~ubuntu-branches/ubuntu/hardy/trousers/hardy-proposed

Committer: Bazaar Package Importer
Author(s): Daniel Baumann
Date: 2008-01-23 22:03:00 UTC
mfrom: (1.1.1 upstream)
Revision ID: james.westby@ubuntu.com-20080123220300-fhtqja3c0oq0gp6z

Tags: 0.3.1-4

http://bugs.debian.org/457400

http://bugs.debian.org/459682

* Added patch from Aaron M. Ucko <ucko@debian.org> to allow trousers to
  build successfully on amd64, and presumably also other 64-bit
  architectures (Closes: #457400).
* Including udev rule for /dev/tpm from William Lima
  <wlima.amadeus@gmail.com> as suggested by David Smith <dds@google.com>
  (Closes: #459682).
* Added lintian overrides.

files added:
debian/TODO

debian/config

debian/config/45-trousers.rules

debian/libtspi-dev.docs

debian/lintian

debian/lintian/libtspi1

debian/lintian/trousers

debian/patches/01-tss-user.dpatch

debian/patches/02-manapge.dpatch

debian/patches/03-readme.dpatch

debian/patches/04-64bit-cleanliness.dpatch

debian/trousers.examples

man/man3/Tspi_Context_GetRegisteredKeysByUUID2.3

man/man3/Tspi_DAA_IssueCredential.3

man/man3/Tspi_DAA_IssueInit.3

man/man3/Tspi_DAA_IssueSetup.3

man/man3/Tspi_DAA_IssuerKeyVerification.3

man/man3/Tspi_DAA_VerifyInit.3

man/man3/Tspi_DAA_VerifySignature.3

man/man3/Tspi_DecodeBER_TssBlob.3

man/man3/Tspi_EncodeDER_TssBlob.3

man/man3/Tspi_TPM_DAA_JoinCreateDaaPubKey.3

man/man3/Tspi_TPM_DAA_JoinInit.3

man/man3/Tspi_TPM_DAA_JoinStoreCredential.3

man/man3/Tspi_TPM_DAA_Sign.3

man/man3/Tspi_TPM_GetAuditDigest.3

man/man3/Tspi_TPM_OwnerGetSRKPubKey.3

man/man3/Tspi_TPM_Quote2.3

src/include/authsess.h

src/include/obj_context.h

src/include/obj_daa.h

src/include/obj_delfamily.h

src/include/obj_encdata.h

src/include/obj_hash.h

src/include/obj_migdata.h

src/include/obj_nv.h

src/include/obj_pcrs.h

src/include/obj_policy.h

src/include/obj_rsakey.h

src/include/obj_tpm.h

src/include/rpc_tcstp.h

src/include/rpc_tcstp_tcs.h

src/include/rpc_tcstp_tsp.h

src/include/tcs_aik.h

src/include/tcs_context.h

src/include/tcs_key_ps.h

src/include/threads.h

src/include/tsp_audit.h

src/include/tsp_delegate.h

src/include/tsp_seal.h

src/include/tss/TSP.idl

src/include/tss/compat11b.h

src/include/tss/tcs.h

src/include/tss/tcs_defines.h

src/include/tss/tpm.h

src/include/tss/tpm_error.h

src/include/tss/tpm_ordinal.h

src/tcs/crypto

src/tcs/crypto/openssl

src/tcs/crypto/openssl/crypto.c

src/tcs/rpc

src/tcs/rpc/tcstp

src/tcs/rpc/tcstp/rpc.c

src/tcs/rpc/tcstp/rpc_admin.c

src/tcs/rpc/tcstp/rpc_aik.c

src/tcs/rpc/tcstp/rpc_audit.c

src/tcs/rpc/tcstp/rpc_auth.c

src/tcs/rpc/tcstp/rpc_bind.c

src/tcs/rpc/tcstp/rpc_caps.c

src/tcs/rpc/tcstp/rpc_caps_tpm.c

src/tcs/rpc/tcstp/rpc_certify.c

src/tcs/rpc/tcstp/rpc_changeauth.c

src/tcs/rpc/tcstp/rpc_cmk.c

src/tcs/rpc/tcstp/rpc_context.c

src/tcs/rpc/tcstp/rpc_counter.c

src/tcs/rpc/tcstp/rpc_daa.c

src/tcs/rpc/tcstp/rpc_delegate.c

src/tcs/rpc/tcstp/rpc_dir.c

src/tcs/rpc/tcstp/rpc_ek.c

src/tcs/rpc/tcstp/rpc_evlog.c

src/tcs/rpc/tcstp/rpc_key.c

src/tcs/rpc/tcstp/rpc_maint.c

src/tcs/rpc/tcstp/rpc_migration.c

src/tcs/rpc/tcstp/rpc_nv.c

src/tcs/rpc/tcstp/rpc_oper.c

src/tcs/rpc/tcstp/rpc_own.c

src/tcs/rpc/tcstp/rpc_pcr_extend.c

src/tcs/rpc/tcstp/rpc_ps.c

src/tcs/rpc/tcstp/rpc_quote.c

src/tcs/rpc/tcstp/rpc_quote2.c

src/tcs/rpc/tcstp/rpc_random.c

src/tcs/rpc/tcstp/rpc_seal.c

src/tcs/rpc/tcstp/rpc_selftest.c

src/tcs/rpc/tcstp/rpc_sign.c

src/tcs/rpc/tcstp/rpc_tick.c

src/tcs/rpc/tcstp/rpc_transport.c

src/tcs/tcs_aik.c

src/tcs/tcs_auth_mgr.c

src/tcs/tcs_caps.c

src/tcs/tcs_context.c

src/tcs/tcs_context_key.c

src/tcs/tcs_counter.c

src/tcs/tcs_evlog.c

src/tcs/tcs_evlog_biosem.c

src/tcs/tcs_evlog_imaem.c

src/tcs/tcs_key.c

src/tcs/tcs_key_mem_cache.c

src/tcs/tcs_key_ps.c

src/tcs/tcs_migration.c

src/tcs/tcs_pbg.c

src/tcs/tcs_ps.c

src/tcs/tcs_quote.c

src/tcs/tcs_quote2.c

src/tcs/tcs_req_mgr.c

src/tcs/tcs_seal.c

src/tcs/tcsi_admin.c

src/tcs/tcsi_aik.c

src/tcs/tcsi_audit.c

src/tcs/tcsi_auth.c

src/tcs/tcsi_bind.c

src/tcs/tcsi_caps.c

src/tcs/tcsi_caps_tpm.c

src/tcs/tcsi_certify.c

src/tcs/tcsi_changeauth.c

src/tcs/tcsi_cmk.c

src/tcs/tcsi_context.c

src/tcs/tcsi_counter.c

src/tcs/tcsi_daa.c

src/tcs/tcsi_delegate.c

src/tcs/tcsi_dir.c

src/tcs/tcsi_ek.c

src/tcs/tcsi_evlog.c

src/tcs/tcsi_key.c

src/tcs/tcsi_maint.c

src/tcs/tcsi_migration.c

src/tcs/tcsi_nv.c

src/tcs/tcsi_oper.c

src/tcs/tcsi_own.c

src/tcs/tcsi_pcr.c

src/tcs/tcsi_ps.c

src/tcs/tcsi_quote.c

src/tcs/tcsi_quote2.c

src/tcs/tcsi_random.c

src/tcs/tcsi_seal.c

src/tcs/tcsi_selftest.c

src/tcs/tcsi_sign.c

src/tcs/tcsi_tick.c

src/tcs/tcsi_transport.c

src/trspi/crypto/openssl/hash.c

src/trspi/crypto/openssl/rsa.c

src/trspi/crypto/openssl/symmetric.c

src/tspi/obj_daa.c

src/tspi/obj_delfamily.c

src/tspi/obj_migdata.c

src/tspi/obj_nv.c

src/tspi/rpc

src/tspi/rpc/hosttable.c

src/tspi/rpc/tcs_api.c

src/tspi/rpc/tcstp

src/tspi/rpc/tcstp/rpc.c

src/tspi/rpc/tcstp/rpc_admin.c

src/tspi/rpc/tcstp/rpc_aik.c

src/tspi/rpc/tcstp/rpc_audit.c

src/tspi/rpc/tcstp/rpc_auth.c

src/tspi/rpc/tcstp/rpc_bind.c

src/tspi/rpc/tcstp/rpc_caps.c

src/tspi/rpc/tcstp/rpc_caps_tpm.c

src/tspi/rpc/tcstp/rpc_certify.c

