~ubuntu-branches/ubuntu/hardy/trousers/hardy-proposed

Committer: Bazaar Package Importer
Author(s): Daniel Baumann
Date: 2008-01-23 22:03:00 UTC
mfrom: (1.1.1 upstream)
Revision ID: james.westby@ubuntu.com-20080123220300-fhtqja3c0oq0gp6z

Tags: 0.3.1-4

http://bugs.debian.org/457400

http://bugs.debian.org/459682

* Added patch from Aaron M. Ucko <ucko@debian.org> to allow trousers to
  build successfully on amd64, and presumably also other 64-bit
  architectures (Closes: #457400).
* Including udev rule for /dev/tpm from William Lima
  <wlima.amadeus@gmail.com> as suggested by David Smith <dds@google.com>
  (Closes: #459682).
* Added lintian overrides.

files added:
debian/TODO

debian/config

debian/config/45-trousers.rules

debian/libtspi-dev.docs

debian/lintian

debian/lintian/libtspi1

debian/lintian/trousers

debian/patches/01-tss-user.dpatch

debian/patches/02-manapge.dpatch

debian/patches/03-readme.dpatch

debian/patches/04-64bit-cleanliness.dpatch

debian/trousers.examples

man/man3/Tspi_Context_GetRegisteredKeysByUUID2.3

man/man3/Tspi_DAA_IssueCredential.3

man/man3/Tspi_DAA_IssueInit.3

man/man3/Tspi_DAA_IssueSetup.3

man/man3/Tspi_DAA_IssuerKeyVerification.3

man/man3/Tspi_DAA_VerifyInit.3

man/man3/Tspi_DAA_VerifySignature.3

man/man3/Tspi_DecodeBER_TssBlob.3

man/man3/Tspi_EncodeDER_TssBlob.3

man/man3/Tspi_TPM_DAA_JoinCreateDaaPubKey.3

man/man3/Tspi_TPM_DAA_JoinInit.3

man/man3/Tspi_TPM_DAA_JoinStoreCredential.3

man/man3/Tspi_TPM_DAA_Sign.3

man/man3/Tspi_TPM_GetAuditDigest.3

man/man3/Tspi_TPM_OwnerGetSRKPubKey.3

man/man3/Tspi_TPM_Quote2.3

src/include/authsess.h

src/include/obj_context.h

src/include/obj_daa.h

src/include/obj_delfamily.h

src/include/obj_encdata.h

src/include/obj_hash.h

src/include/obj_migdata.h

src/include/obj_nv.h

src/include/obj_pcrs.h

src/include/obj_policy.h

src/include/obj_rsakey.h

src/include/obj_tpm.h

src/include/rpc_tcstp.h

src/include/rpc_tcstp_tcs.h

src/include/rpc_tcstp_tsp.h

src/include/tcs_aik.h

src/include/tcs_context.h

src/include/tcs_key_ps.h

src/include/threads.h

src/include/tsp_audit.h

src/include/tsp_delegate.h

src/include/tsp_seal.h

src/include/tss/TSP.idl

src/include/tss/compat11b.h

src/include/tss/tcs.h

src/include/tss/tcs_defines.h

src/include/tss/tpm.h

src/include/tss/tpm_error.h

src/include/tss/tpm_ordinal.h

src/tcs/crypto

src/tcs/crypto/openssl

src/tcs/crypto/openssl/crypto.c

src/tcs/rpc

src/tcs/rpc/tcstp

src/tcs/rpc/tcstp/rpc.c

src/tcs/rpc/tcstp/rpc_admin.c

src/tcs/rpc/tcstp/rpc_aik.c

src/tcs/rpc/tcstp/rpc_audit.c

src/tcs/rpc/tcstp/rpc_auth.c

src/tcs/rpc/tcstp/rpc_bind.c

src/tcs/rpc/tcstp/rpc_caps.c

src/tcs/rpc/tcstp/rpc_caps_tpm.c

src/tcs/rpc/tcstp/rpc_certify.c

src/tcs/rpc/tcstp/rpc_changeauth.c

src/tcs/rpc/tcstp/rpc_cmk.c

src/tcs/rpc/tcstp/rpc_context.c

src/tcs/rpc/tcstp/rpc_counter.c

src/tcs/rpc/tcstp/rpc_daa.c

src/tcs/rpc/tcstp/rpc_delegate.c

src/tcs/rpc/tcstp/rpc_dir.c

src/tcs/rpc/tcstp/rpc_ek.c

src/tcs/rpc/tcstp/rpc_evlog.c

src/tcs/rpc/tcstp/rpc_key.c

src/tcs/rpc/tcstp/rpc_maint.c

src/tcs/rpc/tcstp/rpc_migration.c

src/tcs/rpc/tcstp/rpc_nv.c

src/tcs/rpc/tcstp/rpc_oper.c

src/tcs/rpc/tcstp/rpc_own.c

src/tcs/rpc/tcstp/rpc_pcr_extend.c

src/tcs/rpc/tcstp/rpc_ps.c

src/tcs/rpc/tcstp/rpc_quote.c

src/tcs/rpc/tcstp/rpc_quote2.c

src/tcs/rpc/tcstp/rpc_random.c

src/tcs/rpc/tcstp/rpc_seal.c

src/tcs/rpc/tcstp/rpc_selftest.c

src/tcs/rpc/tcstp/rpc_sign.c

src/tcs/rpc/tcstp/rpc_tick.c

src/tcs/rpc/tcstp/rpc_transport.c

src/tcs/tcs_aik.c

src/tcs/tcs_auth_mgr.c

src/tcs/tcs_caps.c

src/tcs/tcs_context.c

src/tcs/tcs_context_key.c

src/tcs/tcs_counter.c

src/tcs/tcs_evlog.c

src/tcs/tcs_evlog_biosem.c

src/tcs/tcs_evlog_imaem.c

src/tcs/tcs_key.c

src/tcs/tcs_key_mem_cache.c

src/tcs/tcs_key_ps.c

src/tcs/tcs_migration.c

src/tcs/tcs_pbg.c

src/tcs/tcs_ps.c

src/tcs/tcs_quote.c

src/tcs/tcs_quote2.c

src/tcs/tcs_req_mgr.c

src/tcs/tcs_seal.c

src/tcs/tcsi_admin.c

src/tcs/tcsi_aik.c

src/tcs/tcsi_audit.c

src/tcs/tcsi_auth.c

src/tcs/tcsi_bind.c

src/tcs/tcsi_caps.c

src/tcs/tcsi_caps_tpm.c

src/tcs/tcsi_certify.c

src/tcs/tcsi_changeauth.c

src/tcs/tcsi_cmk.c

src/tcs/tcsi_context.c

src/tcs/tcsi_counter.c

src/tcs/tcsi_daa.c

src/tcs/tcsi_delegate.c

src/tcs/tcsi_dir.c

src/tcs/tcsi_ek.c

src/tcs/tcsi_evlog.c

src/tcs/tcsi_key.c

src/tcs/tcsi_maint.c

src/tcs/tcsi_migration.c

src/tcs/tcsi_nv.c

src/tcs/tcsi_oper.c

src/tcs/tcsi_own.c

src/tcs/tcsi_pcr.c

src/tcs/tcsi_ps.c

src/tcs/tcsi_quote.c

src/tcs/tcsi_quote2.c

src/tcs/tcsi_random.c

src/tcs/tcsi_seal.c

src/tcs/tcsi_selftest.c

src/tcs/tcsi_sign.c

src/tcs/tcsi_tick.c

src/tcs/tcsi_transport.c

src/trspi/crypto/openssl/hash.c

src/trspi/crypto/openssl/rsa.c

src/trspi/crypto/openssl/symmetric.c

src/tspi/obj_daa.c

src/tspi/obj_delfamily.c

src/tspi/obj_migdata.c

src/tspi/obj_nv.c

src/tspi/rpc

src/tspi/rpc/hosttable.c

src/tspi/rpc/tcs_api.c

src/tspi/rpc/tcstp

src/tspi/rpc/tcstp/rpc.c

src/tspi/rpc/tcstp/rpc_admin.c

src/tspi/rpc/tcstp/rpc_aik.c

src/tspi/rpc/tcstp/rpc_audit.c

src/tspi/rpc/tcstp/rpc_auth.c

src/tspi/rpc/tcstp/rpc_bind.c

src/tspi/rpc/tcstp/rpc_caps.c

src/tspi/rpc/tcstp/rpc_caps_tpm.c

src/tspi/rpc/tcstp/rpc_certify.c

src/tspi/rpc/tcstp/rpc_changeauth.c

src/tspi/rpc/tcstp/rpc_cmk.c

src/tspi/rpc/tcstp/rpc_context.c

src/tspi/rpc/tcstp/rpc_counter.c

src/tspi/rpc/tcstp/rpc_daa.c

src/tspi/rpc/tcstp/rpc_delegate.c

src/tspi/rpc/tcstp/rpc_dir.c

src/tspi/rpc/tcstp/rpc_ek.c

src/tspi/rpc/tcstp/rpc_evlog.c

src/tspi/rpc/tcstp/rpc_key.c

src/tspi/rpc/tcstp/rpc_maint.c

src/tspi/rpc/tcstp/rpc_migration.c

src/tspi/rpc/tcstp/rpc_nv.c

src/tspi/rpc/tcstp/rpc_oper.c

src/tspi/rpc/tcstp/rpc_own.c

src/tspi/rpc/tcstp/rpc_pcr_extend.c

src/tspi/rpc/tcstp/rpc_ps.c

src/tspi/rpc/tcstp/rpc_quote.c

src/tspi/rpc/tcstp/rpc_quote2.c

src/tspi/rpc/tcstp/rpc_random.c

src/tspi/rpc/tcstp/rpc_seal.c

src/tspi/rpc/tcstp/rpc_selftest.c

src/tspi/rpc/tcstp/rpc_sign.c

src/tspi/rpc/tcstp/rpc_tick.c

src/tspi/rpc/tcstp/rpc_transport.c

src/tspi/tsp_admin.c

src/tspi/tsp_aik.c

src/tspi/tsp_asym.c

src/tspi/tsp_audit.c

src/tspi/tsp_auth.c

src/tspi/tsp_bind.c

src/tspi/tsp_caps.c

src/tspi/tsp_caps_tpm.c

src/tspi/tsp_certify.c

src/tspi/tsp_changeauth.c

src/tspi/tsp_context_mem.c

src/tspi/tsp_counter.c

src/tspi/tsp_daa.c

src/tspi/tsp_delegate.c

src/tspi/tsp_dir.c

src/tspi/tsp_ek.c

src/tspi/tsp_get_flags.c

src/tspi/tsp_key.c

src/tspi/tsp_maint.c

src/tspi/tsp_migration.c

src/tspi/tsp_nv.c

src/tspi/tsp_oper.c

src/tspi/tsp_own.c

src/tspi/tsp_pcr.c

src/tspi/tsp_pcr_extend.c

src/tspi/tsp_policy.c

src/tspi/tsp_ps.c

src/tspi/tsp_quote.c

src/tspi/tsp_quote2.c

src/tspi/tsp_random.c

src/tspi/tsp_seal.c

src/tspi/tsp_selftest.c

src/tspi/tsp_sign.c

src/tspi/tsp_tick.c

src/tspi/tsp_transport.c

src/tspi/tspi_admin.c

src/tspi/tspi_aik.c

src/tspi/tspi_asn1.c

src/tspi/tspi_audit.c

src/tspi/tspi_bind.c

src/tspi/tspi_caps.c

src/tspi/tspi_caps_tpm.c

src/tspi/tspi_certify.c

src/tspi/tspi_changeauth.c

src/tspi/tspi_cmk.c

src/tspi/tspi_context.c

src/tspi/tspi_counter.c

src/tspi/tspi_daa.c

src/tspi/tspi_delegate.c

src/tspi/tspi_dir.c

src/tspi/tspi_ek.c

src/tspi/tspi_getset.c

src/tspi/tspi_hash.c

src/tspi/tspi_key.c

src/tspi/tspi_maint.c

src/tspi/tspi_migration.c

src/tspi/tspi_nv.c

src/tspi/tspi_oper.c

src/tspi/tspi_own.c

src/tspi/tspi_pcr_comp.c

src/tspi/tspi_pcr_comp12.c

src/tspi/tspi_pcr_events.c

src/tspi/tspi_pcr_extend.c

src/tspi/tspi_policy.c

src/tspi/tspi_ps.c

src/tspi/tspi_quote.c

src/tspi/tspi_quote2.c

src/tspi/tspi_random.c

src/tspi/tspi_seal.c

src/tspi/tspi_selftest.c

src/tspi/tspi_sign.c

src/tspi/tspi_tick.c

src/tspi/tspi_transport.c

files removed:
autom4te.cache

autom4te.cache/output.0

autom4te.cache/output.1

autom4te.cache/requests

autom4te.cache/traces.0

autom4te.cache/traces.1

debian/45-trousers.rules

debian/patches/01_makefiles.diff

debian/patches/01_makefiles.dpatch

