Skip to content

Commit 2c73a2a

Browse files
THS-onansasaki
THS-on
authored and
ansasaki
committed
Enable non standard key sizes and curves for EK and AK
Add the missing argument when calling create_ak() to the push model prototype Signed-off-by: Thore Sommer <[email protected]> Signed-off-by: Anderson Toshiyuki Sasaki <[email protected]>
1 parent 6a3ab57 commit 2c73a2a

File tree

6 files changed

+142
-38
lines changed

6 files changed

+142
-38
lines changed

‎keylime-agent/src/agent_handler.rs‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -88,7 +88,7 @@ mod tests {
8888
async fn test_agent_info() {
8989
let (mut quotedata, mutex) = QuoteData::fixture().await.unwrap(); //#[allow_ci]
9090
quotedata.hash_alg = keylime::algorithms::HashAlgorithm::Sha256;
91-
quotedata.enc_alg = keylime::algorithms::EncryptionAlgorithm::Rsa;
91+
quotedata.enc_alg = keylime::algorithms::EncryptionAlgorithm::Rsa2048;
9292
quotedata.sign_alg = keylime::algorithms::SignAlgorithm::RsaSsa;
9393
quotedata.agent_uuid = "DEADBEEF".to_string();
9494
let data = web::Data::new(quotedata);

‎keylime-agent/src/common.rs‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -126,6 +126,7 @@ mod tests {
126126
let ak = ctx.create_ak(
127127
ek_result.key_handle,
128128
tpm_hash_alg,
129+
tpm_encryption_alg,
129130
tpm_signing_alg,
130131
)?;
131132

‎keylime-agent/src/main.rs‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -423,6 +423,7 @@ async fn main() -> Result<()> {
423423
let new_ak = ctx.create_ak(
424424
ek_result.key_handle,
425425
tpm_hash_alg,
426+
tpm_encryption_alg,
426427
tpm_signing_alg,
427428
)?;
428429
let ak_handle = ctx.load_ak(ek_result.key_handle, &new_ak)?;
@@ -980,6 +981,7 @@ mod testing {
980981
.create_ak(
981982
ek_result.key_handle,
982983
tpm_hash_alg,
984+
tpm_encryption_alg,
983985
tpm_signing_alg,
984986
)
985987
.unwrap(); //#[allow_ci]
@@ -1057,7 +1059,8 @@ mod testing {
10571059
payload_tx,
10581060
revocation_tx,
10591061
hash_alg: keylime::algorithms::HashAlgorithm::Sha256,
1060-
enc_alg: keylime::algorithms::EncryptionAlgorithm::Rsa,
1062+
enc_alg:
1063+
keylime::algorithms::EncryptionAlgorithm::Rsa2048,
10611064
sign_alg: keylime::algorithms::SignAlgorithm::RsaSsa,
10621065
agent_uuid: test_config.agent.uuid,
10631066
allow_payload_revocation_actions: test_config

‎keylime-push-model-agent/src/registration.rs‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -34,8 +34,12 @@ pub async fn register_agent<T: PushModelConfigTrait>(
3434
let mut ctx = tpm::Context::new()?;
3535
let ek_result = ctx.create_ek(tpm_encryption_alg, None)?;
3636
let ek_hash = hash_ek::hash_ek_pubkey(ek_result.public.clone())?;
37-
let ak =
38-
ctx.create_ak(ek_result.key_handle, tpm_hash_alg, tpm_signing_alg)?;
37+
let ak = ctx.create_ak(
38+
ek_result.key_handle,
39+
tpm_hash_alg,
40+
tpm_encryption_alg,
41+
tpm_signing_alg,
42+
)?;
3943
let ak_handle = ctx.load_ak(ek_result.key_handle, &ak)?;
4044

