Skip to content

Commit 2774bb4

Browse files
dgarskedgarske
committed
Improve TPM handle use logic further. Only load to TPM when needed.
1 parent ceb2550 commit 2774bb4

2 files changed

Lines changed: 78 additions & 100 deletions

File tree

‎src/internal.c‎

Lines changed: 74 additions & 100 deletions
Original file line numberDiff line numberDiff line change
@@ -6619,22 +6619,6 @@ int WP11_Object_SetRsaKey(WP11_Object* object, unsigned char** data,
66196619
key->type = RSA_PRIVATE;
66206620
}
66216621
}
6622-
#ifdef WOLFPKCS11_TPM
6623-
if (ret == 0 && key->type == RSA_PRIVATE) {
6624-
/* tell crypto callback which RsaKey to use*/
6625-
object->slot->tpmCtx.rsaKey = (WOLFTPM2_KEY*)&object->tpmKey;
6626-
/* load private key - populates handle */
6627-
ret = wolfTPM2_RsaKey_WolfToTpm_ex(&object->slot->tpmDev,
6628-
&object->slot->tpmSrk, &object->data.rsaKey,
6629-
(WOLFTPM2_KEY*)&object->tpmKey);
6630-
if (ret == 0) {
6631-
/* unload handle, but keep the WOLFTPM2 key populated,
6632-
* so we can load it again when needed */
6633-
wolfTPM2_UnloadHandle(&object->slot->tpmDev,
6634-
&object->tpmKey.handle);
6635-
}
6636-
}
6637-
#endif
66386622

66396623
if (ret != 0)
66406624
wc_FreeRsaKey(key);
@@ -6801,23 +6785,6 @@ int WP11_Object_SetEcKey(WP11_Object* object, unsigned char** data,
68016785
key->type = ECC_PUBLICKEY;
68026786
ret = EcSetPoint(key, data[2], (int)len[2]);
68036787
}
6804-
#ifdef WOLFPKCS11_TPM
6805-
if (ret == 0 &&
6806-
(key->type == ECC_PRIVATEKEY_ONLY || key->type == ECC_PRIVATEKEY)) {
6807-
/* tell crypto callback which RsaKey to use*/
6808-
object->slot->tpmCtx.eccKey = (WOLFTPM2_KEY*)&object->tpmKey;
6809-
/* load private key */
6810-
ret = wolfTPM2_EccKey_WolfToTpm_ex(&object->slot->tpmDev,
6811-
&object->slot->tpmSrk, &object->data.ecKey,
6812-
(WOLFTPM2_KEY*)&object->tpmKey);
6813-
if (ret == 0) {
6814-
/* unload handle, but keep the WOLFTPM2 key populated,
6815-
* so we can load it again when needed */
6816-
wolfTPM2_UnloadHandle(&object->slot->tpmDev,
6817-
&object->tpmKey.handle);
6818-
}
6819-
}
6820-
#endif
68216788

68226789
if (ret != 0)
68236790
wc_ecc_free(key);
@@ -8316,6 +8283,59 @@ int WP11_Object_MatchAttr(WP11_Object* object, CK_ATTRIBUTE_TYPE type,
83168283
return ret;
83178284
}
83188285

