Skip to content

Commit bce749c

Browse files
aidangarskeaidangarske
committed
fwTPM v185: final skoll reivew pass
1 parent 6c6a2a8 commit bce749c

11 files changed

Lines changed: 519 additions & 41 deletions

File tree

‎.github/workflows/pqc-examples.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -139,8 +139,10 @@ jobs:
139139
env:
140140
WOLFSSL_PATH: ${{ github.workspace }}/wolfssl
141141
run: |
142+
set +e
142143
bash -x ./examples/run_examples.sh
143144
rc=$?
145+
set -e
144146
if [ $rc -ne 0 ]; then
145147
echo "=== run.out (last 200 lines) ==="
146148
tail -200 run.out

‎examples/pqc/mldsa_sign.c‎

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -72,8 +72,10 @@ static int mldsa_sign_run(int argc, char *argv[])
7272
TPMT_TK_VERIFIED validation;
7373
byte message[] = "wolfTPM PQC example: Pure ML-DSA sign/verify";
7474
int messageSz = (int)sizeof(message) - 1;
75-
byte sig[5000]; /* ML-DSA-87 sig = 4627 bytes; slack included */
76-
int sigSz = (int)sizeof(sig);
75+
/* ML-DSA-87 sig = 4627 bytes; heap-alloc to keep stack small. */
76+
byte* sig = NULL;
77+
int sigBufSz = 5000;
78+
int sigSz = sigBufSz;
7779

7880
if (argc >= 2) {
7981
if (XSTRCMP(argv[1], "-?") == 0 ||
@@ -110,10 +112,17 @@ static int mldsa_sign_run(int argc, char *argv[])
110112
paramSet == TPM_MLDSA_44 ? "44" :
111113
paramSet == TPM_MLDSA_87 ? "87" : "65");
112114

115+
sig = (byte*)XMALLOC(sigBufSz, NULL, DYNAMIC_TYPE_TMP_BUFFER);
116+
if (sig == NULL) {
117+
printf("XMALLOC sig failed\n");
118+
return MEMORY_E;
119+
}
120+
113121
rc = wolfTPM2_Init(&dev, TPM2_IoCb, NULL);
114122
if (rc != TPM_RC_SUCCESS) {
115123
printf("wolfTPM2_Init failed 0x%x: %s\n",
116124
rc, wolfTPM2_GetRCString(rc));
125+
XFREE(sig, NULL, DYNAMIC_TYPE_TMP_BUFFER);
117126
return rc;
118127
}
119128

@@ -186,6 +195,7 @@ static int mldsa_sign_run(int argc, char *argv[])
186195
exit:
187196
wolfTPM2_UnloadHandle(&dev, &mldsaKey.handle);
188197
wolfTPM2_Cleanup(&dev);
198+
XFREE(sig, NULL, DYNAMIC_TYPE_TMP_BUFFER);
189199
return rc;
190200
}
191201

‎examples/pqc/mlkem_encap.c‎

Lines changed: 13 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -61,8 +61,10 @@ static int mlkem_encap_run(int argc, char *argv[])
6161
WOLFTPM2_KEY mlkemKey;
6262
TPMT_PUBLIC pubTemplate;
6363
TPMI_MLKEM_PARAMETER_SET paramSet = TPM_MLKEM_768;
64-
byte ciphertext[1600];
65-
int ciphertextSz = (int)sizeof(ciphertext);
64+
/* MLKEM-1024 ct = 1568 bytes; heap-alloc to keep stack small. */
65+
byte* ciphertext = NULL;
66+
int ciphertextBufSz = 1600;
67+
int ciphertextSz = ciphertextBufSz;
6668
byte sharedSecret1[64];
6769
int sharedSecret1Sz = (int)sizeof(sharedSecret1);
6870
byte sharedSecret2[64];
@@ -96,7 +98,6 @@ static int mlkem_encap_run(int argc, char *argv[])
9698
XMEMSET(&dev, 0, sizeof(dev));
9799
XMEMSET(&mlkemKey, 0, sizeof(mlkemKey));
98100
XMEMSET(&pubTemplate, 0, sizeof(pubTemplate));
99-
XMEMSET(ciphertext, 0, sizeof(ciphertext));
100101
XMEMSET(sharedSecret1, 0, sizeof(sharedSecret1));
101102
XMEMSET(sharedSecret2, 0, sizeof(sharedSecret2));
102103