4145
AgentData::create(

‎keylime/src/algorithms.rs‎

Lines changed: 99 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -6,8 +6,13 @@ use std::convert::TryFrom;
66
use std::fmt;
77
use thiserror::Error;
88
use tss_esapi::{
9-
interface_types::algorithm::{
10-
AsymmetricAlgorithm, HashingAlgorithm, SignatureSchemeAlgorithm,
9+
abstraction::AsymmetricAlgorithmSelection,
10+
interface_types::{
11+
algorithm::{
12+
AsymmetricAlgorithm, HashingAlgorithm, SignatureSchemeAlgorithm,
13+
},
14+
ecc::EccCurve,
15+
key_bits::RsaKeyBits,
1116
},
1217
structures::{HashScheme, SignatureScheme},
1318
};
@@ -89,15 +94,68 @@ impl From<HashAlgorithm> for MessageDigest {
8994

9095
#[derive(Copy, Clone, Debug, PartialEq, Eq, Hash, Serialize, Deserialize)]
9196
pub enum EncryptionAlgorithm {
92-
Rsa,
93-
Ecc,
97+
Rsa1024,
98+
Rsa2048,
99+
Rsa3072,
100+
Rsa4096,
101+
Ecc192,
102+
Ecc224,
103+
Ecc256,
104+
Ecc384,
105+
Ecc521,
106+
EccSm2,
94107
}
95108

96109
impl From<EncryptionAlgorithm> for AsymmetricAlgorithm {
97110
fn from(enc_alg: EncryptionAlgorithm) -> Self {
98111
match enc_alg {
99-
EncryptionAlgorithm::Rsa => AsymmetricAlgorithm::Rsa,
100-
EncryptionAlgorithm::Ecc => AsymmetricAlgorithm::Ecc,
112+
EncryptionAlgorithm::Rsa1024 => AsymmetricAlgorithm::Rsa,
113+
EncryptionAlgorithm::Rsa2048 => AsymmetricAlgorithm::Rsa,
114+
EncryptionAlgorithm::Rsa3072 => AsymmetricAlgorithm::Rsa,
115+
EncryptionAlgorithm::Rsa4096 => AsymmetricAlgorithm::Rsa,
116+
EncryptionAlgorithm::Ecc192 => AsymmetricAlgorithm::Ecc,
117+
EncryptionAlgorithm::Ecc224 => AsymmetricAlgorithm::Ecc,
118+
EncryptionAlgorithm::Ecc256 => AsymmetricAlgorithm::Ecc,
119+
EncryptionAlgorithm::Ecc384 => AsymmetricAlgorithm::Ecc,
120+
EncryptionAlgorithm::Ecc521 => AsymmetricAlgorithm::Ecc,
121+
EncryptionAlgorithm::EccSm2 => AsymmetricAlgorithm::Ecc,
122+
}
123+
}
124+
}
125+
126+
impl From<EncryptionAlgorithm> for AsymmetricAlgorithmSelection {
127+
fn from(enc_alg: EncryptionAlgorithm) -> Self {
128+
match enc_alg {
129+
EncryptionAlgorithm::Rsa1024 => {
130+
AsymmetricAlgorithmSelection::Rsa(RsaKeyBits::Rsa1024)
131+
}
132+
EncryptionAlgorithm::Rsa2048 => {
133+
AsymmetricAlgorithmSelection::Rsa(RsaKeyBits::Rsa2048)
134+
}
135+
EncryptionAlgorithm::Rsa3072 => {
136+
AsymmetricAlgorithmSelection::Rsa(RsaKeyBits::Rsa3072)
137+
}
138+
EncryptionAlgorithm::Rsa4096 => {
139+
AsymmetricAlgorithmSelection::Rsa(RsaKeyBits::Rsa4096)
140+
}
141+
EncryptionAlgorithm::Ecc192 => {
142+
AsymmetricAlgorithmSelection::Ecc(EccCurve::NistP192)
143+
}
144+
EncryptionAlgorithm::Ecc224 => {
145+
AsymmetricAlgorithmSelection::Ecc(EccCurve::NistP224)
146+
}
147+
EncryptionAlgorithm::Ecc256 => {
148+
AsymmetricAlgorithmSelection::Ecc(EccCurve::NistP256)
149+
}
150+
EncryptionAlgorithm::Ecc384 => {
151+
AsymmetricAlgorithmSelection::Ecc(EccCurve::NistP384)
152+
}
153+
EncryptionAlgorithm::Ecc521 => {
154+
AsymmetricAlgorithmSelection::Ecc(EccCurve::NistP521)
155+
}
156+
EncryptionAlgorithm::EccSm2 => {
157+
AsymmetricAlgorithmSelection::Ecc(EccCurve::Sm2P256)
158+
}
101159
}
102160
}
103161
}
@@ -107,8 +165,25 @@ impl TryFrom<&str> for EncryptionAlgorithm {
107165