debian/patches/02_defaultgroup__tcsd.dpatch

debian/trousers.README.Debian

debian/trousers.default

debian/trousers.dirs

debian/watch

src/include/spi_internal_types.h

src/include/tcs_internal_types.h

src/include/trpctp.h

src/tcs/auth_mgr.c

src/tcs/biosem.c

src/tcs/cache.c

src/tcs/cxt.c

src/tcs/imaem.c

src/tcs/req_mgr.c

src/tcs/tcscm.c

src/tcs/tcsem.c

src/tcs/tcskcm.c

src/tcs/tcspbg.c

src/tcsd/tcsd_wrap.c

src/tcsd_api

src/tcsd_api/calltcsapi.c

src/tcsd_api/clntside.c

src/tcsd_api/hosttable.c

src/tcsd_api/tcstp.c

src/trspi/crypto/openssl/crypto.c

src/tspi/keyreg.c

src/tspi/memmgr.c

src/tspi/secrets.c

src/tspi/spi_context.c

src/tspi/spi_data.c

src/tspi/spi_getset.c

src/tspi/spi_hash.c

src/tspi/spi_key.c

src/tspi/spi_pcr.c

src/tspi/spi_policy.c

src/tspi/spi_tpm.c

files modified:
AUTHORS

ChangeLog

Makefile.in

README

config.guess

config.sub

configure

configure.in

debian/changelog

debian/control

debian/copyright

debian/libtspi-dev.install

debian/libtspi1.install

debian/patches/00list

debian/rules

debian/trousers.docs

debian/trousers.init

debian/trousers.install

debian/trousers.postinst

debian/trousers.postrm

dist/Makefile.in

dist/tcsd.conf.in

man/Makefile.in

man/man3/Makefile.am

man/man3/Makefile.in

man/man3/Tspi_Context_LoadKeyByUUID.3

man/man3/Tspi_TPM_GetPubEndorsementKey.3

man/man5/Makefile.in

man/man5/tcsd.conf.5.in

man/man8/Makefile.in

src/Makefile.in

src/include/Makefile.am

src/include/Makefile.in

src/include/auth_mgr.h

src/include/capabilities.h

src/include/hosttable.h

src/include/memmgr.h

src/include/obj.h

src/include/req_mgr.h

src/include/spi_utils.h

src/include/tcs_tsp.h

src/include/tcs_utils.h

src/include/tcsd.h

src/include/tcsd_ops.h

src/include/tcsd_wrap.h

src/include/tcsem.h

src/include/tcslog.h

src/include/tcsps.h

src/include/trousers/trousers.h

src/include/trousers/tss.h

src/include/trousers_types.h

src/include/tspps.h

src/include/tss/platform.h

src/include/tss/tcpa_defines.h

src/include/tss/tcpa_error.h

src/include/tss/tcpa_struct.h

src/include/tss/tcpa_typedef.h

src/include/tss/tcs_error.h

src/include/tss/tcs_structs.h

src/include/tss/tcs_typedef.h

src/include/tss/tddl_error.h

src/include/tss/tddlapi_error.h

src/include/tss/tddli.h

src/include/tss/tspi.h

src/include/tss/tss_defines.h

src/include/tss/tss_error.h

src/include/tss/tss_error_basics.h

src/include/tss/tss_structs.h

src/include/tss/tss_typedef.h

src/tcs/Makefile.am

src/tcs/Makefile.in

src/tcs/ps/ps_utils.c

src/tcs/ps/tcsps.c

src/tcs/tcs_utils.c

src/tcsd/Makefile.am

src/tcsd/Makefile.in

src/tcsd/platform.c

src/tcsd/svrside.c

src/tcsd/tcsd_conf.c

src/tcsd/tcsd_threads.c

src/tddl/Makefile.am

src/tddl/Makefile.in

src/trspi/Makefile.am

src/trspi/Makefile.in

src/trspi/trousers.c

src/tspi/Makefile.am

src/tspi/Makefile.in

src/tspi/obj.c

src/tspi/obj_context.c

src/tspi/obj_encdata.c

src/tspi/obj_hash.c

src/tspi/obj_pcrs.c

src/tspi/obj_policy.c

src/tspi/obj_rsakey.c

src/tspi/obj_tpm.c

src/tspi/ps/tspps.c

src/tspi/spi_utils.c

tools/Makefile.in

tools/ps_inspect.c

Show diffs side-by-side

added added

removed removed

src/tspi/spi_tpm.c

* Licensed Materials - Property of IBM

* trousers - An open source TCG Software Stack

* (C) Copyright International Business Machines Corp. 2004-2006

#include <stdlib.h>

#include <stdio.h>

#include <string.h>

#include <inttypes.h>

#include "trousers/tss.h"

#include "trousers/trousers.h"

#include "spi_internal_types.h"

#include "spi_utils.h"

#include "capabilities.h"

#include "tsplog.h"

#include "obj.h"

TSS_RESULT

Tspi_TPM_CreateEndorsementKey(TSS_HTPM hTPM, /* in */

TSS_HKEY hKey, /* in */

TSS_VALIDATION * pValidationData) /* in, out */

{

TCPA_NONCE antiReplay;

TCPA_DIGEST digest;

TSS_RESULT result;

UINT32 ekSize;

BYTE *ek;

TCPA_KEY dummyKey;

UINT64 offset;

TCPA_DIGEST hash;

BYTE hashBlob[1024];

UINT32 newEKSize;

BYTE *newEK;

TSS_HCONTEXT tspContext;

TCPA_PUBKEY pubEK;

memset(&pubEK, 0, sizeof(TCPA_PUBKEY));

memset(&dummyKey, 0, sizeof(TCPA_KEY));

if ((result = obj_tpm_get_tsp_context(hTPM, &tspContext)))

return result;

if ((result = obj_rsakey_get_blob(hKey, &ekSize, &ek)))

return result;

offset = 0;

if ((result = Trspi_UnloadBlob_KEY(&offset, ek, &dummyKey)))

return result;

offset = 0;

Trspi_LoadBlob_KEY_PARMS(&offset, ek, &dummyKey.algorithmParms);

free_key_refs(&dummyKey);

ekSize = offset;

if (pValidationData == NULL) {

if ((result = internal_GetRandomNonce(tspContext, &antiReplay))) {

LogError("Failed to create random nonce");

return TSPERR(TSS_E_INTERNAL_ERROR);

}

} else {

if (pValidationData->ulExternalDataLength < sizeof(antiReplay.nonce))

return TSPERR(TSS_E_BAD_PARAMETER);

memcpy(antiReplay.nonce, pValidationData->rgbExternalData,

sizeof(antiReplay.nonce));

}

if ((result = TCSP_CreateEndorsementKeyPair(tspContext, antiReplay, ekSize, ek, &newEKSize,

&newEK, &digest)))

return result;

if (pValidationData == NULL) {

offset = 0;

Trspi_LoadBlob(&offset, newEKSize, hashBlob, newEK);

Trspi_LoadBlob(&offset, 20, hashBlob, antiReplay.nonce);

Trspi_Hash(TSS_HASH_SHA1, offset, hashBlob, hash.digest);

if (memcmp(hash.digest, digest.digest, TCPA_SHA1_160_HASH_LEN)) {

LogError("Internal verification failed");

return TSPERR(TSS_E_INTERNAL_ERROR);

}

} else {

pValidationData->rgbData = calloc_tspi(tspContext, newEKSize);

if (pValidationData->rgbData == NULL) {

LogError("malloc of %u bytes failed.", newEKSize);

return TSPERR(TSS_E_OUTOFMEMORY);

}

pValidationData->ulDataLength = newEKSize;

memcpy(pValidationData->rgbData, newEK, newEKSize);

memcpy(&pValidationData->rgbData[ekSize], antiReplay.nonce,

sizeof(antiReplay.nonce));

100

pValidationData->rgbValidationData = calloc_tspi(tspContext,

101

TCPA_SHA1_160_HASH_LEN);

102

if (pValidationData->rgbValidationData == NULL) {

103

LogError("malloc of %d bytes failed.", TCPA_SHA1_160_HASH_LEN);

104

free_tspi(tspContext, pValidationData->rgbData);

105

pValidationData->rgbData = NULL;

106

pValidationData->ulDataLength = 0;

107

return TSPERR(TSS_E_OUTOFMEMORY);

108

}

109

pValidationData->ulValidationDataLength = TCPA_SHA1_160_HASH_LEN;

110

memcpy(pValidationData->rgbValidationData, digest.digest, TCPA_SHA1_160_HASH_LEN);

111

}

112

113

if ((result = obj_rsakey_set_pubkey(hKey, FALSE, newEK)) && pValidationData) {

114

free_tspi(tspContext, pValidationData->rgbValidationData);

115

free_tspi(tspContext, pValidationData->rgbData);

116

pValidationData->rgbData = NULL;

117

pValidationData->ulDataLength = 0;

118

pValidationData->rgbValidationData = NULL;

119

pValidationData->ulValidationDataLength = 0;

120

}

121

122

free(newEK);

123

124

return result;

125

}

126

127

TSS_RESULT

128

Tspi_TPM_GetPubEndorsementKey(TSS_HTPM hTPM, /* in */

129

TSS_BOOL fOwnerAuthorized, /* in */

130

TSS_VALIDATION *pValidationData, /* in, out */

131

TSS_HKEY *phEndorsementPubKey) /* out */

132

{

133

TCPA_DIGEST digest;

134

TSS_RESULT result;

135

TPM_AUTH ownerAuth;

136

UINT64 offset;

137

BYTE hashblob[1000];

138

TSS_HPOLICY hPolicy;

139

UINT32 pubEKSize;

140

BYTE *pubEK;

141

TCPA_NONCE antiReplay;

142

TCPA_DIGEST checkSum;

143

TSS_HOBJECT retKey;

144

TSS_HCONTEXT tspContext;

145

TCPA_PUBKEY pubKey;

146

147

memset(&pubKey, 0, sizeof(TCPA_PUBKEY));

148

149

if (phEndorsementPubKey == NULL)

150

return TSPERR(TSS_E_BAD_PARAMETER);

151

152

if ((result = obj_tpm_get_tsp_context(hTPM, &tspContext)))

153

return result;

154

155

if (fOwnerAuthorized) {

156

if ((result = obj_tpm_get_policy(hTPM, &hPolicy)))

157

return result;

158

159

offset = 0;

160

Trspi_LoadBlob_UINT32(&offset, TPM_ORD_OwnerReadPubek, hashblob);

161

Trspi_Hash(TSS_HASH_SHA1, offset, hashblob, digest.digest);

162

163

if ((result = secret_PerformAuth_OIAP(hTPM, TPM_ORD_OwnerReadPubek,

164

hPolicy, &digest,

165

&ownerAuth)))