src/tspi/rpc/tcstp/rpc_changeauth.c

src/tspi/rpc/tcstp/rpc_cmk.c

src/tspi/rpc/tcstp/rpc_context.c

src/tspi/rpc/tcstp/rpc_counter.c

src/tspi/rpc/tcstp/rpc_daa.c

src/tspi/rpc/tcstp/rpc_delegate.c

src/tspi/rpc/tcstp/rpc_dir.c

src/tspi/rpc/tcstp/rpc_ek.c

src/tspi/rpc/tcstp/rpc_evlog.c

src/tspi/rpc/tcstp/rpc_key.c

src/tspi/rpc/tcstp/rpc_maint.c

src/tspi/rpc/tcstp/rpc_migration.c

src/tspi/rpc/tcstp/rpc_nv.c

src/tspi/rpc/tcstp/rpc_oper.c

src/tspi/rpc/tcstp/rpc_own.c

src/tspi/rpc/tcstp/rpc_pcr_extend.c

src/tspi/rpc/tcstp/rpc_ps.c

src/tspi/rpc/tcstp/rpc_quote.c

src/tspi/rpc/tcstp/rpc_quote2.c

src/tspi/rpc/tcstp/rpc_random.c

src/tspi/rpc/tcstp/rpc_seal.c

src/tspi/rpc/tcstp/rpc_selftest.c

src/tspi/rpc/tcstp/rpc_sign.c

src/tspi/rpc/tcstp/rpc_tick.c

src/tspi/rpc/tcstp/rpc_transport.c

src/tspi/tsp_admin.c

src/tspi/tsp_aik.c

src/tspi/tsp_asym.c

src/tspi/tsp_audit.c

src/tspi/tsp_auth.c

src/tspi/tsp_bind.c

src/tspi/tsp_caps.c

src/tspi/tsp_caps_tpm.c

src/tspi/tsp_certify.c

src/tspi/tsp_changeauth.c

src/tspi/tsp_context_mem.c

src/tspi/tsp_counter.c

src/tspi/tsp_daa.c

src/tspi/tsp_delegate.c

src/tspi/tsp_dir.c

src/tspi/tsp_ek.c

src/tspi/tsp_get_flags.c

src/tspi/tsp_key.c

src/tspi/tsp_maint.c

src/tspi/tsp_migration.c

src/tspi/tsp_nv.c

src/tspi/tsp_oper.c

src/tspi/tsp_own.c

src/tspi/tsp_pcr.c

src/tspi/tsp_pcr_extend.c

src/tspi/tsp_policy.c

src/tspi/tsp_ps.c

src/tspi/tsp_quote.c

src/tspi/tsp_quote2.c

src/tspi/tsp_random.c

src/tspi/tsp_seal.c

src/tspi/tsp_selftest.c

src/tspi/tsp_sign.c

src/tspi/tsp_tick.c

src/tspi/tsp_transport.c

src/tspi/tspi_admin.c

src/tspi/tspi_aik.c

src/tspi/tspi_asn1.c

src/tspi/tspi_audit.c

src/tspi/tspi_bind.c

src/tspi/tspi_caps.c

src/tspi/tspi_caps_tpm.c

src/tspi/tspi_certify.c

src/tspi/tspi_changeauth.c

src/tspi/tspi_cmk.c

src/tspi/tspi_context.c

src/tspi/tspi_counter.c

src/tspi/tspi_daa.c

src/tspi/tspi_delegate.c

src/tspi/tspi_dir.c

src/tspi/tspi_ek.c

src/tspi/tspi_getset.c

src/tspi/tspi_hash.c

src/tspi/tspi_key.c

src/tspi/tspi_maint.c

src/tspi/tspi_migration.c

src/tspi/tspi_nv.c

src/tspi/tspi_oper.c

src/tspi/tspi_own.c

src/tspi/tspi_pcr_comp.c

src/tspi/tspi_pcr_comp12.c

src/tspi/tspi_pcr_events.c

src/tspi/tspi_pcr_extend.c

src/tspi/tspi_policy.c

src/tspi/tspi_ps.c

src/tspi/tspi_quote.c

src/tspi/tspi_quote2.c

src/tspi/tspi_random.c

src/tspi/tspi_seal.c

src/tspi/tspi_selftest.c

src/tspi/tspi_sign.c

src/tspi/tspi_tick.c

src/tspi/tspi_transport.c

files removed:
autom4te.cache

autom4te.cache/output.0

autom4te.cache/output.1

autom4te.cache/requests

autom4te.cache/traces.0

autom4te.cache/traces.1

debian/45-trousers.rules

debian/patches/01_makefiles.diff

debian/patches/01_makefiles.dpatch

debian/patches/02_defaultgroup__tcsd.dpatch

debian/trousers.README.Debian

debian/trousers.default

debian/trousers.dirs

debian/watch

src/include/spi_internal_types.h

src/include/tcs_internal_types.h

src/include/trpctp.h

src/tcs/auth_mgr.c

src/tcs/biosem.c

src/tcs/cache.c

src/tcs/cxt.c

src/tcs/imaem.c

src/tcs/req_mgr.c

src/tcs/tcscm.c

src/tcs/tcsem.c

src/tcs/tcskcm.c

src/tcs/tcspbg.c

src/tcsd/tcsd_wrap.c

src/tcsd_api

src/tcsd_api/calltcsapi.c

src/tcsd_api/clntside.c

src/tcsd_api/hosttable.c

src/tcsd_api/tcstp.c

src/trspi/crypto/openssl/crypto.c

src/tspi/keyreg.c

src/tspi/memmgr.c

src/tspi/secrets.c

src/tspi/spi_context.c

src/tspi/spi_data.c

src/tspi/spi_getset.c

src/tspi/spi_hash.c

src/tspi/spi_key.c

src/tspi/spi_pcr.c

src/tspi/spi_policy.c

src/tspi/spi_tpm.c

files modified:
AUTHORS

ChangeLog

Makefile.in

README

config.guess

config.sub

configure

configure.in

debian/changelog

debian/control

debian/copyright

debian/libtspi-dev.install

debian/libtspi1.install

debian/patches/00list

debian/rules

debian/trousers.docs

debian/trousers.init

debian/trousers.install

debian/trousers.postinst

debian/trousers.postrm

dist/Makefile.in

dist/tcsd.conf.in

man/Makefile.in

man/man3/Makefile.am

man/man3/Makefile.in

man/man3/Tspi_Context_LoadKeyByUUID.3

man/man3/Tspi_TPM_GetPubEndorsementKey.3

man/man5/Makefile.in

man/man5/tcsd.conf.5.in

man/man8/Makefile.in

src/Makefile.in

src/include/Makefile.am

src/include/Makefile.in

src/include/auth_mgr.h

src/include/capabilities.h

src/include/hosttable.h

src/include/memmgr.h

src/include/obj.h

src/include/req_mgr.h

src/include/spi_utils.h

src/include/tcs_tsp.h

src/include/tcs_utils.h

src/include/tcsd.h

src/include/tcsd_ops.h

src/include/tcsd_wrap.h

src/include/tcsem.h

src/include/tcslog.h

src/include/tcsps.h

src/include/trousers/trousers.h

src/include/trousers/tss.h

src/include/trousers_types.h

src/include/tspps.h

src/include/tss/platform.h

src/include/tss/tcpa_defines.h

src/include/tss/tcpa_error.h

src/include/tss/tcpa_struct.h

src/include/tss/tcpa_typedef.h

src/include/tss/tcs_error.h

src/include/tss/tcs_structs.h

src/include/tss/tcs_typedef.h

src/include/tss/tddl_error.h

src/include/tss/tddlapi_error.h

src/include/tss/tddli.h

src/include/tss/tspi.h

src/include/tss/tss_defines.h

src/include/tss/tss_error.h

src/include/tss/tss_error_basics.h

src/include/tss/tss_structs.h

src/include/tss/tss_typedef.h

