Skip to content

Commit

Permalink
It all works
Browse files Browse the repository at this point in the history
  • Loading branch information
@Firstyear
Firstyear committed Feb 13, 2024
1 parent d06c74c commit dafa523
Show file tree
Hide file tree
Showing 4 changed files with 388 additions and 437 deletions.
2 changes: 0 additions & 2 deletions Cargo.toml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -13,8 +13,6 @@ authors = ["William Brown <[email protected]>"]
tpm = ["dep:tss-esapi", "dep:tss-esapi-sys"]
msextensions = []

# tss-esapi = { path = "../rust-tss-esapi/tss-esapi" }

[dependencies]
argon2 = { version = "0.5.2", features = ["alloc"] }
hex = "0.4.3"
Expand Down
102 changes: 29 additions & 73 deletions src/lib.rs
View file
Original file line number Diff line number Diff line change
Expand Up @@ -149,6 +149,8 @@ pub enum TpmError {
EcKeyPrivateToDer,
EcKeyFromDer,
EcKeyToPrivateKey,
EcdsaPublicFromComponents,
EcdsaPublicToDer,
IdentityKeyDigest,
IdentityKeyPublicToDer,
IdentityKeyPublicToPem,
Expand All @@ -162,6 +164,7 @@ pub enum TpmError {
RsaGenerate,
RsaPrivateToDer,
RsaKeyFromDer,
RsaPublicToDer,
RsaToPrivateKey,
RsaPublicFromComponents,
X509FromDer,
Expand Down Expand Up @@ -196,11 +199,17 @@ pub enum TpmError {
TpmMachineKeyBuilderInvalid,
TpmMachineKeyCreate,
TpmMachineKeyLoad,
TpmKeyLoad,

TpmMsRsaKeyLoad,
TpmHmacKeyLoad,

TpmStorageKeyObjectAttributesInvalid,
TpmStorageKeyBuilderInvalid,

TpmHmacKeyObjectAttributesInvalid,
TpmHmacKeyBuilderInvalid,
TpmHmacKeyCreate,
TpmHmacKeyLoad,
TpmHmacSign,
TpmHmacInputTooLarge,

Expand Down Expand Up @@ -228,7 +237,6 @@ pub enum TpmError {
TpmMsRsaKeyAlgorithmInvalid,
TpmMsRsaKeyBuilderInvalid,
TpmMsRsaKeyCreate,
TpmMsRsaKeyLoad,
TpmMsRsaKeyReadPublic,
TpmMsRsaOaepDecrypt,
TpmMsRsaOaepInvalidKeyLength,
Expand All @@ -252,9 +260,16 @@ pub enum LoadableMachineKey {
TpmAes128CfbV1 {
private: tpm::Private,
public: tpm::Public,
sk_private: tpm::Private,
sk_public: tpm::Public,
},
#[cfg(not(feature = "tpm"))]
TpmAes128CfbV1 { private: (), public: () },
TpmAes128CfbV1 {
private: (),
public: (),
sk_private: (),
sk_public: (),
},
}

pub enum MachineKey {
Expand All @@ -264,7 +279,6 @@ pub enum MachineKey {
#[cfg(feature = "tpm")]
Tpm {
key_context: tpm::TpmsContext,
auth_value: tpm::Auth,
},
#[cfg(not(feature = "tpm"))]
Tpm {
Expand Down Expand Up @@ -842,58 +856,6 @@ mod tests {
};
}

#[macro_export]
macro_rules! test_tpm_identity_no_export {
( $tpm:expr, $alg:expr ) => {
use crate::{AuthValue, Tpm};
use std::str::FromStr;
use tracing::trace;

let _ = tracing_subscriber::fmt::try_init();

let auth_str = AuthValue::generate().expect("Failed to create hex pin");

let auth_value = AuthValue::from_str(&auth_str).expect("Unable to create auth value");