8286+
#if !defined(NO_RSA) || defined(HAVE_ECC)
8287+
8288+
static int WP11_Object_LoadTpmKey(WP11_Object* object)
8289+
{
8290+
int ret = 0;
8291+
8292+
if (object == NULL) {
8293+
return BAD_FUNC_ARG;
8294+
}
8295+
8296+
switch (object->type) {
8297+
#ifndef NO_RSA
8298+
case CKK_RSA:
8299+
{
8300+
RsaKey* key = &object->data.rsaKey;
8301+
if (key->type == RSA_PRIVATE) {
8302+
/* tell crypto callback which RsaKey to use*/
8303+
object->slot->tpmCtx.rsaKey = (WOLFTPM2_KEY*)&object->tpmKey;
8304+
/* load private key */
8305+
ret = wolfTPM2_RsaKey_WolfToTpm_ex(&object->slot->tpmDev,
8306+
&object->slot->tpmSrk, &object->data.rsaKey,
8307+
(WOLFTPM2_KEY*)&object->tpmKey);
8308+
}
8309+
break;
8310+
}
8311+
#endif
8312+
#ifdef HAVE_ECC
8313+
case CKK_EC:
8314+
{
8315+
ecc_key* key = &object->data.ecKey;
8316+
if (key->type == ECC_PRIVATEKEY_ONLY || key->type == ECC_PRIVATEKEY) {
8317+
/* tell crypto callback which RsaKey to use*/
8318+
object->slot->tpmCtx.eccKey = (WOLFTPM2_KEY*)&object->tpmKey;
8319+
/* load private key */
8320+
ret = wolfTPM2_EccKey_WolfToTpm_ex(&object->slot->tpmDev,
8321+
&object->slot->tpmSrk, &object->data.ecKey,
8322+
(WOLFTPM2_KEY*)&object->tpmKey);
8323+
}
8324+
break;
8325+
}
8326+
#endif
8327+
default:
8328+
/* not supported on TPM, don't load and return success to use software key */
8329+
ret = 0;
8330+
break;
8331+
}
8332+
8333+
return ret;
8334+
}
8335+
8336+
#endif
8337+
8338+
83198339
#ifndef NO_RSA
83208340

83218341
/**
@@ -8519,22 +8539,16 @@ int WP11_Rsa_PrivateDecrypt(unsigned char* in, word32 inLen, unsigned char* out,
85198539
ret = Rng_New(&slot->token.rng, &slot->token.rngLock, &rng);
85208540
if (ret == 0) {
85218541
#ifdef WOLFPKCS11_TPM
8522-
if (priv->opFlag & WP11_FLAG_TPM) {
8523-
/* load TPM key */
8524-
ret = wolfTPM2_LoadKey(&slot->tpmDev, &priv->tpmKey,
8525-
&slot->tpmCtx.storageKey->handle);
8526-
}
8542+
ret = WP11_Object_LoadTpmKey(priv);
85278543
if (ret == 0)
85288544
#endif
85298545
{
85308546
ret = wc_RsaFunction(in, inLen, out, outLen, RSA_PRIVATE_DECRYPT,
85318547
&priv->data.rsaKey, &rng);
8532-
}
8533-
#ifdef WOLFPKCS11_TPM
8534-
if (priv->opFlag & WP11_FLAG_TPM) {
8548+
#ifdef WOLFPKCS11_TPM
85358549
wolfTPM2_UnloadHandle(&slot->tpmDev, &priv->tpmKey.handle);
8550+
#endif
85368551
}
8537-
#endif
85388552
Rng_Free(&rng);
85398553
}
85408554
if (priv->onToken)
@@ -8617,11 +8631,7 @@ int WP11_RsaPkcs15_PrivateDecrypt(unsigned char* in, word32 inLen,
86178631
#endif
86188632

86198633
#ifdef WOLFPKCS11_TPM
8620-
if (priv->opFlag & WP11_FLAG_TPM) {
8621-
/* load TPM key */
8622-
ret = wolfTPM2_LoadKey(&slot->tpmDev, &priv->tpmKey,
8623-
&slot->tpmCtx.storageKey->handle);
8624-
}
8634+
ret = WP11_Object_LoadTpmKey(priv);
86258635
if (ret == 0)
86268636
#endif
86278637
{
@@ -8634,9 +8644,7 @@ int WP11_RsaPkcs15_PrivateDecrypt(unsigned char* in, word32 inLen,
86348644
}
86358645

86368646
#ifdef WOLFPKCS11_TPM
8637-
if (priv->opFlag & WP11_FLAG_TPM) {
8638-
wolfTPM2_UnloadHandle(&slot->tpmDev, &priv->tpmKey.handle);
8639-
}
8647+
wolfTPM2_UnloadHandle(&slot->tpmDev, &priv->tpmKey.handle);
86408648
#endif
86418649
}
86428650

@@ -8738,11 +8746,7 @@ int WP11_RsaOaep_PrivateDecrypt(unsigned char* in, word32 inLen,
87388746
#endif
87398747