src/tcs/Makefile.am

src/tcs/Makefile.in

src/tcs/ps/ps_utils.c

src/tcs/ps/tcsps.c

src/tcs/tcs_utils.c

src/tcsd/Makefile.am

src/tcsd/Makefile.in

src/tcsd/platform.c

src/tcsd/svrside.c

src/tcsd/tcsd_conf.c

src/tcsd/tcsd_threads.c

src/tddl/Makefile.am

src/tddl/Makefile.in

src/trspi/Makefile.am

src/trspi/Makefile.in

src/trspi/trousers.c

src/tspi/Makefile.am

src/tspi/Makefile.in

src/tspi/obj.c

src/tspi/obj_context.c

src/tspi/obj_encdata.c

src/tspi/obj_hash.c

src/tspi/obj_pcrs.c

src/tspi/obj_policy.c

src/tspi/obj_rsakey.c

src/tspi/obj_tpm.c

src/tspi/ps/tspps.c

src/tspi/spi_utils.c

tools/Makefile.in

tools/ps_inspect.c

Show diffs side-by-side

added added

removed removed

src/tspi/spi_key.c

* Licensed Materials - Property of IBM

* trousers - An open source TCG Software Stack

* (C) Copyright International Business Machines Corp. 2004

#include <stdlib.h>

#include <stdio.h>

#include <string.h>

#include "trousers/tss.h"

#include "trousers/trousers.h"

#include "trousers_types.h"

#include "spi_internal_types.h"

#include "spi_utils.h"

#include "capabilities.h"

#include "tsplog.h"

#include "obj.h"

TSS_RESULT

Tspi_Key_UnloadKey(TSS_HKEY hKey) /* in */

{

TSS_HCONTEXT tspContext;

TCS_KEY_HANDLE hTcsKey;

TSS_RESULT result;

if ((result = obj_rsakey_get_tsp_context(hKey, &tspContext)))

return result;

if ((result = obj_rsakey_get_tcs_handle(hKey, &hTcsKey)))

return result;

return TCSP_EvictKey(tspContext, hTcsKey);

}

TSS_RESULT

Tspi_Key_LoadKey(TSS_HKEY hKey, /* in */

TSS_HKEY hUnwrappingKey) /* in */

{

TPM_AUTH auth;

BYTE blob[1000];

UINT64 offset;

TCPA_DIGEST digest;

TSS_RESULT result;

UINT32 keyslot;

TSS_HCONTEXT tspContext;

TSS_HPOLICY hPolicy;

UINT32 keySize;

BYTE *keyBlob;

TCS_KEY_HANDLE parentTCSKeyHandle, tcsKey;

TSS_BOOL usesAuth;

TPM_AUTH *pAuth;

if ((result = obj_rsakey_get_tsp_context(hKey, &tspContext)))

return result;

if (!obj_is_rsakey(hUnwrappingKey))

return TSPERR(TSS_E_INVALID_HANDLE);

if ((result = obj_rsakey_get_blob(hKey, &keySize, &keyBlob)))

return result;

if ((result = obj_rsakey_get_tcs_handle(hUnwrappingKey, &parentTCSKeyHandle)))

return result;

if ((result = obj_rsakey_get_policy(hUnwrappingKey, TSS_POLICY_USAGE,

&hPolicy, &usesAuth)))

return result;

if (usesAuth) {

offset = 0;

Trspi_LoadBlob_UINT32(&offset, TPM_ORD_LoadKey, blob);

Trspi_LoadBlob(&offset, keySize, blob, keyBlob);

Trspi_Hash(TSS_HASH_SHA1, offset, blob, digest.digest);

if ((result = secret_PerformAuth_OIAP(hUnwrappingKey,

TPM_ORD_LoadKey,

hPolicy, &digest,

&auth)))

return result;

pAuth = &auth;

} else {

pAuth = NULL;

}

if ((result = TCSP_LoadKeyByBlob(tspContext, parentTCSKeyHandle, keySize, keyBlob, pAuth,

&tcsKey, &keyslot)))

return result;

if (usesAuth) {

offset = 0;

Trspi_LoadBlob_UINT32(&offset, result, blob);

Trspi_LoadBlob_UINT32(&offset, TPM_ORD_LoadKey, blob);

Trspi_LoadBlob_UINT32(&offset, keyslot, blob);

100

Trspi_Hash(TSS_HASH_SHA1, offset, blob, digest.digest);

101

102

if ((result = obj_policy_validate_auth_oiap(hPolicy, &digest, &auth)))

103

return result;

104

}

105

106

return obj_rsakey_set_tcs_handle(hKey, tcsKey);

107

}

108

109

TSS_RESULT

110

Tspi_Key_GetPubKey(TSS_HKEY hKey, /* in */

111

UINT32 * pulPubKeyLength, /* out */

112

BYTE ** prgbPubKey) /* out */

113

{

114

TSS_HCONTEXT tspContext;

115

TPM_AUTH auth;

116

TPM_AUTH *pAuth;

117

BYTE hashblob[1024];

118

TCPA_DIGEST digest;

119

TCPA_RESULT result;

120

UINT64 offset;

121

TSS_HPOLICY hPolicy;

122

TCS_KEY_HANDLE tcsKeyHandle;

123

TSS_BOOL usesAuth;

124

TCPA_PUBKEY pubKey;

125

126

if (pulPubKeyLength == NULL || prgbPubKey == NULL)

127

return TSPERR(TSS_E_BAD_PARAMETER);

128

129

if ((result = obj_rsakey_get_tsp_context(hKey, &tspContext)))

130

return result;

131

132

if ((result = obj_rsakey_get_policy(hKey, TSS_POLICY_USAGE,

133

&hPolicy, &usesAuth)))

134

return result;

135

136

if ((result = obj_rsakey_get_tcs_handle(hKey, &tcsKeyHandle)))

137

return result;

138

139

if (usesAuth) {

140

offset = 0;

141

Trspi_LoadBlob_UINT32(&offset, TPM_ORD_GetPubKey, hashblob);

142

Trspi_Hash(TSS_HASH_SHA1, offset, hashblob, digest.digest);

143

144

if ((result = secret_PerformAuth_OIAP(hKey, TPM_ORD_GetPubKey,

145

hPolicy, &digest,

146

&auth)))

147

return result;

148

pAuth = &auth;

149

} else {

150

pAuth = NULL;

151

}

152

153

if ((result = TCSP_GetPubKey(tspContext, tcsKeyHandle, pAuth, pulPubKeyLength, prgbPubKey)))

154

return result;

155

156

memset(&pubKey, 0, sizeof(TCPA_PUBKEY));

157

158

if (usesAuth) {

159

offset = 0;

160

Trspi_LoadBlob_UINT32(&offset, result, hashblob);

161

Trspi_LoadBlob_UINT32(&offset, TPM_ORD_GetPubKey, hashblob);

162

Trspi_LoadBlob(&offset, *pulPubKeyLength, hashblob, *prgbPubKey);

163

Trspi_Hash(TSS_HASH_SHA1, offset, hashblob, digest.digest);

164

165

/* goto error here since prgbPubKey has been set */

166

if ((result = obj_policy_validate_auth_oiap(hPolicy, &digest, &auth)))

167

goto error;

168

}

169

170

/* If the key is the SRK, populate the pubkey data in the TSP object */

171

if (tcsKeyHandle == TPM_KEYHND_SRK)