108166
fn try_from(value: &str) -> Result<Self, Self::Error> {
109167
match value {
110-
"rsa" => Ok(EncryptionAlgorithm::Rsa),
111-
"ecc" => Ok(EncryptionAlgorithm::Ecc),
168+
/* Use default key size and curve if not explicitly specified */
169+
"rsa" => Ok(EncryptionAlgorithm::Rsa2048),
170+
"ecc" => Ok(EncryptionAlgorithm::Ecc256),
171+
"rsa1024" => Ok(EncryptionAlgorithm::Rsa1024),
172+
"rsa2048" => Ok(EncryptionAlgorithm::Rsa2048),
173+
"rsa3072" => Ok(EncryptionAlgorithm::Rsa3072),
174+
"rsa4096" => Ok(EncryptionAlgorithm::Rsa4096),
175+
"ecc192" => Ok(EncryptionAlgorithm::Ecc192),
176+
"ecc_nist_p192" => Ok(EncryptionAlgorithm::Ecc192),
177+
"ecc224" => Ok(EncryptionAlgorithm::Ecc224),
178+
"ecc_nist_p224" => Ok(EncryptionAlgorithm::Ecc224),
179+
"ecc256" => Ok(EncryptionAlgorithm::Ecc256),
180+
"ecc_nist_p256" => Ok(EncryptionAlgorithm::Ecc256),
181+
"ecc384" => Ok(EncryptionAlgorithm::Ecc384),
182+
"ecc_nist_p384" => Ok(EncryptionAlgorithm::Ecc384),
183+
"ecc521" => Ok(EncryptionAlgorithm::Ecc521),
184+
"ecc_nist_p521" => Ok(EncryptionAlgorithm::Ecc521),
185+
"ecc_sm2" => Ok(EncryptionAlgorithm::EccSm2),
186+
"ecc_sm2_p256" => Ok(EncryptionAlgorithm::EccSm2),
112187
_ => Err(AlgorithmError::UnsupportedEncryptionAlgorithm(
113188
value.into(),
114189
)),
@@ -119,8 +194,16 @@ impl TryFrom<&str> for EncryptionAlgorithm {
119194
impl fmt::Display for EncryptionAlgorithm {
120195
fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
121196
let value = match self {
122-
EncryptionAlgorithm::Rsa => "rsa",
123-
EncryptionAlgorithm::Ecc => "ecc",
197+
EncryptionAlgorithm::Rsa1024 => "rsa1024",
198+
EncryptionAlgorithm::Rsa2048 => "rsa", /* for backwards compatibility */
199+
EncryptionAlgorithm::Rsa3072 => "rsa3072",
200+
EncryptionAlgorithm::Rsa4096 => "rsa4096",
201+
EncryptionAlgorithm::Ecc192 => "ecc192",
202+
EncryptionAlgorithm::Ecc224 => "ecc224",
203+
EncryptionAlgorithm::Ecc256 => "ecc", /* for backwards compatibility */
204+
EncryptionAlgorithm::Ecc384 => "ecc384",
205+
EncryptionAlgorithm::Ecc521 => "ecc521",
206+
EncryptionAlgorithm::EccSm2 => "ecc_sm2",
124207
};
125208
write!(f, "{value}")
126209
}
@@ -219,9 +302,13 @@ mod tests {
219302
#[test]
220303
fn test_encrypt_try_from() {
221304
let result = EncryptionAlgorithm::try_from("rsa");
222-
assert!(result.is_ok());
305+
assert!(result.is_ok_and(|r| r == EncryptionAlgorithm::Rsa2048));
223306
let result = EncryptionAlgorithm::try_from("ecc");
224-
assert!(result.is_ok());
307+
assert!(result.is_ok_and(|r| r == EncryptionAlgorithm::Ecc256));
308+
let result = EncryptionAlgorithm::try_from("rsa4096");
309+
assert!(result.is_ok_and(|r| r == EncryptionAlgorithm::Rsa4096));
310+
let result = EncryptionAlgorithm::try_from("ecc256");
311+
assert!(result.is_ok_and(|r| r == EncryptionAlgorithm::Ecc256));
225312
}
226313
#[test]
227314
fn test_unsupported_encrypt_try_from() {

