// This file was extracted from the TCG Published // Trusted Platform Module Library // Part 4: Supporting Routines // Family "2.0" // Level 00 Revision 01.16 // October 30, 2014 #include "TPM_Types.h" #include "CryptoEngine.h" // types shared by CryptUtil and CryptoEngine. // Includes the function prototypes for the // CryptoEngine functions. #include "Global.h" #include "InternalRoutines.h" #include "MemoryLib_fp.h" //#include "CryptSelfTest_fp.h" // // // 10.2.2 TranslateCryptErrors() // // This function converts errors from the cryptographic library into TPM_RC_VALUES. // // Error Returns Meaning // // TPM_RC_VALUE CRYPT_FAIL // TPM_RC_NO_RESULT CRYPT_NO_RESULT // TPM_RC_SCHEME CRYPT_SCHEME // TPM_RC_VALUE CRYPT_PARAMETER // TPM_RC_SIZE CRYPT_UNDERFLOW // TPM_RC_ECC_POINT CRYPT_POINT // TPM_RC_CANCELLED CRYPT_CANCEL // static TPM_RC TranslateCryptErrors ( CRYPT_RESULT retVal // IN: crypt error to evaluate ) { switch (retVal) { case CRYPT_SUCCESS: return TPM_RC_SUCCESS; case CRYPT_FAIL: return TPM_RC_VALUE; case CRYPT_NO_RESULT: return TPM_RC_NO_RESULT; case CRYPT_SCHEME: return TPM_RC_SCHEME; case CRYPT_PARAMETER: return TPM_RC_VALUE; case CRYPT_UNDERFLOW: return TPM_RC_SIZE; case CRYPT_POINT: return TPM_RC_ECC_POINT; case CRYPT_CANCEL: return TPM_RC_CANCELED; default: // Other unknown warnings return TPM_RC_FAILURE; } } // // // 10.2.3 Random Number Generation Functions // #ifdef TPM_ALG_NULL //% #ifdef _DRBG_STATE_SAVE //% // // // 10.2.3.1 CryptDrbgGetPutState() // // Read or write the current state from the DRBG in the cryptoEngine. // void CryptDrbgGetPutState( GET_PUT direction // IN: Get from or put to DRBG ) { _cpri__DrbgGetPutState(direction, sizeof(go.drbgState), (BYTE *)&go.drbgState); } #else //% 00 //%#define CryptDrbgGetPutState(ignored) // If not doing state save, turn this //% // into a null macro #endif //% // // // 10.2.3.2 CryptStirRandom() // // Stir random entropy // void CryptStirRandom( UINT32 entropySize, // IN: size of entropy buffer BYTE *buffer // IN: entropy buffer ) { // RNG self testing code may be inserted here // Call crypto engine random number stirring function _cpri__StirRandom(entropySize, buffer); return; } // // // 10.2.3.3 CryptGenerateRandom() // // This is the interface to _cpri__GenerateRandom(). // UINT16 CryptGenerateRandom( UINT16 randomSize, // IN: size of random number BYTE *buffer // OUT: buffer of random number ) { UINT16 result; pAssert(randomSize <= MAX_RSA_KEY_BYTES || randomSize <= PRIMARY_SEED_SIZE); if(randomSize == 0) return 0; // Call crypto engine random number generation result = _cpri__GenerateRandom(randomSize, buffer); if(result != randomSize) FAIL(FATAL_ERROR_INTERNAL); return result; } #endif //TPM_ALG_NULL //% // // // 10.2.4 Hash/HMAC Functions // // 10.2.4.1 CryptGetContextAlg() // // This function returns the hash algorithm associated with a hash context. // #ifdef TPM_ALG_KEYEDHASH //% 1 TPM_ALG_ID CryptGetContextAlg( void *state // IN: the context to check ) { HASH_STATE *context = (HASH_STATE *)state; return _cpri__GetContextAlg(&context->state); } // // // 10.2.4.2 CryptStartHash() // // This function starts a hash and return the size, in bytes, of the digest. // // Return Value Meaning // // >0 the digest size of the algorithm // =0 the hashAlg was TPM_ALG_NULL // UINT16 CryptStartHash( TPMI_ALG_HASH hashAlg, // IN: hash algorithm HASH_STATE *hashState // OUT: the state of hash stack. It will be used // in hash update and completion ) { CRYPT_RESULT retVal = 0; pAssert(hashState != NULL); TEST_HASH(hashAlg); hashState->type = HASH_STATE_EMPTY; // Call crypto engine start hash function if((retVal = _cpri__StartHash(hashAlg, FALSE, &hashState->state)) > 0) hashState->type = HASH_STATE_HASH; return retVal; } // // // // 10.2.4.3 CryptStartHashSequence() // // Start a hash stack for a sequence object and return the size, in bytes, of the digest. This call uses the // form of the hash state that requires context save and restored. // // Return Value Meaning // // >0 the digest size of the algorithm // =0 the hashAlg was TPM_ALG_NULL // UINT16 CryptStartHashSequence( TPMI_ALG_HASH hashAlg, // IN: hash algorithm HASH_STATE *hashState // OUT: the state of hash stack. It will be used // in hash update and completion ) { CRYPT_RESULT retVal = 0; pAssert(hashState != NULL); TEST_HASH(hashAlg); hashState->type = HASH_STATE_EMPTY; // Call crypto engine start hash function if((retVal = _cpri__StartHash(hashAlg, TRUE, &hashState->state)) > 0) hashState->type = HASH_STATE_HASH; return retVal; } // // // 10.2.4.4 CryptStartHMAC() // // This function starts an HMAC sequence and returns the size of the digest that will be produced. // The caller must provide a block of memory in which the hash sequence state is kept. The caller should // not alter the contents of this buffer until the hash sequence is completed or abandoned. // // Return Value Meaning // // >0 the digest size of the algorithm // =0 the hashAlg was TPM_ALG_NULL // UINT16 CryptStartHMAC( TPMI_ALG_HASH hashAlg, // IN: hash algorithm UINT16 keySize, // IN: the size of HMAC key in byte BYTE *key, // IN: HMAC key HMAC_STATE *hmacState // OUT: the state of HMAC stack. It will be used // in HMAC update and completion ) { HASH_STATE *hashState = (HASH_STATE *)hmacState; CRYPT_RESULT retVal; // This has to come before the pAssert in case we all calling this function // during testing. If so, the first instance will have no arguments but the // hash algorithm. The call from the test routine will have arguments. When // the second call is done, then we return to the test dispatcher. TEST_HASH(hashAlg); pAssert(hashState != NULL); hashState->type = HASH_STATE_EMPTY; if((retVal = _cpri__StartHMAC(hashAlg, FALSE, &hashState->state, keySize, key, &hmacState->hmacKey.b)) > 0) hashState->type = HASH_STATE_HMAC; return retVal; } // // // 10.2.4.5 CryptStartHMACSequence() // // This function starts an HMAC sequence and returns the size of the digest that will be produced. // The caller must provide a block of memory in which the hash sequence state is kept. The caller should // not alter the contents of this buffer until the hash sequence is completed or abandoned. // This call is used to start a sequence HMAC that spans multiple TPM commands. // // Return Value Meaning // // >0 the digest size of the algorithm // =0 the hashAlg was TPM_ALG_NULL // UINT16 CryptStartHMACSequence( TPMI_ALG_HASH hashAlg, // IN: hash algorithm UINT16 keySize, // IN: the size of HMAC key in byte BYTE *key, // IN: HMAC key HMAC_STATE *hmacState // OUT: the state of HMAC stack. It will be used // in HMAC update and completion ) { HASH_STATE *hashState = (HASH_STATE *)hmacState; CRYPT_RESULT retVal; TEST_HASH(hashAlg); hashState->type = HASH_STATE_EMPTY; if((retVal = _cpri__StartHMAC(hashAlg, TRUE, &hashState->state, keySize, key, &hmacState->hmacKey.b)) > 0) hashState->type = HASH_STATE_HMAC; return retVal; } // // // 10.2.4.6 CryptStartHMAC2B() // // This function starts an HMAC and returns the size of the digest that will be produced. // This function is provided to support the most common use of starting an HMAC with a TPM2B key. // The caller must provide a block of memory in which the hash sequence state is kept. The caller should // not alter the contents of this buffer until the hash sequence is completed or abandoned. // // // // // Return Value Meaning // // >0 the digest size of the algorithm // =0 the hashAlg was TPM_ALG_NULL // LIB_EXPORT UINT16 CryptStartHMAC2B( TPMI_ALG_HASH hashAlg, // IN: hash algorithm TPM2B *key, // IN: HMAC key HMAC_STATE *hmacState // OUT: the state of HMAC stack. It will be used // in HMAC update and completion ) { return CryptStartHMAC(hashAlg, key->size, key->buffer, hmacState); } // // // 10.2.4.7 CryptStartHMACSequence2B() // // This function starts an HMAC sequence and returns the size of the digest that will be produced. // This function is provided to support the most common use of starting an HMAC with a TPM2B key. // The caller must provide a block of memory in which the hash sequence state is kept. The caller should // not alter the contents of this buffer until the hash sequence is completed or abandoned. // // Return Value Meaning // // >0 the digest size of the algorithm // =0 the hashAlg was TPM_ALG_NULL // UINT16 CryptStartHMACSequence2B( TPMI_ALG_HASH hashAlg, // IN: hash algorithm TPM2B *key, // IN: HMAC key HMAC_STATE *hmacState // OUT: the state of HMAC stack. It will be used // in HMAC update and completion ) { return CryptStartHMACSequence(hashAlg, key->size, key->buffer, hmacState); } // // // 10.2.4.8 CryptUpdateDigest() // // This function updates a digest (hash or HMAC) with an array of octets. // This function can be used for both HMAC and hash functions so the digestState is void so that either // state type can be passed. // LIB_EXPORT void CryptUpdateDigest( void *digestState, // IN: the state of hash stack UINT32 dataSize, // IN: the size of data BYTE *data // IN: data to be hashed ) { HASH_STATE *hashState = (HASH_STATE *)digestState; pAssert(digestState != NULL); if(hashState->type != HASH_STATE_EMPTY && data != NULL && dataSize != 0) { // Call crypto engine update hash function _cpri__UpdateHash(&hashState->state, dataSize, data); } return; } // // // 10.2.4.9 CryptUpdateDigest2B() // // This function updates a digest (hash or HMAC) with a TPM2B. // This function can be used for both HMAC and hash functions so the digestState is void so that either // state type can be passed. // LIB_EXPORT void CryptUpdateDigest2B( void *digestState, // IN: the digest state TPM2B *bIn // IN: 2B containing the data ) { // Only compute the digest if a pointer to the 2B is provided. // In CryptUpdateDigest(), if size is zero or buffer is NULL, then no change // to the digest occurs. This function should not provide a buffer if bIn is // not provided. if(bIn != NULL) CryptUpdateDigest(digestState, bIn->size, bIn->buffer); return; } // // // 10.2.4.10 CryptUpdateDigestInt() // // This function is used to include an integer value to a hash stack. The function marshals the integer into its // canonical form before calling CryptUpdateHash(). // LIB_EXPORT void CryptUpdateDigestInt( void *state, // IN: the state of hash stack UINT32 intSize, // IN: the size of 'intValue' in byte void *intValue // IN: integer value to be hashed ) { #if BIG_ENDIAN_TPM == YES pAssert( intValue != NULL && (intSize == 1 || intSize == 2 || intSize == 4 || intSize == 8)); CryptUpdateHash(state, inSize, (BYTE *)intValue); #else BYTE marshalBuffer[8]; // Point to the big end of an little-endian value BYTE *p = &((BYTE *)intValue)[intSize - 1]; // Point to the big end of an big-endian value BYTE *q = marshalBuffer; pAssert(intValue != NULL); switch (intSize) { case 8: *q++ = *p--; *q++ = *p--; *q++ = *p--; *q++ = *p--; case 4: *q++ = *p--; *q++ = *p--; case 2: *q++ = *p--; case 1: *q = *p; // Call update the hash CryptUpdateDigest(state, intSize, marshalBuffer); break; default: FAIL(0); } #endif return; } // // // 10.2.4.11 CryptCompleteHash() // // This function completes a hash sequence and returns the digest. // This function can be called to complete either an HMAC or hash sequence. The state type determines if // the context type is a hash or HMAC. If an HMAC, then the call is forwarded to CryptCompleteHash(). // If digestSize is smaller than the digest size of hash/HMAC algorithm, the most significant bytes of // required size will be returned // // Return Value Meaning // // >=0 the number of bytes placed in digest // LIB_EXPORT UINT16 CryptCompleteHash( void *state, // IN: the state of hash stack UINT16 digestSize, // IN: size of digest buffer BYTE *digest // OUT: hash digest ) { HASH_STATE *hashState = (HASH_STATE *)state; // local value // If the session type is HMAC, then could forward this to // the HMAC processing and not cause an error. However, if no // function calls this routine to forward it, then we can't get // test coverage. The decision is to assert if this is called with // the type == HMAC and fix anything that makes the wrong call. pAssert(hashState->type == HASH_STATE_HASH); // Set the state to empty so that it doesn't get used again hashState->type = HASH_STATE_EMPTY; // Call crypto engine complete hash function return _cpri__CompleteHash(&hashState->state, digestSize, digest); } // // // 10.2.4.12 CryptCompleteHash2B() // // This function is the same as CypteCompleteHash() but the digest is placed in a TPM2B. This is the most // common use and this is provided for specification clarity. 