172

obj_rsakey_set_pubkey(hKey, TRUE, *prgbPubKey);

173

174

return TSS_SUCCESS;

175

error:

176

free_tspi(tspContext, *prgbPubKey);

177

*prgbPubKey = NULL;

178

*pulPubKeyLength = 0;

179

return result;

180

}

181

182

TSS_RESULT

183

Tspi_Key_CertifyKey(TSS_HKEY hKey, /* in */

184

TSS_HKEY hCertifyingKey, /* in */

185

TSS_VALIDATION * pValidationData) /* in, out */

186

{

187

TCPA_RESULT result;

188

TPM_AUTH certAuth;

189

TPM_AUTH keyAuth;

190

UINT64 offset = 0;

191

BYTE hashBlob[1024];

192

TCPA_DIGEST hash;

193

TCPA_NONCE antiReplay;

194

UINT32 CertifyInfoSize;

195

BYTE *CertifyInfo;

196

UINT32 outDataSize;

197

BYTE *outData;

198

TSS_HPOLICY hPolicy;

199

TSS_HPOLICY hCertPolicy;

200

TCS_KEY_HANDLE certifyTCSKeyHandle, keyTCSKeyHandle;

201

BYTE *keyData = NULL;

202

UINT32 keyDataSize;

203

TCPA_KEY keyContainer;

204

TSS_BOOL useAuthCert;

205

TSS_BOOL useAuthKey;

206

TPM_AUTH *pCertAuth = &certAuth;

207

TPM_AUTH *pKeyAuth = &keyAuth;

208

TSS_HCONTEXT tspContext;

209

210

211

if ((result = obj_rsakey_get_tsp_context(hKey, &tspContext)))

212

return result;

213

214

if ((result = obj_rsakey_get_policy(hKey, TSS_POLICY_USAGE,

215

&hPolicy, &useAuthKey)))

216

return result;

217

218

if ((result = obj_rsakey_get_policy(hCertifyingKey, TSS_POLICY_USAGE,

219

&hCertPolicy, &useAuthCert)))

220

return result;

221

222

if ((result = obj_rsakey_get_tcs_handle(hCertifyingKey, &certifyTCSKeyHandle)))

223

return result;

224

225

if ((result = obj_rsakey_get_tcs_handle(hKey, &keyTCSKeyHandle)))

226

return result;

227

228

if (pValidationData == NULL) {

229

LogDebug("Internal Verify");

230

if ((result = internal_GetRandomNonce(tspContext, &antiReplay)))

231

return result;

232

} else {

233

LogDebug("External Verify");

234

if (pValidationData->ulExternalDataLength < sizeof(antiReplay.nonce))

235

return TSPERR(TSS_E_BAD_PARAMETER);

236

237

memcpy(antiReplay.nonce, pValidationData->rgbExternalData,

238

sizeof(antiReplay.nonce));

239

}

240

241

if (useAuthCert && !useAuthKey)

242

return TSPERR(TSS_E_BAD_PARAMETER);

243

244

/* Setup the auths */

245

if (useAuthCert || useAuthKey) {

246

offset = 0;

247

Trspi_LoadBlob_UINT32(&offset, TPM_ORD_CertifyKey, hashBlob);

248

Trspi_LoadBlob(&offset, 20, hashBlob, antiReplay.nonce);

249

Trspi_Hash(TSS_HASH_SHA1, offset, hashBlob, hash.digest);

250

}

251

252

if (useAuthKey) {

253

if ((result = secret_PerformAuth_OIAP(hKey, TPM_ORD_CertifyKey,

254

hPolicy, &hash,

255

&keyAuth)))

256

return result;

257

} else

258

pKeyAuth = NULL;

259

260

if (useAuthCert) {

261

if ((result = secret_PerformAuth_OIAP(hCertifyingKey,

262

TPM_ORD_CertifyKey,

263

hCertPolicy, &hash,

264

&certAuth)))

265

return result;

266

} else

267

pCertAuth = NULL;

268

269

if ((result = TCSP_CertifyKey(tspContext, certifyTCSKeyHandle, keyTCSKeyHandle, antiReplay,

270

pCertAuth, pKeyAuth, &CertifyInfoSize, &CertifyInfo,

271

&outDataSize, &outData))) {

272

if (useAuthKey)

273

TCSP_TerminateHandle(tspContext, keyAuth.AuthHandle);

274

if (useAuthCert)

275

TCSP_TerminateHandle(tspContext, certAuth.AuthHandle);

276

return result;

277

}

278

279

/* Validate auth */

280

if (useAuthCert || useAuthKey) {

281

offset = 0;

282

Trspi_LoadBlob_UINT32(&offset, result, hashBlob);

283

Trspi_LoadBlob_UINT32(&offset, TPM_ORD_CertifyKey, hashBlob);

284

Trspi_LoadBlob(&offset, CertifyInfoSize, hashBlob, CertifyInfo);

285

Trspi_LoadBlob_UINT32(&offset, outDataSize, hashBlob);

286

Trspi_LoadBlob(&offset, outDataSize, hashBlob, outData);

287

Trspi_Hash(TSS_HASH_SHA1, offset, hashBlob, hash.digest);

288

if (useAuthKey) {

289

if ((result = obj_policy_validate_auth_oiap(hPolicy, &hash, &keyAuth))) {

290

TCSP_TerminateHandle(tspContext, keyAuth.AuthHandle);

291

if (useAuthCert)

292

TCSP_TerminateHandle(tspContext, certAuth.AuthHandle);

293

return result;

294

}

295

}

296

if (useAuthCert) {

297

if ((result = obj_policy_validate_auth_oiap(hCertPolicy, &hash, &certAuth))) {

298

TCSP_TerminateHandle(tspContext, certAuth.AuthHandle);

299

if (useAuthKey)

300

TCSP_TerminateHandle(tspContext, keyAuth.AuthHandle);

301

return result;

302

}

303

}

304

}

305

306

if (pValidationData == NULL) {

307

if ((result = obj_rsakey_get_blob(hCertifyingKey,

308

&keyDataSize, &keyData))) {

309

if (useAuthKey)

310

TCSP_TerminateHandle(tspContext, keyAuth.AuthHandle);

311

if (useAuthCert)

312

TCSP_TerminateHandle(tspContext, certAuth.AuthHandle);

313

314

LogError("Error in calling GetAttribData internally");

315

return TSPERR(TSS_E_INTERNAL_ERROR);

316

}

317

318

memset(&keyContainer, 0, sizeof(TCPA_KEY));

319

320

offset = 0;

321

if ((result = Trspi_UnloadBlob_KEY(&offset, keyData, &keyContainer)))

322

return result;

323

324

Trspi_Hash(TSS_HASH_SHA1, CertifyInfoSize, CertifyInfo, hash.digest);

325

326

if ((result = Trspi_Verify(TSS_HASH_SHA1, hash.digest, 20,

327

keyContainer.pubKey.key,

328

keyContainer.pubKey.keyLength,

329

outData, outDataSize))) {

330

if (useAuthKey)

331

TCSP_TerminateHandle(tspContext, keyAuth.AuthHandle);

332

if (useAuthCert)

333

TCSP_TerminateHandle(tspContext, certAuth.AuthHandle);

334

335

free_key_refs(&keyContainer);

336

return TSPERR(TSS_E_VERIFICATION_FAILED);

337

}

338

free_key_refs(&keyContainer);

339

} else {

340

pValidationData->ulDataLength = CertifyInfoSize;

341

pValidationData->rgbData = calloc_tspi(tspContext, CertifyInfoSize);

342

if (pValidationData->rgbData == NULL) {

343

LogError("malloc of %d bytes failed.", CertifyInfoSize);

344

if (useAuthKey)

345

TCSP_TerminateHandle(tspContext, keyAuth.AuthHandle);

346

if (useAuthCert)

347

TCSP_TerminateHandle(tspContext, certAuth.AuthHandle);

348

349

return TSPERR(TSS_E_OUTOFMEMORY);