‎keylime/src/tpm.rs‎

Lines changed: 31 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -599,7 +599,7 @@ impl Context<'_> {
599599
let key_handle: KeyHandle = match handle {
600600
Some(v) => {
601601
if v.is_empty() {
602-
ek::create_ek_object(&mut ctx, alg.into(), DefaultKey)
602+
ek::create_ek_object_2(&mut ctx, alg.into(), DefaultKey)
603603
.map_err(|source| TpmError::TSSCreateEKError {
604604
source,
605605
})?
@@ -628,7 +628,7 @@ impl Context<'_> {
628628
.into()
629629
}
630630
}
631-
None => ek::create_ek_object(&mut ctx, alg.into(), DefaultKey)
631+
None => ek::create_ek_object_2(&mut ctx, alg.into(), DefaultKey)
632632
.map_err(|source| TpmError::TSSCreateEKError { source })?,
633633
};
634634

@@ -677,19 +677,22 @@ impl Context<'_> {
677677
///
678678
/// * `handle`: The associated EK handle
679679
/// * `hash_alg`: The digest algorithm used for signing with the created AK
680+
/// * `key_alg`: The key type used for signing with the created AK
680681
/// * `sign_alg`: The created AK signing algorithm
681682
///
682683
/// Returns an `AKResult` structure if successful and a `TPMError` otherwise
683684
pub fn create_ak(
684685
&mut self,
685686
handle: KeyHandle,
686687
hash_alg: HashAlgorithm,
688+
key_alg: EncryptionAlgorithm,
687689
sign_alg: SignAlgorithm,
688690
) -> Result<AKResult> {
689-
let ak = ak::create_ak(
691+
let ak = ak::create_ak_2(
690692
&mut self.inner.lock().unwrap(), //#[allow_ci]
691693
handle,
692694
hash_alg.into(),
695+
key_alg.into(),
693696
sign_alg.into(),
694697
None,
695698
DefaultKey,
@@ -1973,9 +1976,7 @@ pub fn get_idevid_template(
19731976
"H-4" => (AsymmetricAlgorithm::Ecc, HashingAlgorithm::Sha512),
19741977
"H-5" => (AsymmetricAlgorithm::Ecc, HashingAlgorithm::Sm3_256),
19751978
_ => (
1976-
AsymmetricAlgorithm::from(EncryptionAlgorithm::try_from(
1977-
asym_alg_str,
1978-
)?),
1979+
EncryptionAlgorithm::try_from(asym_alg_str)?.into(),
19791980
HashingAlgorithm::from(HashAlgorithm::try_from(name_alg_str)?),
19801981
),
19811982
};
@@ -2583,7 +2584,8 @@ pub mod tests {
25832584
async fn test_create_ek() {
25842585
let _mutex = testing::lock_tests().await;
25852586
let mut ctx = Context::new().unwrap(); //#[allow_ci]
2586-
let algs = [EncryptionAlgorithm::Rsa, EncryptionAlgorithm::Ecc];
2587+
let algs =
2588+
[EncryptionAlgorithm::Rsa2048, EncryptionAlgorithm::Ecc256];
25872589
// TODO: create persistent handle and add to be tested: Some("0x81000000"),
25882590
let handles = [Some(""), None];
25892591