@@ -105,10 +106,18 @@ static int mlkem_encap_run(int argc, char *argv[])
105106
paramSet == TPM_MLKEM_512 ? "512" :
106107
paramSet == TPM_MLKEM_1024 ? "1024" : "768");
107108

109+
ciphertext = (byte*)XMALLOC(ciphertextBufSz, NULL,
110+
DYNAMIC_TYPE_TMP_BUFFER);
111+
if (ciphertext == NULL) {
112+
printf("XMALLOC ciphertext failed\n");
113+
return MEMORY_E;
114+
}
115+
108116
rc = wolfTPM2_Init(&dev, TPM2_IoCb, NULL);
109117
if (rc != TPM_RC_SUCCESS) {
110118
printf("wolfTPM2_Init failed 0x%x: %s\n",
111119
rc, wolfTPM2_GetRCString(rc));
120+
XFREE(ciphertext, NULL, DYNAMIC_TYPE_TMP_BUFFER);
112121
return rc;
113122
}
114123

@@ -161,6 +170,7 @@ static int mlkem_encap_run(int argc, char *argv[])
161170
wc_ForceZero(sharedSecret2, sizeof(sharedSecret2));
162171
wolfTPM2_UnloadHandle(&dev, &mlkemKey.handle);
163172
wolfTPM2_Cleanup(&dev);
173+
XFREE(ciphertext, NULL, DYNAMIC_TYPE_TMP_BUFFER);
164174
return rc;
165175
}
166176

‎examples/pqc/pqc_mssim_e2e.c‎

Lines changed: 20 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -62,24 +62,31 @@ static int test_mlkem_roundtrip(WOLFTPM2_DEV* dev)
6262
int rc;
6363
byte ss1[32], ss2[32];
6464
int ss1Sz = sizeof(ss1), ss2Sz = sizeof(ss2);
65-
byte ct[MAX_MLKEM_CT_SIZE];
66-
int ctSz = sizeof(ct);
65+
/* MLKEM ciphertext can be up to 1568 bytes — heap-alloc. */
66+
byte* ct = NULL;
67+
int ctBufSz = MAX_MLKEM_CT_SIZE;
68+
int ctSz = ctBufSz;
6769

6870
XMEMSET(&mlkem, 0, sizeof(mlkem));
6971
XMEMSET(&tpl, 0, sizeof(tpl));
7072

73+
ct = (byte*)XMALLOC(ctBufSz, NULL, DYNAMIC_TYPE_TMP_BUFFER);
74+
if (ct == NULL) return MEMORY_E;
75+
7176
rc = wolfTPM2_GetKeyTemplate_MLKEM(&tpl,
7277
TPMA_OBJECT_decrypt | TPMA_OBJECT_fixedTPM | TPMA_OBJECT_fixedParent |
7378
TPMA_OBJECT_sensitiveDataOrigin | TPMA_OBJECT_userWithAuth,
7479
TPM_MLKEM_768);
7580
if (rc != 0) {
7681
printf("GetKeyTemplate_MLKEM rc=%d\n", rc);
82+
XFREE(ct, NULL, DYNAMIC_TYPE_TMP_BUFFER);
7783
return rc;
7884
}
7985

8086
rc = wolfTPM2_CreatePrimaryKey(dev, &mlkem, TPM_RH_OWNER, &tpl, NULL, 0);
8187
if (rc != 0) {
8288
printf("CreatePrimary(MLKEM-768) rc=%d\n", rc);
89+
XFREE(ct, NULL, DYNAMIC_TYPE_TMP_BUFFER);
8390
return rc;
8491
}
8592