350

}

351

memcpy(pValidationData->rgbData, CertifyInfo, CertifyInfoSize);

352

pValidationData->ulValidationDataLength = outDataSize;

353

pValidationData->rgbValidationData = calloc_tspi(tspContext, outDataSize);

354

if (pValidationData->rgbValidationData == NULL) {

355

LogError("malloc of %d bytes failed.", outDataSize);

356

if (useAuthKey)

357

TCSP_TerminateHandle(tspContext, keyAuth.AuthHandle);

358

if (useAuthCert)

359

TCSP_TerminateHandle(tspContext, certAuth.AuthHandle);

360

361

return TSPERR(TSS_E_OUTOFMEMORY);

362

}

363

memcpy(pValidationData->rgbValidationData, outData, outDataSize);

364

#if 0

365

memcpy(&pValidationData->versionInfo,

366

getCurrentVersion(tspContext), sizeof (TCPA_VERSION));

367

#endif

368

}

369

370

if (useAuthKey)

371

TCSP_TerminateHandle(tspContext, keyAuth.AuthHandle);

372

if (useAuthCert)

373

TCSP_TerminateHandle(tspContext, certAuth.AuthHandle);

374

375

return TSS_SUCCESS;

376

}

377

378

TSS_RESULT

379

Tspi_Key_CreateKey(TSS_HKEY hKey, /* in */

380

TSS_HKEY hWrappingKey, /* in */

381

TSS_HPCRS hPcrComposite) /* in, may be NULL */

382

{

383

UINT64 offset;

384

BYTE hashBlob[0x1000];

385

BYTE sharedSecret[20];

386

TPM_AUTH auth;

387

TCPA_ENCAUTH encAuthUsage;

388

TCPA_ENCAUTH encAuthMig = { { 0, } };

389

TCPA_DIGEST digest;

390

TCPA_RESULT result;

391

TSS_HPOLICY hUsagePolicy;

392

TSS_HPOLICY hMigPolicy = NULL_HPOLICY;

393

TSS_HPOLICY hWrapPolicy;

394

TCS_KEY_HANDLE parentTCSKeyHandle;

395

BYTE *keyBlob = NULL;

396

UINT32 keySize;

397

TCPA_NONCE nonceEvenOSAP;

398

UINT32 newKeySize;

399

BYTE *newKey;

400

TSS_BOOL usesAuth;

401

TSS_HCONTEXT tspContext;

402

403

if ((result = obj_rsakey_get_tsp_context(hKey, &tspContext)))

404

return result;

405

406

if ((result = obj_rsakey_get_policy(hKey, TSS_POLICY_USAGE,

407

&hUsagePolicy, &usesAuth)))

408

return result;

409

410

if (obj_rsakey_is_migratable(hKey)) {

411

if ((result = obj_rsakey_get_policy(hKey, TSS_POLICY_MIGRATION, &hMigPolicy, NULL)))

412

return result;

413

}

414

415

if ((result = obj_rsakey_get_policy(hWrappingKey, TSS_POLICY_USAGE, &hWrapPolicy, NULL)))

416

return result;

417

418

if (hPcrComposite) {

419

/* its possible that hPcrComposite could be a bad handle here,

420

* or that no indices of it are yet set, which would throw

421

* internal error. Blanket both those codes with bad

422

* parameter to help the user out */

423

if ((result = obj_rsakey_set_pcr_data(hKey, hPcrComposite)))

424

return TSPERR(TSS_E_BAD_PARAMETER);

425

}

426

427

if ((result = obj_rsakey_get_blob(hKey, &keySize, &keyBlob)))

428

return result;

429

430

if ((result = obj_rsakey_get_tcs_handle(hWrappingKey, &parentTCSKeyHandle)))

431

return result;

432

433

/*****************************************

434

* To create the authorization, the first step is to call

435

* secret_PerformXOR_OSAP, which will call OSAP and do the xorenc of

436

* the secrets. Then, the hashdata is done so that

437

* secret_PerformAuth_OSAP can calculate the HMAC.

438

******************************************/

439

440

/* Do the first part of the OSAP */

441

if ((result =

442

secret_PerformXOR_OSAP(hWrapPolicy, hUsagePolicy, hMigPolicy,

443

hWrappingKey, TCPA_ET_KEYHANDLE,

444

parentTCSKeyHandle, &encAuthUsage,

445

&encAuthMig, sharedSecret, &auth,

446

&nonceEvenOSAP)))

447

return result;

448

449

/* Setup the Hash Data for the HMAC */

450

offset = 0;

451

Trspi_LoadBlob_UINT32(&offset, TPM_ORD_CreateWrapKey, hashBlob);

452

Trspi_LoadBlob(&offset, 20, hashBlob, encAuthUsage.authdata);

453

Trspi_LoadBlob(&offset, 20, hashBlob, encAuthMig.authdata);

454

Trspi_LoadBlob(&offset, keySize, hashBlob, keyBlob);

455

Trspi_Hash(TSS_HASH_SHA1, offset, hashBlob, digest.digest);

456

457

/* Complete the Auth Structure */

458

if ((result = secret_PerformAuth_OSAP(hWrappingKey,

459

TPM_ORD_CreateWrapKey,

460

hWrapPolicy, hUsagePolicy,

461

hMigPolicy, sharedSecret, &auth,

462

digest.digest, &nonceEvenOSAP)))

463

return result;

464

465

/* Now call the function */

466

if ((result = TCSP_CreateWrapKey(tspContext, parentTCSKeyHandle, encAuthUsage, encAuthMig,

467

keySize, keyBlob, &newKeySize, &newKey, &auth)))

468

return result;

469

470

/* Validate the Authorization before using the new key */

471

offset = 0;

472

Trspi_LoadBlob_UINT32(&offset, result, hashBlob);

473

Trspi_LoadBlob_UINT32(&offset, TPM_ORD_CreateWrapKey, hashBlob);

474

Trspi_LoadBlob(&offset, newKeySize, hashBlob, newKey);

475

Trspi_Hash(TSS_HASH_SHA1, offset, hashBlob, digest.digest);

476

if ((result = secret_ValidateAuth_OSAP(hWrappingKey,

477

TPM_ORD_CreateWrapKey,

478

hWrapPolicy, hUsagePolicy,

479

hMigPolicy, sharedSecret, &auth,

480

digest.digest,

481

&nonceEvenOSAP))) {

482

free(newKey);

483

return result;

484

}

485

486

/* Push the new key into the existing object */

487

if ((result = obj_rsakey_set_tcpakey(hKey, newKeySize, newKey))) {

488

free(newKey);

489

return result;

490

}

491

492

free(newKey);

493

return result;

494

}

495

496

TSS_RESULT

497

Tspi_Key_WrapKey(TSS_HKEY hKey, /* in */

498

TSS_HKEY hWrappingKey, /* in */

499

TSS_HPCRS hPcrComposite) /* in, may be NULL */

500

{

501

TSS_HPOLICY hUsePolicy, hMigPolicy;

502

TCPA_SECRET usage, migration;

503

TSS_RESULT result;

504

BYTE *keyPrivBlob = NULL, *wrappingPubKey = NULL, *keyBlob = NULL;

505

UINT32 keyPrivBlobLen, wrappingPubKeyLen, keyBlobLen;

506

BYTE newPrivKey[214]; /* its not magic, see TPM 1.1b spec p.71 */

507

BYTE encPrivKey[256];

508

UINT32 newPrivKeyLen = 214, encPrivKeyLen = 256;

509

UINT64 offset;

510

TCPA_KEY keyContainer;

511

BYTE hashBlob[1024];

512

TCPA_DIGEST digest;

513

TSS_HCONTEXT tspContext;

514

515

if ((result = obj_rsakey_get_tsp_context(hKey, &tspContext)))

516

return result;

517

518

if (hPcrComposite) {

519

if ((result = obj_rsakey_set_pcr_data(hKey, hPcrComposite)))

520

return result;

