Implement object duplication

Key attestation using object duplication are [on the horizon], and we'll
need supporting routines for that.

This brings a `create_duplicate` that will make the two layers of wraps
around the object to protect.

[on the horizon]: https://trustedcomputinggroup.org/wp-content/uploads/EK-Based-Key-Attestation-with-TPM-Firmware-Version-V1-RC1_9July2025.pdf

Signed-off-by: Arthur Gautier <arthur.gautier@arista.com>

Author: baloo

test_policy

@@ -37,8 +37,9 @@ tss-esapi-sys = { path = "../tss-esapi-sys", version = "0.7.0-alpha.1" }
 x509-cert = { version = "0.3.0-rc.4", optional = true }
 aes = { version = "0.9", optional = true }
 byte-strings = { version = "0.3.1", optional = true }
+camellia = { version = "0.2.0-rc.0", optional = true }
 cfb-mode = { version = "0.9", optional = true }
-cipher = { version = "0.5", optional = true }
+cipher = { version = "0.5", optional = true, default-features = false, features = ["zeroize"] }
 des = { version = "0.9", optional = true }
 ecdsa = { version = "0.17.0-rc.23", features = [
     "algorithm",
@@ -62,6 +63,7 @@ sha2 = { version = "0.11", optional = true }
 sha3 = { version = "0.12", optional = true }
 sm2 = { version = "0.14.0-rc.15", optional = true }
 sm3 = { version = "0.5", optional = true }
+sm4 = { version = "0.6.0-rc.2", optional = true }
 digest = { version = "0.11.1", optional = true }
 signature = { version = "3", features = [
     "alloc",
@@ -80,6 +82,7 @@ assert_fs = "1.1.3"
 aes = "0.9.0-pre.2"
 env_logger = "0.11.5"
 hex-literal = "1"
+paste = "1.0.15"
 rsa = { version = "0.10.0-pre.3" }
 serde_json = "^1.0.108"
 sha2 = { version = "0.11", features = ["oid"] }
@@ -121,6 +124,7 @@ rustcrypto = [
 rustcrypto-full = [
     "rustcrypto",
     "aes",
+    "camellia",
     "des",
     "p192",
     "p224",
@@ -133,6 +137,7 @@ rustcrypto-full = [
     "sha3",
     "sm2",
     "sm3",
+    "sm4",
 ]
 
 rsa = ["dep:rsa", "kbkdf"]

tss-esapi/Cargo.toml

@@ -23,6 +23,12 @@ pub use self::capability_data::CapabilityData;
 // //////////////////////////////////////////////////////
 mod names;
 pub use names::name::Name;
+#[cfg(feature = "rustcrypto")]
+#[cfg_attr(
+    not(any(feature = "sha1", feature = "sha2", feature = "sha3", feature = "sm3",)),
+    allow(unused)
+)]
+pub(crate) use names::name::make_name;
 // //////////////////////////////////////////////////////
 // The result section
 // //////////////////////////////////////////////////////

tss-esapi/src/structures/mod.rs

@@ -65,3 +65,44 @@ impl AsRef<TPM2B_NAME> for Name {
         &self.value
     }
 }
+
+#[cfg(feature = "rustcrypto")]
+mod as_name {
+    use digest::{Digest, Update};
+    use log::error;
+
+    use super::{Name, TPM2B_NAME};
+    use crate::{
+        error::{Error, Result, WrapperErrorKind},
+        traits::Marshall,
+        utils::hash_object,
+    };
+
+    #[cfg(feature = "rustcrypto")]
+    pub(crate) fn make_name<D, T>(object: &T) -> Result<Name>
+    where
+        D: Digest + Update,
+        T: Marshall,
+    {
+        let mut hasher = D::new();
+
+        hash_object(&mut hasher, object)?;
+
+        let bytes = hasher.finalize();
+        if bytes.len() > Name::MAX_SIZE {
+            error!("Invalid Digest output size (> {})", Name::MAX_SIZE);
+            return Err(Error::local_error(WrapperErrorKind::WrongParamSize));
+        }
+        let size = bytes.len() as u16;
+
+        let mut name = [0; Name::MAX_SIZE];
+        name[..bytes.len()].copy_from_slice(&bytes);
+
+        Ok(Name {
+            value: TPM2B_NAME { size, name },
+        })
+    }
+}
+
+#[cfg(feature = "rustcrypto")]
+pub(crate) use self::as_name::make_name;