@@ -121,6 +128,7 @@ static int test_mlkem_roundtrip(WOLFTPM2_DEV* dev)
121128
wc_ForceZero(ss1, sizeof(ss1));
122129
wc_ForceZero(ss2, sizeof(ss2));
123130
wolfTPM2_UnloadHandle(dev, &mlkem.handle);
131+
XFREE(ct, NULL, DYNAMIC_TYPE_TMP_BUFFER);
124132
return rc;
125133
}
126134

@@ -130,27 +138,34 @@ static int test_hash_mldsa_digest_roundtrip(WOLFTPM2_DEV* dev)
130138
TPMT_PUBLIC tpl;
131139
int rc;
132140
byte digest[32];
133-
byte sig[MAX_MLDSA_SIG_SIZE];
134-
int sigSz = sizeof(sig);
141+
/* MLDSA-87 sig = 4627 bytes — heap-alloc to keep stack small. */
142+
byte* sig = NULL;
143+
int sigBufSz = MAX_MLDSA_SIG_SIZE;
144+
int sigSz = sigBufSz;
135145
TPMT_TK_VERIFIED validation;
136146

137147
XMEMSET(&mldsa, 0, sizeof(mldsa));
138148
XMEMSET(&tpl, 0, sizeof(tpl));
139149
XMEMSET(&validation, 0, sizeof(validation));
140150
XMEMSET(digest, 0xAA, sizeof(digest));
141151

152+
sig = (byte*)XMALLOC(sigBufSz, NULL, DYNAMIC_TYPE_TMP_BUFFER);
153+
if (sig == NULL) return MEMORY_E;
154+
142155
rc = wolfTPM2_GetKeyTemplate_HASH_MLDSA(&tpl,
143156
TPMA_OBJECT_sign | TPMA_OBJECT_fixedTPM | TPMA_OBJECT_fixedParent |
144157
TPMA_OBJECT_sensitiveDataOrigin | TPMA_OBJECT_userWithAuth,
145158
TPM_MLDSA_65, TPM_ALG_SHA256);
146159
if (rc != 0) {
147160
printf("GetKeyTemplate_HASH_MLDSA rc=%d\n", rc);
161+
XFREE(sig, NULL, DYNAMIC_TYPE_TMP_BUFFER);
148162
return rc;
149163
}
150164

151165
rc = wolfTPM2_CreatePrimaryKey(dev, &mldsa, TPM_RH_OWNER, &tpl, NULL, 0);
152166
if (rc != 0) {
153167
printf("CreatePrimary(HashMLDSA-65) rc=%d\n", rc);
168+
XFREE(sig, NULL, DYNAMIC_TYPE_TMP_BUFFER);
154169
return rc;
155170
}
156171

@@ -196,6 +211,7 @@ static int test_hash_mldsa_digest_roundtrip(WOLFTPM2_DEV* dev)
196211

197212
cleanup:
198213
wolfTPM2_UnloadHandle(dev, &mldsa.handle);
214+
XFREE(sig, NULL, DYNAMIC_TYPE_TMP_BUFFER);
199215
return rc;
200216
}
201217

‎examples/run_examples.sh‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,9 @@ if [ -z "$ENABLE_V185" ]; then
3333
ENABLE_V185=0
3434
for cfg in src/config.h config.h ../src/config.h ../config.h \
3535
wolftpm/options.h wolftpm/version.h; do
36-
if [ -f "$cfg" ] && grep -q "WOLFTPM_V185[[:space:]]*1" "$cfg"; then
36+
if [ -f "$cfg" ] && grep -qE \
37+
'^[[:space:]]*#[[:space:]]*define[[:space:]]+WOLFTPM_V185([[:space:]]|$)' \
38+
"$cfg"; then
3739
ENABLE_V185=1
3840
break
3941
fi