166

return result;

167

168

if ((result = TCSP_OwnerReadPubek(tspContext, &ownerAuth, &pubEKSize, &pubEK)))

169

return result;

170

171

offset = 0;

172

Trspi_LoadBlob_UINT32(&offset, result, hashblob);

173

Trspi_LoadBlob_UINT32(&offset, TPM_ORD_OwnerReadPubek, hashblob);

174

Trspi_LoadBlob(&offset, pubEKSize, hashblob, pubEK);

175

Trspi_Hash(TSS_HASH_SHA1, offset, hashblob, digest.digest);

176

177

if ((result = obj_policy_validate_auth_oiap(hPolicy, &digest, &ownerAuth)))

178

goto done;

179

} else {

180

if (pValidationData == NULL) {

181

if ((result = internal_GetRandomNonce(tspContext, &antiReplay))) {

182

LogDebug("Failed to generate random nonce");

183

return TSPERR(TSS_E_INTERNAL_ERROR);

184

}

185

} else {

186

if (pValidationData->ulExternalDataLength < sizeof(antiReplay.nonce))

187

return TSPERR(TSS_E_BAD_PARAMETER);

188

189

memcpy(antiReplay.nonce, pValidationData->rgbExternalData,

190

sizeof(antiReplay.nonce));

191

}

192

193

/* call down to the TPM */

194

if ((result = TCSP_ReadPubek(tspContext, antiReplay, &pubEKSize, &pubEK,

195

&checkSum)))

196

return result;

197

198

/* validate the returned hash, or set up the return so that the user can */

199

if (pValidationData == NULL) {

200

offset = 0;

201

Trspi_LoadBlob(&offset, pubEKSize, hashblob, pubEK);

202

Trspi_LoadBlob(&offset, TCPA_SHA1_160_HASH_LEN, hashblob, antiReplay.nonce);

203

Trspi_Hash(TSS_HASH_SHA1, offset, hashblob, digest.digest);

204

205

/* check validation of the entire pubkey structure */

206

if (memcmp(digest.digest, checkSum.digest, TCPA_SHA1_160_HASH_LEN)) {

207

/* validation failed, unload the pubEK in order to hash

208

* just the pubKey portion of the pubEK. This is done on

209

* Atmel chips specifically.

210

211

offset = 0;

212

memset(&pubKey, 0, sizeof(TCPA_PUBKEY));

213

if ((result = Trspi_UnloadBlob_PUBKEY(&offset, pubEK, &pubKey)))

214

goto done;

215

216

offset = 0;

217

Trspi_LoadBlob(&offset, pubKey.pubKey.keyLength, hashblob,

218

pubKey.pubKey.key);

219

Trspi_LoadBlob(&offset, TCPA_SHA1_160_HASH_LEN, hashblob,

220

antiReplay.nonce);

221

Trspi_Hash(TSS_HASH_SHA1, offset, hashblob, digest.digest);

222

223

if (memcmp(digest.digest, checkSum.digest,

224

TCPA_SHA1_160_HASH_LEN)) {

225

result = TSPERR(TSS_E_VALIDATION_FAILED);

226

goto done;

227

}

228

}

229

} else {

230

/* validate the entire TCPA_PUBKEY structure */

231

pValidationData->ulDataLength = pubEKSize + TCPA_SHA1_160_HASH_LEN;

232

pValidationData->rgbData = calloc_tspi(tspContext,

233

pValidationData->ulDataLength);

234

if (pValidationData->rgbData == NULL) {

235

LogError("malloc of %u bytes failed.",

236

pValidationData->ulDataLength);

237

pValidationData->ulDataLength = 0;

238

return TSPERR(TSS_E_OUTOFMEMORY);

239

}

240

241

memcpy(pValidationData->rgbData, pubEK, pubEKSize);

242

memcpy(&pValidationData->rgbData[pubEKSize], antiReplay.nonce,

243

TCPA_SHA1_160_HASH_LEN);

244

245

pValidationData->ulValidationDataLength = TCPA_SHA1_160_HASH_LEN;

246

pValidationData->rgbValidationData = calloc_tspi(tspContext,

247

TCPA_SHA1_160_HASH_LEN);

248

if (pValidationData->rgbValidationData == NULL) {

249

LogError("malloc of %d bytes failed.", TCPA_SHA1_160_HASH_LEN);

250

pValidationData->ulValidationDataLength = 0;

251

pValidationData->ulDataLength = 0;

252

free_tspi(tspContext,pValidationData->rgbData);

253

result = TSPERR(TSS_E_OUTOFMEMORY);

254

goto done;

255

}

256

257

memcpy(pValidationData->rgbValidationData, checkSum.digest,

258

TCPA_SHA1_160_HASH_LEN);

259

}

260

}

261

262

if ((result = obj_rsakey_add(tspContext,

263

TSS_KEY_SIZE_2048|TSS_KEY_TYPE_LEGACY,

264

&retKey)))

265

return result;

266

267

if ((result = obj_rsakey_set_pubkey(retKey, FALSE, pubEK)))

268

goto done;

269

270

*phEndorsementPubKey = retKey;

271

272

done:

273

free(pubEK);

274

return result;

275

}

276

277

TSS_RESULT

278

Tspi_TPM_TakeOwnership(TSS_HTPM hTPM, /* in */

279

TSS_HKEY hKeySRK, /* in */

280

TSS_HKEY hEndorsementPubKey) /* in */

281

{

282

TPM_AUTH privAuth;

283

TSS_HCONTEXT tspContext;

284

BYTE encOwnerAuth[256];

285

UINT32 encOwnerAuthLength;

286

BYTE encSRKAuth[256];

287

UINT32 encSRKAuthLength;

288

UINT64 offset;

289

290

BYTE hashblob[1024];

291

TCPA_DIGEST digest;

292

TSS_RESULT result;

293

UINT32 srkKeyBlobLength;

294

BYTE *srkKeyBlob;

295

TSS_HPOLICY hOwnerPolicy;

296

UINT32 newSrkBlobSize;

297

BYTE *newSrkBlob = NULL;

298

BYTE oldAuthDataUsage;

299

TSS_HKEY hPubEK;

300

301

/* The first step is to get context and to get the SRK Key Blob.

302

* If these succeed, then the auth should be init'd. */

303

304

if (hEndorsementPubKey == NULL_HKEY) {

305

if ((result = Tspi_TPM_GetPubEndorsementKey(hTPM, FALSE, NULL, &hPubEK))) {

306

return result;

307

}

308

} else {

309

hPubEK = hEndorsementPubKey;

310

}

311

312

if ((result = obj_tpm_get_tsp_context(hTPM, &tspContext)))

313

return result;

314

315

/* Get the srkKeyData */

316

if ((result = obj_rsakey_get_blob(hKeySRK, &srkKeyBlobLength, &srkKeyBlob)))

317

return result;

318

319

/* Need to check for Atmel bug where authDataUsage is changed */

320

oldAuthDataUsage = srkKeyBlob[10];

321

LogDebug("oldAuthDataUsage is %.2X. Wait to see if it changes", oldAuthDataUsage);

322

323

/* Now call the module that will encrypt the secrets. This

324

* will either get the secrets from the policy objects or

325

* use the callback function to encrypt the secrets */

326

327

if ((result = secret_TakeOwnership(hPubEK,

328

hTPM,

329

hKeySRK,

330

&privAuth,

331

&encOwnerAuthLength,

332

encOwnerAuth,

333

&encSRKAuthLength,

334

encSRKAuth)))

335

return result;

336

337

/* Now, take ownership is ready to call. The auth structure should be complete

338

* and the encrypted data structures should be ready */

339

340

if ((result = TCSP_TakeOwnership(tspContext, TCPA_PID_OWNER, encOwnerAuthLength,

341

encOwnerAuth, encSRKAuthLength, encSRKAuth,

342

srkKeyBlobLength, srkKeyBlob, &privAuth, &newSrkBlobSize,

343

&newSrkBlob)))

344

return result;

345

346

/* The final step is to validate the return Auth */

347

348

offset = 0;

349

Trspi_LoadBlob_UINT32(&offset, result, hashblob);

350

Trspi_LoadBlob_UINT32(&offset, TPM_ORD_TakeOwnership, hashblob);

351

Trspi_LoadBlob(&offset, newSrkBlobSize, hashblob, newSrkBlob);

352

Trspi_Hash(TSS_HASH_SHA1, offset, hashblob, digest.digest);

353

354

if ((result = obj_tpm_get_policy(hTPM, &hOwnerPolicy))) {

355

free(newSrkBlob);

356

return result;

357

}

358

if ((result = obj_policy_validate_auth_oiap(hOwnerPolicy, &digest, &privAuth))) {

359

free(newSrkBlob);

360

return result;

361

}

362

363

/* Now that it's all happy, stuff the keyBlob into the object

364

* If atmel, need to adjust the authDataUsage if it changed */

365

if (oldAuthDataUsage != newSrkBlob[10]) { /* hardcoded blob stuff */

366

LogDebug("auth data usage changed. Atmel bug. Fixing in key object");

367

newSrkBlob[10] = oldAuthDataUsage; /* this will fix it */

368

}

369

370

result = obj_rsakey_set_tcpakey(hKeySRK, newSrkBlobSize, newSrkBlob);

371

free(newSrkBlob);

372

373

if (result)

374

return result;

375

376

/* The SRK is loaded at this point, so insert it into the key handle list */

377

return obj_rsakey_set_tcs_handle(hKeySRK, TPM_KEYHND_SRK);

378

}

379

380

TSS_RESULT

381

Tspi_TPM_CollateIdentityRequest(TSS_HTPM hTPM, /* in */

382

TSS_HKEY hKeySRK, /* in */

383

TSS_HKEY hCAPubKey, /* in */

384

UINT32 ulIdentityLabelLength, /* in */

385

BYTE * rgbIdentityLabelData, /* in */

386

TSS_HKEY hIdentityKey, /* in */

387

TSS_ALGORITHM_ID algID, /* in */

388

UINT32 * pulTcpaIdentityReqLength, /* out */

389

BYTE ** prgbTcpaIdentityReq) /* out */

390

{

391

TCPA_ENCAUTH encAuthUsage;

392

TCPA_ENCAUTH encAuthMig;

393

BYTE sharedSecret[20];

394

TPM_AUTH srkAuth, ownerAuth;

395

TCPA_RESULT result;

396

UINT64 offset;

397

BYTE hashblob[USHRT_MAX], idReqBlob[USHRT_MAX], testblob[USHRT_MAX];

398

TCPA_DIGEST digest;

399

TSS_HPOLICY hSRKPolicy, hIDPolicy, hCAPolicy, hTPMPolicy;

400

UINT32 caKeyBlobSize, idKeySize, idPubSize;

401

BYTE *caKeyBlob, *idKey, *newIdKey, *idPub;

402

TCPA_NONCE nonceEvenOSAP;

403

TCPA_KEY caKey;

404

TCPA_CHOSENID_HASH chosenIDHash = { { 0, } };

405

UINT32 pcIdentityBindingSize;

406

BYTE *prgbIdentityBinding = NULL;

407

UINT32 pcEndorsementCredentialSize;

408

BYTE *prgbEndorsementCredential = NULL;

409

UINT32 pcPlatformCredentialSize;

410

BYTE *prgbPlatformCredential = NULL;

411

UINT32 pcConformanceCredentialSize;

412

BYTE *prgbConformanceCredential = NULL;

413

#define CHOSENID_BLOB_SIZE 2048

414

BYTE chosenIDBlob[CHOSENID_BLOB_SIZE];

415

TSS_HCONTEXT tspContext;

416

UINT32 encSymKeySize = 256, tmp;

417

BYTE encSymKey[256], *cb_var;

418

TSS_BOOL usesAuth;

419

TPM_AUTH *pSrkAuth = &srkAuth;

420

TCPA_IDENTITY_REQ rgbTcpaIdentityReq;

