Skip to content

Commit 50c0e3d

Browse files
royalsreaferroyalsreafer
committed
Added support for tpm persistent handles in TSS2 privkey
Signed-off-by: RoyalReafer <royalsmods@hotmail.com>
1 parent 6dcc3b2 commit 50c0e3d

4 files changed

Lines changed: 114 additions & 13 deletions

File tree

‎Makefile.am‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -31,8 +31,6 @@ if WITH_OP_CIPHER
3131
tpm2_la_SOURCES += src/tpm2-provider-cipher.c
3232
endif
3333

34-
CODE_COVERAGE_LCOV_RMOPTS = --ignore-errors unused
35-
3634
# https://www.gnu.org/software/autoconf-archive/ax_code_coverage.html
3735
if AUTOCONF_CODE_COVERAGE_2019_01_06
3836
include $(top_srcdir)/aminclude_static.am
@@ -71,8 +69,8 @@ test_rand_processes_LDFLAGS = $(COMMON_LDFLAGS)
7169
check_PROGRAMS += test/rand_threads
7270
test_rand_threads_SOURCES = test/rand_threads.c
7371
test_rand_threads_CFLAGS = $(COMMON_CFLAGS)
74-
test_rand_threads_LDADD = $(CRYPTO_LIBS) @PTHREAD_CFLAGS@
75-
test_rand_threads_LDFLAGS = $(COMMON_LDFLAGS) @PTHREAD_LIBS@
72+
test_rand_threads_LDADD = $(CRYPTO_LIBS)
73+
test_rand_threads_LDFLAGS = $(COMMON_LDFLAGS)
7674

7775
check_PROGRAMS += test/ec_genpkey_store_load
7876
test_ec_genpkey_store_load_SOURCES = test/ec_genpkey_store_load.c
@@ -97,6 +95,7 @@ TESTS = $(TESTS_SHELL) $(check_PROGRAMS)
9795
TESTS_SHELL = test/list.sh \
9896
test/rand.sh \
9997
test/rsa_genrsa_check.sh \
98+
test/rsa_genrsa_check_handle.sh \
10099
test/rsa_genpkey_sign.sh \
101100
test/rsa_genpkey_sign_rawin.sh \
102101
test/rsa_genpkey_auth_parent.sh \
@@ -115,6 +114,7 @@ TESTS_SHELL = test/list.sh \
115114
test/rsapss_createak_tls_server.sh \
116115
test/rsa_pki/rsa_pki.sh \
117116
test/ec_genpkey_check.sh \
117+
test/ec_genpkey_check_handle.sh \
118118
test/ec_genpkey_parameters.sh \
119119
test/ec_genpkey_x509_cms.sh \
120120
test/ecdsa_genpkey_sign_auth.sh \

‎src/tpm2-provider-pkey.c‎

Lines changed: 26 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@
66
#include <openssl/rand.h>
77

88
#include <tss2/tss2_mu.h>
9+
#include <tss2/tss2_tpm2_types.h>
910

1011
#include "tpm2-provider-pkey.h"
1112

@@ -62,9 +63,15 @@ tpm2_keydata_write(const TPM2_KEYDATA *keydata, BIO *bout, TPM2_PKEY_FORMAT form
6263
if (!tpk)
6364
return 0;
6465

65-
if (Tss2_MU_TPM2B_PRIVATE_Marshal(&keydata->priv, &privbuf[0],
66-
sizeof(privbuf), &privbuf_len))
67-
goto error;
66+
if (keydata->privatetype == KEY_TYPE_HANDLE) {
67+
if (Tss2_MU_TPM2_HANDLE_Marshal(keydata->handle, &privbuf[0],
68+
sizeof(TPM2_HANDLE), &privbuf_len))
69+
goto error;
70+
} else {
71+
if (Tss2_MU_TPM2B_PRIVATE_Marshal(&keydata->priv, &privbuf[0],
72+
sizeof(privbuf), &privbuf_len))
73+
goto error;
74+
}
6875

6976
if (Tss2_MU_TPM2B_PUBLIC_Marshal(&keydata->pub, &pubbuf[0],
7077
sizeof(pubbuf), &pubbuf_len))
@@ -131,7 +138,11 @@ tpm2_keydata_read(BIO *bin, TPM2_KEYDATA *keydata, TPM2_PKEY_FORMAT format)
131138
if (tpk == NULL)
132139
return 0;
133140

134-
keydata->privatetype = KEY_TYPE_BLOB;
141+
if (ASN1_STRING_length(tpk->privkey) == sizeof(keydata->handle) && ASN1_STRING_get0_data(tpk->privkey)[0] == TPM2_HT_PERSISTENT)
142+
keydata->privatetype = KEY_TYPE_HANDLE;
143+
else
144+
keydata->privatetype = KEY_TYPE_BLOB;
145+
135146
keydata->emptyAuth = (tpk->emptyAuth != V_ASN1_UNDEF && tpk->emptyAuth);
136147

137148
// the ASN1_INTEGER_get on a 32-bit machine will fail for numbers of UINT32_MAX
@@ -149,10 +160,17 @@ tpm2_keydata_read(BIO *bin, TPM2_KEYDATA *keydata, TPM2_PKEY_FORMAT format)
149160
strcmp(type_oid, OID_loadableKey))
150161
goto error;
151162