‎src/fwtpm/fwtpm_command.c‎

Lines changed: 62 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -7154,6 +7154,9 @@ static TPM_RC FwCmd_SequenceComplete(FWTPM_CTX* ctx, TPM2_Packet* cmd,
71547154
TPMI_ALG_HASH hashAlg = TPM_ALG_NULL;
71557155
int paramSzPos, paramStart;
71567156
int trc;
7157+
#ifdef WOLFTPM_V185
7158+
FWTPM_SignSeq* misRoutedSign = NULL;
7159+
#endif
71577160

71587161
FWTPM_ALLOC_BUF(dataBuf, FWTPM_MAX_DATA_BUF);
71597162

@@ -7167,6 +7170,11 @@ static TPM_RC FwCmd_SequenceComplete(FWTPM_CTX* ctx, TPM2_Packet* cmd,
71677170
seq = FwFindHashSeq(ctx, seqHandle);
71687171
if (seq == NULL) {
71697172
rc = TPM_RC_HANDLE;
7173+
#ifdef WOLFTPM_V185
7174+
/* Free a sign/verify slot mis-routed here so it doesn't leak. */
7175+
misRoutedSign = FwFindSignSeq(ctx, seqHandle);
7176+
if (misRoutedSign != NULL) FwFreeSignSeq(misRoutedSign);
7177+
#endif
71707178
}
71717179
else {
71727180
hashAlg = seq->hashAlg;
@@ -13054,9 +13062,10 @@ static TPM_RC FwCmd_Encapsulate(FWTPM_CTX* ctx, TPM2_Packet* cmd, int cmdSize,
1305413062
if (rc == 0 && cmdTag == TPM_ST_SESSIONS) {
1305513063
rc = FwSkipAuthArea(cmd, cmdSize);
1305613064
}
13057-
/* Two KEM types per Part 2 Sec.10.3.13 Table 100: ML-KEM (FIPS 203) and
13058-
* ECC DHKEM (RFC 9180 Sec.4.1). For ECC the kdf scheme MUST be HKDF
13059-
* (Part 2 Sec.12.2.3.5) — TPM_RC_KEY for any other key type or unset kdf. */
13065+
/* KEM types per Part 2 Sec.10.3.13 Table 100: ML-KEM (FIPS 203) and ECC
13066+
* DHKEM (RFC 9180 Sec.4.1, ECC kdf MUST be HKDF). Part 3 Sec.14.10.1
13067+
* explicitly says the TPM does NOT verify objectAttributes here (only
13068+
* the public portion may be loaded), so no decrypt/restricted check. */
1306013069
if (rc == 0) {
1306113070
if (obj->pub.type == TPM_ALG_MLKEM) {
1306213071
ps = obj->pub.parameters.mlkemDetail.parameterSet;
@@ -13311,13 +13320,15 @@ static TPM_RC FwCmd_SignSequenceStart(FWTPM_CTX* ctx, TPM2_Packet* cmd,
1331113320
rc = TPM_RC_KEY;
1331213321
}
1331313322
/* Accept ML-DSA, Hash-ML-DSA, classical RSA/ECC, and KEYEDHASH
13314-
* (HMAC) signing keys. Other types (SM2, ECSCHNORR) unsupported. */
13323+
* (HMAC) signing keys. Other types (SYMCIPHER, SM2, ECSCHNORR)
13324+
* map to TPM_RC_KEY ("not a signing key" — Part 3 Sec.17.5.1
13325+
* reserves TPM_RC_SCHEME for the NULL-scheme case below). */
1331513326
else if (obj->pub.type != TPM_ALG_MLDSA &&
1331613327
obj->pub.type != TPM_ALG_HASH_MLDSA &&
1331713328
obj->pub.type != TPM_ALG_RSA &&
1331813329
obj->pub.type != TPM_ALG_ECC &&
1331913330
obj->pub.type != TPM_ALG_KEYEDHASH) {
13320-
rc = TPM_RC_SCHEME;
13331+
rc = TPM_RC_KEY;
1332113332
}
1332213333
}
1332313334