521

}

522

523

/* get the key to be wrapped's private key */

524

if ((result = obj_rsakey_get_priv_blob(hKey, &keyPrivBlobLen, &keyPrivBlob)))

525

goto done;

526

527

/* get the key to be wrapped's blob */

528

if ((result = obj_rsakey_get_blob(hKey, &keyBlobLen, &keyBlob)))

529

goto done;

530

531

/* get the wrapping key's public key */

532

if ((result = obj_rsakey_get_modulus(hWrappingKey, &wrappingPubKeyLen, &wrappingPubKey)))

533

goto done;

534

535

/* get the key to be wrapped's usage policy */

536

if ((result = obj_rsakey_get_policy(hKey, TSS_POLICY_USAGE, &hUsePolicy, NULL)))

537

goto done;

538

539

if ((result = obj_rsakey_get_policy(hKey, TSS_POLICY_MIGRATION, &hMigPolicy, NULL)))

540

goto done;

541

542

if ((result = obj_policy_get_secret(hUsePolicy, TR_SECRET_CTX_NEW, &usage)))

543

goto done;

544

545

if ((result = obj_policy_get_secret(hMigPolicy, TR_SECRET_CTX_NEW, &migration)))

546

goto done;

547

548

memset(&keyContainer, 0, sizeof(TCPA_KEY));

549

550

/* unload the key to be wrapped's blob */

551

offset = 0;

552

if ((result = Trspi_UnloadBlob_KEY(&offset, keyBlob, &keyContainer)))

553

return result;

554

555

/* load the key's attributes into an object and get its hash value */

556

offset = 0;

557

Trspi_LoadBlob_PRIVKEY_DIGEST(&offset, hashBlob, &keyContainer);

558

Trspi_Hash(TSS_HASH_SHA1, offset, hashBlob, digest.digest);

559

560

free_key_refs(&keyContainer);

561

562

/* create the plaintext private key blob */

563

offset = 0;

564

Trspi_LoadBlob_BYTE(&offset, TCPA_PT_ASYM, newPrivKey);

565

Trspi_LoadBlob(&offset, 20, newPrivKey, usage.authdata);

566

Trspi_LoadBlob(&offset, 20, newPrivKey, migration.authdata);

567

Trspi_LoadBlob(&offset, 20, newPrivKey, digest.digest);

568

Trspi_LoadBlob_UINT32(&offset, keyPrivBlobLen, newPrivKey);

569

Trspi_LoadBlob(&offset, keyPrivBlobLen, newPrivKey, keyPrivBlob);

570

newPrivKeyLen = offset;

571

572

/* encrypt the private key blob */

573

if ((result = Trspi_RSA_Encrypt(newPrivKey, newPrivKeyLen, encPrivKey,

574

&encPrivKeyLen, wrappingPubKey,

575

wrappingPubKeyLen)))

576

goto done;

577

578

/* set the new encrypted private key in the wrapped key object */

579

if ((result = obj_rsakey_set_privkey(hKey, FALSE, encPrivKeyLen, encPrivKey)))

580

goto done;

581

582

done:

583

free_tspi(tspContext, keyPrivBlob);

584

free_tspi(tspContext, keyBlob);

585

free_tspi(tspContext, wrappingPubKey);

586

return result;

587

}

588

#if 0

589

TSS_RESULT

590

create_migration_blob_encdata(TSS_HENCDATA hDataToMigrate,

591

TSS_HKEY hParentKey,

592

UINT32 ulMigTicketLength,

593

BYTE * rgbMigTicket,

594

UINT32 * pulRandomLength,

595

BYTE ** prgbRandom,

596

UINT32 * pulMigrationBlobLength,

597

BYTE ** prgbMigrationBlob)

598

{

599

TCS_CONTEXT_HANDLE tcsContext;

600

TPM_AUTH parentAuth;

601

TPM_AUTH entityAuth;

602

TCPA_RESULT result;

603

UINT16 offset;

604

BYTE hashblob[0x1000];

605

TCPA_DIGEST digest;

606

UINT32 parentKeySize;

607

BYTE *parentKeyBlob;

608

UINT32 dataToMigrateSize;

609

BYTE *dataToMigrateBlob;

610

TSS_HPOLICY hParentPolicy;

611

TSS_HPOLICY hMigratePolicy;

612

TCPA_MIGRATIONKEYAUTH migAuth;

613

TCS_KEY_HANDLE parentHandle;

614

TPM_AUTH *pParentAuth;

615

TSS_BOOL useAuth;

616

UINT32 blobSize;

617

BYTE *blob;

618

TCPA_STORED_DATA storedData;

619

TSS_HCONTEXT tspContext;

620

621

if ((result = obj_encdata_get_tsp_context(hDataToMigrate, &tspContext)))

622

return result;

623

624

if ((result = obj_context_is_connected(tspContext, &tcsContext)))

625

return result;

626

627

if ((result = obj_rsakey_get_blob(hParentKey, &parentKeySize, &parentKeyBlob)))

628

return result;

629

630

if ((result = obj_encdata_get_data(hDataToMigrate, &dataToMigrateSize, &dataToMigrateBlob)))

631

return result;

632

633

if ((result = obj_rsakey_get_policy(hParentKey, TSS_POLICY_USAGE, &hParentPolicy,

634

&useAuth)))

635

return result;

636

637

if ((result = obj_encdata_get_policy(hDataToMigrate, TSS_POLICY_MIGRATION, &hMigratePolicy)))

638

return result;

639

640

/* Parsing the migration scheme from the blob and key object */

641

memset(&migAuth, 0, sizeof(TCPA_MIGRATIONKEYAUTH));

642

643

offset = 0;

644

if ((result = Trspi_UnloadBlob_MigrationKeyAuth(&offset, rgbMigTicket, &migAuth)))

645

return result;

646

647

/* free these now, since none are used below */

648

free(migAuth.migrationKey.algorithmParms.parms);

649

migAuth.migrationKey.algorithmParms.parmSize = 0;

650

free(migAuth.migrationKey.pubKey.key);

651

migAuth.migrationKey.pubKey.keyLength = 0;

652

#if 1

653

offset = 0;

654

if ((result = Trspi_UnloadBlob_STORED_DATA(&offset, dataToMigrateBlob, &storedData)))

655

return result;

656

#endif

657

/* Generate the Authorization data */

658

offset = 0;

659

Trspi_LoadBlob_UINT32(&offset, TPM_ORD_CreateMigrationBlob, hashblob);

660

Trspi_LoadBlob_UINT16(&offset, migAuth.migrationScheme, hashblob);

661

Trspi_LoadBlob(&offset, ulMigTicketLength, hashblob, rgbMigTicket);

662

#if 1

663

Trspi_LoadBlob_UINT32(&offset, storedData.encDataSize, hashblob);

664

Trspi_LoadBlob(&offset, storedData.encDataSize, hashblob, storedData.encData);

665

#else

666

Trspi_LoadBlob_UINT32(&offset, dataToMigrateSize, hashblob);

667

Trspi_LoadBlob(&offset, dataToMigrateSize, hashblob, dataToMigrateBlob);

668

#endif

669

Trspi_Hash(TSS_HASH_SHA1, offset, hashblob, digest.digest);

670

671

if (useAuth) {

672

if ((result = secret_PerformAuth_OIAP(hParentPolicy,

673

TPM_ORD_CreateMigrationBlob,

674

hParentPolicy, &digest,

675

&parentAuth))) {

676

//free(storedData.sealInfo);

677

//free(storedData.encData);

678

return result;

679

}

680

pParentAuth = &parentAuth;

681

} else

682

pParentAuth = NULL;

683

684

if ((result = secret_PerformAuth_OIAP(hDataToMigrate,

685

TPM_ORD_CreateMigrationBlob,

686

hMigratePolicy, &digest,

687

&entityAuth))) {

688

//free(storedData.sealInfo);

689

//free(storedData.encData);

690

return result;