// Request a new machine-key-context. This key "owns" anything
// created underneath it.
let loadable_machine_key = $tpm
.machine_key_create(&auth_value)
.expect("Unable to create new machine key");

trace!(?loadable_machine_key);

let machine_key = $tpm
.machine_key_load(&auth_value, &loadable_machine_key)
.expect("Unable to load machine key");

// from that ctx, create an identity key
let loadable_id_key = $tpm
.identity_key_create(&machine_key, $alg)
.expect("Unable to create id key");

trace!(?loadable_id_key);

let id_key = $tpm
.identity_key_load(&machine_key, &loadable_id_key)
.expect("Unable to load id key");

let input = "test string";
let signature = $tpm
.identity_key_sign(&id_key, input.as_bytes())
.expect("Unable to sign input");

trace!(?signature);

let verify = $tpm.identity_key_verify(&id_key, input.as_bytes(), signature.as_slice());

trace!(?verify);

// Internal verification
assert!(verify.expect("Unable to sign input"));
};
}

#[macro_export]
macro_rules! test_tpm_identity {
( $tpm:expr, $alg:expr ) => {
Expand Down Expand Up @@ -947,6 +909,8 @@ mod tests {
// Rehydrate the der to a public key.
let public_key = PKey::public_key_from_der(&id_key_public_der).expect("Invalid DER");

trace!(?public_key);

let input = "test string";
let signature = $tpm
.identity_key_sign(&id_key, input.as_bytes())
Expand All @@ -961,6 +925,15 @@ mod tests {
let mut verifier = Verifier::new(MessageDigest::sha256(), &public_key)
.expect("Unable to setup verifier.");

match $alg {
KeyAlgorithm::Rsa2048 => {
verifier
.set_rsa_padding(openssl::rsa::Padding::PKCS1)
.unwrap();
}
_ => {}
}

let valid = verifier
.verify_oneshot(&signature, input.as_bytes())
.expect("Unable to validate signature");
Expand Down Expand Up @@ -1157,7 +1130,6 @@ mod ms_extn_tests {
macro_rules! test_tpm_ms_extensions {
( $tpm_a:expr ) => {
use crate::{AuthValue, Tpm};
use tracing::trace;

let _ = tracing_subscriber::fmt::try_init();

Expand All @@ -1170,21 +1142,15 @@ mod ms_extn_tests {
.machine_key_create(&auth_value)
.expect("Unable to create new machine key");

trace!(?loadable_machine_key);

let machine_key = $tpm_a
.machine_key_load(&auth_value, &loadable_machine_key)
.expect("Unable to load machine key");

trace!("mk loaded");

// from that ctx, create a hmac key.
let loadable_ms_rsa_key = $tpm_a
.msoapxbc_rsa_key_create(&machine_key)
.expect("Unable to create new hmac key");

trace!(?loadable_ms_rsa_key);

let ms_rsa_key = $tpm_a
.msoapxbc_rsa_key_load(&machine_key, &loadable_ms_rsa_key)
.expect("Unable to load ms rsa key");
Expand All @@ -1194,29 +1160,21 @@ mod ms_extn_tests {
.msoapxbc_rsa_public_as_der(&ms_rsa_key)
.expect("Unable to retrieve key as DER");

trace!(?ms_rsa_key_public_der);

let rsa_public = openssl::rsa::Rsa::public_key_from_der(&ms_rsa_key_public_der)
.expect("Invalid public key");

trace!(?rsa_public);

let secret = &[0, 1, 2, 3];

// Create something for the key to decrypt.
let encrypted_secret =
crate::soft::rsa_oaep_encrypt(&rsa_public, secret).expect("unable to wrap key");

trace!(?encrypted_secret);

// Decrypt it.

let loadable_session_key = $tpm_a
.msoapxbc_rsa_decipher_session_key(&ms_rsa_key, &encrypted_secret, secret.len())
.expect("Unable to decipher encrypted secret");

trace!(?loadable_session_key);

let yielded_session_key = $tpm_a
.msoapxbc_rsa_yield_session_key(&ms_rsa_key, &loadable_session_key)
.expect("unable to load session key");
Expand All @@ -1225,8 +1183,6 @@ mod ms_extn_tests {

