Skip to content

Commit 509bbd4

Browse files
JuergenReppSITAndreasFuchsTPM
JuergenReppSIT
authored and
AndreasFuchsTPM
committed
FAPI Test: Add compatibility test for old FAPI profiles.
The test fapi-second-provisioning is extended to check whether legacy profiles which might still be used produce the same SRK and EK as the new profiles where the initialization of the unique field can be adjusted. Signed-off-by: Juergen Repp <juergen_repp@web.de>
1 parent f5a80a5 commit 509bbd4

8 files changed

Lines changed: 452 additions & 3 deletions

File tree

‎Makefile.am‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -778,6 +778,10 @@ EXTRA_DIST += \
778778
test/data/fapi/P_ECC.json \
779779
test/data/fapi/P_ECC384.json \
780780
test/data/fapi/P_ECC_system.json \
781+
test/data/fapi/P_ECC384_no_unique_init.json \
782+
test/data/fapi/P_ECC_no_unique_init.json \
783+
test/data/fapi/P_RSA3072_no_unique_init.json \
784+
test/data/fapi/P_RSA_no_unique_init.json \
781785
test/data/fapi/policy/pol_pcr16_0.json \
782786
test/data/fapi/policy/pol_pcr16_0_rsa_authorized.json \
783787
test/data/fapi/policy/pol_pcr16_0_ecc_authorized.json \

‎src/tss2-fapi/fapi_util.c‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -597,10 +597,32 @@ ifapi_init_primary_async(FAPI_CONTEXT *context, TSS2_KEY_TYPE ktype)
597597
memcpy(context->cmd.Provision.public_templ.public.publicArea.unique.rsa.buffer,
598598
&pkey->nonce.buffer[0], pkey->nonce.size);
599599
}
600+
else if (! (context->cmd.Provision.public_templ.unique_rsa_set ||
601+
context->cmd.Provision.public_templ.unique_zero)) {
602+
/* is needed to be backward compatible to versions where unique
603+
is not set via the profile. */
604+
if ((context->cmd.Provision.public_templ.public.publicArea.objectAttributes &
605+
TPMA_OBJECT_USERWITHAUTH))
606+
context->cmd.Provision.public_templ.public.publicArea.unique.rsa.size = 0;
607+
else
608+
context->cmd.Provision.public_templ.public.publicArea.unique.rsa.size = 256;
609+
}
600610
} else if (context->cmd.Provision.public_templ.public.publicArea.type == TPM2_ALG_ECC) {
601611
if (pkey->nonce.size) {
602612
memcpy(context->cmd.Provision.public_templ.public.publicArea.unique.ecc.x.buffer,
603613
&pkey->nonce.buffer[0], pkey->nonce.size);
614+
} else if (! (context->cmd.Provision.public_templ.unique_ecc_set ||
615+
context->cmd.Provision.public_templ.unique_zero)) {
616+
/* is needed to be backward compatible to versions where unique
617+
is not set via the profile. */
618+
if ((context->cmd.Provision.public_templ.public.publicArea.objectAttributes &
619+
TPMA_OBJECT_USERWITHAUTH)) {
620+
context->cmd.Provision.public_templ.public.publicArea.unique.ecc.x.size = 0;
621+
context->cmd.Provision.public_templ.public.publicArea.unique.ecc.y.size = 0;
622+
} else {
623+
context->cmd.Provision.public_templ.public.publicArea.unique.ecc.x.size = 32;
624+
context->cmd.Provision.public_templ.public.publicArea.unique.ecc.y.size = 32;
625+
}
604626
}
605627
}
606628
policy = context->profiles.default_profile.ek_policy;

‎test/data/fapi/P_ECC.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"type": "TPM2_ALG_ECC",
33
"nameAlg":"TPM2_ALG_SHA256",
4-
"srk_template": "system,restricted,noda,decrypt,0x81000001",
4+
"srk_template": "system,restricted,decrypt,0x81000001",
55
"srk_description": "Storage root key SRK",
66
"ek_template": "system,restricted,decrypt,unique_zero=32",
77
"ek_description": "Endorsement key EK",