tss-esapi/src/structures/names/name.rs

@@ -8,7 +8,7 @@ use crate::{
     Error, Result, ReturnCode, WrapperErrorKind,
     attributes::ObjectAttributes,
     interface_types::algorithm::{HashingAlgorithm, PublicAlgorithm},
-    structures::{Digest, EccPoint, PublicKeyRsa, SymmetricCipherParameters},
+    structures::{Digest, EccPoint, Name, PublicKeyRsa, SymmetricCipherParameters},
     traits::{Marshall, impl_mu_standard},
     tss2_esys::{TPM2B_PUBLIC, TPMT_PUBLIC},
 };
@@ -586,3 +586,20 @@ impl TryFrom<Public> for TPM2B_PUBLIC {
         })
     }
 }
+
+#[cfg(feature = "rustcrypto")]
+impl Public {
+    pub fn name(&self) -> Result<Name> {
+        #[cfg_attr(
+            not(any(feature = "sha1", feature = "sha2", feature = "sha3", feature = "sm3",)),
+            allow(unused)
+        )]
+        macro_rules! make_name {
+            ($hash: ty) => {
+                crate::structures::make_name::<$hash, _>(self)
+            };
+        }
+
+        crate::utils::match_name_hashing_algorithm!(self, make_name)
+    }
+}

tss-esapi/src/structures/tagged/public.rs

@@ -1,6 +1,7 @@
 // Copyright 2021 Contributors to the Parsec project.
 // SPDX-License-Identifier: Apache-2.0
-use crate::{Result, tss2_esys::UINT32};
+use crate::{Error, Result, WrapperErrorKind, tss2_esys::UINT32};
+use log::error;
 use std::convert::TryFrom;
 
 /// Trait for types that can be converted into
@@ -25,6 +26,23 @@ pub trait Marshall: Sized {
     fn marshall_offset(&self, _marshalled_data: &mut [u8], _offset: &mut usize) -> Result<()> {
         unimplemented!();
     }
+
+    /// Returns the type in form of marshalled data prefixed with their length
+    fn marshall_prefixed(&self) -> Result<Vec<u8>> {
+        let data = self.marshall()?;
+        let mut buffer = vec![0; data.len() + 2];
+        buffer[..2].copy_from_slice(
+            &u16::try_from(data.len())
+                .map_err(|_| {
+                    error!("object may only be 2^16 bytes long");
+                    Error::local_error(WrapperErrorKind::WrongParamSize)
+                })?
+                .to_be_bytes()[..],
+        );
+        buffer[2..].copy_from_slice(&data);
+
+        Ok(buffer)
+    }
 }
 
 /// Trait for types that can be created from
@@ -185,3 +203,20 @@ pub(crate) use impl_mu_standard;
 pub(crate) use impl_unmarshall_trait;
 // Implementation of Marshall and UnMarshall macro for base TSS types.
 impl_mu_aliases!(UINT32);
+
+#[cfg(feature = "rustcrypto")]
+impl<T> Marshall for digest::CtOutput<T>
+where
+    T: digest::OutputSizeUser,
+{
+    const BUFFER_SIZE: usize = <T::OutputSize as digest::typenum::Unsigned>::USIZE;
+
+    fn marshall_offset(&self, buf: &mut [u8], offset: &mut usize) -> Result<()> {
+        let src = &self.as_bytes()[*offset..];
+        let to_write = buf.len().min(src.len());
+        buf[..to_write].copy_from_slice(&src[..to_write]);
+        *offset += to_write;
+
+        Ok(())
+    }
+}

tss-esapi/src/traits.rs

@@ -252,6 +252,26 @@ mod key_test_des {
     }
 }
 
+#[cfg(any(feature = "camellia", feature = "sm4"))]
+macro_rules! dummy_weak_key_test {
+    ($k: ty) => {
+        impl TcgKeyTest for $k {
+            fn tcg_weak_key_test(_key: &Key<Self>) -> core::result::Result<(), WeakKeyError> {
+                Ok(())
+            }
+        }
+    };
+}
+
+#[cfg(feature = "camellia")]
+dummy_weak_key_test!(camellia::Camellia128);
+#[cfg(feature = "camellia")]
+dummy_weak_key_test!(camellia::Camellia192);
+#[cfg(feature = "camellia")]
+dummy_weak_key_test!(camellia::Camellia256);
+#[cfg(feature = "sm4")]
+dummy_weak_key_test!(sm4::Sm4);
+
 /// [`make_credential_ecc`] creates a credential that will only be decrypted by the target
 /// elliptic-curve EK.
 ///