Skip to content

Commit 00c1c2b

Browse files
JuergenReppSITAndreasFuchsTPM
JuergenReppSIT
authored and
AndreasFuchsTPM
committed
Options: Add option to allow usage of password session.
For authentication of an object always an HMAC session was used. For an unsalted session an openssl HMAC key with the size of the auth value was created. This caused problems with the OpenSSL FIPS mode if the key length is less than 112 bits. To avoid this the option --pwd-session (-z) is added. Here the session handle ESYS_TR_PASSWORD will be used. For example, now the EK can be used to create a salted session: tpm2_createek --pwd-session -Q --key-algorithm rsa --ek-context ek.ctx tpm2_startauthsession -Q --session salted_session.ctx --hmac-session --tpmkey-context ek.ctx tpm2_sessionconfig -Q salted_session.ctx --enable-decrypt tpm2_createprimary -c prim.ctx -P session:salted_session.ctx Adresses: #3420 Signed-off-by: Juergen Repp <juergen_repp@web.de>
1 parent 0a401f4 commit 00c1c2b

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

50 files changed

+168
-156
lines changed

‎lib/tpm2_auth_util.c‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -467,7 +467,13 @@ tool_rc tpm2_auth_util_from_optarg(ESYS_CONTEXT *ectx, const char *password,
467467
}
468468

469469
/* must be a password */
470-
return handle_password_session(ectx, password, session);
470+
if (is_restricted) {
471+
/* ESYS_TR_PASSWORD will be used as handle. */
472+
return handle_password_session(NULL, password, session);
473+
} else {
474+
/* A hmac session will be created. */
475+
return handle_password_session(ectx, password, session);
476+
}
471477
}
472478

473479
tool_rc tpm2_auth_util_get_shandle(ESYS_CONTEXT *ectx, ESYS_TR object,

‎lib/tpm2_options.c‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -288,11 +288,12 @@ tpm2_option_code tpm2_handle_options(int argc, char **argv,
288288
{ "quiet", no_argument, NULL, 'Q' },
289289
{ "version", no_argument, NULL, 'v' },
290290
{ "enable-errata", no_argument, NULL, 'Z' },
291+
{ "pwd-session", no_argument, NULL, 'z' },
291292
};
292293

293294

294295
/* handle any options */
295-
const char* common_short_opts = "T:h::vVQZ";
296+
const char* common_short_opts = "T:h::vVQZz";
296297
tpm2_options *opts = tpm2_options_new(common_short_opts,
297298
ARRAY_LEN(long_options), long_options, NULL, NULL, 0);
298299
if (!opts) {
@@ -373,6 +374,9 @@ tpm2_option_code tpm2_handle_options(int argc, char **argv,
373374
case 'V':
374375
flags->verbose = 1;
375376
break;
377+
case 'z':
378+
flags->restricted_pwd_session = 1;
379+
break;
376380
case 'Q':
377381
flags->quiet = 1;
378382
break;

‎lib/tpm2_options.h‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,8 @@ union tpm2_option_flags {
2222
uint8_t quiet :1;
2323
uint8_t enable_errata :1;
2424
uint8_t tcti_none :1;
25+
uint8_t restricted_pwd_session :1;
26+
2527
};
2628
uint8_t all;
2729
};

‎man/common/options.md‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,11 +22,16 @@ information that many users may expect.
2222

2323
* **-Q**, **\--quiet**:
2424
Silence normal tool output to stdout.
25-
25+
x
2626
* **-Z**, **\--enable-errata**:
2727
Enable the application of errata fixups. Useful if an errata fixup needs to be
2828
applied to commands sent to the TPM. Defining the environment
2929
TPM2TOOLS\_ENABLE\_ERRATA is equivalent.
30+
* **-z**, **\--pwd-session**:
31+
Use password session instead of a HMAC session for authentication. A clear text password
32+
is passed to the TPM to authorize the action. This option can be used to avoid problems
33+
when unsalted sessions are used in OpenSSL FIPS mode. If auth values are used
34+
a salted session should be used for authentication.
3035
* **-R**, **\--autoflush**:
3136
Enable autoflush for transient objects created by the command. If a parent
3237
object is loaded from a context file also the transient parent object will

‎tools/misc/tpm2_encodeobject.c‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -113,7 +113,7 @@ static tool_rc check_opts(void) {
113113
return rc;
114114
}
115115