152-
if (Tss2_MU_TPM2B_PRIVATE_Unmarshal(ASN1_STRING_get0_data(tpk->privkey),
153-
ASN1_STRING_length(tpk->privkey), NULL,
154-
&keydata->priv))
155-
goto error;
163+
if (keydata->privatetype == KEY_TYPE_HANDLE) {
164+
if (Tss2_MU_TPM2_HANDLE_Unmarshal(ASN1_STRING_get0_data(tpk->privkey),
165+
ASN1_STRING_length(tpk->privkey), NULL,
166+
&keydata->handle))
167+
goto error;
168+
} else {
169+
if (Tss2_MU_TPM2B_PRIVATE_Unmarshal(ASN1_STRING_get0_data(tpk->privkey),
170+
ASN1_STRING_length(tpk->privkey), NULL,
171+
&keydata->priv))
172+
goto error;
173+
}
156174

157175
if (Tss2_MU_TPM2B_PUBLIC_Unmarshal(ASN1_STRING_get0_data(tpk->pubkey),
158176
ASN1_STRING_length(tpk->pubkey), NULL,
@@ -363,4 +381,3 @@ tpm2_openssl_type(TPM2_KEYDATA *keydata)
363381
} else
364382
return NULL;
365383
}
366-

‎test/ec_genpkey_check_handle.sh‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
#!/usr/bin/env bash
2+
# SPDX-License-Identifier: BSD-3-Clause
3+
set -eufx
4+
5+
# create EK
6+
tpm2_createek -G ecc -c ek_ecc.ctx
7+
8+
# create AK with defined scheme/hash
9+
tpm2_createak -C ek_ecc.ctx -G ecc -g sha256 -s ecdsa -c ak_ecc.ctx
10+
11+
# load the AK to persistent handle
12+
HANDLE=$(tpm2_evictcontrol -c ak_ecc.ctx | cut -d ' ' -f 2 | head -n 1)
13+
14+
# generate private key as PEM ans save it to tpm2
15+
openssl pkey -provider tpm2 -provider base -in handle:${HANDLE} -out tpmprivkey.pem
16+
17+
# Generate public key from handle
18+
openssl pkey -provider tpm2 -provider base -in tpmprivkey.pem -check -text -noout
19+
20+
# Generate public key from tss2 private keyc
21+
openssl pkey -provider tpm2 -provider base -in handle:${HANDLE} -check -text -noout
22+
23+
# convert PEM private key to DER
24+
openssl pkey -provider tpm2 -provider base -in tpmprivkey.pem -outform der -out testkey.der
25+
26+
# convert PEM private key handle to DER
27+
openssl pkey -provider tpm2 -provider base -in handle:${HANDLE} -outform der -out testkeyhandle.der
28+
29+
# read PEM from stdin and export public key as PEM
30+
cat tpmprivkey.pem | openssl pkey -provider tpm2 -provider base -pubout -out pubkey.pem
31+
32+
# read PEM from handle and export public key as PEM
33+
openssl pkey -provider tpm2 -provider base -in handle:${HANDLE} -pubout -out pubkeyhandle.pem
34+
35+
# display public key info
36+
openssl pkey -pubin -in pubkey.pem -text -noout
37+
openssl pkey -pubin -in pubkeyhandle.pem -text -noout
38+
39+
# release persistent handle
40+
tpm2_evictcontrol -c ${HANDLE}
41+
42+
rm testkey.der testkeyhandle.der pubkey.pem ek_ecc.ctx ak_ecc.ctx pubkeyhandle.pem tpmprivkey.pem

‎test/rsa_genrsa_check_handle.sh‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
#!/usr/bin/env bash
2+
# SPDX-License-Identifier: BSD-3-Clause
3+
set -eufx
4+
5+
# create EK
6+
tpm2_createek -G rsa -c ek_rsa.ctx
7+
8+
# create AK with defined scheme/hash
9+
tpm2_createak -C ek_rsa.ctx -G rsa -g sha256 -s rsassa -c ak_rsa.ctx
10+
11+
# load the AK to persistent handle
12+
HANDLE=$(tpm2_evictcontrol -c ak_rsa.ctx | cut -d ' ' -f 2 | head -n 1)
13+
14+
# generate private key as PEM ans save it to tpm2
15+
openssl pkey -provider tpm2 -provider base -in handle:${HANDLE} -out tpmprivkey.pem
16+
17+
# Generate public key from handle
18+
openssl pkey -provider tpm2 -provider base -in tpmprivkey.pem -check -text -noout
19+
20+
# Generate public key from tss2 private keyc
21+
openssl pkey -provider tpm2 -provider base -in handle:${HANDLE} -check -text -noout
22+
23+
# convert PEM private key to DER
24+
openssl pkey -provider tpm2 -provider base -in tpmprivkey.pem -outform der -out testkey.der
25+
26+
# convert PEM private key handle to DER
27+
openssl pkey -provider tpm2 -provider base -in handle:${HANDLE} -outform der -out testkeyhandle.der
28+
29+
# read PEM from stdin and export public key as PEM
30+
cat tpmprivkey.pem | openssl pkey -provider tpm2 -provider base -pubout -out pubkey.pem
31+
32+
# read PEM from handle and export public key as PEM
33+
openssl pkey -provider tpm2 -provider base -in handle:${HANDLE} -pubout -out pubkeyhandle.pem
34+
35+
# display public key info
36+
openssl pkey -pubin -in pubkey.pem -text -noout
37+
openssl pkey -pubin -in pubkeyhandle.pem -text -noout
38+
39+
# release persistent handle
40+
tpm2_evictcontrol -c ${HANDLE}
41+
42+
rm testkey.der testkeyhandle.der pubkey.pem ek_rsa.ctx ak_rsa.ctx pubkeyhandle.pem tpmprivkey.pem

0 commit comments

Comments
 (0)