'digest.size' should be set to indicate the number // of bytes to place in the buffer // // // // // Return Value Meaning // // >=0 the number of bytes placed in 'digest.buffer' // LIB_EXPORT UINT16 CryptCompleteHash2B( void *state, // IN: the state of hash stack TPM2B *digest // IN: the size of the buffer Out: requested // number of byte ) { UINT16 retVal = 0; if(digest != NULL) retVal = CryptCompleteHash(state, digest->size, digest->buffer); return retVal; } // // // 10.2.4.13 CryptHashBlock() // // Hash a block of data and return the results. If the digest is larger than retSize, it is truncated and with the // least significant octets dropped. // // Return Value Meaning // // >=0 the number of bytes placed in ret // LIB_EXPORT UINT16 CryptHashBlock( TPM_ALG_ID algId, // IN: the hash algorithm to use UINT16 blockSize, // IN: size of the data block BYTE *block, // IN: address of the block to hash UINT16 retSize, // IN: size of the return buffer BYTE *ret // OUT: address of the buffer ) { TEST_HASH(algId); return _cpri__HashBlock(algId, blockSize, block, retSize, ret); } // // // 10.2.4.14 CryptCompleteHMAC() // // This function completes a HMAC sequence and returns the digest. If digestSize is smaller than the digest // size of the HMAC algorithm, the most significant bytes of required size will be returned. // // Return Value Meaning // // >=0 the number of bytes placed in digest // LIB_EXPORT UINT16 CryptCompleteHMAC( HMAC_STATE *hmacState, // IN: the state of HMAC stack UINT32 digestSize, // IN: size of digest buffer BYTE *digest // OUT: HMAC digest ) { HASH_STATE *hashState; pAssert(hmacState != NULL); hashState = &hmacState->hashState; pAssert(hashState->type == HASH_STATE_HMAC); hashState->type = HASH_STATE_EMPTY; return _cpri__CompleteHMAC(&hashState->state, &hmacState->hmacKey.b, digestSize, digest); } // // // 10.2.4.15 CryptCompleteHMAC2B() // // This function is the same as CryptCompleteHMAC() but the HMAC result is returned in a TPM2B which is // the most common use. // // Return Value Meaning // // >=0 the number of bytes placed in digest // LIB_EXPORT UINT16 CryptCompleteHMAC2B( HMAC_STATE *hmacState, // IN: the state of HMAC stack TPM2B *digest // OUT: HMAC ) { UINT16 retVal = 0; if(digest != NULL) retVal = CryptCompleteHMAC(hmacState, digest->size, digest->buffer); return retVal; } // // // 10.2.4.16 CryptHashStateImportExport() // // This function is used to prepare a hash state context for LIB_EXPORT or to import it into the internal // format. It is used by TPM2_ContextSave() and TPM2_ContextLoad() via SequenceDataImportExport(). // This is just a pass-through function to the crypto library. // void CryptHashStateImportExport( HASH_STATE *internalFmt, // IN: state to LIB_EXPORT HASH_STATE *externalFmt, // OUT: exported state IMPORT_EXPORT direction ) { _cpri__ImportExportHashState(&internalFmt->state, (EXPORT_HASH_STATE *)&externalFmt->state, direction); } // // // 10.2.4.17 CryptGetHashDigestSize() // // This function returns the digest size in bytes for a hash algorithm. // // Return Value Meaning // // 0 digest size for TPM_ALG_NULL // >0 digest size // LIB_EXPORT UINT16 CryptGetHashDigestSize( TPM_ALG_ID hashAlg // IN: hash algorithm ) { return _cpri__GetDigestSize(hashAlg); } // // // 10.2.4.18 CryptGetHashBlockSize() // // Get the digest size in byte of a hash algorithm. // // Return Value Meaning // // 0 block size for TPM_ALG_NULL // >0 block size // LIB_EXPORT UINT16 CryptGetHashBlockSize( TPM_ALG_ID hash // IN: hash algorithm to look up ) { return _cpri__GetHashBlockSize(hash); } // // // 10.2.4.19 CryptGetHashAlgByIndex() // // This function is used to iterate through the hashes. TPM_ALG_NULL is returned for all indexes that are // not valid hashes. If the TPM implements 3 hashes, then an index value of 0 will return the first // implemented hash and an index value of 2 will return the last implemented hash. All other index values // will return TPM_ALG_NULL. // // Return Value Meaning // // TPM_ALG_xxx() a hash algorithm // TPM_ALG_NULL this can be used as a stop value // LIB_EXPORT TPM_ALG_ID CryptGetHashAlgByIndex( UINT32 index // IN: the index ) { return _cpri__GetHashAlgByIndex(index); } // // // 10.2.4.20 CryptSignHMAC() // // Sign a digest using an HMAC key. This an HMAC of a digest, not an HMAC of a message. // // Error Returns Meaning // static TPM_RC CryptSignHMAC( OBJECT *signKey, // IN: HMAC key sign the hash TPMT_SIG_SCHEME *scheme, // IN: signing scheme TPM2B_DIGEST *hashData, // IN: hash to be signed TPMT_SIGNATURE *signature // OUT: signature ) { // HMAC_STATE hmacState; UINT32 digestSize; // HMAC algorithm self testing code may be inserted here digestSize = CryptStartHMAC2B(scheme->details.hmac.hashAlg, &signKey->sensitive.sensitive.bits.b, &hmacState); // The hash algorithm must be a valid one. pAssert(digestSize > 0); CryptUpdateDigest2B(&hmacState, &hashData->b); CryptCompleteHMAC(&hmacState, digestSize, (BYTE *) &signature->signature.hmac.digest); // Set HMAC algorithm signature->signature.hmac.hashAlg = scheme->details.hmac.hashAlg; return TPM_RC_SUCCESS; } // // // 10.2.4.21 CryptHMACVerifySignature() // // This function will verify a signature signed by a HMAC key. // // Error Returns Meaning // // TPM_RC_SIGNATURE if invalid input or signature is not genuine // static TPM_RC CryptHMACVerifySignature( OBJECT *signKey, // IN: HMAC key signed the hash TPM2B_DIGEST *hashData, // IN: digest being verified TPMT_SIGNATURE *signature // IN: signature to be verified ) { HMAC_STATE hmacState; TPM2B_DIGEST digestToCompare; digestToCompare.t.size = CryptStartHMAC2B(signature->signature.hmac.hashAlg, &signKey->sensitive.sensitive.bits.b, &hmacState); CryptUpdateDigest2B(&hmacState, &hashData->b); CryptCompleteHMAC2B(&hmacState, &digestToCompare.b); // Compare digest if(MemoryEqual(digestToCompare.t.buffer, (BYTE *) &signature->signature.hmac.digest, digestToCompare.t.size)) return TPM_RC_SUCCESS; else return TPM_RC_SIGNATURE; } // // // 10.2.4.22 CryptGenerateKeyedHash() // // This function creates a keyedHash object. // // // // Error Returns Meaning // // TPM_RC_SIZE sensitive data size is larger than allowed for the scheme // TPM_RC_VALUE the publicArea nameAlg is invalid // static TPM_RC CryptGenerateKeyedHash( TPMT_PUBLIC *publicArea, // IN/OUT: the public area template // for the new key. TPMS_SENSITIVE_CREATE *sensitiveCreate, // IN: sensitive creation data TPMT_SENSITIVE *sensitive, // OUT: sensitive area TPM_ALG_ID kdfHashAlg, // IN: algorithm for the KDF TPM2B_SEED *seed, // IN: the seed TPM2B_NAME *name // IN: name of the object ) { TPMT_KEYEDHASH_SCHEME *scheme; TPM_ALG_ID hashAlg; UINT16 hashBlockSize; // Check parameter values if(publicArea->nameAlg == TPM_ALG_NULL) { return TPM_RC_VALUE; } scheme = &publicArea->parameters.keyedHashDetail.scheme; pAssert(publicArea->type == TPM_ALG_KEYEDHASH); // Pick the limiting hash algorithm if(scheme->scheme == TPM_ALG_NULL) hashAlg = publicArea->nameAlg; else if(scheme->scheme == TPM_ALG_XOR) hashAlg = scheme->details.xor_.hashAlg; else hashAlg = scheme->details.hmac.hashAlg; hashBlockSize = CryptGetHashBlockSize(hashAlg); // if this is a signing or a decryption key, then then the limit // for the data size is the block size of the hash. This limit // is set because larger values have lower entropy because of the // HMAC function. if(publicArea->objectAttributes.sensitiveDataOrigin == CLEAR) { if( ( publicArea->objectAttributes.decrypt || publicArea->objectAttributes.sign) && sensitiveCreate->data.t.size > hashBlockSize) return TPM_RC_SIZE; } else { // If the TPM is going to generate the data, then set the size to be the // size of the digest of the algorithm sensitive->sensitive.sym.t.size = CryptGetHashDigestSize(hashAlg); sensitiveCreate->data.t.size = 0; } // Fill in the sensitive area CryptGenerateNewSymmetric(sensitiveCreate, sensitive, kdfHashAlg, seed, name); // Create unique area in public CryptComputeSymmetricUnique(publicArea->nameAlg, sensitive, &publicArea->unique.sym); return TPM_RC_SUCCESS; } // // // 10.2.4.25 KDFa() // // This function is used by functions outside of CryptUtil() to access _cpri_KDFa(). // void KDFa( TPM_ALG_ID hash, // IN: hash algorithm used in HMAC TPM2B *key, // IN: HMAC key const char *label, // IN: a null-terminated label for KDF TPM2B *contextU, // IN: context U TPM2B *contextV, // IN: context V UINT32 sizeInBits, // IN: size of generated key in bit BYTE *keyStream, // OUT: key buffer UINT32 *counterInOut // IN/OUT: caller may provide the iteration // counter for incremental operations to // avoid large intermediate buffers. ) { CryptKDFa(hash, key, label, contextU, contextV, sizeInBits, keyStream, counterInOut); } #endif //TPM_ALG_KEYEDHASH //% 1 // // // 10.2.5 RSA Functions // // 10.2.5.1 BuildRSA() // // Function to set the cryptographic elements of an RSA key into a structure to simplify the interface to // _cpri__ RSA function. This can/should be eliminated by building this structure into the object structure. // #ifdef TPM_ALG_RSA //% 2 static void BuildRSA( OBJECT *rsaKey, RSA_KEY *key ) { key->exponent = rsaKey->publicArea.parameters.rsaDetail.exponent; if(key->exponent == 0) key->exponent = RSA_DEFAULT_PUBLIC_EXPONENT; key->publicKey = &rsaKey->publicArea.unique.rsa.b; if(rsaKey->attributes.publicOnly || rsaKey->privateExponent.t.size == 0) key->privateKey = NULL; else key->privateKey = &(rsaKey->privateExponent.b); } // // // 10.2.5.2 CryptTestKeyRSA() // // This function provides the interface to _cpri__TestKeyRSA(). If both p and q are provided, n will be set to // p*q. // If only p is provided, q is computed by q = n/p. If n mod p != 0, TPM_RC_BINDING is returned. // The key is validated by checking that a d can be found such that e d mod ((p-1)*(q-1)) = 1. If d is found // that satisfies this requirement, it will be placed in d. // Page 286 TCG Published Family "2.0" // October 30, 2014 Copyright © TCG 2006-2014 Level 00 Revision 01.16 // Part 4: Supporting Routines Trusted Platform Module Library // // // Error Returns Meaning // // TPM_RC_BINDING the public and private portions of the key are not matched // TPM_RC CryptTestKeyRSA( TPM2B *d, // OUT: receives the private exponent UINT32 e, // IN: public exponent TPM2B *n, // IN/OUT: public modulu TPM2B *p, // IN: a first prime TPM2B *q // IN: an optional second prime ) { CRYPT_RESULT retVal; TEST(ALG_NULL_VALUE); pAssert(d != NULL && n != NULL && p != NULL); // Set the exponent if(e == 0) e = RSA_DEFAULT_PUBLIC_EXPONENT; // CRYPT_PARAMETER retVal =_cpri__TestKeyRSA(d, e, n, p, q); if(retVal == CRYPT_SUCCESS) return TPM_RC_SUCCESS; else return TPM_RC_BINDING; // convert CRYPT_PARAMETER } // // // 10.2.5.3 CryptGenerateKeyRSA() // // This function is called to generate an RSA key from a provided seed. It calls _cpri__GenerateKeyRSA() // to perform the computations. The implementation is vendor specific. // // Error Returns Meaning // // TPM_RC_RANGE the exponent value is not supported // TPM_RC_CANCELLED key generation has been canceled // TPM_RC_VALUE exponent is not prime or is less than 3; or could not find a prime using // the provided parameters // static TPM_RC CryptGenerateKeyRSA( TPMT_PUBLIC *publicArea, // IN/OUT: The public area template for // the new key. The public key // area will be replaced by the // product of two primes found by // this function TPMT_SENSITIVE *sensitive, // OUT: the sensitive area will be // updated to contain the first // prime and the symmetric // encryption key TPM_ALG_ID hashAlg, // IN: the hash algorithm for the KDF TPM2B_SEED *seed, // IN: Seed for the creation TPM2B_NAME *name, // IN: Object name UINT32 *counter // OUT: last iteration of the counter ) { CRYPT_RESULT retVal; UINT32 exponent = publicArea->parameters.rsaDetail.exponent; TEST_HASH(hashAlg); TEST(ALG_NULL_VALUE); // In this implementation, only the default exponent is allowed if(exponent != 0 && exponent != RSA_DEFAULT_PUBLIC_EXPONENT) return TPM_RC_RANGE; exponent = RSA_DEFAULT_PUBLIC_EXPONENT; *counter = 0; // _cpri_GenerateKeyRSA can return CRYPT_CANCEL or CRYPT_FAIL retVal = _cpri__GenerateKeyRSA(&publicArea->unique.rsa.b, &sensitive->sensitive.rsa.b, publicArea->parameters.rsaDetail.keyBits, exponent, hashAlg, &seed->b, "RSA key by vendor", &name->b, counter); // CRYPT_CANCEL -> TPM_RC_CANCELLED; CRYPT_FAIL -> TPM_RC_VALUE return TranslateCryptErrors(retVal); } // // // 10.2.5.4 CryptLoadPrivateRSA() // // This function is called to generate the private exponent of an RSA key. It uses CryptTestKeyRSA(). // // Error Returns Meaning // // TPM_RC_BINDING public and private parts of rsaKey are not matched // TPM_RC CryptLoadPrivateRSA( OBJECT *rsaKey // IN: the RSA key object ) { TPM_RC result; TPMT_PUBLIC *publicArea = &rsaKey->publicArea; TPMT_SENSITIVE *sensitive = &rsaKey->sensitive; // Load key by computing the private exponent // TPM_RC_BINDING result = CryptTestKeyRSA(&(rsaKey->privateExponent.b), publicArea->parameters.rsaDetail.exponent, &(publicArea->unique.rsa.b), &(sensitive->sensitive.rsa.b), NULL); if(result == TPM_RC_SUCCESS) rsaKey->attributes.privateExp = SET; return result; } // // // 10.2.5.5 CryptSelectRSAScheme() // // This function is used by TPM2_RSA_Decrypt() and TPM2_RSA_Encrypt(). It sets up the rules to select a // scheme between input and object default. This function assume the RSA object is loaded. If a default // scheme is defined in object, the default scheme should be chosen, otherwise, the input scheme should // be chosen. In the case that both the object and scheme are not TPM_ALG_NULL, then if the schemes // // // are the same, the input scheme will be chosen. if the scheme are not compatible, a NULL pointer will be // returned. // The return pointer may point to a TPM_ALG_NULL scheme. // TPMT_RSA_DECRYPT* CryptSelectRSAScheme( TPMI_DH_OBJECT rsaHandle, // IN: handle of sign key TPMT_RSA_DECRYPT *scheme // IN: a sign or decrypt scheme ) { OBJECT *rsaObject; TPMT_ASYM_SCHEME *keyScheme; TPMT_RSA_DECRYPT *retVal = NULL; // Get sign object pointer rsaObject = ObjectGet(rsaHandle); keyScheme = &rsaObject->publicArea.parameters.asymDetail.scheme; // if the default scheme of