@@ -13336,6 +13347,9 @@ static TPM_RC FwCmd_SignSequenceStart(FWTPM_CTX* ctx, TPM2_Packet* cmd,
1333613347
if (authSz > sizeof(((TPM2B_AUTH*)0)->buffer)) {
1333713348
rc = TPM_RC_SIZE;
1333813349
}
13350+
else if (cmd->pos + authSz > cmdSize) {
13351+
rc = TPM_RC_COMMAND_SIZE;
13352+
}
1333913353
}
1334013354
/* Parse context (TPM2B_SIGNATURE_CTX) */
1334113355
if (rc == 0) {
@@ -13475,13 +13489,15 @@ static TPM_RC FwCmd_VerifySequenceStart(FWTPM_CTX* ctx, TPM2_Packet* cmd,
1347513489
rc = TPM_RC_KEY;
1347613490
}
1347713491
/* Accept ML-DSA, Hash-ML-DSA, classical RSA/ECC, and KEYEDHASH
13478-
* (HMAC) signing keys. */
13492+
* (HMAC) signing keys. Other types map to TPM_RC_KEY per
13493+
* Part 3 Sec.17.6.1 (TPM_RC_SCHEME is reserved for the
13494+
* NULL-scheme case below). */
1347913495
else if (obj->pub.type != TPM_ALG_MLDSA &&
1348013496
obj->pub.type != TPM_ALG_HASH_MLDSA &&
1348113497
obj->pub.type != TPM_ALG_RSA &&
1348213498
obj->pub.type != TPM_ALG_ECC &&
1348313499
obj->pub.type != TPM_ALG_KEYEDHASH) {
13484-
rc = TPM_RC_SCHEME;
13500+
rc = TPM_RC_KEY;
1348513501
}
1348613502
}
1348713503

@@ -13497,6 +13513,9 @@ static TPM_RC FwCmd_VerifySequenceStart(FWTPM_CTX* ctx, TPM2_Packet* cmd,
1349713513
if (authSz > sizeof(((TPM2B_AUTH*)0)->buffer)) {
1349813514
rc = TPM_RC_SIZE;
1349913515
}
13516+
else if (cmd->pos + authSz > cmdSize) {
13517+
rc = TPM_RC_COMMAND_SIZE;
13518+
}
1350013519
}
1350113520
if (rc == 0) {
1350213521
seq = FwAllocSignSeq(ctx, &seqHandle);
@@ -13509,8 +13528,11 @@ static TPM_RC FwCmd_VerifySequenceStart(FWTPM_CTX* ctx, TPM2_Packet* cmd,
1350913528
TPM2_Packet_ParseBytes(cmd, seq->authValue.buffer, authSz);
1351013529