421

TCPA_KEY_PARMS symParms, asymParms;

422

TCPA_SYMMETRIC_KEY symKey;

423

int padding;

424

TSS_CALLBACK *cb;

425

426

if (pulTcpaIdentityReqLength == NULL || prgbTcpaIdentityReq == NULL)

427

return TSPERR(TSS_E_BAD_PARAMETER);

428

429

if ((result = obj_tpm_get_tsp_context(hTPM, &tspContext)))

430

return result;

431

432

if ((result = obj_tpm_get_cb12(hTPM, TSS_TSPATTRIB_TPM_CALLBACK_COLLATEIDENTITY, &tmp,

433

&cb_var)))

434

return result;

435

436

cb = (TSS_CALLBACK *)cb_var;

437

if (cb->callback == NULL) {

438

free_tspi(tspContext, cb);

439

cb = NULL;

440

}

441

442

/* Get Policies */

443

if ((result = obj_rsakey_get_policy(hKeySRK, TSS_POLICY_USAGE,

444

&hSRKPolicy, &usesAuth)))

445

return result;

446

447

if ((result = obj_tpm_get_policy(hTPM, &hTPMPolicy)))

448

return result;

449

450

if ((result = obj_rsakey_get_policy(hCAPubKey, TSS_POLICY_USAGE,

451

&hCAPolicy, NULL)))

452

return result;

453

454

if ((result = obj_rsakey_get_policy(hIdentityKey, TSS_POLICY_USAGE,

455

&hIDPolicy, NULL)))

456

return result;

457

458

/* setup the symmetric key's parms. */

459

memset(&symParms, 0, sizeof(TCPA_KEY_PARMS));

460

switch (algID) {

461

case TSS_ALG_AES:

462

symParms.algorithmID = TCPA_ALG_AES;

463

symKey.algId = TCPA_ALG_AES;

464

symKey.size = 128/8;

465

break;

466

case TSS_ALG_DES:

467

symParms.algorithmID = TCPA_ALG_DES;

468

symKey.algId = TCPA_ALG_DES;

469

symKey.size = 64/8;

470

break;

471

case TSS_ALG_3DES:

472

symParms.algorithmID = TCPA_ALG_3DES;

473

symKey.algId = TCPA_ALG_3DES;

474

symKey.size = 192/8;

475

break;

476

default:

477

result = TSPERR(TSS_E_BAD_PARAMETER);

478

goto error;

479

break;

480

}

481

482

/* No symmetric key encryption schemes existed in the 1.1 time frame */

483

symParms.encScheme = TCPA_ES_NONE;

484

485

/* get the CA Pubkey's encryption scheme */

486

if ((result = obj_rsakey_get_es(hCAPubKey, &tmp)))

487

return TSPERR(TSS_E_BAD_PARAMETER);

488

489

switch (tmp) {

490

case TSS_ES_RSAESPKCSV15:

491

padding = TR_RSA_PKCS1_PADDING;

492

break;

493

case TSS_ES_RSAESOAEP_SHA1_MGF1:

494

padding = TR_RSA_PKCS1_OAEP_PADDING;

495

break;

496

case TSS_ES_NONE:

497

/* fall through */

498

default:

499

padding = TR_RSA_NO_PADDING;

500

break;

501

}

502

503

/* Get Key blobs */

504

if ((result = obj_rsakey_get_blob(hIdentityKey, &idKeySize, &idKey)))

505

return result;

506

507

if ((result = obj_rsakey_get_blob(hCAPubKey, &caKeyBlobSize, &caKeyBlob)))

508

return result;

509

510

offset = 0;

511

memset(&caKey, 0, sizeof(TCPA_KEY));

512

if ((result = Trspi_UnloadBlob_KEY(&offset, caKeyBlob, &caKey)))

513

return result;

514

515

/* ChosenID hash = SHA1(label || TCPA_PUBKEY(CApub)) */

516

offset = 0;

517

Trspi_LoadBlob(&offset, ulIdentityLabelLength, chosenIDBlob, rgbIdentityLabelData);

518

Trspi_LoadBlob_KEY_PARMS(&offset, chosenIDBlob, &caKey.algorithmParms);

519

Trspi_LoadBlob_STORE_PUBKEY(&offset, chosenIDBlob, &caKey.pubKey);

520

521

if (offset > CHOSENID_BLOB_SIZE)

522

return TSPERR(TSS_E_INTERNAL_ERROR);

523

524

if ((result = Trspi_Hash(TSS_HASH_SHA1, offset, chosenIDBlob, chosenIDHash.digest))) {

525

free_key_refs(&caKey);

526

return result;

527

}

528

529

/* use chosenIDBlob temporarily */

530

offset = 0;

531

Trspi_LoadBlob_KEY_PARMS(&offset, chosenIDBlob, &caKey.algorithmParms);

532

533

offset = 0;

534

if ((result = Trspi_UnloadBlob_KEY_PARMS(&offset, chosenIDBlob, &asymParms)))

535

return result;

536

537

if ((result = secret_PerformXOR_OSAP(hTPMPolicy, hIDPolicy,

538

NULL_HPOLICY, hTPM, TCPA_ET_OWNER,

539

TPM_KEYHND_SRK, &encAuthUsage,

540

&encAuthMig, sharedSecret,

541

&ownerAuth, &nonceEvenOSAP)))

542

return result;

543

544

/* Hash the Auth data */

545

offset = 0;

546

Trspi_LoadBlob_UINT32(&offset, TPM_ORD_MakeIdentity, hashblob);

547

Trspi_LoadBlob(&offset, 20, hashblob, encAuthUsage.authdata);

548

Trspi_LoadBlob(&offset, 20, hashblob, chosenIDHash.digest);

549

Trspi_LoadBlob(&offset, idKeySize, hashblob, idKey);

550

Trspi_Hash(TSS_HASH_SHA1, offset, hashblob, digest.digest);

551

552

/* Do the Auth's */

553

if (usesAuth) {

554

if ((result = secret_PerformAuth_OIAP(hKeySRK,

555

TPM_ORD_MakeIdentity,

556

hSRKPolicy, &digest,

557

&srkAuth)))

558

return result;

559

pSrkAuth = &srkAuth;

560

} else {

561

pSrkAuth = NULL;

562

}

563

564

if ((result = secret_PerformAuth_OSAP(hTPM, TPM_ORD_MakeIdentity,

565

hTPMPolicy, hIDPolicy,

566

NULL_HPOLICY, sharedSecret,

567

&ownerAuth, digest.digest,

568

&nonceEvenOSAP)))

569

return result;

570

571

if ((result = TCSP_MakeIdentity(tspContext, encAuthUsage, chosenIDHash, idKeySize, idKey,

572

pSrkAuth, &ownerAuth, &idKeySize, &newIdKey,

573

&pcIdentityBindingSize, &prgbIdentityBinding,

574

&pcEndorsementCredentialSize, &prgbEndorsementCredential,

575

&pcPlatformCredentialSize, &prgbPlatformCredential,

576

&pcConformanceCredentialSize, &prgbConformanceCredential)))

577

return result;

578

579

offset = 0;

580

Trspi_LoadBlob_UINT32(&offset, result, hashblob);

581

Trspi_LoadBlob_UINT32(&offset, TPM_ORD_MakeIdentity, hashblob);

582

Trspi_LoadBlob(&offset, idKeySize, hashblob, newIdKey);

583

Trspi_LoadBlob_UINT32(&offset, pcIdentityBindingSize, hashblob);

584

Trspi_LoadBlob(&offset, pcIdentityBindingSize, hashblob,

585

prgbIdentityBinding);

586

587

Trspi_Hash(TSS_HASH_SHA1, offset, hashblob, digest.digest);

588

589

if ((result = secret_ValidateAuth_OSAP(hTPM, TPM_ORD_MakeIdentity,

590

hTPMPolicy, hIDPolicy,

591

NULL_HPOLICY, sharedSecret,

592

&ownerAuth, digest.digest,

593

&nonceEvenOSAP)))

594

goto error;

595

596

if (usesAuth == TRUE) {

597

if ((result = obj_policy_validate_auth_oiap(hSRKPolicy,

598

&digest,

599

&srkAuth)))

600

goto error;

601

}

602

603

if ((result = obj_rsakey_set_tcpakey(hIdentityKey, idKeySize, newIdKey))) {

604

free(newIdKey);

605

goto error;

606

}

607

free(newIdKey);

608

609

if ((result = obj_rsakey_get_pub_blob(hIdentityKey, &idPubSize, &idPub)))

610

goto error;

611

612

/* set up the TCPA_IDENTITY_PROOF structure */

613

/* XXX This should be DER encoded first. TPM1.1b section 9.4 */

614

offset = 0;

615

Trspi_LoadBlob_TSS_VERSION(&offset, hashblob, VERSION_1_1);

616

Trspi_LoadBlob_UINT32(&offset, ulIdentityLabelLength, hashblob);

617

Trspi_LoadBlob_UINT32(&offset, pcIdentityBindingSize, hashblob);

618

Trspi_LoadBlob_UINT32(&offset, pcEndorsementCredentialSize, hashblob);

619

Trspi_LoadBlob_UINT32(&offset, pcPlatformCredentialSize, hashblob);

620

Trspi_LoadBlob_UINT32(&offset, pcConformanceCredentialSize, hashblob);

621

Trspi_LoadBlob(&offset, idPubSize, hashblob, idPub);

622

free_tspi(tspContext, idPub);

623

Trspi_LoadBlob(&offset, ulIdentityLabelLength, hashblob, rgbIdentityLabelData);

624

Trspi_LoadBlob(&offset, pcIdentityBindingSize, hashblob, prgbIdentityBinding);

625

Trspi_LoadBlob(&offset, pcEndorsementCredentialSize, hashblob, prgbEndorsementCredential);

626

Trspi_LoadBlob(&offset, pcPlatformCredentialSize, hashblob, prgbPlatformCredential);

627

Trspi_LoadBlob(&offset, pcConformanceCredentialSize, hashblob, prgbConformanceCredential);

628

629

if (cb && cb->callback) {

630

/* Alloc the space for the callback to copy into. The additional 32 bytes will

631

* attempt to account for padding that the symmetric encryption will do. */

632

rgbTcpaIdentityReq.asymBlob = calloc(1, (int)offset + 32);

633

rgbTcpaIdentityReq.symBlob = calloc(1, (int)offset + 32);

634

if (rgbTcpaIdentityReq.asymBlob == NULL ||

635

rgbTcpaIdentityReq.symBlob == NULL) {

636

free(rgbTcpaIdentityReq.asymBlob);

637

free(rgbTcpaIdentityReq.symBlob);

638

LogError("malloc of %" PRIu64 " bytes failed", offset);

639

free_tspi(tspContext, cb);

640

result = TSPERR(TSS_E_OUTOFMEMORY);

641

goto error;

642

}

643

rgbTcpaIdentityReq.asymSize = (UINT32)offset + 32;

644

rgbTcpaIdentityReq.symSize = (UINT32)offset + 32;

645

646

if ((result = ((TSS_RESULT (*)(PVOID, UINT32, BYTE *, UINT32, UINT32 *, BYTE *,

647

UINT32 *, BYTE *))cb->callback)(cb->appData, (UINT32)offset,

648

hashblob, algID,

649

&rgbTcpaIdentityReq.asymSize,

650

rgbTcpaIdentityReq.asymBlob,

651

&rgbTcpaIdentityReq.symSize,

652

rgbTcpaIdentityReq.symBlob))) {

653

LogDebug("CollateIdentityRequest callback returned error 0x%x", result);

654

free_tspi(tspContext, cb);

655

goto error;

656

}

657

} else {

658

/* generate the symmetric key. */

659

if ((result = get_local_random(tspContext, symKey.size, &symKey.data)))

660

goto error;

661

662

/* No symmetric key encryption schemes existed in the 1.1 time frame */

663

symKey.encScheme = TCPA_ES_NONE;