the object is TPM_ALG_NULL, then select the // input scheme if(keyScheme->scheme == TPM_ALG_NULL) { retVal = scheme; } // if the object scheme is not TPM_ALG_NULL and the input scheme is // TPM_ALG_NULL, then select the default scheme of the object. else if(scheme->scheme == TPM_ALG_NULL) { // if input scheme is NULL retVal = (TPMT_RSA_DECRYPT *)keyScheme; } // get here if both the object scheme and the input scheme are // not TPM_ALG_NULL. Need to insure that they are the same. // The hash algorithm match has to be verified for OAEP. // IMPLEMENTATION NOTE: This could cause problems if future versions have // schemes that have more values than just a hash algorithm. A new function // (IsSchemeSame()) might be needed then. else if (keyScheme->scheme == scheme->scheme && ((keyScheme->scheme != TPM_ALG_OAEP) || (keyScheme->details.anySig.hashAlg == scheme->details.anySig.hashAlg))) { retVal = scheme; } // two different, incompatible schemes specified will return NULL return retVal; } // // // 10.2.5.6 CryptDecryptRSA() // // This function is the interface to _cpri__DecryptRSA(). It handles the return codes from that function and // converts them from CRYPT_RESULT to TPM_RC values. The rsaKey parameter must reference an RSA // decryption key // // Error Returns Meaning // // TPM_RC_BINDING Public and private parts of the key are not cryptographically bound. // TPM_RC_SIZE Size of data to decrypt is not the same as the key size. // TPM_RC_VALUE Numeric value of the encrypted data is greater than the public // exponent, or output buffer is too small for the decrypted message. // TPM_RC CryptDecryptRSA( UINT16 *dataOutSize, // OUT: size of plain text in byte BYTE *dataOut, // OUT: plain text OBJECT *rsaKey, // IN: internal RSA key TPMT_RSA_DECRYPT *scheme, // IN: selects the padding scheme UINT16 cipherInSize, // IN: size of cipher text in byte BYTE *cipherIn, // IN: cipher text const char *label // IN: a label, when needed ) { RSA_KEY key; CRYPT_RESULT retVal = CRYPT_SUCCESS; UINT32 dSize; // Place to put temporary value for the // returned data size TPMI_ALG_HASH hashAlg = TPM_ALG_NULL; // hash algorithm in the selected // padding scheme TPM_RC result = TPM_RC_SUCCESS; // pointer checks pAssert( (dataOutSize != NULL) && (dataOut != NULL) && (rsaKey != NULL) && (cipherIn != NULL)); // The public type is a RSA decrypt key pAssert( (rsaKey->publicArea.type == TPM_ALG_RSA && rsaKey->publicArea.objectAttributes.decrypt == SET)); // Must have the private portion loaded. This check is made before this // function is called. pAssert(rsaKey->attributes.publicOnly == CLEAR); // decryption requires that the private modulus be present if(rsaKey->attributes.privateExp == CLEAR) { // Load key by computing the private exponent // CryptLoadPrivateRSA may return TPM_RC_BINDING result = CryptLoadPrivateRSA(rsaKey); } // the input buffer must be the size of the key if(result == TPM_RC_SUCCESS) { if(cipherInSize != rsaKey->publicArea.unique.rsa.t.size) result = TPM_RC_SIZE; else { BuildRSA(rsaKey, &key); // Initialize the dOutSize parameter dSize = *dataOutSize; // For OAEP scheme, initialize the hash algorithm for padding if(scheme->scheme == TPM_ALG_OAEP) { hashAlg = scheme->details.oaep.hashAlg; TEST_HASH(hashAlg); } // See if the padding mode needs to be tested TEST(scheme->scheme); // _cpri__DecryptRSA may return CRYPT_PARAMETER CRYPT_FAIL CRYPT_SCHEME retVal = _cpri__DecryptRSA(&dSize, dataOut, &key, scheme->scheme, cipherInSize, cipherIn, hashAlg, label); // Scheme must have been validated when the key was loaded/imported pAssert(retVal != CRYPT_SCHEME); // Set the return size pAssert(dSize <= UINT16_MAX); *dataOutSize = (UINT16)dSize; // CRYPT_PARAMETER -> TPM_RC_VALUE, CRYPT_FAIL -> TPM_RC_VALUE result = TranslateCryptErrors(retVal); } } return result; } // // // 10.2.5.7 CryptEncryptRSA() // // This function provides the interface to _cpri__EncryptRSA(). The object referenced by rsaKey is required // to be an RSA decryption key. // // Error Returns Meaning // // TPM_RC_SCHEME scheme is not supported // TPM_RC_VALUE numeric value of dataIn is greater than the key modulus // TPM_RC CryptEncryptRSA( UINT16 *cipherOutSize, // OUT: size of cipher text in byte BYTE *cipherOut, // OUT: cipher text OBJECT *rsaKey, // IN: internal RSA key TPMT_RSA_DECRYPT *scheme, // IN: selects the padding scheme UINT16 dataInSize, // IN: size of plain text in byte BYTE *dataIn, // IN: plain text const char *label // IN: an optional label ) { RSA_KEY key; CRYPT_RESULT retVal; UINT32 cOutSize; // Conversion variable TPMI_ALG_HASH hashAlg = TPM_ALG_NULL; // hash algorithm in selected // padding scheme // must have a pointer to a key and some data to encrypt pAssert(rsaKey != NULL && dataIn != NULL); // The public type is a RSA decryption key pAssert( rsaKey->publicArea.type == TPM_ALG_RSA && rsaKey->publicArea.objectAttributes.decrypt == SET); // If the cipher buffer must be provided and it must be large enough // for the result pAssert( cipherOut != NULL && cipherOutSize != NULL && *cipherOutSize >= rsaKey->publicArea.unique.rsa.t.size); // Only need the public key and exponent for encryption BuildRSA(rsaKey, &key); // Copy the size to the conversion buffer cOutSize = *cipherOutSize; // For OAEP scheme, initialize the hash algorithm for padding if(scheme->scheme == TPM_ALG_OAEP) { hashAlg = scheme->details.oaep.hashAlg; TEST_HASH(hashAlg); } // This is a public key operation and does not require that the private key // be loaded. To verify this, need to do the full algorithm TEST(scheme->scheme); // Encrypt the data with the public exponent // _cpri__EncryptRSA may return CRYPT_PARAMETER or CRYPT_SCHEME retVal = _cpri__EncryptRSA(&cOutSize,cipherOut, &key, scheme->scheme, dataInSize, dataIn, hashAlg, label); pAssert (cOutSize <= UINT16_MAX); *cipherOutSize = (UINT16)cOutSize; // CRYPT_PARAMETER -> TPM_RC_VALUE, CRYPT_SCHEME -> TPM_RC_SCHEME return TranslateCryptErrors(retVal); } // // // 10.2.5.8 CryptSignRSA() // // This function is used to sign a digest with an RSA signing key. // // Error Returns Meaning // // TPM_RC_BINDING public and private part of signKey are not properly bound // TPM_RC_SCHEME scheme is not supported // TPM_RC_VALUE hashData is larger than the modulus of signKey, or the size of // hashData does not match hash algorithm in scheme // static TPM_RC CryptSignRSA( OBJECT *signKey, // IN: RSA key signs the hash TPMT_SIG_SCHEME *scheme, // IN: sign scheme TPM2B_DIGEST *hashData, // IN: hash to be signed TPMT_SIGNATURE *sig // OUT: signature ) { UINT32 signSize; RSA_KEY key; CRYPT_RESULT retVal; TPM_RC result = TPM_RC_SUCCESS; pAssert( (signKey != NULL) && (scheme != NULL) && (hashData != NULL) && (sig != NULL)); // assume that the key has private part loaded and that it is a signing key. pAssert( (signKey->attributes.publicOnly == CLEAR) && (signKey->publicArea.objectAttributes.sign == SET)); // check if the private exponent has been computed if(signKey->attributes.privateExp == CLEAR) // May return TPM_RC_BINDING result = CryptLoadPrivateRSA(signKey); if(result == TPM_RC_SUCCESS) { BuildRSA(signKey, &key); // Make sure that the hash is tested TEST_HASH(sig->signature.any.hashAlg); // Run a test of the RSA sign TEST(scheme->scheme); // _crypi__SignRSA can return CRYPT_SCHEME and CRYPT_PARAMETER retVal = _cpri__SignRSA(&signSize, sig->signature.rsassa.sig.t.buffer, &key, sig->sigAlg, sig->signature.any.hashAlg, hashData->t.size, hashData->t.buffer); pAssert(signSize <= UINT16_MAX); sig->signature.rsassa.sig.t.size = (UINT16)signSize; // CRYPT_SCHEME -> TPM_RC_SCHEME; CRYPT_PARAMTER -> TPM_RC_VALUE result = TranslateCryptErrors(retVal); } return result; } // // // 10.2.5.9 CryptRSAVerifySignature() // // This function is used to verify signature signed by a RSA key. // // Error Returns Meaning // // TPM_RC_SIGNATURE if signature is not genuine // TPM_RC_SCHEME signature scheme not supported // static TPM_RC CryptRSAVerifySignature( OBJECT *signKey, // IN: RSA key signed the hash TPM2B_DIGEST *digestData, // IN: digest being signed TPMT_SIGNATURE *sig // IN: signature to be verified ) { RSA_KEY key; CRYPT_RESULT retVal; TPM_RC result; // Validate parameter assumptions pAssert((signKey != NULL) && (digestData != NULL) && (sig != NULL)); TEST_HASH(sig->signature.any.hashAlg); TEST(sig->sigAlg); // This is a public-key-only operation BuildRSA(signKey, &key); // Call crypto engine to verify signature // _cpri_ValidateSignaturRSA may return CRYPT_FAIL or CRYPT_SCHEME retVal = _cpri__ValidateSignatureRSA(&key, sig->sigAlg, sig->signature.any.hashAlg, digestData->t.size, digestData->t.buffer, sig->signature.rsassa.sig.t.size, sig->signature.rsassa.sig.t.buffer, 0); // _cpri__ValidateSignatureRSA can return CRYPT_SUCCESS, CRYPT_FAIL, or // CRYPT_SCHEME. Translate CRYPT_FAIL to TPM_RC_SIGNATURE if(retVal == CRYPT_FAIL) result = TPM_RC_SIGNATURE; else // CRYPT_SCHEME -> TPM_RC_SCHEME result = TranslateCryptErrors(retVal); return result; } // #endif //TPM_ALG_RSA //% 2 // // // 10.2.6 ECC Functions // // 10.2.6.1 CryptEccGetCurveDataPointer() // // This function returns a pointer to an ECC_CURVE_VALUES structure that contains the parameters for // the key size and schemes for a given curve. // #ifdef TPM_ALG_ECC //% 3 static const ECC_CURVE * CryptEccGetCurveDataPointer( TPM_ECC_CURVE curveID // IN: id of the curve ) { return _cpri__EccGetParametersByCurveId(curveID); } // // // 10.2.6.2 CryptEccGetKeySizeInBits() // // This function returns the size in bits of the key associated with a curve. // UINT16 CryptEccGetKeySizeInBits( TPM_ECC_CURVE curveID // IN: id of the curve ) { const ECC_CURVE *curve = CryptEccGetCurveDataPointer(curveID); UINT16 keySizeInBits = 0; if(curve != NULL) keySizeInBits = curve->keySizeBits; return keySizeInBits; } // // // 10.2.6.4 CryptEccGetParameter() // // This function returns a pointer to an ECC curve parameter. The parameter is selected by a single // character designator from the set of {pnabxyh}. // LIB_EXPORT const TPM2B * CryptEccGetParameter( char p, // IN: the parameter selector TPM_ECC_CURVE curveId // IN: the curve id ) { const ECC_CURVE *curve = _cpri__EccGetParametersByCurveId(curveId); const TPM2B *parameter = NULL; if(curve != NULL) { switch (p) { case 'p': parameter = curve->curveData->p; break; case 'n': parameter = curve->curveData->n; break; case 'a': parameter = curve->curveData->a; break; case 'b': parameter = curve->curveData->b; break; case 'x': parameter = curve->curveData->x; break; case 'y': parameter = curve->curveData->y; break; case 'h': parameter = curve->curveData->h; break; default: break; } } return parameter; } // // // 10.2.6.5 CryptGetCurveSignScheme() // // This function will return a pointer to the scheme of the curve. // const TPMT_ECC_SCHEME * CryptGetCurveSignScheme( TPM_ECC_CURVE curveId // IN: The curve selector ) { const ECC_CURVE *curve = _cpri__EccGetParametersByCurveId(curveId); const TPMT_ECC_SCHEME *scheme = NULL; if(curve != NULL) scheme = &(curve->sign); return scheme; } // // // 10.2.6.6 CryptEccIsPointOnCurve() // // This function will validate that an ECC point is on the curve of given curveID. // // Return Value Meaning // // TRUE if the point is on curve // FALSE if the point is not on curve // BOOL CryptEccIsPointOnCurve( TPM_ECC_CURVE curveID, // IN: ECC curve ID TPMS_ECC_POINT *Q // IN: ECC point ) { // Make sure that point multiply is working TEST(TPM_ALG_ECC); // Check point on curve logic by seeing if the test key is on the curve // Call crypto engine function to check if a ECC public point is on the // given curve if(_cpri__EccIsPointOnCurve(curveID, Q)) return TRUE; else return FALSE; } // // // 10.2.6.7 CryptNewEccKey() // // This function creates a random ECC key that is not derived from other parameters as is a Primary Key. // TPM_RC CryptNewEccKey( TPM_ECC_CURVE curveID, // IN: ECC curve TPMS_ECC_POINT *publicPoint, // OUT: public point TPM2B_ECC_PARAMETER *sensitive // OUT: private area ) { TPM_RC result = TPM_RC_SUCCESS; // _cpri__GetEphemeralECC may return CRYPT_PARAMETER if(_cpri__GetEphemeralEcc(publicPoint, sensitive, curveID) != CRYPT_SUCCESS) // Something is wrong with the key. result = TPM_RC_KEY; return result; } // // // 10.2.6.8 CryptEccPointMultiply() // // This function is used to perform a point multiply R = [d]Q. If Q is not provided, the multiplication is // performed using the generator point of the curve. // // Error Returns Meaning // // TPM_RC_ECC_POINT invalid optional ECC point pIn // TPM_RC_NO_RESULT multiplication resulted in a point at infinity // TPM_RC_CANCELED if a self-test was done, it might have been aborted // TPM_RC CryptEccPointMultiply( TPMS_ECC_POINT *pOut, // OUT: output point TPM_ECC_CURVE curveId, // IN: curve selector TPM2B_ECC_PARAMETER *dIn, // IN: public scalar TPMS_ECC_POINT *pIn // IN: optional point ) { TPM2B_ECC_PARAMETER *n = NULL; CRYPT_RESULT retVal; pAssert(pOut != NULL && dIn != NULL); if(pIn != NULL) { n = dIn; dIn = NULL; } // Do a test of point multiply TEST(TPM_ALG_ECC); // _cpri__EccPointMultiply may return CRYPT_POINT or CRYPT_NO_RESULT retVal = _cpri__EccPointMultiply(pOut, curveId, dIn, pIn, n); // CRYPT_POINT->TPM_RC_ECC_POINT and CRYPT_NO_RESULT->TPM_RC_NO_RESULT return TranslateCryptErrors(retVal); } // // // 10.2.6.9 CryptGenerateKeyECC() // // This function generates an ECC key from