116-
static tool_rc init(ESYS_CONTEXT *ectx) {
116+
static tool_rc init(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
117117
bool res = files_load_public(ctx.object.pubpath, &ctx.object.public);
118118
if (!res) {
119119
return tool_rc_general_error;
@@ -125,7 +125,7 @@ static tool_rc init(ESYS_CONTEXT *ectx) {
125125
}
126126

127127
return tpm2_util_object_load_auth(ectx, ctx.parent.ctx_path,
128-
ctx.parent.auth_str, &ctx.parent.object, false,
128+
ctx.parent.auth_str, &ctx.parent.object, flags.restricted_pwd_session,
129129
TPM2_HANDLE_ALL_W_NV);
130130
}
131131

@@ -212,14 +212,13 @@ static int encode(ESYS_CONTEXT *ectx) {
212212
}
213213

214214
static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
215-
UNUSED(flags);
216215

217216
tool_rc rc = check_opts();
218217
if (rc != tool_rc_success) {
219218
return rc;
220219
}
221220

222-
rc = init(ectx);
221+
rc = init(ectx, flags);
223222
if (rc != tool_rc_success) {
224223
return rc;
225224
}

‎tools/tpm2_activatecredential.c‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -173,7 +173,7 @@ static bool read_cert_secret(void) {
173173
return result;
174174
}
175175

176-
static tool_rc process_inputs(ESYS_CONTEXT *ectx) {
176+
static tool_rc process_inputs(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
177177

178178
/*
179179
* 1. Object and auth initializations
@@ -189,14 +189,14 @@ static tool_rc process_inputs(ESYS_CONTEXT *ectx) {
189189

190190
/* Object #1 */
191191
tool_rc rc = tpm2_util_object_load_auth(ectx, ctx.credential_key.ctx_path,
192-
ctx.credential_key.auth_str, &ctx.credential_key.object, false,
192+
ctx.credential_key.auth_str, &ctx.credential_key.object, flags.restricted_pwd_session,
193193
TPM2_HANDLE_ALL_W_NV);
194194
if (rc != tool_rc_success) {
195195
return rc;
196196
}
197197
/* Object #2 */
198198
rc = tpm2_util_object_load_auth(ectx, ctx.credentialed_key.ctx_path,
199-
ctx.credentialed_key.auth_str, &ctx.credentialed_key.object, false,
199+
ctx.credentialed_key.auth_str, &ctx.credentialed_key.object, flags.restricted_pwd_session,
200200
TPM2_HANDLE_ALL_W_NV);
201201
if (rc != tool_rc_success) {
202202
return rc;
@@ -341,7 +341,7 @@ static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
341341
/*
342342
* 2. Process inputs
343343
*/
344-
rc = process_inputs(ectx);
344+
rc = process_inputs(ectx, flags);
345345
if (rc != tool_rc_success) {
346346
return rc;
347347
}

‎tools/tpm2_certify.c‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -137,7 +137,7 @@ static tool_rc process_output(ESYS_CONTEXT *ectx) {
137137
return is_file_op_success ? tool_rc_success : tool_rc_general_error;
138138
}
139139

140-
static tool_rc process_inputs(ESYS_CONTEXT *ectx) {
140+
static tool_rc process_inputs(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
141141

142142
/*
143143
* 1. Object and auth initializations
@@ -152,15 +152,15 @@ static tool_rc process_inputs(ESYS_CONTEXT *ectx) {
152152
*/
153153
/* Object #1 */
154154
tool_rc rc = tpm2_util_object_load_auth(ectx, ctx.certified_key.ctx_path,
155-
ctx.certified_key.auth_str, &ctx.certified_key.object, false,
155+
ctx.certified_key.auth_str, &ctx.certified_key.object, flags.restricted_pwd_session,
156156
TPM2_HANDLE_ALL_W_NV);
157157
if (rc != tool_rc_success) {
158158
return rc;
159159
}
160160

161161
/* Object #2 */
162162
rc = tpm2_util_object_load_auth(ectx, ctx.signing_key.ctx_path,
163-
ctx.signing_key.auth_str, &ctx.signing_key.object, false,
163+
ctx.signing_key.auth_str, &ctx.signing_key.object, flags.restricted_pwd_session,
164164
TPM2_HANDLE_ALL_W_NV);
165165
if (rc != tool_rc_success) {
166166
return rc;
@@ -333,7 +333,7 @@ static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
333333
/*
334334
* 2. Process inputs
335335
*/
336-
rc = process_inputs(ectx);
336+
rc = process_inputs(ectx, flags);
337337
if (rc != tool_rc_success) {
338338
return rc;
339339
}