691

}

692

693

if ((parentHandle = getTCSKeyHandle(hParentKey)) == NULL_HKEY) {

694

//free(storedData.sealInfo);

695

//free(storedData.encData);

696

return TSPERR(TSS_E_KEY_NOT_LOADED);

697

}

698

699

if ((result = TCSP_CreateMigrationBlob(tcsContext, parentHandle, migAuth.migrationScheme,

700

ulMigTicketLength, rgbMigTicket,

701

//storedData.encDataSize, storedData.encData,

702

dataToMigrateSize, dataToMigrateBlob,

703

pParentAuth, &entityAuth, pulRandomLength,

704

prgbRandom, pulMigrationBlobLength,

705

prgbMigrationBlob))) {

706

//free(storedData.sealInfo);

707

//free(storedData.encData);

708

return result;

709

}

710

//free(storedData.sealInfo);

711

//free(storedData.encData);

712

713

offset = 0;

714

Trspi_LoadBlob_UINT32(&offset, result, hashblob);

715

Trspi_LoadBlob_UINT32(&offset, TPM_ORD_CreateMigrationBlob, hashblob);

716

Trspi_LoadBlob_UINT32(&offset, *pulRandomLength, hashblob);

717

Trspi_LoadBlob(&offset, *pulRandomLength, hashblob, *prgbRandom);

718

Trspi_LoadBlob_UINT32(&offset, *pulMigrationBlobLength, hashblob);

719

Trspi_LoadBlob(&offset, *pulMigrationBlobLength, hashblob, *prgbMigrationBlob);

720

Trspi_Hash(TSS_HASH_SHA1, offset, hashblob, digest.digest);

721

if (useAuth) {

722

if ((result = obj_policy_validate_auth_oiap(hParentPolicy, &digest, &parentAuth)))

723

goto error;

724

}

725

if ((result = obj_policy_validate_auth_oiap(hMigratePolicy, &digest, &entityAuth)))

726

goto error;

727

728

if (migAuth.migrationScheme == TSS_MS_REWRAP) {

729

#if 1

730

if ((result = obj_encdata_get_data(hDataToMigrate, &blobSize, &blob)))

731

goto error;

732

733

offset = 0;

734

if ((result = Trspi_UnloadBlob_STORED_DATA(&offset, blob, &storedData)))

735

goto error;

736

737

/* keyContainer.encData = calloc_tspi(tspContext, outDataSize); */

738

storedData.encDataSize = *pulMigrationBlobLength;

739

memcpy(storedData.encData, *prgbMigrationBlob, *pulMigrationBlobLength);

740

741

offset = 0;

742

Trspi_LoadBlob_STORED_DATA(&offset, blob, &storedData);

743

free(storedData.sealInfo);

744

free(storedData.encData);

745

746

if ((result = obj_encdata_set_data(hDataToMigrate, blobSize, blob)))

747

goto error;

748

#else

749

if ((result = obj_encdata_set_data(hDataToMigrate, *pulMigrationBlobLength,

750

*prgbMigrationBlob)))

751

goto error;

752

#endif

753

}

754

755

return result;

756

error:

757

if (*pulRandomLength)

758

free_tspi(tspContext, prgbRandom);

759

free_tspi(tspContext, prgbMigrationBlob);

760

return result;

761

}

762

#endif

763

764

TSS_RESULT

765

create_migration_blob_key(TSS_HKEY hKeyToMigrate,

766

TSS_HKEY hParentKey,

767

UINT32 ulMigTicketLength,

768

BYTE * rgbMigTicket,

769

UINT32 * pulRandomLength,

770

BYTE ** prgbRandom,

771

UINT32 * pulMigrationBlobLength,

772

BYTE ** prgbMigrationBlob)

773

{

774

TPM_AUTH parentAuth, entityAuth;

775

TPM_AUTH *pParentAuth;

776

TCPA_RESULT result;

777

UINT64 offset;

778

BYTE hashblob[0x1000];

779

TCPA_DIGEST digest;

780

UINT32 parentKeySize;

781

BYTE *parentKeyBlob;

782

UINT32 keyToMigrateSize;

783

BYTE *keyToMigrateBlob;

784

TSS_HPOLICY hParentPolicy;

785

TSS_HPOLICY hMigratePolicy;

786

TCPA_MIGRATIONKEYAUTH migAuth;

787

TCPA_KEY tcpaKey;

788

TCS_KEY_HANDLE parentHandle;

789

TSS_BOOL parentUsesAuth;

790

UINT32 blobSize;

791

BYTE *blob;

792

TCPA_KEY keyContainer;

793

TSS_HCONTEXT tspContext;

794

795

if ((result = obj_rsakey_get_tsp_context(hKeyToMigrate, &tspContext)))

796

return result;

797

798

if ((result = obj_rsakey_get_blob(hParentKey, &parentKeySize, &parentKeyBlob)))

799

return result;

800

801

if ((result = obj_rsakey_get_blob(hKeyToMigrate, &keyToMigrateSize, &keyToMigrateBlob)))

802

return result;

803

804

if ((result = obj_rsakey_get_policy(hParentKey, TSS_POLICY_USAGE, &hParentPolicy,

805

&parentUsesAuth)))

806

return result;

807

808

if ((result = obj_rsakey_get_policy(hKeyToMigrate, TSS_POLICY_MIGRATION, &hMigratePolicy,

809

NULL)))

810

return result;

811

812

/* Parsing the migration scheme from the blob and key object */

813

memset(&migAuth, 0, sizeof(TCPA_MIGRATIONKEYAUTH));

814

815

offset = 0;

816

if ((result = Trspi_UnloadBlob_MigrationKeyAuth(&offset, rgbMigTicket, &migAuth)))

817

return result;

818

819

/* free these now, since none are used below */

820

free(migAuth.migrationKey.algorithmParms.parms);

821

migAuth.migrationKey.algorithmParms.parmSize = 0;

822

free(migAuth.migrationKey.pubKey.key);

823

migAuth.migrationKey.pubKey.keyLength = 0;

824

825

memset(&tcpaKey, 0, sizeof(TCPA_KEY));

826

827

offset = 0;

828

if ((result = Trspi_UnloadBlob_KEY(&offset, keyToMigrateBlob, &tcpaKey)))

829

return result;

830

831

/* Generate the Authorization data */

832

offset = 0;

833

Trspi_LoadBlob_UINT32(&offset, TPM_ORD_CreateMigrationBlob, hashblob);

834

Trspi_LoadBlob_UINT16(&offset, migAuth.migrationScheme, hashblob);

835

Trspi_LoadBlob(&offset, ulMigTicketLength, hashblob, rgbMigTicket);

836

Trspi_LoadBlob_UINT32(&offset, tcpaKey.encSize, hashblob);

837

Trspi_LoadBlob(&offset, tcpaKey.encSize, hashblob, tcpaKey.encData);

838

Trspi_Hash(TSS_HASH_SHA1, offset, hashblob, digest.digest);

839

840

if (parentUsesAuth) {

841

if ((result = secret_PerformAuth_OIAP(hParentPolicy,

842

TPM_ORD_CreateMigrationBlob,

843

hParentPolicy, &digest,

844

&parentAuth))) {

845

free_key_refs(&tcpaKey);

846

return result;

847

}

848

pParentAuth = &parentAuth;

849

} else {

850

pParentAuth = NULL;

851

}

852

853

if ((result = secret_PerformAuth_OIAP(hKeyToMigrate,

854

TPM_ORD_CreateMigrationBlob,

855

hMigratePolicy, &digest,

856

&entityAuth))) {

857

free_key_refs(&tcpaKey);

858

return result;

859

}

860

861

if ((result = obj_rsakey_get_tcs_handle(hParentKey, &parentHandle)))

862

return result;

863

864

if ((result = TCSP_CreateMigrationBlob(tspContext, parentHandle, migAuth.migrationScheme,