‎test/data/fapi/P_ECC384_no_unique_init.json‎

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
{
2+
"type": "TPM2_ALG_ECC",
3+
"nameAlg":"TPM2_ALG_SHA384",
4+
"srk_template": "system,restricted,decrypt,0x81000001",
5+
"srk_description": "Storage root key SRK",
6+
"ek_template": "system,restricted,decrypt,user",
7+
"ek_description": "Endorsement key EK",
8+
"ecc_signing_scheme": {
9+
"scheme":"TPM2_ALG_ECDSA",
10+
"details":{
11+
"hashAlg":"TPM2_ALG_SHA384"
12+
},
13+
},
14+
"sym_mode":"TPM2_ALG_CFB",
15+
"sym_parameters": {
16+
"algorithm":"TPM2_ALG_AES",
17+
"keyBits":"256",
18+
"mode":"TPM2_ALG_CFB"
19+
},
20+
"sym_block_size": 16,
21+
"pcr_selection": [
22+
{ "hash": "TPM2_ALG_SHA256",
23+
"pcrSelect": [ 8, 9, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23 ]
24+
},
25+
{ "hash": "TPM2_ALG_SHA384",
26+
"pcrSelect": [ ],
27+
}
28+
],
29+
"curveID": "TPM2_ECC_NIST_P384",
30+
"ek_policy": {
31+
"description": "Endorsement hierarchy used for policy secret.",
32+
"policy":[
33+
{
34+
"type": "PolicyOR",
35+
"branches": [
36+
{
37+
"name": "A",
38+
"description": "",
39+
"policy": [
40+
{
41+
"type":"POLICYSECRET",
42+
"objectName": "4000000b"
43+
}
44+
]
45+
},
46+
{
47+
"name": "B",
48+
"description": "",
49+
"policy": [
50+
{
51+
"type":"AUTHORIZENV",
52+
"nvPublic": {
53+
"size": 60,
54+
"nvPublic": {
55+
"nvIndex": 29392642,
56+
"nameAlg":"SHA384",
57+
"attributes":{
58+
"PPWRITE":0,
59+
"OWNERWRITE":0,
60+
"AUTHWRITE":0,
61+
"POLICYWRITE":1,
62+
"POLICY_DELETE":0,
63+
"WRITELOCKED":0,
64+
"WRITEALL":1,
65+
"WRITEDEFINE":0,
66+
"WRITE_STCLEAR":0,
67+
"GLOBALLOCK":0,
68+
"PPREAD":1,
69+
"OWNERREAD":1,
70+
"AUTHREAD":1,
71+
"POLICYREAD":1,
72+
"NO_DA":1,
73+
"ORDERLY":0,
74+
"CLEAR_STCLEAR":0,
75+
"READLOCKED":0,
76+
"WRITTEN":1,
77+
"PLATFORMCREATE":0,
78+
"READ_STCLEAR":0,
79+
"TPM2_NT":"ORDINARY"
80+
},
81+
"authPolicy":"8bbf2266537c171cb56e403c4dc1d4b64f432611dc386e6f532050c3278c930e143e8bb1133824ccb431053871c6db53",
82+
"dataSize":50
83+
}
84+
}
85+
86+
}
87+
]
88+
}
89+
]
90+
}
91+
]
92+
}
93+
}

‎test/data/fapi/P_ECC_no_unique_init.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"type": "TPM2_ALG_ECC",
3+
"nameAlg":"TPM2_ALG_SHA256",
4+
"srk_template": "system,restricted,decrypt,0x81000001",
5+
"srk_description": "Storage root key SRK",
6+
"ek_template": "system,restricted,decrypt",
7+
"ek_description": "Endorsement key EK",
8+
"ecc_signing_scheme": {
9+
"scheme":"TPM2_ALG_ECDSA",
10+
"details":{
11+
"hashAlg":"TPM2_ALG_SHA256"
12+
},
13+
},
14+
"sym_mode":"TPM2_ALG_CFB",
15+
"sym_parameters": {
16+
"algorithm":"TPM2_ALG_AES",
17+
"keyBits":"128",
18+
"mode":"TPM2_ALG_CFB"
19+
},
20+
"sym_block_size": 16,
21+
"pcr_selection": [
22+
{ "hash": "TPM2_ALG_SHA256",
23+
"pcrSelect": [ 8, 9, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23 ]
24+
}
25+
],
26+
"curveID": "TPM2_ECC_NIST_P256",
27+
"ek_policy": {
28+
"description": "Endorsement hierarchy used for policy secret.",
29+
"policy":[
30+
{
31+
"type":"POLICYSECRET",
32+
"objectName": "4000000b"
33+
}
34+
]
35+
}
36+
}