‎tools/tpm2_certifycreation.c‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -135,7 +135,7 @@ static tool_rc process_output(void) {
135135
return is_file_op_success ? tool_rc_success : tool_rc_general_error;
136136
}
137137

138-
static tool_rc process_inputs(ESYS_CONTEXT *ectx) {
138+
static tool_rc process_inputs(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
139139

140140
/*
141141
* 1. Object and auth initializations
@@ -149,7 +149,7 @@ static tool_rc process_inputs(ESYS_CONTEXT *ectx) {
149149
* 1.b Add object names and their auth sessions
150150
*/
151151
tool_rc rc = tpm2_util_object_load_auth(ectx, ctx.signing_key.ctx_path,
152-
ctx.signing_key.auth_str, &ctx.signing_key.object, false,
152+
ctx.signing_key.auth_str, &ctx.signing_key.object, flags.restricted_pwd_session,
153153
TPM2_HANDLES_FLAGS_TRANSIENT|TPM2_HANDLES_FLAGS_PERSISTENT);
154154
if (rc != tool_rc_success) {
155155
LOG_ERR("Invalid signing key/ authorization.");
@@ -413,7 +413,7 @@ static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
413413
/*
414414
* 2. Process inputs
415415
*/
416-
tool_rc rc = process_inputs(ectx);
416+
tool_rc rc = process_inputs(ectx, flags);
417417
if (rc != tool_rc_success) {
418418
return rc;
419419
}

‎tools/tpm2_changeauth.c‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -181,7 +181,7 @@ static inline bool object_needs_parent(tpm2_loaded_object *obj) {
181181
return (h == TPM2_HR_TRANSIENT) || (h == TPM2_HR_PERSISTENT);
182182
}
183183

184-
static tool_rc process_inputs(ESYS_CONTEXT *ectx) {
184+
static tool_rc process_inputs(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
185185

186186
/*
187187
* 1. Object and auth initializations
@@ -206,7 +206,7 @@ static tool_rc process_inputs(ESYS_CONTEXT *ectx) {
206206

207207
/* Object #1 */
208208
rc = tpm2_util_object_load_auth(ectx, ctx.object.ctx,
209-
ctx.object.auth_current, &ctx.object.obj, false, TPM2_HANDLE_ALL_W_NV);
209+
ctx.object.auth_current, &ctx.object.obj, flags.restricted_pwd_session, TPM2_HANDLE_ALL_W_NV);
210210
if (rc != tool_rc_success) {
211211
return rc;
212212
}
@@ -377,7 +377,7 @@ static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
377377
/*
378378
* 2. Process inputs
379379
*/
380-
rc = process_inputs(ectx);
380+
rc = process_inputs(ectx, flags);
381381
if (rc != tool_rc_success) {
382382
return rc;
383383
}

‎tools/tpm2_clear.c‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -70,7 +70,7 @@ static tool_rc process_output(ESYS_CONTEXT *ectx) {
7070
}
7171

7272

73-
static tool_rc process_inputs(ESYS_CONTEXT *ectx) {
73+
static tool_rc process_inputs(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
7474

7575
/*
7676
* 1. Object and auth initializations
@@ -86,7 +86,7 @@ static tool_rc process_inputs(ESYS_CONTEXT *ectx) {
8686

8787
/* Object #1 */
8888
tool_rc rc = tpm2_util_object_load_auth(ectx, ctx.auth_hierarchy.ctx_path,
89-
ctx.auth_hierarchy.auth_str, &ctx.auth_hierarchy.object, false,
89+
ctx.auth_hierarchy.auth_str, &ctx.auth_hierarchy.object, flags.restricted_pwd_session,
9090
TPM2_HANDLE_FLAGS_L | TPM2_HANDLE_FLAGS_P);
9191
if (rc != tool_rc_success) {
9292
LOG_ERR("Invalid lockout authorization");
@@ -199,7 +199,7 @@ static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) {
199199
/*
200200
* 2. Process inputs
201201
*/
202-
rc = process_inputs(ectx);
202+
rc = process_inputs(ectx, flags);
203203
if (rc != tool_rc_success) {
204204
return rc;
205205
}

0 commit comments

Comments
 (0)