a seed value. // The method here may not work for objects that have an order (G) that with a different size than a private // key. // // Error Returns Meaning // // TPM_RC_VALUE hash algorithm is not supported // static TPM_RC CryptGenerateKeyECC( TPMT_PUBLIC *publicArea, // IN/OUT: The public area template for the new // key. TPMT_SENSITIVE *sensitive, // IN/OUT: the sensitive area TPM_ALG_ID hashAlg, // IN: algorithm for the KDF TPM2B_SEED *seed, // IN: the seed value TPM2B_NAME *name, // IN: the name of the object UINT32 *counter // OUT: the iteration counter ) { CRYPT_RESULT retVal; TEST_HASH(hashAlg); TEST(ALG_ECDSA_VALUE); // ECDSA is used to verify each key // The iteration counter has no meaning for ECC key generation. The parameter // will be overloaded for those implementations that have a requirement for // doing pair-wise consistency checks on signing keys. If the counter parameter // is 0 or NULL, then no consistency check is done. If it is other than 0, then // a consistency check is run. This modification allow this code to work with // the existing versions of the CrytpoEngine and with FIPS-compliant versions // as well. *counter = (UINT32)(publicArea->objectAttributes.sign == SET); // _cpri__GenerateKeyEcc only has one error return (CRYPT_PARAMETER) which means // that the hash algorithm is not supported. This should not be possible retVal = _cpri__GenerateKeyEcc(&publicArea->unique.ecc, &sensitive->sensitive.ecc, publicArea->parameters.eccDetail.curveID, hashAlg, &seed->b, "ECC key by vendor", &name->b, counter); // This will only be useful if _cpri__GenerateKeyEcc return CRYPT_CANCEL return TranslateCryptErrors(retVal); } // // // 10.2.6.10 CryptSignECC() // // This function is used for ECC signing operations. If the signing scheme is a split scheme, and the signing // operation is successful, the commit value is retired. // // // Error Returns Meaning // // TPM_RC_SCHEME unsupported scheme // TPM_RC_VALUE invalid commit status (in case of a split scheme) or failed to generate // r value. // static TPM_RC CryptSignECC( OBJECT *signKey, // IN: ECC key to sign the hash TPMT_SIG_SCHEME *scheme, // IN: sign scheme TPM2B_DIGEST *hashData, // IN: hash to be signed TPMT_SIGNATURE *signature // OUT: signature ) { TPM2B_ECC_PARAMETER r; TPM2B_ECC_PARAMETER *pr = NULL; CRYPT_RESULT retVal; // Run a test of the ECC sign and verify if it has not already been run TEST_HASH(scheme->details.any.hashAlg); TEST(scheme->scheme); if(CryptIsSplitSign(scheme->scheme)) { // When this code was written, the only split scheme was ECDAA // (which can also be used for U-Prove). if(!CryptGenerateR(&r, &scheme->details.ecdaa.count, signKey->publicArea.parameters.eccDetail.curveID, &signKey->name)) return TPM_RC_VALUE; pr = &r; } // Call crypto engine function to sign // _cpri__SignEcc may return CRYPT_SCHEME retVal = _cpri__SignEcc(&signature->signature.ecdsa.signatureR, &signature->signature.ecdsa.signatureS, scheme->scheme, scheme->details.any.hashAlg, signKey->publicArea.parameters.eccDetail.curveID, &signKey->sensitive.sensitive.ecc, &hashData->b, pr ); if(CryptIsSplitSign(scheme->scheme) && retVal == CRYPT_SUCCESS) CryptEndCommit(scheme->details.ecdaa.count); // CRYPT_SCHEME->TPM_RC_SCHEME return TranslateCryptErrors(retVal); } // // // 10.2.6.11 CryptECCVerifySignature() // // This function is used to verify a signature created with an ECC key. // // Error Returns Meaning // // TPM_RC_SIGNATURE if signature is not valid // TPM_RC_SCHEME the signing scheme or hashAlg is not supported // static TPM_RC CryptECCVerifySignature( OBJECT *signKey, // IN: ECC key signed the hash TPM2B_DIGEST *digestData, // IN: digest being signed TPMT_SIGNATURE *signature // IN: signature to be verified ) { CRYPT_RESULT retVal; TEST_HASH(signature->signature.any.hashAlg); TEST(signature->sigAlg); // This implementation uses the fact that all the defined ECC signing // schemes have the hash as the first parameter. // _cpriValidateSignatureEcc may return CRYPT_FAIL or CRYP_SCHEME retVal = _cpri__ValidateSignatureEcc(&signature->signature.ecdsa.signatureR, &signature->signature.ecdsa.signatureS, signature->sigAlg, signature->signature.any.hashAlg, signKey->publicArea.parameters.eccDetail.curveID, &signKey->publicArea.unique.ecc, &digestData->b); if(retVal == CRYPT_FAIL) return TPM_RC_SIGNATURE; // CRYPT_SCHEME->TPM_RC_SCHEME return TranslateCryptErrors(retVal); } // // // 10.2.6.12 CryptGenerateR() // // This function computes the commit random value for a split signing scheme. // If c is NULL, it indicates that r is being generated for TPM2_Commit(). If c is not NULL, the TPM will // validate that the gr.commitArray bit associated with the input value of c is SET. If not, the TPM returns // FALSE and no r value is generated. // // Return Value Meaning // // TRUE r value computed // FALSE no r value computed // BOOL CryptGenerateR( TPM2B_ECC_PARAMETER *r, // OUT: the generated random value UINT16 *c, // IN/OUT: count value. TPMI_ECC_CURVE curveID, // IN: the curve for the value TPM2B_NAME *name // IN: optional name of a key to // associate with 'r' ) { // This holds the marshaled g_commitCounter. TPM2B_TYPE(8B, 8); TPM2B_8B cntr = {.b.size = 8}; UINT32 iterations; const TPM2B *n; UINT64 currentCount = gr.commitCounter; // This is just to suppress a compiler warning about a conditional expression // being a constant. This is because of the macro expansion of ryptKDFa TPMI_ALG_HASH hashAlg = CONTEXT_INTEGRITY_HASH_ALG; n = CryptEccGetParameter('n', curveID); pAssert(r != NULL && n != NULL); // If this is the commit phase, use the current value of the commit counter if(c != NULL) // { UINT16 t1; // if the array bit is not set, can't use the value. if(!BitIsSet((*c & COMMIT_INDEX_MASK), gr.commitArray, sizeof(gr.commitArray))) return FALSE; // If it is the sign phase, figure out what the counter value was // when the commitment was made. // // When gr.commitArray has less than 64K bits, the extra // bits of 'c' are used as a check to make sure that the // signing operation is not using an out of range count value t1 = (UINT16)currentCount; // If the lower bits of c are greater or equal to the lower bits of t1 // then the upper bits of t1 must be one more than the upper bits // of c if((*c & COMMIT_INDEX_MASK) >= (t1 & COMMIT_INDEX_MASK)) // Since the counter is behind, reduce the current count currentCount = currentCount - (COMMIT_INDEX_MASK + 1); t1 = (UINT16)currentCount; if((t1 & ~COMMIT_INDEX_MASK) != (*c & ~COMMIT_INDEX_MASK)) return FALSE; // set the counter to the value that was // present when the commitment was made currentCount = (currentCount & 0xffffffffffff0000) | *c; } // Marshal the count value to a TPM2B buffer for the KDF cntr.t.size = sizeof(currentCount); UINT64_TO_BYTE_ARRAY(currentCount, cntr.t.buffer); // Now can do the KDF to create the random value for the signing operation // During the creation process, we may generate an r that does not meet the // requirements of the random value. // want to generate a new r. r->t.size = n->size; // Arbitrary upper limit on the number of times that we can look for // a suitable random value. The normally number of tries will be 1. for(iterations = 1; iterations < 1000000;) { BYTE *pr = &r->b.buffer[0]; int i; CryptKDFa(hashAlg, &gr.commitNonce.b, "ECDAA Commit", name, &cntr.b, n->size * 8, r->t.buffer, &iterations); // random value must be less than the prime if(CryptCompare(r->b.size, r->b.buffer, n->size, n->buffer) >= 0) continue; // in this implementation it is required that at least bit // in the upper half of the number be set for(i = n->size/2; i > 0; i--) if(*pr++ != 0) return TRUE; } return FALSE; } // // // // 10.2.6.13 CryptCommit() // // This function is called when the count value is committed. The gr.commitArray value associated with the // current count value is SET and g_commitCounter is incremented. The low-order 16 bits of old value of the // counter is returned. // UINT16 CryptCommit( void ) { UINT16 oldCount = (UINT16)gr.commitCounter; gr.commitCounter++; BitSet(oldCount & COMMIT_INDEX_MASK, gr.commitArray, sizeof(gr.commitArray)); return oldCount; } // // // 10.2.6.14 CryptEndCommit() // // This function is called when the signing operation using the committed value is completed. It clears the // gr.commitArray bit associated with the count value so that it can't be used again. // void CryptEndCommit( UINT16 c // IN: the counter value of the commitment ) { BitClear((c & COMMIT_INDEX_MASK), gr.commitArray, sizeof(gr.commitArray)); } // // // 10.2.6.15 CryptCommitCompute() // // This function performs the computations for the TPM2_Commit() command. This could be a macro. // // Error Returns Meaning // // TPM_RC_NO_RESULT K, L, or E is the point at infinity // TPM_RC_CANCELLED command was canceled // TPM_RC CryptCommitCompute( TPMS_ECC_POINT *K, // OUT: [d]B TPMS_ECC_POINT *L, // OUT: [r]B TPMS_ECC_POINT *E, // OUT: [r]M TPM_ECC_CURVE curveID, // IN: The curve for the computation TPMS_ECC_POINT *M, // IN: M (P1) TPMS_ECC_POINT *B, // IN: B (x2, y2) TPM2B_ECC_PARAMETER *d, // IN: the private scalar TPM2B_ECC_PARAMETER *r // IN: the computed r value ) { TEST(ALG_ECDH_VALUE); // CRYPT_NO_RESULT->TPM_RC_NO_RESULT CRYPT_CANCEL->TPM_RC_CANCELLED return TranslateCryptErrors( _cpri__EccCommitCompute(K, L , E, curveID, M, B, d, r)); } // // // // 10.2.6.16 CryptEccGetParameters() // // This function returns the ECC parameter details of the given curve // // Return Value Meaning // // TRUE Get parameters success // FALSE Unsupported ECC curve ID // BOOL CryptEccGetParameters( TPM_ECC_CURVE curveId, // IN: ECC curve ID TPMS_ALGORITHM_DETAIL_ECC *parameters // OUT: ECC parameter ) { const ECC_CURVE *curve = _cpri__EccGetParametersByCurveId(curveId); const ECC_CURVE_DATA *data; BOOL found = curve != NULL; if(found) { data = curve->curveData; parameters->curveID = curve->curveId; // Key size in bit parameters->keySize = curve->keySizeBits; // KDF parameters->kdf = curve->kdf; // Sign parameters->sign = curve->sign; // Copy p value MemoryCopy2B(¶meters->p.b, data->p, sizeof(parameters->p.t.buffer)); // Copy a value MemoryCopy2B(¶meters->a.b, data->a, sizeof(parameters->a.t.buffer)); // Copy b value MemoryCopy2B(¶meters->b.b, data->b, sizeof(parameters->b.t.buffer)); // Copy Gx value MemoryCopy2B(¶meters->gX.b, data->x, sizeof(parameters->gX.t.buffer)); // Copy Gy value MemoryCopy2B(¶meters->gY.b, data->y, sizeof(parameters->gY.t.buffer)); // Copy n value MemoryCopy2B(¶meters->n.b, data->n, sizeof(parameters->n.t.buffer)); // Copy h value MemoryCopy2B(¶meters->h.b, data->h, sizeof(parameters->h.t.buffer)); } return found; } #if CC_ZGen_2Phase == YES // // CryptEcc2PhaseKeyExchange() This is the interface to the key exchange function. // TPM_RC CryptEcc2PhaseKeyExchange( TPMS_ECC_POINT *outZ1, // OUT: the computed point TPMS_ECC_POINT *outZ2, // OUT: optional second point TPM_ALG_ID scheme, // IN: the key exchange scheme TPM_ECC_CURVE curveId, // IN: the curve for the computation TPM2B_ECC_PARAMETER *dsA, // IN: static private TPM key TPM2B_ECC_PARAMETER *deA, // IN: ephemeral private TPM key TPMS_ECC_POINT *QsB, // IN: static public party B key TPMS_ECC_POINT *QeB // IN: ephemeral public party B key ) { return (TranslateCryptErrors(_cpri__C_2_2_KeyExchange(outZ1, outZ2, scheme, curveId, dsA, deA, QsB, QeB))); } #endif // CC_ZGen_2Phase #endif //TPM_ALG_ECC //% 3 // // // 10.2.6.17 CryptIsSchemeAnonymous() // // This function is used to test a scheme to see if it is an anonymous scheme The only anonymous scheme // is ECDAA. ECDAA can be used to do things like U-Prove. // BOOL CryptIsSchemeAnonymous( TPM_ALG_ID scheme // IN: the scheme algorithm to test ) { #ifdef TPM_ALG_ECDAA return (scheme == TPM_ALG_ECDAA); #else UNREFERENCED(scheme); return 0; #endif } // // // 10.2.7 Symmetric Functions // // 10.2.7.1 ParmDecryptSym() // // This function performs parameter decryption using symmetric block cipher. // void ParmDecryptSym( TPM_ALG_ID symAlg, // IN: the symmetric algorithm TPM_ALG_ID hash, // IN: hash algorithm for KDFa UINT16 keySizeInBits, // IN: key key size in bit TPM2B *key, // IN: KDF HMAC key TPM2B *nonceCaller, // IN: nonce caller TPM2B *nonceTpm, // IN: nonce TPM UINT32 dataSize, // IN: size of parameter buffer BYTE *data // OUT: buffer to be decrypted ) { // KDF output buffer // It contains parameters for the CFB encryption // From MSB to LSB, they are the key and iv BYTE symParmString[MAX_SYM_KEY_BYTES + MAX_SYM_BLOCK_SIZE]; // Symmetric key size in byte UINT16 keySize = (keySizeInBits + 7) / 8; TPM2B_IV iv; iv.t.size = CryptGetSymmetricBlockSize(symAlg, keySizeInBits); // If there is decryption to do... if(iv.t.size > 0) { // Generate key and iv CryptKDFa(hash, key, "CFB", nonceCaller, nonceTpm, keySizeInBits + (iv.t.size * 8), symParmString, NULL); MemoryCopy(iv.t.buffer, &symParmString[keySize], iv.t.size, sizeof(iv.t.buffer)); CryptSymmetricDecrypt(data, symAlg, keySizeInBits, TPM_ALG_CFB, symParmString, &iv, dataSize, data); } return; } // // // 10.2.7.2 ParmEncryptSym() // // This function performs parameter encryption using symmetric block cipher. // void ParmEncryptSym( TPM_ALG_ID symAlg, // IN: symmetric algorithm TPM_ALG_ID hash, // IN: hash algorithm for KDFa UINT16 keySizeInBits, // IN: AES key size in bit TPM2B *key, // IN: KDF HMAC key TPM2B *nonceCaller, // IN: nonce caller TPM2B *nonceTpm, // IN: nonce TPM UINT32 dataSize, // IN: size of parameter buffer BYTE *data // OUT: buffer to be encrypted ) { // KDF output buffer // It contains parameters for the CFB encryption BYTE symParmString[MAX_SYM_KEY_BYTES + MAX_SYM_BLOCK_SIZE]; // Symmetric key size in bytes UINT16 keySize = (keySizeInBits + 7) / 8; TPM2B_IV iv; iv.t.size = CryptGetSymmetricBlockSize(symAlg, keySizeInBits); // See if there is any encryption to do if(iv.t.size > 0) { // Generate key and iv CryptKDFa(hash, key, "CFB", nonceTpm, nonceCaller, keySizeInBits + (iv.t.size * 8), symParmString, NULL); MemoryCopy(iv.t.buffer, &symParmString[keySize], iv.t.size, sizeof(iv.t.buffer)); CryptSymmetricEncrypt(data, symAlg, keySizeInBits, TPM_ALG_CFB, symParmString, &iv, dataSize, data); } return; } // // // // 10.2.7.3 CryptGenerateNewSymmetric() // // This function creates the sensitive symmetric values for an HMAC or symmetric key. If the sensitive area // is zero, then the sensitive creation key data is copied. If it is not zero, then the TPM will generate a // random value of the selected size. // void CryptGenerateNewSymmetric( TPMS_SENSITIVE_CREATE *sensitiveCreate, // IN: sensitive creation data TPMT_SENSITIVE *sensitive, // OUT: sensitive area TPM_ALG_ID hashAlg, // IN: hash algorithm for the KDF TPM2B_SEED *seed, // IN: seed used in creation TPM2B_NAME *name // IN: name of the object ) { // This function is called to create a key and obfuscation value for a // symmetric key that can either be a block cipher or an XOR key. The buffer // in sensitive->sensitive will hold either. When we call the function // to copy the input value or generated value to the sensitive->sensitive // buffer we will need to have a size for the output buffer. This define // computes the maximum that it might need to be and uses that. It will always // be smaller than the largest value that will fit. #define MAX_SENSITIVE_SIZE \ (MAX(sizeof(sensitive->sensitive.bits.t.buffer), \ sizeof(sensitive->sensitive.sym.t.buffer))) // set the size of the obfuscation value sensitive->seedValue.t.size = CryptGetHashDigestSize(hashAlg); // If the input sensitive size is zero, then create both the sensitive data // and the obfuscation value if(sensitiveCreate->data.t.size == 0) { BYTE symValues[MAX(MAX_DIGEST_SIZE, MAX_SYM_KEY_BYTES) + MAX_DIGEST_SIZE]; UINT16 requestSize; // Set the size of the request to be the size of the key and the // obfuscation value requestSize = sensitive->sensitive.sym.t.size + sensitive->seedValue.t.size; pAssert(requestSize <= sizeof(symValues)); requestSize = _cpri__GenerateSeededRandom(requestSize, symValues, hashAlg, &seed->b, "symmetric sensitive", &name->b, NULL); pAssert(requestSize != 0); // Copy the new key MemoryCopy(sensitive->sensitive.sym.t.buffer, symValues, sensitive->sensitive.sym.t.size, MAX_SENSITIVE_SIZE); // copy the obfuscation value MemoryCopy(sensitive->seedValue.t.buffer, &symValues[sensitive->sensitive.sym.t.size], sensitive->seedValue.t.size, sizeof(sensitive->seedValue.t.buffer)); } else { // Copy input symmetric key to sensitive area as long as it will fit MemoryCopy2B(&sensitive->sensitive.sym.b, &sensitiveCreate->data.b, MAX_SENSITIVE_SIZE); // Create the obfuscation value _cpri__GenerateSeededRandom(sensitive->seedValue.t.size, sensitive->seedValue.t.buffer, hashAlg, &seed->b, "symmetric obfuscation", &name->b, NULL); } return; } // // // 10.2.7.4 CryptGenerateKeySymmetric() // // This function derives a symmetric cipher key from the provided seed. // // Error Returns Meaning // // TPM_RC_KEY_SIZE key size in the public area does not match the size in the sensitive // creation area // TPM_RC_VALUE the publicArea nameAlg is invalid // static TPM_RC CryptGenerateKeySymmetric( TPMT_PUBLIC *publicArea, // IN/OUT: The public area template // for the new key. TPMS_SENSITIVE_CREATE *sensitiveCreate, // IN: sensitive creation data TPMT_SENSITIVE *sensitive, // OUT: sensitive area TPM_ALG_ID hashAlg, // IN: hash algorithm for the KDF TPM2B_SEED *seed, // IN: seed used in creation TPM2B_NAME *name // IN: name of the object ) { // Check parameter values if(publicArea->nameAlg == TPM_ALG_NULL) { return TPM_RC_VALUE; } // If this is not a new key, then the provided key data must be the right size if(publicArea->objectAttributes.sensitiveDataOrigin == CLEAR) { if( (sensitiveCreate->data.t.size * 8) != publicArea->parameters.symDetail.sym.keyBits.sym) return TPM_RC_KEY_SIZE; // Make sure that the key size is OK. // This implementation only supports symmetric key sizes that are // multiples of 8 if(publicArea->parameters.symDetail.sym.keyBits.sym % 8 != 0) return TPM_RC_KEY_SIZE; } else { // TPM is going to generate the key so set the size sensitive->sensitive.sym.t.size = publicArea->parameters.symDetail.sym.keyBits.sym / 8; sensitiveCreate->data.t.size = 0; } // Fill in the sensitive area CryptGenerateNewSymmetric(sensitiveCreate, sensitive, hashAlg, seed, name); // Create unique area in public CryptComputeSymmetricUnique(publicArea->nameAlg, sensitive, &publicArea->unique.sym); return TPM_RC_SUCCESS; } // // // // 10.2.7.5 CryptXORObfuscation() // // This function implements XOR obfuscation. It should not be called if the hash algorithm is not // implemented. The only return value from this function is TPM_RC_SUCCESS. // #ifdef TPM_ALG_KEYEDHASH //% 5 void CryptXORObfuscation( TPM_ALG_ID hash, // IN: hash algorithm for KDF TPM2B *key, // IN: KDF key TPM2B *contextU, // IN: contextU TPM2B *contextV, // IN: contextV UINT32 dataSize, // IN: size of data buffer BYTE *data // IN/OUT: data to be XORed in place ) { BYTE mask[MAX_DIGEST_SIZE]; // Allocate a digest sized buffer BYTE *pm; UINT32 i; UINT32 counter = 0; UINT16 hLen = CryptGetHashDigestSize(hash); UINT32 requestSize = dataSize * 8; INT32 remainBytes = (INT32) dataSize; pAssert((key != NULL) && (data != NULL) && (hLen != 0)); // Call KDFa to generate XOR mask for(; remainBytes > 0; remainBytes -= hLen) { // Make a call to KDFa to get next iteration CryptKDFaOnce(hash, key, "XOR", contextU, contextV, requestSize, mask, &counter); // XOR next piece of the data pm = mask; for(i = hLen < remainBytes ? hLen : remainBytes; i > 0; i--) *data++ ^= *pm++; } return; } #endif //TPM_ALG_KEYED_HASH //%5 // // // 10.2.8 Initialization and shut down // // 10.2.8.1 CryptInitUnits() // // This function is called when the TPM receives a _TPM_Init() indication. After function returns, the hash // algorithms should be available. // // NOTE: The hash algorithms do not have to be tested, they just need to be available. They have to be tested before the // TPM can accept HMAC authorization or return any result that relies on a hash algorithm. // void CryptInitUnits( void ) { // Initialize the vector of implemented algorithms AlgorithmGetImplementedVector(&g_implementedAlgorithms); // Indicate that all test are necessary CryptInitializeToTest(); // // Call crypto engine unit initialization // It is assumed that crypt engine initialization should always succeed. // Otherwise, TPM should go to failure mode. if(_cpri__InitCryptoUnits(&TpmFail) != CRYPT_SUCCESS) FAIL(FATAL_ERROR_INTERNAL); return; } // // // 10.2.8.2 CryptStopUnits() // // This function is only used in a simulated environment. There should be no reason to shut down the // cryptography on an actual TPM other than loss of power. After receiving TPM2_Startup(), the TPM should // be able to accept commands until it loses power and, unless the TPM is in Failure Mode, the // cryptographic algorithms should be available. // void CryptStopUnits( void ) { // Call crypto engine unit stopping _cpri__StopCryptoUnits(); return; } // // // 10.2.8.3 CryptUtilStartup() // // This function is called by TPM2_Startup() to initialize the functions in this crypto library and in the // provided CryptoEngine(). In this implementation, the only initialization required in this library is // initialization of the Commit nonce on TPM Reset. // This function returns false if some problem prevents the functions from starting correctly. The TPM should // go into failure mode. // BOOL CryptUtilStartup( STARTUP_TYPE type // IN: the startup type ) { // Make sure that the crypto library functions are ready. // NOTE: need to initialize the crypto before loading // the RND state may trigger a self-test which // uses the if( !_cpri__Startup()) return FALSE; // Initialize the state of the RNG. CryptDrbgGetPutState(PUT_STATE); if(type == SU_RESET) { #ifdef TPM_ALG_ECC // Get a new random commit nonce gr.commitNonce.t.size = sizeof(gr.commitNonce.t.buffer); _cpri__GenerateRandom(gr.commitNonce.t.size, gr.commitNonce.t.buffer); // Reset the counter and commit array gr.commitCounter = 0; MemorySet(gr.commitArray, 0, sizeof(gr.commitArray)); #endif // TPM_ALG_ECC } // If the shutdown was orderly, then the values recovered from NV will // be OK to use. If the shutdown was not orderly, then a TPM Reset was required // and we would have initialized in the code above. return TRUE; } // // // 10.2.9 Algorithm-Independent Functions // // 10.2.9.1 Introduction // // These functions are used generically when a function of a general type (e.g., symmetric encryption) is // required. The functions will modify the parameters as required to interface to the indicated algorithms. // // 10.2.9.2 CryptIsAsymAlgorithm() // // This function indicates if an algorithm is an asymmetric algorithm. // // Return Value Meaning // // TRUE if it is an asymmetric algorithm // FALSE if it is not an asymmetric algorithm // BOOL CryptIsAsymAlgorithm( TPM_ALG_ID algID // IN: algorithm ID ) { return ( #ifdef TPM_ALG_RSA algID == TPM_ALG_RSA #endif #if defined TPM_ALG_RSA && defined TPM_ALG_ECC || #endif #ifdef TPM_ALG_ECC algID == TPM_ALG_ECC #endif ); } // // // 10.2.9.3 CryptGetSymmetricBlockSize() // // This function returns the size in octets of the symmetric encryption block used by an algorithm and key // size combination. // INT16 CryptGetSymmetricBlockSize( TPMI_ALG_SYM algorithm, // IN: symmetric algorithm UINT16 keySize // IN: key size in bit ) { return _cpri__GetSymmetricBlockSize(algorithm, keySize); } // // // // 10.2.9.4 CryptSymmetricEncrypt() // // This function does in-place encryption of a buffer using the indicated symmetric algorithm, key, IV, and // mode. If the symmetric algorithm and mode are not defined, the TPM will fail. // void CryptSymmetricEncrypt( BYTE *encrypted, // OUT: the encrypted data TPM_ALG_ID algorithm, // IN: algorithm for encryption UINT16 keySizeInBits, // IN: key size in bit TPMI_ALG_SYM_MODE mode, // IN: symmetric encryption mode BYTE *key, // IN: encryption key TPM2B_IV *ivIn, // IN/OUT: Input IV and output chaining // value for the next block UINT32 dataSize, // IN: data size in byte BYTE *data // IN/OUT: data buffer ) { TPM2B_IV defaultIv = {}; TPM2B_IV *iv = (ivIn != NULL) ? ivIn : &defaultIv; TEST(algorithm); pAssert(encrypted != NULL && key != NULL); // this check can pass but the case below can fail. ALG_xx_VALUE values are // defined for all algorithms but the TPM_ALG_xx might not be. if(algorithm == ALG_AES_VALUE || algorithm == ALG_SM4_VALUE) { if(mode != TPM_ALG_ECB) defaultIv.t.size = 16; // A provided IV has to be the right size pAssert(mode == TPM_ALG_ECB || iv->t.size == 16); } switch(algorithm) { #ifdef TPM_ALG_AES case TPM_ALG_AES: { switch (mode) { case TPM_ALG_CTR: _cpri__AESEncryptCTR(encrypted, keySizeInBits, key, iv->t.buffer, dataSize, data); break; case TPM_ALG_OFB: _cpri__AESEncryptOFB(encrypted, keySizeInBits, key, iv->t.buffer, dataSize, data); break; case TPM_ALG_CBC: _cpri__AESEncryptCBC(encrypted, keySizeInBits, key, iv->t.buffer, dataSize, data); break; case TPM_ALG_CFB: _cpri__AESEncryptCFB(encrypted, keySizeInBits, key, iv->t.buffer, dataSize, data); break; case TPM_ALG_ECB: _cpri__AESEncryptECB(encrypted, keySizeInBits, key, dataSize, data); break; default: pAssert(0); } } break; #endif #ifdef TPM_ALG_SM4 case TPM_ALG_SM4: { switch (mode) { case TPM_ALG_CTR: _cpri__SM4EncryptCTR(encrypted, keySizeInBits, key, iv->t.buffer, dataSize, data); break; case TPM_ALG_OFB: _cpri__SM4EncryptOFB(encrypted, keySizeInBits, key, iv->t.buffer, dataSize, data); break; case TPM_ALG_CBC: _cpri__SM4EncryptCBC(encrypted, keySizeInBits, key, iv->t.buffer, dataSize, data); break; case TPM_ALG_CFB: _cpri__SM4EncryptCFB(encrypted, keySizeInBits, key, iv->t.buffer, dataSize, data); break; case TPM_ALG_ECB: _cpri__SM4EncryptECB(encrypted, keySizeInBits, key, dataSize, data); break; default: pAssert(0); } } break; #endif default: pAssert(FALSE); break; } return; } // // // 10.2.9.5 CryptSymmetricDecrypt() // // This function does in-place decryption of a buffer using the indicated symmetric algorithm, key, IV, and // mode. If the symmetric algorithm and mode are not defined, the TPM will fail. // void CryptSymmetricDecrypt( BYTE *decrypted, TPM_ALG_ID algorithm, // IN: algorithm for encryption UINT16 keySizeInBits, // IN: key size in bit TPMI_ALG_SYM_MODE mode, // IN: symmetric encryption mode BYTE *key, // IN: encryption key TPM2B_IV *ivIn, // IN/OUT: IV for next block UINT32 dataSize, // IN: data size in byte BYTE *data // IN/OUT: data buffer ) { BYTE *iv = NULL; BYTE defaultIV[sizeof(TPMT_HA)]; TEST(algorithm); if( #ifdef TPM_ALG_AES algorithm == TPM_ALG_AES #endif #if defined TPM_ALG_AES && defined TPM_ALG_SM4 || #endif #ifdef