‎test/data/fapi/P_RSA3072_no_unique_init.json‎

Lines changed: 106 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,106 @@
1+
{
2+
"type": "TPM2_ALG_RSA",
3+
"nameAlg":"TPM2_ALG_SHA384",
4+
"srk_template": "system,restricted,decrypt,0x81000001",
5+
"srk_description": "Storage root key SRK",
6+
"ek_template": "system,restricted,decrypt,user",
7+
"ek_description": "Endorsement key EK",
8+
"rsa_signing_scheme": {
9+
"scheme":"TPM2_ALG_RSAPSS",
10+
"details":{
11+
"hashAlg":"TPM2_ALG_SHA384"
12+
}
13+
},
14+
"rsa_decrypt_scheme": {
15+
"scheme":"TPM2_ALG_OAEP",
16+
"details":{
17+
"hashAlg":"TPM2_ALG_SHA384"
18+
}
19+
},
20+
"sym_mode":"TPM2_ALG_CFB",
21+
"sym_parameters": {
22+
"algorithm":"TPM2_ALG_AES",
23+
"keyBits":"256",
24+
"mode":"TPM2_ALG_CFB"
25+
},
26+
"sym_block_size": 16,
27+
"pcr_selection": [
28+
{ "hash": "TPM2_ALG_SHA256",
29+
"pcrSelect": [ 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23 ]
30+
},
31+
{ "hash": "TPM2_ALG_SHA384",
32+
"pcrSelect": [ ]
33+
}
34+
],
35+
"exponent": 0,
36+
"keyBits": 3072,
37+
"session_symmetric":{
38+
"algorithm":"TPM2_ALG_AES",
39+
"keyBits":"256",
40+
"mode":"TPM2_ALG_CFB"
41+
},
42+
"ek_policy": {
43+
"description": "Endorsement hierarchy used for policy secret.",
44+
"policy":[
45+
{
46+
"type": "PolicyOR",
47+
"branches": [
48+
{
49+
"name": "A",
50+
"description": "",
51+
"policy": [
52+
{
53+
"type":"POLICYSECRET",
54+
"objectName": "4000000b"
55+
}
56+
]
57+
},
58+
{
59+
"name": "B",
60+
"description": "",
61+
"policy": [
62+
{
63+
"type":"AUTHORIZENV",
64+
"nvPublic": {
65+
"size": 60,
66+
"nvPublic": {
67+
"nvIndex": 29392642,
68+
"nameAlg":"SHA384",
69+
"attributes":{
70+
"PPWRITE":0,
71+
"OWNERWRITE":0,
72+
"AUTHWRITE":0,
73+
"POLICYWRITE":1,
74+
"POLICY_DELETE":0,
75+
"WRITELOCKED":0,
76+
"WRITEALL":1,
77+
"WRITEDEFINE":0,
78+
"WRITE_STCLEAR":0,
79+
"GLOBALLOCK":0,
80+
"PPREAD":1,
81+
"OWNERREAD":1,
82+
"AUTHREAD":1,
83+
"POLICYREAD":1,
84+
"NO_DA":1,
85+
"ORDERLY":0,
86+
"CLEAR_STCLEAR":0,
87+
"READLOCKED":0,
88+
"WRITTEN":1,
89+
"PLATFORMCREATE":0,
90+
"READ_STCLEAR":0,
91+
"TPM2_NT":"ORDINARY"
92+
},
93+
"authPolicy":"8bbf2266537c171cb56e403c4dc1d4b64f432611dc386e6f532050c3278c930e143e8bb1133824ccb431053871c6db53",
94+
"dataSize":50
95+
}
96+
}
97+
98+
}
99+
]
100+
}
101+
]
102+
}
103+
]
104+
}
105+
106+
}

‎test/data/fapi/P_RSA_no_unique_init.json‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
{
2+
"type": "TPM2_ALG_RSA",
3+
"nameAlg":"TPM2_ALG_SHA256",
4+
"srk_template": "system,restricted,decrypt,0x81000001",
5+
"srk_description": "Storage root key SRK",
6+
"ek_template": "system,restricted,decrypt",
7+
"ek_description": "Endorsement key EK",
8+
"rsa_signing_scheme": {
9+
"scheme":"TPM2_ALG_RSAPSS",
10+
"details":{
11+
"hashAlg":"TPM2_ALG_SHA256"
12+
}
13+
},
14+
"rsa_decrypt_scheme": {
15+
"scheme":"TPM2_ALG_OAEP",
16+
"details":{
17+
"hashAlg":"TPM2_ALG_SHA256"
18+
}
19+
},
20+
"sym_mode":"TPM2_ALG_CFB",
21+
"sym_parameters": {
22+
"algorithm":"TPM2_ALG_AES",
23+
"keyBits":"128",
24+
"mode":"TPM2_ALG_CFB"
25+
},
26+
"sym_block_size": 16,
27+
"pcr_selection": [
28+
{ "hash": "TPM2_ALG_SHA256",
29+
"pcrSelect": [ 8, 9 , 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23 ]
30+
}
31+
],
32+
"exponent": 0,
33+
"keyBits": 2048,
34+
"session_hash_alg": "TPM2_ALG_SHA256",
35+
"session_symmetric":{
36+
"algorithm":"TPM2_ALG_AES",
37+
"keyBits":"128",
38+
"mode":"TPM2_ALG_CFB"
39+
},
40+
"ek_policy": {
41+
"description": "Endorsement hierarchy used for policy secret.",
42+
"policy":[
43+
{
44+
"type":"POLICYSECRET",
45+
"objectName": "4000000b"
46+
}
47+
]
48+
}
49+
50+
}

0 commit comments

Comments
 (0)