664

665

/* encrypt the proof */

666

rgbTcpaIdentityReq.symSize = sizeof(testblob);

667

if ((result = Trspi_SymEncrypt(algID, TR_SYM_MODE_CBC, symKey.data, NULL, hashblob,

668

offset, testblob, &rgbTcpaIdentityReq.symSize)))

669

goto error;

670

671

rgbTcpaIdentityReq.symBlob = testblob;

672

673

/* XXX This should be DER encoded first. TPM1.1b section 9.4 */

674

offset = 0;

675

Trspi_LoadBlob_SYMMETRIC_KEY(&offset, hashblob, &symKey);

676

677

if ((result = Trspi_RSA_Public_Encrypt(hashblob, offset, encSymKey, &encSymKeySize,

678

caKey.pubKey.key, caKey.pubKey.keyLength,

679

65537, padding)))

680

goto error;

681

682

rgbTcpaIdentityReq.asymSize = encSymKeySize;

683

rgbTcpaIdentityReq.asymBlob = encSymKey;

684

}

685

686

rgbTcpaIdentityReq.asymAlgorithm = asymParms;

687

rgbTcpaIdentityReq.symAlgorithm = symParms;

688

689

/* XXX This should be DER encoded first. TPM1.1b section 9.4 */

690

offset = 0;

691

Trspi_LoadBlob_IDENTITY_REQ(&offset, idReqBlob, &rgbTcpaIdentityReq);

692

693

if (cb && cb->callback) {

694

free(rgbTcpaIdentityReq.symBlob);

695

free(rgbTcpaIdentityReq.asymBlob);

696

free_tspi(tspContext, cb);

697

}

698

699

if ((*prgbTcpaIdentityReq = calloc_tspi(tspContext, offset)) == NULL) {

700

result = TSPERR(TSS_E_OUTOFMEMORY);

701

goto error;

702

}

703

704

memcpy(*prgbTcpaIdentityReq, idReqBlob, offset);

705

*pulTcpaIdentityReqLength = offset;

706

error:

707

free_key_refs(&caKey);

708

free(prgbIdentityBinding);

709

free(prgbEndorsementCredential);

710

free(prgbPlatformCredential);

711

free(prgbConformanceCredential);

712

713

return result;

714

}

715

716

TSS_RESULT

717

Tspi_TPM_ActivateIdentity(TSS_HTPM hTPM, /* in */

718

TSS_HKEY hIdentKey, /* in */

719

UINT32 ulAsymCAContentsBlobLength, /* in */

720

BYTE * rgbAsymCAContentsBlob, /* in */

721

UINT32 ulSymCAAttestationBlobLength, /* in */

722

BYTE * rgbSymCAAttestationBlob, /* in */

723

UINT32 * pulCredentialLength, /* out */

724

BYTE ** prgbCredential) /* out */

725

{

726

TPM_AUTH idKeyAuth;

727

TPM_AUTH ownerAuth;

728

TSS_HCONTEXT tspContext;

729

TSS_HPOLICY hIDPolicy, hTPMPolicy;

730

UINT64 offset;

731

BYTE hashblob[0x1000], credBlob[0x1000];

732

TCPA_DIGEST digest;

733

TSS_RESULT result;

734

TCS_KEY_HANDLE tcsKeyHandle;

735

TSS_BOOL usesAuth;

736

TPM_AUTH *pIDKeyAuth;

737

BYTE *symKeyBlob, *credCallback, *cb_var;

738

UINT32 symKeyBlobLen, credLen, tmp;

739

TCPA_SYMMETRIC_KEY symKey;

740

TSS_CALLBACK *cb;

741

TCPA_SYM_CA_ATTESTATION symCAAttestation;

742

743

if (pulCredentialLength == NULL || prgbCredential == NULL)

744

return TSPERR(TSS_E_BAD_PARAMETER);

745

746

if ((result = obj_tpm_get_tsp_context(hTPM, &tspContext)))

747

return result;

748

749

if ((result = obj_tpm_get_cb12(hTPM, TSS_TSPATTRIB_TPM_CALLBACK_ACTIVATEIDENTITY, &tmp,

750

&cb_var)))

751

return result;

752

753

cb = (TSS_CALLBACK *)cb_var;

754

if (cb->callback == NULL) {

755

free_tspi(tspContext, cb);

756

cb = NULL;

757

}

758

759

if ((result = obj_rsakey_get_tcs_handle(hIdentKey, &tcsKeyHandle)))

760

return result;

761

762

if ((result = obj_rsakey_get_policy(hIdentKey, TSS_POLICY_USAGE,

763

&hIDPolicy, &usesAuth)))

764

return result;

765

766

if ((result = obj_tpm_get_policy(hTPM, &hTPMPolicy)))

767

return result;

768

769

offset = 0;

770

Trspi_LoadBlob_UINT32(&offset, TPM_ORD_ActivateTPMIdentity, hashblob);

771

Trspi_LoadBlob_UINT32(&offset, ulAsymCAContentsBlobLength, hashblob);

772

Trspi_LoadBlob(&offset, ulAsymCAContentsBlobLength, hashblob,

773

rgbAsymCAContentsBlob);

774

Trspi_Hash(TSS_HASH_SHA1, offset, hashblob, digest.digest);

775

776

if (usesAuth) {

777

if ((result = secret_PerformAuth_OIAP(hIDPolicy,

778

TPM_ORD_ActivateTPMIdentity,

779

hIDPolicy, &digest,

780

&idKeyAuth)))

781

return result;

782

pIDKeyAuth = &idKeyAuth;

783

} else {

784

pIDKeyAuth = NULL;

785

}

786

787

if ((result = secret_PerformAuth_OIAP(hTPM,

788

TPM_ORD_ActivateTPMIdentity,

789

hTPMPolicy, &digest,

790

&ownerAuth)))

791

return result;

792

793

if ((result = TCSP_ActivateTPMIdentity(tspContext, tcsKeyHandle, ulAsymCAContentsBlobLength,

794

rgbAsymCAContentsBlob, pIDKeyAuth, &ownerAuth,

795

&symKeyBlobLen, &symKeyBlob)))

796

return result;

797

798

offset = 0;

799

Trspi_LoadBlob_UINT32(&offset, result, hashblob);

800

Trspi_LoadBlob_UINT32(&offset, TPM_ORD_ActivateTPMIdentity, hashblob);

801

Trspi_LoadBlob(&offset, symKeyBlobLen, hashblob, symKeyBlob);

802

Trspi_Hash(TSS_HASH_SHA1, offset, hashblob, digest.digest);

803

804

if (usesAuth) {

805

if ((result = obj_policy_validate_auth_oiap(hIDPolicy, &digest, &idKeyAuth))) {

806

LogDebugFn("Identity key auth validation of the symmetric key failed.");

807

return result;

808

}

809

}

810

811

if ((result = obj_policy_validate_auth_oiap(hTPMPolicy, &digest, &ownerAuth))) {

812

LogDebugFn("Owner auth validation of the symmetric key failed.");

813

return result;

814

}

815

816

offset = 0;

817

if ((result = Trspi_UnloadBlob_SYM_CA_ATTESTATION(&offset, rgbSymCAAttestationBlob,

818

&symCAAttestation))) {

819

LogDebugFn("Error unloading CA's attestation blob.");

820

return result;

821

}

822

823

if (cb && cb->callback) {

824

/* alloc the space for the callback to copy into */

825

credCallback = calloc(1, ulSymCAAttestationBlobLength);

826

if (credCallback == NULL) {

827

LogDebug("malloc of %u bytes failed", ulSymCAAttestationBlobLength);

828

free(symCAAttestation.credential);

829

free(symKeyBlob);

830

free_tspi(tspContext, cb);

831

return TSPERR(TSS_E_INTERNAL_ERROR);

832

}

833

credLen = ulSymCAAttestationBlobLength;

834

835

if ((result = ((TSS_RESULT (*)(PVOID, UINT32, BYTE *, UINT32, BYTE *, UINT32 *,

836

BYTE *))cb->callback)(cb->appData, symKeyBlobLen, symKeyBlob,

837

symCAAttestation.credSize,

838

symCAAttestation.credential,

839

&credLen, credCallback))) {

840

LogDebug("ActivateIdentity callback returned error 0x%x", result);

841

free(symCAAttestation.credential);

842

free(symKeyBlob);

843

free_tspi(tspContext, cb);

844

free(credCallback);

845

return TSPERR(TSS_E_INTERNAL_ERROR);

846

}

847

free(symCAAttestation.credential);

848

free_tspi(tspContext, cb);

849

free(symKeyBlob);

850

851

if ((*prgbCredential = calloc_tspi(tspContext, credLen)) == NULL) {

852

free(credCallback);

853

return TSPERR(TSS_E_OUTOFMEMORY);

854

}

855

856

memcpy(*prgbCredential, credCallback, credLen);

857

*pulCredentialLength = credLen;

858

free(credCallback);

859

860

return TSS_SUCCESS;

861

}

862

863

/* decrypt the symmetric blob using the recovered symmetric key */

864

offset = 0;

865

if ((result = Trspi_UnloadBlob_SYMMETRIC_KEY(&offset, symKeyBlob, &symKey))) {

866

free(symCAAttestation.credential);

867

free(symKeyBlob);

868

return result;

869

}

870

free(symKeyBlob);

871

872

if ((result = Trspi_SymDecrypt(symKey.algId, symKey.encScheme, symKey.data, NULL,

873

symCAAttestation.credential, symCAAttestation.credSize,

874

credBlob, &credLen))) {

875

free(symCAAttestation.credential);

876

free(symKey.data);

877

return result;

878

}

879

free(symCAAttestation.credential);

880

881

if ((*prgbCredential = calloc_tspi(tspContext, credLen)) == NULL) {

882

free(symKey.data);

883

return TSPERR(TSS_E_OUTOFMEMORY);

884

}

885

886

free(symKey.data);

887

memcpy(*prgbCredential, credBlob, credLen);

888

*pulCredentialLength = credLen;

889

890

return TSS_SUCCESS;

891

}

892

893

TSS_RESULT

894

Tspi_TPM_ClearOwner(TSS_HTPM hTPM, /* in */

895

TSS_BOOL fForcedClear) /* in */

896

{

897

TSS_HCONTEXT tspContext;

898

TCPA_RESULT result;

899

TPM_AUTH auth;

900

TCPA_DIGEST hashDigest;

901

BYTE *hashBlob;

902

UINT64 offset;

903

TSS_HPOLICY hPolicy;

904

905

if ((result = obj_tpm_get_tsp_context(hTPM, &tspContext)))

906

return result;

907

908

if (!fForcedClear) { /* TPM_OwnerClear */

909

if ((result = obj_tpm_get_policy(hTPM, &hPolicy)))

910

return result;

911

912

/* Now do some Hash'ing */

913

offset = 0;

914

hashBlob = malloc(sizeof(UINT32));

915

if (hashBlob == NULL) {

916

LogError("malloc of %zd bytes failed.", sizeof(UINT32));

917

return TSPERR(TSS_E_OUTOFMEMORY);

918

}

919

Trspi_LoadBlob_UINT32(&offset, TPM_ORD_OwnerClear, hashBlob);

920

Trspi_Hash(TSS_HASH_SHA1, offset, hashBlob, hashDigest.digest);

921

free(hashBlob);

922

/* hashDigest now has the hash result */

923

924

if ((result = secret_PerformAuth_OIAP(hTPM, TPM_ORD_OwnerClear,

925

hPolicy, &hashDigest,

926

&auth)))

927

return result;

928

929

if ((result = TCSP_OwnerClear(tspContext, &auth)))

930

return result;

931

932

/* validate auth */

933

offset = 0;

934

hashBlob = malloc(2 * sizeof(UINT32));

935

if (hashBlob == NULL) {

936

LogError("malloc of %zd bytes failed.", 2 * sizeof(UINT32));