TPM_ALG_SM4 algorithm == TPM_ALG_SM4 #endif ) { // Both SM4 and AES have block size of 128 bits // If the iv is not provided, create a default of 0 if(ivIn == NULL) { // Initialize the default IV iv = defaultIV; MemorySet(defaultIV, 0, 16); } else { // A provided IV has to be the right size pAssert(mode == TPM_ALG_ECB || ivIn->t.size == 16); iv = &(ivIn->t.buffer[0]); } } switch(algorithm) { #ifdef TPM_ALG_AES case TPM_ALG_AES: { switch (mode) { case TPM_ALG_CTR: _cpri__AESDecryptCTR(decrypted, keySizeInBits, key, iv, dataSize, data); break; case TPM_ALG_OFB: _cpri__AESDecryptOFB(decrypted, keySizeInBits, key, iv, dataSize, data); break; case TPM_ALG_CBC: _cpri__AESDecryptCBC(decrypted, keySizeInBits, key, iv, dataSize, data); break; case TPM_ALG_CFB: _cpri__AESDecryptCFB(decrypted, keySizeInBits, key, iv, dataSize, data); break; case TPM_ALG_ECB: _cpri__AESDecryptECB(decrypted, keySizeInBits, key, dataSize, data); break; default: pAssert(0); } break; } #endif //TPM_ALG_AES #ifdef TPM_ALG_SM4 case TPM_ALG_SM4 : switch (mode) { case TPM_ALG_CTR: _cpri__SM4DecryptCTR(decrypted, keySizeInBits, key, iv, dataSize, data); break; case TPM_ALG_OFB: _cpri__SM4DecryptOFB(decrypted, keySizeInBits, key, iv, dataSize, data); break; case TPM_ALG_CBC: _cpri__SM4DecryptCBC(decrypted, keySizeInBits, key, iv, dataSize, data); break; case TPM_ALG_CFB: _cpri__SM4DecryptCFB(decrypted, keySizeInBits, key, iv, dataSize, data); break; case TPM_ALG_ECB: _cpri__SM4DecryptECB(decrypted, keySizeInBits, key, dataSize, data); break; default: pAssert(0); } break; #endif //TPM_ALG_SM4 default: pAssert(FALSE); break; } return; } // // // 10.2.9.6 CryptSecretEncrypt() // // This function creates a secret value and its associated secret structure using an asymmetric algorithm. // This function is used by TPM2_Rewrap() TPM2_MakeCredential(), and TPM2_Duplicate(). // // Error Returns Meaning // // TPM_RC_ATTRIBUTES keyHandle does not reference a valid decryption key // TPM_RC_KEY invalid ECC key (public point is not on the curve) // TPM_RC_SCHEME RSA key with an unsupported padding scheme // TPM_RC_VALUE numeric value of the data to be decrypted is greater than the RSA // key modulus // TPM_RC CryptSecretEncrypt( TPMI_DH_OBJECT keyHandle, // IN: encryption key handle const char *label, // IN: a null-terminated string as L TPM2B_DATA *data, // OUT: secret value TPM2B_ENCRYPTED_SECRET *secret // OUT: secret structure ) { TPM_RC result = TPM_RC_SUCCESS; OBJECT *encryptKey = ObjectGet(keyHandle); // TPM key used for encrypt pAssert(data != NULL && secret != NULL); // The output secret value has the size of the digest produced by the nameAlg. data->t.size = CryptGetHashDigestSize(encryptKey->publicArea.nameAlg); pAssert(encryptKey->publicArea.objectAttributes.decrypt == SET); switch(encryptKey->publicArea.type) { #ifdef TPM_ALG_RSA case TPM_ALG_RSA: { TPMT_RSA_DECRYPT scheme; // Use OAEP scheme scheme.scheme = TPM_ALG_OAEP; scheme.details.oaep.hashAlg = encryptKey->publicArea.nameAlg; // Create secret data from RNG CryptGenerateRandom(data->t.size, data->t.buffer); // Encrypt the data by RSA OAEP into encrypted secret result = CryptEncryptRSA(&secret->t.size, secret->t.secret, encryptKey, &scheme, data->t.size, data->t.buffer, label); } break; #endif //TPM_ALG_RSA #ifdef TPM_ALG_ECC case TPM_ALG_ECC: { TPMS_ECC_POINT eccPublic; TPM2B_ECC_PARAMETER eccPrivate; TPMS_ECC_POINT eccSecret; BYTE *buffer = secret->t.secret; INT32 bufferSize = sizeof(TPMS_ECC_POINT); // Need to make sure that the public point of the key is on the // curve defined by the key. if(!_cpri__EccIsPointOnCurve( encryptKey->publicArea.parameters.eccDetail.curveID, &encryptKey->publicArea.unique.ecc)) result = TPM_RC_KEY; else { // Call crypto engine to create an auxiliary ECC key // We assume crypt engine initialization should always success. // Otherwise, TPM should go to failure mode. CryptNewEccKey(encryptKey->publicArea.parameters.eccDetail.curveID, &eccPublic, &eccPrivate); // Marshal ECC public to secret structure. This will be used by the // recipient to decrypt the secret with their private key. secret->t.size = TPMS_ECC_POINT_Marshal(&eccPublic, &buffer, &bufferSize); // Compute ECDH shared secret which is R = [d]Q where d is the // private part of the ephemeral key and Q is the public part of a // TPM key. TPM_RC_KEY error return from CryptComputeECDHSecret // because the auxiliary ECC key is just created according to the // parameters of input ECC encrypt key. if( CryptEccPointMultiply(&eccSecret, encryptKey->publicArea.parameters.eccDetail.curveID, &eccPrivate, &encryptKey->publicArea.unique.ecc) != CRYPT_SUCCESS) result = TPM_RC_KEY; else // The secret value is computed from Z using KDFe as: // secret := KDFe(HashID, Z, Use, PartyUInfo, PartyVInfo, bits) // Where: // HashID the nameAlg of the decrypt key // Z the x coordinate (Px) of the product (P) of the point // (Q) of the secret and the private x coordinate (de,V) // of the decryption key // Use a null-terminated string containing "SECRET" // PartyUInfo the x coordinate of the point in the secret // (Qe,U ) // PartyVInfo the x coordinate of the public key (Qs,V ) // bits the number of bits in the digest of HashID // Retrieve seed from KDFe CryptKDFe(encryptKey->publicArea.nameAlg, &eccSecret.x.b, label, &eccPublic.x.b, &encryptKey->publicArea.unique.ecc.x.b, data->t.size * 8, data->t.buffer); } } break; #endif //TPM_ALG_ECC default: FAIL(FATAL_ERROR_INTERNAL); break; } return result; } // // // 10.2.9.7 CryptSecretDecrypt() // // Decrypt a secret value by asymmetric (or symmetric) algorithm This function is used for // ActivateCredential() and Import for asymmetric decryption, and StartAuthSession() for both asymmetric // and symmetric decryption process // // Error Returns Meaning // // TPM_RC_ATTRIBUTES RSA key is not a decryption key // TPM_RC_BINDING Invalid RSA key (public and private parts are not cryptographically // bound. // TPM_RC_ECC_POINT ECC point in the secret is not on the curve // TPM_RC_INSUFFICIENT failed to retrieve ECC point from the secret // TPM_RC_NO_RESULT multiplication resulted in ECC point at infinity // TPM_RC_SIZE data to decrypt is not of the same size as RSA key // TPM_RC_VALUE For RSA key, numeric value of the encrypted data is greater than the // modulus, or the recovered data is larger than the output buffer. For // keyedHash or symmetric key, the secret is larger than the size of the // digest produced by the name algorithm. // TPM_RC_FAILURE internal error // TPM_RC CryptSecretDecrypt( TPM_HANDLE tpmKey, // IN: decrypt key TPM2B_NONCE *nonceCaller, // IN: nonceCaller. It is needed for // symmetric decryption. For // asymmetric decryption, this // parameter is NULL const char *label, // IN: a null-terminated string as L TPM2B_ENCRYPTED_SECRET *secret, // IN: input secret TPM2B_DATA *data // OUT: decrypted secret value ) { TPM_RC result = TPM_RC_SUCCESS; OBJECT *decryptKey = ObjectGet(tpmKey); //TPM key used for decrypting // Decryption for secret switch(decryptKey->publicArea.type) { #ifdef TPM_ALG_RSA case TPM_ALG_RSA: { TPMT_RSA_DECRYPT scheme; // Use OAEP scheme scheme.scheme = TPM_ALG_OAEP; scheme.details.oaep.hashAlg = decryptKey->publicArea.nameAlg; // Set the output buffer capacity data->t.size = sizeof(data->t.buffer); // Decrypt seed by RSA OAEP result = CryptDecryptRSA(&data->t.size, data->t.buffer, decryptKey, &scheme, secret->t.size, secret->t.secret,label); if( (result == TPM_RC_SUCCESS) && (data->t.size > CryptGetHashDigestSize(decryptKey->publicArea.nameAlg))) result = TPM_RC_VALUE; } break; #endif //TPM_ALG_RSA #ifdef TPM_ALG_ECC case TPM_ALG_ECC: { TPMS_ECC_POINT eccPublic; TPMS_ECC_POINT eccSecret; BYTE *buffer = secret->t.secret; INT32 size = secret->t.size; // Retrieve ECC point from secret buffer result = TPMS_ECC_POINT_Unmarshal(&eccPublic, &buffer, &size); if(result == TPM_RC_SUCCESS) { result = CryptEccPointMultiply(&eccSecret, decryptKey->publicArea.parameters.eccDetail.curveID, &decryptKey->sensitive.sensitive.ecc, &eccPublic); if(result == TPM_RC_SUCCESS) { // Set the size of the "recovered" secret value to be the size // of the digest produced by the nameAlg. data->t.size = CryptGetHashDigestSize(decryptKey->publicArea.nameAlg); // The secret value is computed from Z using KDFe as: // secret := KDFe(HashID, Z, Use, PartyUInfo, PartyVInfo, bits) // Where: // HashID -- the nameAlg of the decrypt key // Z -- the x coordinate (Px) of the product (P) of the point // (Q) of the secret and the private x coordinate (de,V) // of the decryption key // Use -- a null-terminated string containing "SECRET" // PartyUInfo -- the x coordinate of the point in the secret // (Qe,U ) // PartyVInfo -- the x coordinate of the public key (Qs,V ) // bits -- the number of bits in the digest of HashID // Retrieve seed from KDFe CryptKDFe(decryptKey->publicArea.nameAlg, &eccSecret.x.b, label, &eccPublic.x.b, &decryptKey->publicArea.unique.ecc.x.b, data->t.size * 8, data->t.buffer); } } } break; #endif //TPM_ALG_ECC case TPM_ALG_KEYEDHASH: // The seed size can not be bigger than the digest size of nameAlg if(secret->t.size > CryptGetHashDigestSize(decryptKey->publicArea.nameAlg)) result = TPM_RC_VALUE; else { // Retrieve seed by XOR Obfuscation: // seed = XOR(secret, hash, key, nonceCaller, nullNonce) // where: // secret the secret parameter from the TPM2_StartAuthHMAC // command // which contains the seed value // hash nameAlg of tpmKey // key the key or data value in the object referenced by // entityHandle in the TPM2_StartAuthHMAC command // nonceCaller the parameter from the TPM2_StartAuthHMAC command // nullNonce a zero-length nonce // XOR Obfuscation in place CryptXORObfuscation(decryptKey->publicArea.nameAlg, &decryptKey->sensitive.sensitive.bits.b, &nonceCaller->b, NULL, secret->t.size, secret->t.secret); // Copy decrypted seed MemoryCopy2B(&data->b, &secret->b, sizeof(data->t.buffer)); } break; case TPM_ALG_SYMCIPHER: { TPM2B_IV iv = {}; TPMT_SYM_DEF_OBJECT *symDef; // The seed size can not be bigger than the digest size of nameAlg if(secret->t.size > CryptGetHashDigestSize(decryptKey->publicArea.nameAlg)) result = TPM_RC_VALUE; else { symDef = &decryptKey->publicArea.parameters.symDetail.sym; iv.t.size = CryptGetSymmetricBlockSize(symDef->algorithm, symDef->keyBits.sym); pAssert(iv.t.size != 0); if(nonceCaller->t.size >= iv.t.size) MemoryCopy(iv.t.buffer, nonceCaller->t.buffer, iv.t.size, sizeof(iv.t.buffer)); else MemoryCopy(iv.b.buffer, nonceCaller->t.buffer, nonceCaller->t.size, sizeof(iv.t.buffer)); // CFB decrypt in place, using nonceCaller as iv CryptSymmetricDecrypt(secret->t.secret, symDef->algorithm, symDef->keyBits.sym, TPM_ALG_CFB, decryptKey->sensitive.sensitive.sym.t.buffer, &iv, secret->t.size, secret->t.secret); // Copy decrypted seed MemoryCopy2B(&data->b, &secret->b, sizeof(data->t.buffer)); } } break; default: pAssert(0); break; } return result; } // // // 10.2.9.8 CryptParameterEncryption() // // This function does in-place encryption of a response parameter. // void CryptParameterEncryption( TPM_HANDLE handle, // IN: encrypt session handle TPM2B *nonceCaller, // IN: nonce caller UINT16 leadingSizeInByte, // IN: the size of the leading size field in // byte TPM2B_AUTH *extraKey, // IN: additional key material other than // session auth BYTE *buffer // IN/OUT: parameter buffer to be encrypted ) { SESSION *session = SessionGet(handle); // encrypt session TPM2B_TYPE(SYM_KEY, ( sizeof(extraKey->t.buffer) + sizeof(session->sessionKey.t.buffer))); TPM2B_SYM_KEY key; // encryption key UINT32 cipherSize = 0; // size of cipher text pAssert(session->sessionKey.t.size + extraKey->t.size <= sizeof(key.t.buffer)); // Retrieve encrypted data size. if(leadingSizeInByte == 2) { // Extract the first two bytes as the size field as the data size // encrypt cipherSize = (UINT32)BYTE_ARRAY_TO_UINT16(buffer); // advance the buffer buffer = &buffer[2]; } #ifdef TPM4B else if(leadingSizeInByte == 4) { // use the first four bytes to indicate the number of bytes to encrypt cipherSize = BYTE_ARRAY_TO_UINT32(buffer); //advance pointer buffer = &buffer[4]; } #endif else { pAssert(FALSE); } // // Compute encryption key by concatenating sessionAuth with extra key MemoryCopy2B(&key.b, &session->sessionKey.b, sizeof(key.t.buffer)); MemoryConcat2B(&key.b, &extraKey->b, sizeof(key.t.buffer)); if (session->symmetric.algorithm == TPM_ALG_XOR) // XOR parameter encryption formulation: // XOR(parameter, hash, sessionAuth, nonceNewer, nonceOlder) CryptXORObfuscation(session->authHashAlg, &(key.b), &(session->nonceTPM.b), nonceCaller, cipherSize, buffer); else ParmEncryptSym(session->symmetric.algorithm, session->authHashAlg, session->symmetric.keyBits.aes, &(key.b), nonceCaller, &(session->nonceTPM.b), cipherSize, buffer); return; } // // // 10.2.9.9 CryptParameterDecryption() // // This function does in-place decryption of a command parameter. // // Error Returns Meaning // // TPM_RC_SIZE The number of bytes in the input buffer is less than the number of // bytes to be decrypted. // TPM_RC CryptParameterDecryption( TPM_HANDLE handle, // IN: encrypted session handle TPM2B *nonceCaller, // IN: nonce caller UINT32 bufferSize, // IN: size of parameter buffer UINT16 leadingSizeInByte, // IN: the size of the leading size field in // byte TPM2B_AUTH *extraKey, // IN: the authValue BYTE *buffer // IN/OUT: parameter buffer to be decrypted ) { SESSION *session = SessionGet(handle); // encrypt session // The HMAC key is going to be the concatenation of the session key and any // additional key material (like the authValue). The size of both of these // is the size of the buffer which can contain a TPMT_HA. TPM2B_TYPE(HMAC_KEY, ( sizeof(extraKey->t.buffer) + sizeof(session->sessionKey.t.buffer))); TPM2B_HMAC_KEY key; // decryption key UINT32 cipherSize = 0; // size of cipher text pAssert(session->sessionKey.t.size + extraKey->t.size <= sizeof(key.t.buffer)); // Retrieve encrypted data size. if(leadingSizeInByte == 2) { // The first two bytes of the buffer are the size of the // data to be decrypted cipherSize = (UINT32)BYTE_ARRAY_TO_UINT16(buffer); buffer = &buffer[2]; // advance the buffer } #ifdef TPM4B else if(leadingSizeInByte == 4) { // the leading size is four bytes so get the four byte size field cipherSize = BYTE_ARRAY_TO_UINT32(buffer); buffer = &buffer[4]; //advance pointer } #endif else { pAssert(FALSE); } if(cipherSize > bufferSize) return TPM_RC_SIZE; // Compute decryption key by concatenating sessionAuth with extra input key MemoryCopy2B(&key.b, &session->sessionKey.b, sizeof(key.t.buffer)); MemoryConcat2B(&key.b, &extraKey->b, sizeof(key.t.buffer)); if(session->symmetric.algorithm == TPM_ALG_XOR) // XOR parameter decryption formulation: // XOR(parameter, hash, sessionAuth, nonceNewer, nonceOlder) // Call XOR obfuscation function CryptXORObfuscation(session->authHashAlg, &key.b, nonceCaller, &(session->nonceTPM.b), cipherSize, buffer); else // Assume that it is one of the symmetric block ciphers. ParmDecryptSym(session->symmetric.algorithm, session->authHashAlg, session->symmetric.keyBits.sym, &key.b, nonceCaller, &session->nonceTPM.b, cipherSize, buffer); return TPM_RC_SUCCESS; } // // // 10.2.9.10 CryptComputeSymmetricUnique() // // This function computes the unique field in public area for symmetric objects. // void CryptComputeSymmetricUnique( TPMI_ALG_HASH nameAlg, // IN: object name algorithm TPMT_SENSITIVE *sensitive, // IN: sensitive area TPM2B_DIGEST *unique // OUT: unique buffer ) { HASH_STATE hashState; pAssert(sensitive != NULL && unique != NULL); // Compute the public value as the hash of sensitive.symkey || unique.buffer unique->t.size = CryptGetHashDigestSize(nameAlg); CryptStartHash(nameAlg, &hashState); // Add obfuscation value CryptUpdateDigest2B(&hashState, &sensitive->seedValue.b); // Add sensitive value CryptUpdateDigest2B(&hashState, &sensitive->sensitive.any.b); CryptCompleteHash2B(&hashState, &unique->b); return; } #if 0 //% // // // // 10.2.9.11 CryptComputeSymValue() // // This function computes the seedValue field in asymmetric sensitive areas. // void CryptComputeSymValue( TPM_HANDLE parentHandle, // IN: parent handle of the object to be created TPMT_PUBLIC *publicArea, // IN/OUT: the public area template TPMT_SENSITIVE *sensitive, // IN: sensitive area TPM2B_SEED *seed, // IN: the seed TPMI_ALG_HASH hashAlg, // IN: hash algorithm for KDFa TPM2B_NAME *name // IN: object name ) { TPM2B_AUTH *proof = NULL; if(CryptIsAsymAlgorithm(publicArea->type)) { // Generate seedValue only when an asymmetric key is a storage key if(publicArea->objectAttributes.decrypt == SET && publicArea->objectAttributes.restricted == SET) { // If this is a primary object in the endorsement hierarchy, use // ehProof in the creation of the symmetric seed so that child // objects in the endorsement hierarchy are voided on TPM2_Clear() // or TPM2_ChangeEPS() if( parentHandle == TPM_RH_ENDORSEMENT && publicArea->objectAttributes.fixedTPM == SET) proof = &gp.ehProof; } else { sensitive->seedValue.t.size = 0; return; } } // For all object types, the size of seedValue is the digest size of nameAlg sensitive->seedValue.t.size = CryptGetHashDigestSize(publicArea->nameAlg); // Compute seedValue using implementation-dependent method _cpri__GenerateSeededRandom(sensitive->seedValue.t.size, sensitive->seedValue.t.buffer, hashAlg, &seed->b, "seedValue", &name->b, (TPM2B *)proof); return; } #endif //% // // // 10.2.9.12 CryptCreateObject() // // This function creates an object. It: // a) fills in the created key in public and sensitive area; // b) creates a random number in sensitive area for symmetric keys; and // c) compute the unique id in public area for symmetric keys. // // // // // Error Returns Meaning // // TPM_RC_KEY_SIZE key size in the public area does not match the size in the sensitive // creation area for a symmetric key // TPM_RC_RANGE for an RSA key, the exponent is not supported // TPM_RC_SIZE sensitive data size is larger than allowed for the scheme for a keyed // hash object // TPM_RC_VALUE exponent is not prime or could not find a prime using the provided // parameters for an RSA key; unsupported name algorithm for an ECC // key; unsupported name algorithm for symmetric algorithms // TPM_RC CryptCreateObject( TPM_HANDLE parentHandle, // IN/OUT: indication of the seed // source TPMT_PUBLIC *publicArea, // IN/OUT: public area TPMS_SENSITIVE_CREATE *sensitiveCreate, // IN: sensitive creation TPMT_SENSITIVE *sensitive // OUT: sensitive area ) { // Next value is a placeholder for a random seed that is used in // key creation when the parent is not a primary seed. It has the same // size as the primary seed. TPM2B_SEED localSeed; // data to seed key creation if this // is not a primary seed TPM2B_SEED *seed = NULL; TPM_RC result = TPM_RC_SUCCESS; TPM2B_NAME name; TPM_ALG_ID hashAlg = CONTEXT_INTEGRITY_HASH_ALG; OBJECT *parent; UINT32 counter; // Set the sensitive type for the object sensitive->sensitiveType = publicArea->type; ObjectComputeName(publicArea, &name); // For all objects, copy the initial auth data sensitive->authValue = sensitiveCreate->userAuth; // If this is a permanent handle assume that it is a hierarchy if(HandleGetType(parentHandle) == TPM_HT_PERMANENT) { seed = HierarchyGetPrimarySeed(parentHandle); } else { // If not hierarchy handle, get parent parent = ObjectGet(parentHandle); hashAlg = parent->publicArea.nameAlg; // Use random value as seed for non-primary objects localSeed.t.size = PRIMARY_SEED_SIZE; CryptGenerateRandom(PRIMARY_SEED_SIZE, localSeed.t.buffer); seed = &localSeed; } switch(publicArea->type) { #ifdef TPM_ALG_RSA // Create RSA key case TPM_ALG_RSA: result = CryptGenerateKeyRSA(publicArea, sensitive, hashAlg, seed, &name, &counter); break; #endif // TPM_ALG_RSA #ifdef TPM_ALG_ECC // Create ECC key case TPM_ALG_ECC: result = CryptGenerateKeyECC(publicArea, sensitive, hashAlg, seed, &name, &counter); break; #endif // TPM_ALG_ECC // Collect symmetric key information case TPM_ALG_SYMCIPHER: return CryptGenerateKeySymmetric(publicArea, sensitiveCreate, sensitive, hashAlg, seed, &name); break; case TPM_ALG_KEYEDHASH: return CryptGenerateKeyedHash(publicArea, sensitiveCreate, sensitive, hashAlg, seed, &name); break; default: pAssert(0); break; } if(result == TPM_RC_SUCCESS) { TPM2B_AUTH *proof = NULL; if(publicArea->objectAttributes.decrypt == SET && publicArea->objectAttributes.restricted == SET) { // If this is a primary object in the endorsement hierarchy, use // ehProof in the creation of the symmetric seed so that child // objects in the endorsement hierarchy are voided on TPM2_Clear() // or TPM2_ChangeEPS() if( parentHandle == TPM_RH_ENDORSEMENT && publicArea->objectAttributes.fixedTPM == SET) proof = &gp.ehProof; // For all object types, the size of seedValue is the digest size // of its nameAlg sensitive->seedValue.t.size = CryptGetHashDigestSize(publicArea->nameAlg); // Compute seedValue using implementation-dependent method _cpri__GenerateSeededRandom(sensitive->seedValue.t.size, sensitive->seedValue.t.buffer, hashAlg, &seed->b, "seedValuea", &name.b, (TPM2B *)proof); } else { sensitive->seedValue.t.size = 0; } } return result; } // // 10.2.9.13 CryptObjectIsPublicConsistent() // // This function checks that the key sizes in the public area are consistent. For an asymmetric key, the size // of the public key must match the size indicated by the public->parameters. // Checks for the algorithm types matching the key type are handled by the unmarshaling operation. // // Return Value Meaning // // TRUE sizes are consistent // FALSE sizes are not consistent // BOOL CryptObjectIsPublicConsistent( TPMT_PUBLIC *publicArea // IN: public area ) { BOOL OK = TRUE; switch (publicArea->type) { #ifdef TPM_ALG_RSA case TPM_ALG_RSA: OK = CryptAreKeySizesConsistent(publicArea); break; #endif //TPM_ALG_RSA #ifdef TPM_ALG_ECC case TPM_ALG_ECC: { const ECC_CURVE *curveValue; // Check that the public point is on the indicated curve. OK = CryptEccIsPointOnCurve( publicArea->parameters.eccDetail.curveID, &publicArea->unique.ecc); if(OK) { curveValue = CryptEccGetCurveDataPointer( publicArea->parameters.eccDetail.curveID); pAssert(curveValue != NULL); // The input ECC curve must be a supported curve // IF a scheme is defined for the curve, then that scheme must // be used. OK = (curveValue->sign.scheme == TPM_ALG_NULL || ( publicArea->parameters.eccDetail.scheme.scheme == curveValue->sign.scheme)); OK = OK && CryptAreKeySizesConsistent(publicArea); } } break; #endif //TPM_ALG_ECC default: // Symmetric object common checks // There is noting to check with a symmetric key that is public only. // Also not sure that there is anything useful to be done with it // either. break; } return OK; } // // // // 10.2.9.14 CryptObjectPublicPrivateMatch() // // This function checks the cryptographic binding between the public and sensitive areas. // // Error Returns Meaning // // TPM_RC_TYPE the type of the public and private areas are not the same // TPM_RC_FAILURE crypto error // TPM_RC_BINDING the public and private areas are not cryptographically matched. // TPM_RC CryptObjectPublicPrivateMatch( OBJECT *object // IN: the object to check ) { TPMT_PUBLIC *publicArea; TPMT_SENSITIVE *sensitive; TPM_RC result = TPM_RC_SUCCESS; BOOL isAsymmetric = FALSE; pAssert(object != NULL); publicArea = &object->publicArea; sensitive = &object->sensitive; if(publicArea->type != sensitive->sensitiveType) return TPM_RC_TYPE; switch(publicArea->type) { #ifdef TPM_ALG_RSA case TPM_ALG_RSA: isAsymmetric = TRUE; // The public and private key sizes need to be consistent if(sensitive->sensitive.rsa.t.size != publicArea->unique.rsa.t.size/2) result = TPM_RC_BINDING; else // Load key by computing the private exponent result = CryptLoadPrivateRSA(object); break; #endif #ifdef TPM_ALG_ECC // This function is called from ObjectLoad() which has already checked to // see that the public point is on the curve so no need to repeat that // check. case TPM_ALG_ECC: isAsymmetric = TRUE; if( publicArea->unique.ecc.x.t.size != sensitive->sensitive.ecc.t.size) result = TPM_RC_BINDING; else if(publicArea->nameAlg != TPM_ALG_NULL) { TPMS_ECC_POINT publicToCompare; // Compute ECC public key CryptEccPointMultiply(&publicToCompare, publicArea->parameters.eccDetail.curveID, &sensitive->sensitive.ecc, NULL); // Compare ECC public key if( (!Memory2BEqual(&publicArea->unique.ecc.x.b, &publicToCompare.x.b)) || (!Memory2BEqual(&publicArea->unique.ecc.y.b, &publicToCompare.y.b))) result = TPM_RC_BINDING; } break; // #endif case TPM_ALG_KEYEDHASH: break; case TPM_ALG_SYMCIPHER: if( (publicArea->parameters.symDetail.sym.keyBits.sym + 7)/8 != sensitive->sensitive.sym.t.size) result = TPM_RC_BINDING; break; default: // The choice here is an assert or a return of a bad type for the object pAssert(0); break; } // For asymmetric keys, the algorithm for validating the linkage between // the public and private areas is algorithm dependent. For symmetric keys // the linkage is based on hashing the symKey and obfuscation values. if( result == TPM_RC_SUCCESS && !isAsymmetric && publicArea->nameAlg != TPM_ALG_NULL) { TPM2B_DIGEST uniqueToCompare; // Compute unique for symmetric key CryptComputeSymmetricUnique(publicArea->nameAlg, sensitive, &uniqueToCompare); // Compare unique if(!Memory2BEqual(&publicArea->unique.sym.b, &uniqueToCompare.b)) result = TPM_RC_BINDING; } return result; } // // // 10.2.9.15 CryptGetSignHashAlg() // // Get the hash algorithm of signature from a TPMT_SIGNATURE structure. It assumes the signature is not // NULL This is a function for easy access // TPMI_ALG_HASH CryptGetSignHashAlg( TPMT_SIGNATURE *auth // IN: signature ) { pAssert(auth->sigAlg != TPM_ALG_NULL); // Get authHash algorithm based on signing scheme switch(auth->sigAlg) { #ifdef TPM_ALG_RSA case TPM_ALG_RSASSA: return auth->signature.rsassa.hash; case TPM_ALG_RSAPSS: return auth->signature.rsapss.hash; #endif //TPM_ALG_RSA #ifdef TPM_ALG_ECC case TPM_ALG_ECDSA: return auth->signature.ecdsa.hash; #endif //TPM_ALG_ECC case TPM_ALG_HMAC: return auth->signature.hmac.hashAlg; default: return TPM_ALG_NULL; } } // // // 10.2.9.16 CryptIsSplitSign() // // This function us used to determine if the signing operation is a split signing operation that required a // TPM2_Commit(). // BOOL CryptIsSplitSign( TPM_ALG_ID scheme // IN: the algorithm selector ) { if( 0 # ifdef TPM_ALG_ECDAA || scheme == TPM_ALG_ECDAA # endif // TPM_ALG_ECDAA ) return TRUE; return FALSE; } // // // 10.2.9.17 CryptIsSignScheme() // // This function indicates if a scheme algorithm is a sign algorithm. // BOOL CryptIsSignScheme( TPMI_ALG_ASYM_SCHEME scheme ) { BOOL isSignScheme = FALSE; switch(scheme) { #ifdef