@@ -2606,12 +2608,15 @@ pub mod tests {
26062608
let _mutex = testing::lock_tests().await;
26072609
let mut ctx = Context::new().unwrap(); //#[allow_ci]
26082610

2609-
let r = ctx.create_ek(EncryptionAlgorithm::Rsa, None);
2611+
let r = ctx.create_ek(EncryptionAlgorithm::Rsa2048, None);
26102612
assert!(r.is_ok(), "Result: {r:?}");
26112613

26122614
let ek_result = r.unwrap(); //#[allow_ci]
26132615
let ek_handle = ek_result.key_handle;
26142616

2617+
let eng_algs =
2618+
[EncryptionAlgorithm::Rsa1024, EncryptionAlgorithm::Rsa2048];
2619+
26152620
let hash_algs = [
26162621
HashAlgorithm::Sha256,
26172622
HashAlgorithm::Sha384,
@@ -2632,18 +2637,20 @@ pub mod tests {
26322637
];
26332638

26342639
for sign in sign_algs {
2635-
for hash in hash_algs {
2636-
let r = ctx.create_ak(ek_handle, hash, sign);
2637-
assert!(r.is_ok(), "Result: {r:?}");
2638-
let ak = r.unwrap(); //#[allow_ci]
2639-
2640-
let r = ctx.load_ak(ek_handle, &ak);
2641-
assert!(r.is_ok(), "Result: {r:?}");
2642-
let handle = r.unwrap(); //#[allow_ci]
2643-
2644-
// Flush context to free TPM memory
2645-
let r = ctx.flush_context(handle.into());
2646-
assert!(r.is_ok(), "Result: {r:?}");
2640+
for enc in eng_algs {
2641+
for hash in hash_algs {
2642+
let r = ctx.create_ak(ek_handle, hash, enc, sign);
2643+
assert!(r.is_ok(), "Result: {r:?}");
2644+
let ak = r.unwrap(); //#[allow_ci]
2645+
2646+
let r = ctx.load_ak(ek_handle, &ak);
2647+
assert!(r.is_ok(), "Result: {r:?}");
2648+
let handle = r.unwrap(); //#[allow_ci]
2649+
2650+
// Flush context to free TPM memory
2651+
let r = ctx.flush_context(handle.into());
2652+
assert!(r.is_ok(), "Result: {r:?}");
2653+
}
26472654
}
26482655
}
26492656

@@ -2724,7 +2731,7 @@ pub mod tests {
27242731

27252732
// Create EK
27262733
let ek_result = ctx
2727-
.create_ek(EncryptionAlgorithm::Rsa, None)
2734+
.create_ek(EncryptionAlgorithm::Rsa2048, None)
27282735
.expect("failed to create EK");
27292736
let ek_handle = ek_result.key_handle;
27302737

@@ -2733,6 +2740,7 @@ pub mod tests {
27332740
.create_ak(
27342741
ek_handle,
27352742
HashAlgorithm::Sha256,
2743+
EncryptionAlgorithm::Rsa2048,
27362744
SignAlgorithm::RsaSsa,
27372745
)
27382746
.expect("failed to create AK");
@@ -2780,7 +2788,7 @@ pub mod tests {
27802788

27812789
// Create EK
27822790
let ek_result = ctx
2783-
.create_ek(EncryptionAlgorithm::Rsa, None)
2791+
.create_ek(EncryptionAlgorithm::Rsa2048, None)
27842792
.expect("failed to create EK");
27852793
let ek_handle = ek_result.key_handle;
27862794

@@ -2789,6 +2797,7 @@ pub mod tests {
27892797
.create_ak(
27902798
ek_handle,
27912799
HashAlgorithm::Sha256,
2800+
EncryptionAlgorithm::Rsa2048,
27922801
SignAlgorithm::RsaSsa,
27932802
)
27942803
.expect("failed to create ak");

0 commit comments

Comments
 (0)