937

return TSPERR(TSS_E_OUTOFMEMORY);

938

}

939

Trspi_LoadBlob_UINT32(&offset, result, hashBlob);

940

Trspi_LoadBlob_UINT32(&offset, TPM_ORD_OwnerClear, hashBlob);

941

Trspi_Hash(TSS_HASH_SHA1, offset, hashBlob, hashDigest.digest);

942

free(hashBlob);

943

944

if ((result = obj_policy_validate_auth_oiap(hPolicy, &hashDigest, &auth)))

945

return result;

946

} else {

947

if ((result = TCSP_ForceClear(tspContext)))

948

return result;

949

}

950

951

return TSS_SUCCESS;

952

}

953

954

TSS_RESULT

955

Tspi_TPM_SetStatus(TSS_HTPM hTPM, /* in */

956

TSS_FLAG statusFlag, /* in */

957

TSS_BOOL fTpmState) /* in */

958

{

959

TPM_AUTH auth;

960

TSS_RESULT result;

961

BYTE *hashBlob;

962

UINT64 offset;

963

TCPA_DIGEST hashDigest;

964

TSS_HCONTEXT tspContext;

965

TSS_HPOLICY hPolicy;

966

967

if ((result = obj_tpm_get_tsp_context(hTPM, &tspContext)))

968

return result;

969

970

if ((result = obj_tpm_get_policy(hTPM, &hPolicy)))

971

return result;

972

973

switch (statusFlag) {

974

case TSS_TPMSTATUS_DISABLEOWNERCLEAR:

975

hashBlob = malloc(sizeof(UINT32));

976

if (hashBlob == NULL) {

977

LogError("malloc of %zd bytes failed.", sizeof(UINT32));

978

return TSPERR(TSS_E_OUTOFMEMORY);

979

}

980

offset = 0;

981

Trspi_LoadBlob_UINT32(&offset, TPM_ORD_DisableOwnerClear, hashBlob);

982

Trspi_Hash(TSS_HASH_SHA1, offset, hashBlob, hashDigest.digest);

983

free(hashBlob);

984

985

if ((result = secret_PerformAuth_OIAP(hTPM,

986

TPM_ORD_DisableOwnerClear,

987

hPolicy, &hashDigest,

988

&auth)))

989

return result;

990

991

if ((result = TCSP_DisableOwnerClear(tspContext, &auth)))

992

return result;

993

994

offset = 0;

995

hashBlob = malloc(2 * sizeof(UINT32));

996

if (hashBlob == NULL) {

997

LogError("malloc of %zd bytes failed.", 2 * sizeof(UINT32));

998

return TSPERR(TSS_E_OUTOFMEMORY);

999

}

1000

Trspi_LoadBlob_UINT32(&offset, result, hashBlob);

1001

Trspi_LoadBlob_UINT32(&offset, TPM_ORD_DisableOwnerClear, hashBlob);

1002

Trspi_Hash(TSS_HASH_SHA1, offset, hashBlob, hashDigest.digest);

1003

free(hashBlob);

1004

1005

if ((result = obj_policy_validate_auth_oiap(hPolicy, &hashDigest, &auth)))

1006

return result;

1007

break;

1008

case TSS_TPMSTATUS_DISABLEFORCECLEAR:

1009

result = TCSP_DisableForceClear(tspContext);

1010

break;

1011

case TSS_TPMSTATUS_OWNERSETDISABLE:

1012

1013

hashBlob = malloc(sizeof(UINT32) + sizeof(TSS_BOOL));

1014

if (hashBlob == NULL) {

1015

LogError("malloc of %zd bytes failed.", sizeof(UINT32) + sizeof(TSS_BOOL));

1016

return TSPERR(TSS_E_OUTOFMEMORY);

1017

}

1018

offset = 0;

1019

Trspi_LoadBlob_UINT32(&offset, TPM_ORD_OwnerSetDisable, hashBlob);

1020

hashBlob[(offset++)] = fTpmState;

1021

Trspi_Hash(TSS_HASH_SHA1, offset, hashBlob, hashDigest.digest);

1022

free(hashBlob);

1023

1024

if ((result = secret_PerformAuth_OIAP(hTPM,

1025

TPM_ORD_OwnerSetDisable,

1026

hPolicy, &hashDigest,

1027

&auth)))

1028

return result;

1029

1030

if ((result = TCSP_OwnerSetDisable(tspContext, fTpmState, &auth)))

1031

return result;

1032

1033

offset = 0;

1034

hashBlob = malloc(8);

1035

if (hashBlob == NULL) {

1036

LogError("malloc of %zd bytes failed.", 2 * sizeof(UINT32));

1037

return TSPERR(TSS_E_OUTOFMEMORY);

1038

}

1039

Trspi_LoadBlob_UINT32(&offset, result, hashBlob);

1040

Trspi_LoadBlob_UINT32(&offset, TPM_ORD_OwnerSetDisable, hashBlob);

1041

Trspi_Hash(TSS_HASH_SHA1, offset, hashBlob, hashDigest.digest);

1042

free(hashBlob);

1043

1044

if ((result = obj_policy_validate_auth_oiap(hPolicy, &hashDigest, &auth)))

1045

return result;

1046

break;

1047

case TSS_TPMSTATUS_PHYSICALDISABLE:

1048

if ( fTpmState )

1049

result = TCSP_PhysicalDisable(tspContext);

1050

else

1051

result = TCSP_PhysicalEnable(tspContext);

1052

break;

1053

case TSS_TPMSTATUS_PHYSICALSETDEACTIVATED:

1054

result = TCSP_PhysicalSetDeactivated(tspContext, fTpmState);

1055

break;

1056

case TSS_TPMSTATUS_SETTEMPDEACTIVATED:

1057

result = TCSP_SetTempDeactivated(tspContext);

1058

break;

1059

case TSS_TPMSTATUS_SETOWNERINSTALL:

1060

result = TCSP_SetOwnerInstall(tspContext, fTpmState);

1061

break;

1062

case TSS_TPMSTATUS_DISABLEPUBEKREAD:

1063

1064

hashBlob = malloc(sizeof(UINT32));

1065

if (hashBlob == NULL) {

1066

LogError("malloc of %zd bytes failed.", sizeof(UINT32));

1067

return TSPERR(TSS_E_OUTOFMEMORY);

1068

}

1069

offset = 0;

1070

Trspi_LoadBlob_UINT32(&offset, TPM_ORD_DisablePubekRead, hashBlob);

1071

Trspi_Hash(TSS_HASH_SHA1, offset, hashBlob, hashDigest.digest);

1072

free(hashBlob);

1073

1074

if ((result = secret_PerformAuth_OIAP(hTPM,

1075

TPM_ORD_DisablePubekRead,

1076

hPolicy, &hashDigest,

1077

&auth)))

1078

return result;

1079

1080

if ((result = TCSP_DisablePubekRead(tspContext, &auth)))

1081

return result;

1082

1083

offset = 0;

1084

hashBlob = malloc(2 * sizeof(UINT32));

1085

if (hashBlob == NULL) {

1086

LogError("malloc of %zd bytes failed.", 2 * sizeof(UINT32));

1087

return TSPERR(TSS_E_OUTOFMEMORY);

1088

}

1089

Trspi_LoadBlob_UINT32(&offset, result, hashBlob);

1090

Trspi_LoadBlob_UINT32(&offset, TPM_ORD_DisablePubekRead, hashBlob);

1091

Trspi_Hash(TSS_HASH_SHA1, offset, hashBlob, hashDigest.digest);

1092

free(hashBlob);

1093

1094

if ((result = obj_policy_validate_auth_oiap(hPolicy, &hashDigest, &auth)))

1095

return result;

1096

break;

1097

#ifndef TSS_SPEC_COMPLIANCE

1098

case TSS_TPMSTATUS_PHYSPRES_LIFETIMELOCK:

1099

/* set the lifetime lock bit */

1100

result = TCSP_PhysicalPresence(tspContext, TCPA_PHYSICAL_PRESENCE_LIFETIME_LOCK);

1101

break;

1102

case TSS_TPMSTATUS_PHYSPRES_HWENABLE:

1103

/* set the HW enable bit */

1104

result = TCSP_PhysicalPresence(tspContext, TCPA_PHYSICAL_PRESENCE_HW_ENABLE);

1105

break;

1106

case TSS_TPMSTATUS_PHYSPRES_CMDENABLE:

1107

/* set the command enable bit */

1108

result = TCSP_PhysicalPresence(tspContext, TCPA_PHYSICAL_PRESENCE_CMD_ENABLE);

1109

break;

1110

case TSS_TPMSTATUS_PHYSPRES_LOCK:

1111

/* set the physical presence lock bit */

1112

result = TCSP_PhysicalPresence(tspContext, TCPA_PHYSICAL_PRESENCE_LOCK);

1113

break;

1114

case TSS_TPMSTATUS_PHYSPRESENCE:

1115

/* set the physical presence state */

1116

result = TCSP_PhysicalPresence(tspContext, (fTpmState ?

1117

TCPA_PHYSICAL_PRESENCE_PRESENT :

1118

TCPA_PHYSICAL_PRESENCE_NOTPRESENT));

1119

break;

1120

#endif

1121

default:

1122

return TSPERR(TSS_E_BAD_PARAMETER);

1123

break;

1124

}

1125

1126

return result;

1127

}

1128

1129

TSS_RESULT

1130

Tspi_TPM_GetStatus(TSS_HTPM hTPM, /* in */

1131

TSS_FLAG statusFlag, /* in */

1132

TSS_BOOL * pfTpmState) /* out */

1133

{

1134

TSS_HCONTEXT tspContext;

1135

TSS_RESULT result;

1136

UINT32 nonVolFlags;

1137

UINT32 volFlags;

1138

1139

if (pfTpmState == NULL)

1140

return TSPERR(TSS_E_BAD_PARAMETER);

1141

1142

if ((result = obj_tpm_get_tsp_context(hTPM, &tspContext)))

1143

return result;

1144

1145

if ((result = get_tpm_flags(tspContext, hTPM, &volFlags, &nonVolFlags)))

1146

return result;

1147

1148

switch (statusFlag) {

1149

case TSS_TPMSTATUS_DISABLEOWNERCLEAR:

1150

*pfTpmState = BOOL(nonVolFlags & TPM11_NONVOL_OWNER_CLEARABLE);

1151

break;

1152

case TSS_TPMSTATUS_DISABLEFORCECLEAR:

1153

*pfTpmState = BOOL(volFlags & TPM11_VOL_PRES_CLEARABLE);

1154

break;

1155

case TSS_TPMSTATUS_DISABLED:

1156

*pfTpmState = BOOL(nonVolFlags & TPM11_NONVOL_DISABLED);

1157

break;

1158

case TSS_TPMSTATUS_PHYSICALSETDEACTIVATED:

1159

*pfTpmState = BOOL(nonVolFlags & TPM11_NONVOL_DEACTIVATED);

1160

break;

1161

case TSS_TPMSTATUS_SETTEMPDEACTIVATED:

1162

*pfTpmState = BOOL(volFlags & TPM11_VOL_TEMP_DEACTIVATED);

1163

break;

1164

case TSS_TPMSTATUS_SETOWNERINSTALL:

1165

*pfTpmState = BOOL(nonVolFlags & TPM11_NONVOL_OWNABLE);

1166

break;

1167

case TSS_TPMSTATUS_DISABLEPUBEKREAD:

1168

*pfTpmState = INVBOOL(nonVolFlags & TPM11_NONVOL_READABLE_PUBEK);

1169

break;

1170

case TSS_TPMSTATUS_ALLOWMAINTENANCE:

1171

*pfTpmState = BOOL(nonVolFlags & TPM11_NONVOL_ALLOW_MAINT);

1172

break;

1173

case TSS_TPMSTATUS_PHYSPRES_LIFETIMELOCK:

1174

*pfTpmState = BOOL(nonVolFlags & TPM11_NONVOL_LIFETIME_LOCK);