865

ulMigTicketLength, rgbMigTicket, tcpaKey.encSize,

866

tcpaKey.encData, pParentAuth, &entityAuth,

867

pulRandomLength, prgbRandom, pulMigrationBlobLength,

868

prgbMigrationBlob))) {

869

free_key_refs(&tcpaKey);

870

return result;

871

}

872

free_key_refs(&tcpaKey);

873

874

offset = 0;

875

Trspi_LoadBlob_UINT32(&offset, result, hashblob);

876

Trspi_LoadBlob_UINT32(&offset, TPM_ORD_CreateMigrationBlob, hashblob);

877

Trspi_LoadBlob_UINT32(&offset, *pulRandomLength, hashblob);

878

Trspi_LoadBlob(&offset, *pulRandomLength, hashblob, *prgbRandom);

879

Trspi_LoadBlob_UINT32(&offset, *pulMigrationBlobLength, hashblob);

880

Trspi_LoadBlob(&offset, *pulMigrationBlobLength, hashblob, *prgbMigrationBlob);

881

Trspi_Hash(TSS_HASH_SHA1, offset, hashblob, digest.digest);

882

883

if (parentUsesAuth) {

884

if ((result = obj_policy_validate_auth_oiap(hParentPolicy, &digest, &parentAuth)))

885

goto error;

886

}

887

888

if ((result = obj_policy_validate_auth_oiap(hMigratePolicy, &digest, &entityAuth)))

889

goto error;

890

891

if (migAuth.migrationScheme == TCPA_MS_REWRAP) {

892

if ((result = obj_rsakey_get_blob(hKeyToMigrate, &blobSize, &blob)))

893

goto error;

894

895

memset(&keyContainer, 0, sizeof(TCPA_KEY));

896

897

offset = 0;

898

if ((result = Trspi_UnloadBlob_KEY(&offset, blob, &keyContainer)))

899

goto error;

900

901

if (keyContainer.encSize > 0)

902

free(keyContainer.encData);

903

904

keyContainer.encSize = *pulMigrationBlobLength;

905

keyContainer.encData = *prgbMigrationBlob;

906

907

offset = 0;

908

Trspi_LoadBlob_KEY(&offset, hashblob, &keyContainer);

909

910

/* Free manually here since free_key_refs() would free encData, ugh. */

911

free(keyContainer.algorithmParms.parms);

912

keyContainer.algorithmParms.parms = NULL;

913

keyContainer.algorithmParms.parmSize = 0;

914

915

free(keyContainer.pubKey.key);

916

keyContainer.pubKey.key = NULL;

917

keyContainer.pubKey.keyLength = 0;

918

919

free(keyContainer.PCRInfo);

920

keyContainer.PCRInfo = NULL;

921

keyContainer.PCRInfoSize = 0;

922

923

if ((result = obj_rsakey_set_tcpakey(hKeyToMigrate, offset, hashblob)))

924

goto error;

925

}

926

927

return result;

928

error:

929

if (*pulRandomLength)

930

free_tspi(tspContext, prgbRandom);

931

free_tspi(tspContext, prgbMigrationBlob);

932

return result;

933

}

934

935

936

TSS_RESULT

937

Tspi_Key_CreateMigrationBlob(TSS_HKEY hKeyToMigrate, /* in */

938

TSS_HKEY hParentKey, /* in */

939

UINT32 ulMigTicketLength, /* in */

940

BYTE * rgbMigTicket, /* in */

941

UINT32 * pulRandomLength, /* out */

942

BYTE ** prgbRandom, /* out */

943

UINT32 * pulMigrationBlobLength, /* out */

944

BYTE ** prgbMigrationBlob) /* out */

945

{

946

if (pulRandomLength == NULL || prgbRandom == NULL || rgbMigTicket == NULL ||

947

pulMigrationBlobLength == NULL || prgbMigrationBlob == NULL)

948

return TSPERR(TSS_E_BAD_PARAMETER);

949

950

if (obj_is_rsakey(hKeyToMigrate))

951

return create_migration_blob_key(hKeyToMigrate, hParentKey, ulMigTicketLength,

952

rgbMigTicket, pulRandomLength, prgbRandom,

953

pulMigrationBlobLength, prgbMigrationBlob);

954

955

return TSPERR(TSS_E_INVALID_HANDLE);

956

}

957

958

TSS_RESULT

959

Tspi_Key_ConvertMigrationBlob(TSS_HKEY hKeyToMigrate, /* in */

960

TSS_HKEY hParentKey, /* in */

961

UINT32 ulRandomLength, /* in */

962

BYTE * rgbRandom, /* in */

963

UINT32 ulMigrationBlobLength, /* in */

964

BYTE * rgbMigrationBlob) /* in */

965

{

966

967

TCPA_RESULT result;

968

UINT32 outDataSize;

969

BYTE *outData;

970

TCS_KEY_HANDLE parentHandle;

971

TPM_AUTH parentAuth;

972

TSS_HPOLICY hParentPolicy;

973

UINT64 offset;

974

BYTE hashblob[0x1000];

975

TCPA_DIGEST digest;

976

TSS_BOOL useAuth;

977

TPM_AUTH *pParentAuth;

978

TSS_HCONTEXT tspContext;

979

980

if ((result = obj_rsakey_get_tsp_context(hKeyToMigrate, &tspContext)))

981

return result;

982

983

if (!obj_is_rsakey(hParentKey))

984

return TSPERR(TSS_E_INVALID_HANDLE);

985

986

/* Get the parent key handle */

987

if ((result = obj_rsakey_get_tcs_handle(hParentKey, &parentHandle)))

988

return result;

989

990

/* Get the policy */

991

if ((result = obj_rsakey_get_policy(hParentKey, TSS_POLICY_USAGE,

992

&hParentPolicy, &useAuth)))

993

return result;

994

995

/* Generate the authorization */

996

offset = 0;

997

Trspi_LoadBlob_UINT32(&offset, TPM_ORD_ConvertMigrationBlob, hashblob);

998

Trspi_LoadBlob_UINT32(&offset, ulMigrationBlobLength, hashblob);

999

Trspi_LoadBlob(&offset, ulMigrationBlobLength, hashblob, rgbMigrationBlob);

1000

Trspi_LoadBlob_UINT32(&offset, ulRandomLength, hashblob);

1001

Trspi_LoadBlob(&offset, ulRandomLength, hashblob, rgbRandom);

1002

Trspi_Hash(TSS_HASH_SHA1, offset, hashblob, digest.digest);

1003

1004

if (useAuth) {

1005

if ((result = secret_PerformAuth_OIAP(hParentPolicy,

1006

TPM_ORD_ConvertMigrationBlob,

1007

hParentPolicy, &digest,

1008

&parentAuth)))

1009

return result;

1010

pParentAuth = &parentAuth;

1011

} else {

1012

pParentAuth = NULL;

1013

}

1014

1015

if ((result = TCSP_ConvertMigrationBlob(tspContext, parentHandle, ulMigrationBlobLength,

1016

rgbMigrationBlob, ulRandomLength, rgbRandom,

1017

pParentAuth, &outDataSize, &outData)))

1018

return result;

1019

1020

/* add validation */

1021

offset = 0;

1022

Trspi_LoadBlob_UINT32(&offset, result, hashblob);

1023

Trspi_LoadBlob_UINT32(&offset, TPM_ORD_ConvertMigrationBlob, hashblob);

1024

Trspi_LoadBlob_UINT32(&offset, outDataSize, hashblob);

1025

Trspi_LoadBlob(&offset, outDataSize, hashblob, outData);

1026

Trspi_Hash(TSS_HASH_SHA1, offset, hashblob, digest.digest);

1027

if (useAuth) {

1028

if ((result = obj_policy_validate_auth_oiap(hParentPolicy, &digest, &parentAuth))) {

1029

free(outData);

1030

return result;

1031

}

1032

}

1033

1034

result = obj_rsakey_set_privkey(hKeyToMigrate, TRUE, outDataSize, outData);

1035

free(outData);

1036

1037

return result;

1038

}

Older »