1351113530
TPM2_Packet_ParseU16(cmd, &hintSz);
13512-
/* Part 2 Sec.11.3.9: hint MUST be zero-length for non-EdDSA schemes.
13513-
* Reject any non-zero hint up front; nothing to consume on the wire. */
13531+
/* Part 3 Sec.17.6.1: hint carries the EdDSA R for EDDSA verify;
13532+
* MUST be zero-length for all other schemes. wolfTPM does not yet
13533+
* implement EDDSA verify-sequences (no TPM_ALG_EDDSA dispatch in
13534+
* VerifySequenceComplete), so reject any non-zero hint with
13535+
* TPM_RC_VALUE. Re-gate this on obj->pub.type when EDDSA is added. */
1351413536
if (hintSz > 0) {
1351513537
rc = TPM_RC_VALUE;
1351613538
}
@@ -13633,7 +13655,13 @@ static TPM_RC FwCmd_SignSequenceComplete(FWTPM_CTX* ctx, TPM2_Packet* cmd,
1363313655
TPM2_Packet_ParseU32(cmd, &sequenceHandle);
1363413656
TPM2_Packet_ParseU32(cmd, &keyHandle);
1363513657
seq = FwFindSignSeq(ctx, sequenceHandle);
13636-
if (seq == NULL || seq->isVerifySeq) {
13658+
/* NULL out seq for a peer's verify-sequence so cleanup
13659+
* doesn't free their slot. */
13660+
if (seq != NULL && seq->isVerifySeq) {
13661+
seq = NULL;
13662+
rc = TPM_RC_HANDLE;
13663+
}
13664+
else if (seq == NULL) {
1363713665
rc = TPM_RC_HANDLE;
1363813666
}
1363913667
}
@@ -13879,12 +13907,15 @@ static TPM_RC FwCmd_SignSequenceComplete(FWTPM_CTX* ctx, TPM2_Packet* cmd,
1387913907
rc = TPM_RC_SCHEME;
1388013908
}
1388113909
else {
13882-
paramStart = FwRspParamsBegin(rsp, cmdTag, &paramSzPos);
13910+
paramStart = FwRspParamsBegin(rsp, cmdTag,
13911+
&paramSzPos);
1388313912
rc = FwSignDigestAndAppend(ctx, keyObj,
1388413913
schemeAlg, hashAlg,
1388513914
digestOut, digestSz, rsp);
13915+
/* Always pair Begin with End so the param-size
13916+
* back-patch fires even on failure. */
13917+
FwRspParamsEnd(rsp, cmdTag, paramSzPos, paramStart);
1388613918
if (rc == 0) {
13887-
FwRspParamsEnd(rsp, cmdTag, paramSzPos, paramStart);
1388813919
FwFreeSignSeq(seq);
1388913920
FWTPM_FREE_BUF(msgBuf);
1389013921
FWTPM_FREE_VAR(sigOut);
@@ -13983,7 +14014,13 @@ static TPM_RC FwCmd_VerifySequenceComplete(FWTPM_CTX* ctx, TPM2_Packet* cmd,
1398314014
TPM2_Packet_ParseU32(cmd, &sequenceHandle);
1398414015
TPM2_Packet_ParseU32(cmd, &keyHandle);
1398514016
seq = FwFindSignSeq(ctx, sequenceHandle);
13986-
if (seq == NULL || !seq->isVerifySeq) {
14017+
/* NULL out seq for a peer's sign-sequence so cleanup
14018+
* doesn't free their slot. */
14019+
if (seq != NULL && !seq->isVerifySeq) {
14020+
seq = NULL;
14021+
rc = TPM_RC_HANDLE;
14022+
}
14023+
else if (seq == NULL) {
1398714024
rc = TPM_RC_HANDLE;
1398814025
}
1398914026
}
@@ -14473,6 +14510,12 @@ static TPM_RC FwCmd_SignDigest(FWTPM_CTX* ctx, TPM2_Packet* cmd, int cmdSize,
1447314510
if (sigScheme == TPM_ALG_NULL || sigHashAlg == TPM_ALG_NULL) {
1447414511
rc = TPM_RC_SCHEME;
1447514512
}
14513+
else if (digest->size !=
14514+
(UINT16)TPM2_GetHashDigestSize(sigHashAlg)) {
14515+
/* Part 3 Sec.20.7.1: digest size MUST match the hashAlg
14516+
* digest size for ALL signing schemes. */
14517+
rc = TPM_RC_SIZE;
14518+
}
1447614519
else {
1447714520
rc = FwSignDigestAndAppend(ctx, obj, sigScheme, sigHashAlg,
1447814521
digest->buffer, digest->size, rsp);
@@ -14654,6 +14697,12 @@ static TPM_RC FwCmd_VerifyDigestSignature(FWTPM_CTX* ctx, TPM2_Packet* cmd,
1465414697
keyHashAlg != classicalSig.signature.any.hashAlg) {
1465514698
rc = TPM_RC_SCHEME;
1465614699
}
14700+
else if (digest->size !=
14701+
(UINT16)TPM2_GetHashDigestSize(keyHashAlg)) {
14702+
/* Part 3 Sec.20.4.1: digest size MUST match the hashAlg
14703+
* digest size for ALL signing schemes. */
14704+
rc = TPM_RC_SIZE;
14705+
}
1465714706
else {
1465814707
rc = FwVerifySignatureCore(obj, digest->buffer, digest->size,
1465914708
&classicalSig);

0 commit comments

Comments
 (0)