87408748
#ifdef WOLFPKCS11_TPM
8741-
if (priv->opFlag & WP11_FLAG_TPM) {
8742-
/* load TPM key */
8743-
ret = wolfTPM2_LoadKey(&slot->tpmDev, &priv->tpmKey,
8744-
&slot->tpmCtx.storageKey->handle);
8745-
}
8749+
ret = WP11_Object_LoadTpmKey(priv);
87468750
if (ret == 0)
87478751
#endif
87488752
{
@@ -8755,10 +8759,8 @@ int WP11_RsaOaep_PrivateDecrypt(unsigned char* in, word32 inLen,
87558759
ret = 0;
87568760
}
87578761

8758-
#ifdef WOLFPKCS11_TPM
8759-
if (priv->opFlag & WP11_FLAG_TPM) {
8760-
wolfTPM2_UnloadHandle(&slot->tpmDev, &priv->tpmKey.handle);
8761-
}
8762+
#ifdef WOLFPKCS11_TPM
8763+
wolfTPM2_UnloadHandle(&slot->tpmDev, &priv->tpmKey.handle);
87628764
#endif
87638765
}
87648766

@@ -8819,11 +8821,7 @@ int WP11_Rsa_Sign(unsigned char* in, word32 inLen, unsigned char* sig,
88198821
ret = Rng_New(&slot->token.rng, &slot->token.rngLock, &rng);
88208822
if (ret == 0) {
88218823
#ifdef WOLFPKCS11_TPM
8822-
if (priv->opFlag & WP11_FLAG_TPM) {
8823-
/* load TPM key */
8824-
ret = wolfTPM2_LoadKey(&slot->tpmDev, &priv->tpmKey,
8825-
&slot->tpmCtx.storageKey->handle);
8826-
}
8824+
ret = WP11_Object_LoadTpmKey(priv);
88278825
if (ret == 0)
88288826
#endif
88298827
{
@@ -8835,9 +8833,7 @@ int WP11_Rsa_Sign(unsigned char* in, word32 inLen, unsigned char* sig,
88358833
}
88368834

88378835
#ifdef WOLFPKCS11_TPM
8838-
if (priv->opFlag & WP11_FLAG_TPM) {
8839-
wolfTPM2_UnloadHandle(&slot->tpmDev, &priv->tpmKey.handle);
8840-
}
8836+
wolfTPM2_UnloadHandle(&slot->tpmDev, &priv->tpmKey.handle);
88418837
#endif
88428838
}
88438839