TPM_ALG_RSA // If RSA is implemented, then both signing schemes are required case TPM_ALG_RSASSA: case TPM_ALG_RSAPSS: isSignScheme = TRUE; break; #endif //TPM_ALG_RSA #ifdef TPM_ALG_ECC // If ECC is implemented ECDSA is required case TPM_ALG_ECDSA: #ifdef TPM_ALG_ECDAA // ECDAA is optional case TPM_ALG_ECDAA: #endif #ifdef TPM_ALG_ECSCHNORR // Schnorr is also optional case TPM_ALG_ECSCHNORR: #endif #ifdef TPM_ALG_SM2 case TPM_ALG_SM2: #endif isSignScheme = TRUE; break; #endif //TPM_ALG_ECC default: break; } return isSignScheme; } // // // 10.2.9.18 CryptIsDecryptScheme() // // This function indicate if a scheme algorithm is a decrypt algorithm. // BOOL CryptIsDecryptScheme( TPMI_ALG_ASYM_SCHEME scheme ) { BOOL isDecryptScheme = FALSE; switch(scheme) { #ifdef TPM_ALG_RSA // If RSA is implemented, then both decrypt schemes are required case TPM_ALG_RSAES: case TPM_ALG_OAEP: isDecryptScheme = TRUE; break; #endif //TPM_ALG_RSA #ifdef TPM_ALG_ECC // If ECC is implemented ECDH is required case TPM_ALG_ECDH: #ifdef TPM_ALG_SM2 case TPM_ALG_SM2: #endif #ifdef TPM_ALG_ECMQV case TPM_ALG_ECMQV: #endif isDecryptScheme = TRUE; break; #endif //TPM_ALG_ECC default: break; } return isDecryptScheme; } // // // 10.2.9.19 CryptSelectSignScheme() // // This function is used by the attestation and signing commands. It implements the rules for selecting the // signature scheme to use in signing. This function requires that the signing key either be TPM_RH_NULL // or be loaded. // If a default scheme is defined in object, the default scheme should be chosen, otherwise, the input // scheme should be chosen. In the case that both object and input scheme has a non-NULL scheme // algorithm, if the schemes are compatible, the input scheme will be chosen. // // // // // Error Returns Meaning // // TPM_RC_KEY key referenced by signHandle is not a signing key // TPM_RC_SCHEME both scheme and key's default scheme are empty; or scheme is // empty while key's default scheme requires explicit input scheme (split // signing); or non-empty default key scheme differs from scheme // TPM_RC CryptSelectSignScheme( TPMI_DH_OBJECT signHandle, // IN: handle of signing key TPMT_SIG_SCHEME *scheme // IN/OUT: signing scheme ) { OBJECT *signObject; TPMT_SIG_SCHEME *objectScheme; TPMT_PUBLIC *publicArea; TPM_RC result = TPM_RC_SUCCESS; // If the signHandle is TPM_RH_NULL, then the NULL scheme is used, regardless // of the setting of scheme if(signHandle == TPM_RH_NULL) { scheme->scheme = TPM_ALG_NULL; scheme->details.any.hashAlg = TPM_ALG_NULL; } else { // sign handle is not NULL so... // Get sign object pointer signObject = ObjectGet(signHandle); publicArea = &signObject->publicArea; // is this a signing key? if(!publicArea->objectAttributes.sign) result = TPM_RC_KEY; else { // "parms" defined to avoid long code lines. TPMU_PUBLIC_PARMS *parms = &publicArea->parameters; if(CryptIsAsymAlgorithm(publicArea->type)) objectScheme = (TPMT_SIG_SCHEME *)&parms->asymDetail.scheme; else objectScheme = (TPMT_SIG_SCHEME *)&parms->keyedHashDetail.scheme; // If the object doesn't have a default scheme, then use the // input scheme. if(objectScheme->scheme == TPM_ALG_NULL) { // Input and default can't both be NULL if(scheme->scheme == TPM_ALG_NULL) result = TPM_RC_SCHEME; // Assume that the scheme is compatible with the key. If not, // we will generate an error in the signing operation. } else if(scheme->scheme == TPM_ALG_NULL) { // input scheme is NULL so use default // First, check to see if the default requires that the caller // provided scheme data if(CryptIsSplitSign(objectScheme->scheme)) result = TPM_RC_SCHEME; else { scheme->scheme = objectScheme->scheme; scheme->details.any.hashAlg = objectScheme->details.any.hashAlg; } } else { // Both input and object have scheme selectors // If the scheme and the hash are not the same then... if( objectScheme->scheme != scheme->scheme || ( objectScheme->details.any.hashAlg != scheme->details.any.hashAlg)) result = TPM_RC_SCHEME; } } } return result; } // // // 10.2.9.20 CryptSign() // // Sign a digest with asymmetric key or HMAC. This function is called by attestation commands and the // generic TPM2_Sign() command. This function checks the key scheme and digest size. It does not check // if the sign operation is allowed for restricted key. It should be checked before the function is called. The // function will assert if the key is not a signing key. // // Error Returns Meaning // // TPM_RC_SCHEME signScheme is not compatible with the signing key type // TPM_RC_VALUE digest value is greater than the modulus of signHandle or size of // hashData does not match hash algorithm insignScheme (for an RSA // key); invalid commit status or failed to generate r value (for an ECC // key) // TPM_RC CryptSign( TPMI_DH_OBJECT signHandle, // IN: The handle of sign key TPMT_SIG_SCHEME *signScheme, // IN: sign scheme. TPM2B_DIGEST *digest, // IN: The digest being signed TPMT_SIGNATURE *signature // OUT: signature ) { OBJECT *signKey = ObjectGet(signHandle); TPM_RC result = TPM_RC_SCHEME; // check if input handle is a sign key pAssert(signKey->publicArea.objectAttributes.sign == SET); // Must have the private portion loaded. This check is made during // authorization. pAssert(signKey->attributes.publicOnly == CLEAR); // Initialize signature scheme signature->sigAlg = signScheme->scheme; // If the signature algorithm is TPM_ALG_NULL, then we are done if(signature->sigAlg == TPM_ALG_NULL) return TPM_RC_SUCCESS; // All the schemes other than TPM_ALG_NULL have a hash algorithm TEST_HASH(signScheme->details.any.hashAlg); // Initialize signature hash // Note: need to do the check for alg null first because the null scheme // doesn't have a hashAlg member. signature->signature.any.hashAlg = signScheme->details.any.hashAlg; // perform sign operation based on different key type switch (signKey->publicArea.type) { #ifdef TPM_ALG_RSA case TPM_ALG_RSA: result = CryptSignRSA(signKey, signScheme, digest, signature); break; #endif //TPM_ALG_RSA #ifdef TPM_ALG_ECC case TPM_ALG_ECC: result = CryptSignECC(signKey, signScheme, digest, signature); break; #endif //TPM_ALG_ECC case TPM_ALG_KEYEDHASH: result = CryptSignHMAC(signKey, signScheme, digest, signature); break; default: break; } return result; } // // // 10.2.9.21 CryptVerifySignature() // // This function is used to verify a signature. It is called by TPM2_VerifySignature() and // TPM2_PolicySigned(). // Since this operation only requires use of a public key, no consistency checks are necessary for the key to // signature type because a caller can load any public key that they like with any scheme that they like. This // routine simply makes sure that the signature is correct, whatever the type. // This function requires that auth is not a NULL pointer. // // Error Returns Meaning // // TPM_RC_SIGNATURE the signature is not genuine // TPM_RC_SCHEME the scheme is not supported // TPM_RC_HANDLE an HMAC key was selected but the private part of the key is not // loaded // TPM_RC CryptVerifySignature( TPMI_DH_OBJECT keyHandle, // IN: The handle of sign key TPM2B_DIGEST *digest, // IN: The digest being validated TPMT_SIGNATURE *signature // IN: signature ) { // NOTE: ObjectGet will either return a pointer to a loaded object or // will assert. It will never return a non-valid value. This makes it save // to initialize 'publicArea' with the return value from ObjectGet() without // checking it first. OBJECT *authObject = ObjectGet(keyHandle); TPMT_PUBLIC *publicArea = &authObject->publicArea; TPM_RC result = TPM_RC_SCHEME; // The input unmarshaling should prevent any input signature from being // a NULL signature, but just in case if(signature->sigAlg == TPM_ALG_NULL) return TPM_RC_SIGNATURE; switch (publicArea->type) { #ifdef TPM_ALG_RSA case TPM_ALG_RSA: result = CryptRSAVerifySignature(authObject, digest, signature); break; #endif //TPM_ALG_RSA #ifdef TPM_ALG_ECC case TPM_ALG_ECC: result = CryptECCVerifySignature(authObject, digest, signature); break; #endif // TPM_ALG_ECC case TPM_ALG_KEYEDHASH: if(authObject->attributes.publicOnly) result = TPM_RC_HANDLE; else result = CryptHMACVerifySignature(authObject, digest, signature); break; default: break; } return result; } // // // 10.2.10 Math functions // // 10.2.10.1 CryptDivide() // // This function interfaces to the math library for large number divide. // // Error Returns Meaning // // TPM_RC_SIZE quotient or remainder is too small to receive the result // TPM_RC CryptDivide( TPM2B *numerator, // IN: numerator TPM2B *denominator, // IN: denominator TPM2B *quotient, // OUT: quotient = numerator / denominator. TPM2B *remainder // OUT: numerator mod denominator. ) { pAssert( numerator != NULL && denominator!= NULL && (quotient != NULL || remainder != NULL) ); // assume denominator is not 0 pAssert(denominator->size != 0); return TranslateCryptErrors(_math__Div(numerator, denominator, quotient, remainder) ); } // // // 10.2.10.2 CryptCompare() // // This function interfaces to the math library for large number, unsigned compare. // // Return Value Meaning // // 1 if a > b // 0 if a = b // -1 if a < b // LIB_EXPORT int CryptCompare( const UINT32 aSize, // IN: size of a const BYTE *a, // IN: a buffer const UINT32 bSize, // IN: size of b const BYTE *b // IN: b buffer ) { return _math__uComp(aSize, a, bSize, b); } // // // 10.2.10.3 CryptCompareSigned() // // This function interfaces to the math library for large number, signed compare. // // Return Value Meaning // // 1 if a > b // 0 if a = b // -1 if a < b // int CryptCompareSigned( UINT32 aSize, // IN: size of a BYTE *a, // IN: a buffer UINT32 bSize, // IN: size of b BYTE *b // IN: b buffer ) { return _math__Comp(aSize, a, bSize, b); } // // // 10.2.10.4 CryptGetTestResult // // This function returns the results of a self-test function. // // NOTE: the behavior in this function is NOT the correct behavior for a real TPM implementation. An artificial behavior is // placed here due to the limitation of a software simulation environment. For the correct behavior, consult the // part 3 specification for TPM2_GetTestResult(). // TPM_RC CryptGetTestResult( TPM2B_MAX_BUFFER *outData // OUT: test result data ) { outData->t.size = 0; return TPM_RC_SUCCESS; } // // // 10.2.11 Capability Support // // 10.2.11.1 CryptCapGetECCCurve() // // This function returns the list of implemented ECC curves. // // Return Value Meaning // // YES if no more ECC curve is available // NO if there are more ECC curves not reported // #ifdef TPM_ALG_ECC //% 5 TPMI_YES_NO CryptCapGetECCCurve( TPM_ECC_CURVE curveID, // IN: the starting ECC curve UINT32 maxCount, // IN: count of returned curve TPML_ECC_CURVE *curveList // OUT: ECC curve list ) { TPMI_YES_NO more = NO; UINT16 i; UINT32 count = _cpri__EccGetCurveCount(); TPM_ECC_CURVE curve; // Initialize output property list curveList->count = 0; // The maximum count of curves we may return is MAX_ECC_CURVES if(maxCount > MAX_ECC_CURVES) maxCount = MAX_ECC_CURVES; // Scan the eccCurveValues array for(i = 0; i < count; i++) { curve = _cpri__GetCurveIdByIndex(i); // If curveID is less than the starting curveID, skip it if(curve < curveID) continue; if(curveList->count < maxCount) { // If we have not filled up the return list, add more curves to // it curveList->eccCurves[curveList->count] = curve; curveList->count++; } else { // If the return list is full but we still have curves // available, report this and stop iterating more = YES; break; } } return more; } // // // 10.2.11.2 CryptCapGetEccCurveNumber() // // This function returns the number of ECC curves supported by the TPM. // UINT32 CryptCapGetEccCurveNumber( void ) { // There is an array that holds the curve data. Its size divided by the // size of an entry is the number of values in the table. return _cpri__EccGetCurveCount(); } #endif //TPM_ALG_ECC //% 5 // // // 10.2.11.3 CryptAreKeySizesConsistent() // // This function validates that the public key size values are consistent for an asymmetric key. // // NOTE: This is not a comprehensive test of the public key. // // // Return Value Meaning // // TRUE sizes are consistent // FALSE sizes are not consistent // BOOL CryptAreKeySizesConsistent( TPMT_PUBLIC *publicArea // IN: the public area to check ) { BOOL consistent = FALSE; switch (publicArea->type) { #ifdef TPM_ALG_RSA case TPM_ALG_RSA: // The key size in bits is filtered by the unmarshaling consistent = ( ((publicArea->parameters.rsaDetail.keyBits+7)/8) == publicArea->unique.rsa.t.size); break; #endif //TPM_ALG_RSA #ifdef TPM_ALG_ECC case TPM_ALG_ECC: { UINT16 keySizeInBytes; TPM_ECC_CURVE curveId = publicArea->parameters.eccDetail.curveID; keySizeInBytes = CryptEccGetKeySizeInBytes(curveId); consistent = keySizeInBytes > 0 && publicArea->unique.ecc.x.t.size <= keySizeInBytes && publicArea->unique.ecc.y.t.size <= keySizeInBytes; } break; #endif //TPM_ALG_ECC default: break; } return consistent; } // // // 10.2.11.4 CryptAlgSetImplemented() // // This function initializes the bit vector with one bit for each implemented algorithm. This function is called // from _TPM_Init(). The vector of implemented algorithms should be generated by the part 2 parser so that // the g_implementedAlgorithms vector can be a const. That's not how it is now // void CryptAlgsSetImplemented( void ) { AlgorithmGetImplementedVector(&g_implementedAlgorithms); }