// Seal and unseal some data.

trace!("=====================");

let sealed_secret = $tpm_a
.msoapxbc_rsa_seal_data(&ms_rsa_key, secret)
.expect("Unable to seal");
Expand Down
19 changes: 12 additions & 7 deletions src/soft.rs
View file
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ use openssl::hash::{hash, MessageDigest};
use openssl::nid::Nid;
use openssl::pkey::PKey;
use openssl::rand::rand_bytes;
use openssl::rsa::Rsa;
use openssl::rsa::{Padding, Rsa};
use openssl::sign::{Signer, Verifier};
use openssl::symm::{Cipher, Crypter, Mode};
use openssl::x509::{X509NameBuilder, X509ReqBuilder, X509};
Expand Down Expand Up @@ -394,13 +394,20 @@ impl Tpm for SoftTpm {

fn identity_key_sign(&mut self, key: &IdentityKey, input: &[u8]) -> Result<Vec<u8>, TpmError> {
let mut signer = match key {
IdentityKey::SoftEcdsa256 { pkey, x509: _ }
| IdentityKey::SoftRsa2048 { pkey, x509: _ } => {
IdentityKey::SoftEcdsa256 { pkey, x509: _ } => {
Signer::new(MessageDigest::sha256(), pkey).map_err(|ossl_err| {
error!(?ossl_err);
TpmError::IdentityKeyInvalidForSigning
})?
}
IdentityKey::SoftRsa2048 { pkey, x509: _ } => {
Signer::new(MessageDigest::sha256(), pkey)
.and_then(|mut signer| signer.set_rsa_padding(Padding::PKCS1).map(|()| signer))
.map_err(|ossl_err| {
error!(?ossl_err);
TpmError::IdentityKeyInvalidForSigning
})?
}
IdentityKey::TpmEcdsa256 { .. } | IdentityKey::TpmRsa2048 { .. } => {
return Err(TpmError::IncorrectKeyType)
}
Expand Down Expand Up @@ -628,7 +635,7 @@ impl Tpm for SoftTpm {
TpmError::RsaKeyFromDer
})?;

let mut cek = rsa_oaep_decrypt(&key, &cek)?;
let mut cek = rsa_oaep_decrypt(&key, cek)?;

cek.truncate(AES256GCM_KEY_LEN);

Expand Down Expand Up @@ -733,7 +740,7 @@ impl Tpm for SoftTpm {
) -> Result<Zeroizing<Vec<u8>>, TpmError> {
match (key, sealed_data) {
(MsOapxbcRsaKey::Soft { key: _, cek }, SealedData::SoftV1 { data, tag, iv }) => {
aes_256_gcm_decrypt(data, tag, &cek, iv)
aes_256_gcm_decrypt(data, tag, cek, iv)
}
(_, _) => Err(TpmError::IncorrectKeyType),
}
Expand All @@ -746,7 +753,6 @@ pub(crate) fn rsa_oaep_encrypt<T: openssl::pkey::HasPublic>(
key_to_wrap: &[u8],
) -> Result<Vec<u8>, TpmError> {
use openssl::encrypt::Encrypter;
use openssl::rsa::Padding;

let rsa_pub_key = PKey::from_rsa(key.clone()).map_err(|ossl_err| {
error!(?ossl_err);
Expand Down Expand Up @@ -806,7 +812,6 @@ fn rsa_oaep_decrypt(
input: &[u8],
) -> Result<Zeroizing<Vec<u8>>, TpmError> {
use openssl::encrypt::Decrypter;
use openssl::rsa::Padding;

let rsa_priv_key = PKey::from_rsa(key.clone()).map_err(|ossl_err| {
error!(?ossl_err);
Expand Down
Loading

0 comments on commit dafa523

Please sign in to comment.