@@ -8987,11 +8983,7 @@ int WP11_RsaPkcs15_Sign(unsigned char* encHash, word32 encHashLen,
89878983
ret = Rng_New(&slot->token.rng, &slot->token.rngLock, &rng);
89888984
if (ret == 0) {
89898985
#ifdef WOLFPKCS11_TPM
8990-
if (priv->opFlag & WP11_FLAG_TPM) {
8991-
/* load TPM key */
8992-
ret = wolfTPM2_LoadKey(&slot->tpmDev, &priv->tpmKey,
8993-
&slot->tpmCtx.storageKey->handle);
8994-
}
8986+
ret = WP11_Object_LoadTpmKey(priv);
89958987
if (ret == 0)
89968988
#endif
89978989
{
@@ -9002,9 +8994,7 @@ int WP11_RsaPkcs15_Sign(unsigned char* encHash, word32 encHashLen,
90028994
ret = 0;
90038995
}
90048996
#ifdef WOLFPKCS11_TPM
9005-
if (priv->opFlag & WP11_FLAG_TPM) {
9006-
wolfTPM2_UnloadHandle(&slot->tpmDev, &priv->tpmKey.handle);
9007-
}
8997+
wolfTPM2_UnloadHandle(&slot->tpmDev, &priv->tpmKey.handle);
90088998
#endif
90098999
}
90109000
Rng_Free(&rng);
@@ -9086,11 +9076,7 @@ int WP11_RsaPKCSPSS_Sign(unsigned char* hash, word32 hashLen,
90869076
ret = Rng_New(&slot->token.rng, &slot->token.rngLock, &rng);
90879077
if (ret == 0) {
90889078
#ifdef WOLFPKCS11_TPM
9089-
if (priv->opFlag & WP11_FLAG_TPM) {
9090-
/* load TPM key */
9091-
ret = wolfTPM2_LoadKey(&slot->tpmDev, &priv->tpmKey,
9092-
&slot->tpmCtx.storageKey->handle);
9093-
}
9079+
ret = WP11_Object_LoadTpmKey(priv);
90949080
if (ret == 0)
90959081
#endif
90969082
{
@@ -9102,9 +9088,7 @@ int WP11_RsaPKCSPSS_Sign(unsigned char* hash, word32 hashLen,
91029088
ret = 0;
91039089
}
91049090
#ifdef WOLFPKCS11_TPM
9105-
if (priv->opFlag & WP11_FLAG_TPM) {
9106-
wolfTPM2_UnloadHandle(&slot->tpmDev, &priv->tpmKey.handle);
9107-
}
9091+
wolfTPM2_UnloadHandle(&slot->tpmDev, &priv->tpmKey.handle);
91089092
#endif
91099093
}
91109094
Rng_Free(&rng);
@@ -9416,22 +9400,17 @@ int WP11_Ec_Sign(unsigned char* hash, word32 hashLen, unsigned char* sig,
94169400
ret = Rng_New(&slot->token.rng, &slot->token.rngLock, &rng);
94179401
if (ret == 0) {
94189402
#ifdef WOLFPKCS11_TPM
9419-
if (priv->opFlag & WP11_FLAG_TPM) {
9420-
/* load TPM key */
9421-
ret = wolfTPM2_LoadKey(&slot->tpmDev, &priv->tpmKey,
9422-
&slot->tpmCtx.storageKey->handle);
9423-
}
9403+
ret = WP11_Object_LoadTpmKey(priv);
94249404
if (ret == 0)
94259405
#endif
94269406
{
94279407
ret = wc_ecc_sign_hash(hash, hashLen, encSig, &encSigLen, &rng,
94289408
&priv->data.ecKey);
9429-
}
9430-
#ifdef WOLFPKCS11_TPM
9431-
if (priv->opFlag & WP11_FLAG_TPM) {
9409+
9410+
#ifdef WOLFPKCS11_TPM
94329411
wolfTPM2_UnloadHandle(&slot->tpmDev, &priv->tpmKey.handle);
9412+
#endif
94339413
}
9434-
#endif
94359414
Rng_Free(&rng);
94369415
}
94379416

@@ -9551,21 +9530,16 @@ int WP11_EC_Derive(unsigned char* point, word32 pointLen, unsigned char* key,
95519530
if (priv->onToken)
95529531
WP11_Lock_LockRO(priv->lock);
95539532
#ifdef WOLFPKCS11_TPM
9554-
if (priv->opFlag & WP11_FLAG_TPM) {
9555-
/* load TPM key */
9556-
ret = wolfTPM2_LoadKey(&priv->slot->tpmDev, &priv->tpmKey,
9557-
&priv->slot->tpmCtx.storageKey->handle);
9558-
}
9533+
ret = WP11_Object_LoadTpmKey(priv);
95599534
if (ret == 0)
95609535
#endif
95619536
{
95629537
PRIVATE_KEY_UNLOCK();
95639538
ret = wc_ecc_shared_secret(&priv->data.ecKey, &pubKey, key, &keyLen);
95649539
PRIVATE_KEY_LOCK();
9540+
95659541
#ifdef WOLFPKCS11_TPM
9566-
if (priv->opFlag & WP11_FLAG_TPM) {
9567-
wolfTPM2_UnloadHandle(&priv->slot->tpmDev, &priv->tpmKey.handle);
9568-
}
9542+
wolfTPM2_UnloadHandle(&priv->slot->tpmDev, &priv->tpmKey.handle);
95699543
#endif
95709544
}
95719545
if (priv->onToken)

‎tests/unit.h‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -321,6 +321,10 @@ static CK_RV run_tests(TEST_FUNC* testFunc, int testFuncCnt, int onlySet,
321321
int i;
322322
void* testArgs;
323323

324+
if (verbose) {
325+
wolfPKCS11_Debugging_On();
326+
}
327+
324328
for (i = 0; i < testFuncCnt; i++) {
325329
if (testFunc[i].flags != flags)
326330
continue;

0 commit comments

Comments
 (0)