaryKey, secboot.DiskUnlockKey, error) {
// Make sure the requested name algorithm is available.
if !params.NameAlg.Available() {
return nil, nil, nil, xerrors.Errorf("chosen name algorithm %v is not available", params.NameAlg)
}

// Create a primary key, if required.
primaryKey := params.PrimaryKey
if primaryKey == nil {
Expand Down Expand Up @@ -146,10 +154,9 @@ var makeSealedKeyData = func(tpm *tpm2.TPMContext, params *makeSealedKeyDataPara
}

// Create the initial policy data.
nameAlg := tpm2.HashAlgorithmSHA256
requireAuthValue := params.AuthMode != secboot.AuthModeNone

policyData, authPolicyDigest, err := newKeyDataPolicy(nameAlg, authPublicKey, params.Role, pcrPolicyCounterPub, requireAuthValue)
policyData, authPolicyDigest, err := newKeyDataPolicy(params.NameAlg, authPublicKey, params.Role, pcrPolicyCounterPub, requireAuthValue)
if err != nil {
return nil, nil, nil, xerrors.Errorf("cannot create initial policy data: %w", err)
}
Expand All @@ -163,7 +170,7 @@ var makeSealedKeyData = func(tpm *tpm2.TPMContext, params *makeSealedKeyDataPara
// Seal the symmetric key and nonce. The final boolean argument is set to true in order
// to disable dictionary attack protection (ie, adding the noDA attribute). We want this
// when no user auth value is required.
priv, pub, importSymSeed, err := sealer.CreateSealedObject(symKey[:], nameAlg, authPolicyDigest, !requireAuthValue)
priv, pub, importSymSeed, err := sealer.CreateSealedObject(symKey[:], params.NameAlg, authPolicyDigest, !requireAuthValue)
if err != nil {
return nil, nil, nil, err
}
Expand Down Expand Up @@ -253,6 +260,7 @@ func NewExternalTPMProtectedKey(tpmKey *tpm2.Public, params *ProtectKeyParams) (
AuthMode: secboot.AuthModeNone,
Role: params.Role,
PcrProfile: params.PCRProfile,
NameAlg: params.NameAlg,
}, sealer, makeKeyDataNoAuth, nil)
}

Expand Down Expand Up @@ -291,6 +299,7 @@ func NewTPMProtectedKey(tpm *Connection, params *ProtectKeyParams) (protectedKey
PcrPolicyCounterHandle: params.PCRPolicyCounterHandle,
PrimaryKey: params.PrimaryKey,
AuthMode: secboot.AuthModeNone,
NameAlg: params.NameAlg,
}, sealer, makeKeyDataNoAuth, tpm.HmacSession())
}

Expand All @@ -308,5 +317,6 @@ func NewTPMPassphraseProtectedKey(tpm *Connection, params *PassphraseProtectKeyP
AuthMode: secboot.AuthModePassphrase,
Role: params.Role,
PcrProfile: params.PCRProfile,
NameAlg: params.NameAlg,
}, sealer, makeKeyDataWithPassphraseConstructor(tpm, params.KDFOptions, passphrase), tpm.HmacSession())
}
Loading
Loading