1175

break;

1176

case TSS_TPMSTATUS_PHYSPRES_HWENABLE:

1177

*pfTpmState = BOOL(nonVolFlags & TPM11_NONVOL_HW_PRES);

1178

break;

1179

case TSS_TPMSTATUS_PHYSPRES_CMDENABLE:

1180

*pfTpmState = BOOL(nonVolFlags & TPM11_NONVOL_CMD_PRES);

1181

break;

1182

case TSS_TPMSTATUS_CEKP_USED:

1183

*pfTpmState = BOOL(nonVolFlags & TPM11_NONVOL_CEKP_USED);

1184

break;

1185

case TSS_TPMSTATUS_PHYSPRESENCE:

1186

*pfTpmState = BOOL(volFlags & TPM11_VOL_PRES);

1187

break;

1188

case TSS_TPMSTATUS_PHYSPRES_LOCK:

1189

*pfTpmState = BOOL(volFlags & TPM11_VOL_PRES_LOCK);

1190

break;

1191

1192

default:

1193

return TSPERR(TSS_E_BAD_PARAMETER);

1194

break;

1195

}

1196

1197

return TSS_SUCCESS;

1198

}

1199

1200

TSS_RESULT

1201

Tspi_TPM_SelfTestFull(TSS_HTPM hTPM) /* in */

1202

{

1203

TSS_RESULT result;

1204

TSS_HCONTEXT tspContext;

1205

1206

if ((result = obj_tpm_get_tsp_context(hTPM, &tspContext)))

1207

return result;

1208

1209

return TCSP_SelfTestFull(tspContext);

1210

}

1211

1212

TSS_RESULT

1213

Tspi_TPM_CertifySelfTest(TSS_HTPM hTPM, /* in */

1214

TSS_HKEY hKey, /* in */

1215

TSS_VALIDATION *pValidationData) /* in, out */

1216

{

1217

TCPA_RESULT result;

1218

TPM_AUTH keyAuth;

1219

UINT64 offset = 0;

1220

BYTE *hashBlob;

1221

TCPA_DIGEST hash;

1222

TCPA_NONCE antiReplay;

1223

UINT32 outDataSize;

1224

BYTE *outData;

1225

TSS_HPOLICY hPolicy;

1226

TCS_KEY_HANDLE keyTCSKeyHandle;

1227

BYTE *keyData = NULL;

1228

UINT32 keyDataSize;

1229

TCPA_KEY keyContainer;

1230

TPM_AUTH *pKeyAuth;

1231

TSS_BOOL useAuth;

1232

TSS_HCONTEXT tspContext;

1233

1234

1235

if ((result = obj_tpm_get_tsp_context(hTPM, &tspContext)))

1236

return result;

1237

1238

if ((result = obj_rsakey_get_policy(hKey, TSS_POLICY_USAGE,

1239

&hPolicy, &useAuth)))

1240

return result;

1241

1242

if ((result = obj_rsakey_get_tcs_handle(hKey, &keyTCSKeyHandle)))

1243

return result;

1244

1245

if (pValidationData == NULL) {

1246

if ((result = internal_GetRandomNonce(tspContext, &antiReplay))) {

1247

LogError("Failed creating random nonce");

1248

return TSPERR(TSS_E_INTERNAL_ERROR);

1249

}

1250

} else {

1251

if (pValidationData->ulExternalDataLength < sizeof(antiReplay.nonce))

1252

return TSPERR(TSS_E_BAD_PARAMETER);

1253

1254

memcpy(antiReplay.nonce, pValidationData->rgbExternalData,

1255

sizeof(antiReplay.nonce));

1256

}

1257

1258

if (useAuth) {

1259

LogDebug("Uses Auth");

1260

1261

/* === now setup the auth's */

1262

hashBlob = malloc(sizeof(UINT32) + sizeof(TCPA_NONCE));

1263

if (hashBlob == NULL) {

1264

LogError("malloc of %zd bytes failed.", sizeof(UINT32) + sizeof(TCPA_NONCE));

1265

return TSPERR(TSS_E_OUTOFMEMORY);

1266

}

1267

offset = 0;

1268

Trspi_LoadBlob_UINT32(&offset, TPM_ORD_CertifySelfTest, hashBlob);

1269

Trspi_LoadBlob(&offset, sizeof(TCPA_NONCE), hashBlob, antiReplay.nonce);

1270

Trspi_Hash(TSS_HASH_SHA1, offset, hashBlob, hash.digest);

1271

free(hashBlob);

1272

1273

if ((result = secret_PerformAuth_OIAP(hKey,

1274

TPM_ORD_CertifySelfTest,

1275

hPolicy, &hash,

1276

&keyAuth)))

1277

return result;

1278

pKeyAuth = &keyAuth;

1279

} else {

1280

LogDebug("No Auth");

1281

pKeyAuth = NULL;

1282

}

1283

1284

if ((result = TCSP_CertifySelfTest(tspContext, keyTCSKeyHandle, antiReplay, pKeyAuth,

1285

&outDataSize, &outData)))

1286

return result;

1287

1288

/* validate auth */

1289

if (useAuth) {

1290

offset = 0;

1291

hashBlob = malloc((3 * sizeof(UINT32)) + outDataSize);

1292

if (hashBlob == NULL) {

1293

LogError("malloc of %zd bytes failed.", (3 * sizeof(UINT32)) + outDataSize);

1294

return TSPERR(TSS_E_OUTOFMEMORY);

1295

}

1296

Trspi_LoadBlob_UINT32(&offset, result, hashBlob);

1297

Trspi_LoadBlob_UINT32(&offset, TPM_ORD_CertifySelfTest, hashBlob);

1298

Trspi_LoadBlob_UINT32(&offset, outDataSize, hashBlob);

1299

Trspi_LoadBlob(&offset, outDataSize, hashBlob, outData);

1300

Trspi_Hash(TSS_HASH_SHA1, offset, hashBlob, hash.digest);

1301

free(hashBlob);

1302

1303

if ((result = obj_policy_validate_auth_oiap(hPolicy, &hash, &keyAuth)))

1304

return result;

1305

}

1306

1307

if (pValidationData == NULL) {

1308

if ((result = Tspi_GetAttribData(hKey, TSS_TSPATTRIB_KEY_BLOB,

1309

TSS_TSPATTRIB_KEYBLOB_BLOB, &keyDataSize, &keyData))) {

1310

LogError("Failed call to GetAttribData to get key blob");

1311

return TSPERR(TSS_E_INTERNAL_ERROR);

1312

}

1313

1314

offset = 0;

1315

memset(&keyContainer, 0, sizeof(TCPA_KEY));

1316

if ((result = Trspi_UnloadBlob_KEY(&offset, keyData, &keyContainer)))

1317

return result;

1318

1319

offset = 0;

1320

hashBlob = malloc(sizeof(UINT32) + sizeof(TCPA_NONCE) + strlen("Test Passed"));

1321

if (hashBlob == NULL) {

1322

LogError("malloc of %zd bytes failed.", sizeof(UINT32) + sizeof(TCPA_NONCE)

1323

+ strlen("Test Passed"));

1324

free_key_refs(&keyContainer);

1325

return TSPERR(TSS_E_OUTOFMEMORY);

1326

}

1327

Trspi_LoadBlob(&offset, strlen("Test Passed"), hashBlob, (BYTE *)"Test Passed");

1328

Trspi_LoadBlob(&offset, sizeof(TCPA_NONCE), hashBlob, antiReplay.nonce);

1329

Trspi_LoadBlob_UINT32(&offset, TPM_ORD_CertifySelfTest, hashBlob);

1330

1331

Trspi_Hash(TSS_HASH_SHA1, offset, hashBlob, hash.digest);

1332

free(hashBlob);

1333

1334

if ((result = Trspi_Verify(TSS_HASH_SHA1, hash.digest, 20,

1335

keyContainer.pubKey.key, keyContainer.pubKey.keyLength,

1336

outData, outDataSize))) {

1337

free(outData);

1338

free_key_refs(&keyContainer);

1339

return TSPERR(TSS_E_VERIFICATION_FAILED);

1340

}

1341

1342

} else {

1343

pValidationData->ulDataLength = sizeof(TCPA_NONCE) + sizeof(UINT32) +

1344

strlen("Test Passed");

1345

pValidationData->rgbData = calloc_tspi(tspContext, pValidationData->ulDataLength);

1346

if (pValidationData->rgbData == NULL) {

1347

LogError("malloc of %u bytes failed.", pValidationData->ulDataLength);

1348

pValidationData->ulDataLength = 0;

1349

return TSPERR(TSS_E_OUTOFMEMORY);

1350

}

1351

offset = 0;

1352

Trspi_LoadBlob(&offset, strlen("Test Passed"), pValidationData->rgbData,

1353

(BYTE *)"Test Passed");

1354

Trspi_LoadBlob(&offset, sizeof(TCPA_NONCE), pValidationData->rgbData,

1355

antiReplay.nonce);

1356

Trspi_LoadBlob_UINT32(&offset, TPM_ORD_CertifySelfTest, pValidationData->rgbData);

1357

pValidationData->ulValidationDataLength = outDataSize;

1358

pValidationData->rgbValidationData = calloc_tspi(tspContext, outDataSize);

1359

if (pValidationData->rgbValidationData == NULL) {

1360

free_tspi(tspContext, pValidationData->rgbData);

1361

pValidationData->rgbData = NULL;

1362

pValidationData->ulDataLength = 0;

1363

LogError("malloc of %u bytes failed.",

1364

pValidationData->ulValidationDataLength);

1365

pValidationData->ulValidationDataLength = 0;

1366

return TSPERR(TSS_E_OUTOFMEMORY);

1367

}

1368

memcpy(pValidationData->rgbValidationData, outData, outDataSize);

1369

free(outData);

1370

}

1371

1372

return TSS_SUCCESS;

1373

}

1374

1375

TSS_RESULT

1376

Tspi_TPM_GetTestResult(TSS_HTPM hTPM, /* in */

1377

UINT32 * pulTestResultLength, /* out */

1378

BYTE ** prgbTestResult) /* out */

1379

{

1380

TSS_HCONTEXT tspContext;

1381

TSS_RESULT result;

1382

1383

if (pulTestResultLength == NULL || prgbTestResult == NULL)

1384

return TSPERR(TSS_E_BAD_PARAMETER);

1385

1386

if ((result = obj_tpm_get_tsp_context(hTPM, &tspContext)))

1387

return result;

1388

1389

return TCSP_GetTestResult(tspContext, pulTestResultLength, prgbTestResult);

1390

}

1391

1392

TSS_RESULT

1393

Tspi_TPM_GetCapability(TSS_HTPM hTPM, /* in */

1394

TSS_FLAG capArea, /* in */

1395

UINT32 ulSubCapLength, /* in */

1396

BYTE * rgbSubCap, /* in */

1397

UINT32 * pulRespDataLength, /* out */

1398

BYTE ** prgbRespData) /* out */

1399

{

1400

TSS_HCONTEXT tspContext;

1401

TCPA_CAPABILITY_AREA tcsCapArea;

1402

UINT32 tcsSubCap = 0;

1403

UINT32 tcsSubCapContainer;

1404

TSS_RESULT result;

1405

UINT32 nonVolFlags, volFlags, respLen, correct_endianess = 0;

1406

BYTE *respData;

1407

UINT64 offset;

1408

TSS_BOOL fOwnerAuth = FALSE; /* flag for caps that need owner auth */

1409

1410

if (pulRespDataLength == NULL || prgbRespData == NULL)

1411

return TSPERR(TSS_E_BAD_PARAMETER);

1412

1413

if ((result = obj_tpm_get_tsp_context(hTPM, &tspContext)))

1414

return result;

1415

1416

/* Verify the caps and subcaps */

1417

switch (capArea) {

1418

case TSS_TPMCAP_ORD:

1419

if ((ulSubCapLength != sizeof(UINT32)) || !rgbSubCap)

1420

return TSPERR(TSS_E_BAD_PARAMETER);

1421

1422

tcsCapArea = TCPA_CAP_ORD;

1423

tcsSubCap = *(UINT32 *)rgbSubCap;

1424

break;

1425

case TSS_TPMCAP_FLAG:

1426

fOwnerAuth = TRUE;

1427

break;

1428

case TSS_TPMCAP_ALG: /* Queries whether an algorithm is supported by the TPM. */

1429

if ((ulSubCapLength != sizeof(UINT32)) || !rgbSubCap)

1430

return TSPERR(TSS_E_BAD_PARAMETER);

1431

1432

tcsCapArea = TCPA_CAP_ALG;

1433

switch (*(UINT32 *)rgbSubCap) {

1434

case TSS_ALG_RSA:

1435

tcsSubCap = TCPA_ALG_RSA;

1436

break;

1437

case TSS_ALG_AES:

1438

tcsSubCap = TCPA_ALG_AES;

1439

break;

1440

case TSS_ALG_3DES:

1441

tcsSubCap = TCPA_ALG_3DES;

1442

break;

1443

case TSS_ALG_DES:

1444

tcsSubCap = TCPA_ALG_DES;

1445

break;

1446

default:

1447

tcsSubCap = *(UINT32 *)rgbSubCap;

1448

break;

1449

}

1450

break;

1451

case TSS_TPMCAP_PROPERTY: /* Determines a physical property of the TPM. */

1452

if ((ulSubCapLength != sizeof(UINT32)) || !rgbSubCap)

1453

return TSPERR(TSS_E_BAD_PARAMETER);

1454

1455

tcsCapArea = TCPA_CAP_PROPERTY;

1456

tcsSubCapContainer = *(UINT32 *)rgbSubCap;

1457

1458

if (tcsSubCapContainer == TSS_TPMCAP_PROP_PCR) {

1459

tcsSubCap = TPM_CAP_PROP_PCR;

1460

correct_endianess = 1;

1461

} else if (tcsSubCapContainer == TSS_TPMCAP_PROP_DIR) {

1462

tcsSubCap = TPM_CAP_PROP_DIR;

1463

correct_endianess = 1;

1464

} else if (tcsSubCapContainer == TSS_TPMCAP_PROP_SLOTS) {

1465

tcsSubCap = TPM_CAP_PROP_SLOTS;

1466

correct_endianess = 1;

1467

} else if (tcsSubCapContainer == TSS_TPMCAP_PROP_MANUFACTURER) {

1468

tcsSubCap = TPM_CAP_PROP_MANUFACTURER;

1469

} else

1470

return TSPERR(TSS_E_BAD_PARAMETER);

1471

break;

1472

case TSS_TPMCAP_VERSION: /* Queries the current TPM version. */

1473

tcsCapArea = TCPA_CAP_VERSION;

1474

break;

1475

default:

1476

return TSPERR(TSS_E_BAD_PARAMETER);

1477

break;

1478

}

1479

1480

if (fOwnerAuth) {

1481

/* do an owner authorized get capability call */

1482

if ((result = get_tpm_flags(tspContext, hTPM, &volFlags, &nonVolFlags)))

1483

return result;

1484

1485

respLen = 2 * sizeof(UINT32);

1486

respData = calloc_tspi(tspContext, respLen);

1487

if (respData == NULL) {

1488

LogError("malloc of %d bytes failed.", respLen);

1489

return TSPERR(TSS_E_OUTOFMEMORY);

1490

}

1491

1492

offset = 0;

1493

Trspi_LoadBlob_UINT32(&offset, nonVolFlags, respData);

1494

Trspi_LoadBlob_UINT32(&offset, volFlags, respData);

1495

1496

*pulRespDataLength = respLen;

1497

*prgbRespData = respData;

1498

} else {

1499

tcsSubCap = endian32(tcsSubCap);

1500

1501

result = TCSP_GetCapability(tspContext, tcsCapArea, ulSubCapLength,

1502

(BYTE *)&tcsSubCap, &respLen, &respData);

1503

1504

*prgbRespData = calloc_tspi(tspContext, respLen);

1505

if (*prgbRespData == NULL) {

1506

free(respData);

1507

LogError("malloc of %d bytes failed.", respLen);

1508

return TSPERR(TSS_E_OUTOFMEMORY);

1509

}

1510

1511

*pulRespDataLength = respLen;

1512

memcpy(*prgbRespData, respData, respLen);

1513

free(respData);

1514

1515

if (*pulRespDataLength == sizeof(UINT32) && correct_endianess) {

1516

*((UINT32 *)(*prgbRespData)) = endian32(*((UINT32 *)(*prgbRespData)));

1517

}

1518

}

1519

1520

return result;

1521

}

1522

1523

TSS_RESULT

1524

Tspi_TPM_GetCapabilitySigned(TSS_HTPM hTPM, /* in */

1525

TSS_HTPM hKey, /* in */

1526

TSS_FLAG capArea, /* in */

1527

UINT32 ulSubCapLength, /* in */

1528

BYTE * rgbSubCap, /* in */

1529

TSS_VALIDATION * pValidationData, /* in, out */

1530

UINT32 * pulRespDataLength, /* out */

1531

BYTE ** prgbRespData) /* out */

1532

{

1533

#if 1

1534

1535

* Function was found to have a vulnerability, so implementation is not

1536

* required by the TSS 1.1b spec.

1537

1538

return TSPERR(TSS_E_NOTIMPL);

1539

#else

1540

TPM_AUTH auth;

1541

TCS_CONTEXT_HANDLE tcsContext;

1542

TCPA_RESULT result;

1543

BYTE *hashBlob;

1544

UINT64 offset;

1545

TCPA_DIGEST hashDigest;

1546

TCPA_VERSION version;

1547

TSS_HPOLICY hPolicy;

1548

TCPA_NONCE antiReplay;

1549

TCS_KEY_HANDLE tcsKeyHandle;

1550

TCPA_CAPABILITY_AREA tcsCapArea;

1551

UINT32 tcsSubCapContainer;

1552

BYTE tcsSubCap[4];

1553

UINT32 sigSize;

1554

BYTE *sig = NULL;

1555

UINT32 keyDataSize;

1556

BYTE *keyData;

1557

TCPA_KEY keyContainer;

1558

1559

if (pulRespDataLength == NULL || prgbRespData == NULL)

1560

return TSPERR(TSS_E_BAD_PARAMETER);

1561

1562

if ((result = obj_tpm_get_tsp_context(hTPM, &tspContext)))

1563

return result;

1564

1565

if ((result = obj_tpm_is_connected(hTPM, &tcsContext)))

1566

return result;

1567

1568

if ((result = obj_rsakey_get_tcs_handle(hKey, &tcsKeyHandle)))

1569

return result;

1570

1571

if ((result = obj_rsakey_get_policy(hKey, TSS_POLICY_USAGE, &hPolicy, NULL)))

1572

return result;

1573

1574

/* Verify the caps and subcaps */

1575

switch (capArea) {

1576

1577

case TSS_TPMCAP_ALG: /* Queries whether an algorithm is supported. */

1578

tcsCapArea = TCPA_CAP_ALG;

1579

break;

1580

case TSS_TPMCAP_PROPERTY: /* Determines a physical property of the TPM. */

1581

tcsCapArea = TCPA_CAP_PROPERTY;

1582

tcsSubCapContainer = Decode_UINT32(rgbSubCap);

1583

if (tcsSubCapContainer == TSS_TPMCAP_PROP_PCR) {

1584

UINT32ToArray(TCPA_CAP_PROP_PCR, tcsSubCap);

1585

} else if (tcsSubCapContainer == TSS_TPMCAP_PROP_DIR) {

1586

UINT32ToArray(TCPA_CAP_PROP_DIR, tcsSubCap);

1587

} else if (tcsSubCapContainer == TSS_TPMCAP_PROP_SLOTS) {

1588

UINT32ToArray(TCPA_CAP_PROP_SLOTS, tcsSubCap);

1589

} else if (tcsSubCapContainer == TSS_TPMCAP_PROP_MANUFACTURER) {

1590

UINT32ToArray(TCPA_CAP_PROP_MANUFACTURER, tcsSubCap);

1591

} else

1592

return TSPERR(TSS_E_BAD_PARAMETER);

1593

break;

1594

case TSS_TPMCAP_VERSION: /* Queries the current TPM version. */

1595

tcsCapArea = TCPA_CAP_VERSION;

1596

break;

1597

default:

1598

return TSPERR(TSS_E_BAD_PARAMETER);

1599

}

1600

1601

/* If we get to this point, then neither getCapOwner nor an internal

1602

* getCap was called. */

1603

if (pValidationData == NULL) {

1604

if ((result = internal_GetRandomNonce(tcsContext, &antiReplay))) {

1605

LogError("Failed creating random nonce");

1606

return TSPERR(TSS_E_INTERNAL_ERROR);

1607

}

1608

} else {

1609

if (pValidationData->ulExternalDataLength < sizeof(antiReplay.nonce))

1610

return TSPERR(TSS_E_BAD_PARAMETER);

1611

1612

memcpy(antiReplay.nonce, pValidationData->rgbExternalData,

1613

sizeof(antiReplay.nonce));

1614

}

1615

1616

/* Now do some Hashing */

1617

offset = 0;

1618

hashBlob = malloc((3 * sizeof(UINT32)) + sizeof(TCPA_NONCE) + ulSubCapLength);

1619

if (hashBlob == NULL) {

1620

LogError("malloc of %zd bytes failed.", (3 * sizeof(UINT32)) + sizeof(TCPA_NONCE)

1621

+ ulSubCapLength);

1622

return TSPERR(TSS_E_OUTOFMEMORY);

1623

}

1624

Trspi_LoadBlob_UINT32(&offset, TPM_ORD_GetCapabilitySigned, hashBlob);

1625

Trspi_LoadBlob(&offset, sizeof(TCPA_NONCE), hashBlob, antiReplay.nonce);

1626

Trspi_LoadBlob_UINT32(&offset, tcsCapArea, hashBlob);

1627

Trspi_LoadBlob_UINT32(&offset, ulSubCapLength, hashBlob);

1628

Trspi_LoadBlob(&offset, ulSubCapLength, hashBlob, rgbSubCap);

1629

Trspi_Hash(TSS_HASH_SHA1, offset, hashBlob, hashDigest.digest);

1630

free(hashBlob);

1631

1632

/* hashDigest now has the hash result */

1633

if ((result = secret_PerformAuth_OIAP(hKey, TPM_ORD_GetCapabilitySigned,

1634

hPolicy, &hashDigest, &auth)))

1635

return result;

1636

1637

if ((result = TCSP_GetCapabilitySigned(tcsContext,

1638

tcsKeyHandle, antiReplay,

1639

tcsCapArea,

1640

ulSubCapLength,

1641

rgbSubCap,

1642

&auth, &version, pulRespDataLength,

1643

prgbRespData,

1644

&sigSize,

1645

&sig)))

1646

return result;

1647

1648

/* validate return auth */

1649

offset = 0;

1650

hashBlob = malloc(20 + *pulRespDataLength + sigSize);

1651

if (hashBlob == NULL) {

1652

LogError("malloc of %d bytes failed.", 20 + *pulRespDataLength + sigSize);

1653

free(sig);

1654

return TSPERR(TSS_E_OUTOFMEMORY);

1655

}

1656

Trspi_LoadBlob_UINT32(&offset, result, hashBlob);

1657

Trspi_LoadBlob_UINT32(&offset, TPM_ORD_GetCapabilitySigned, hashBlob);

1658

Trspi_LoadBlob_TCPA_VERSION(&offset, hashBlob, version);

1659

Trspi_LoadBlob_UINT32(&offset, *pulRespDataLength, hashBlob);

1660

Trspi_LoadBlob(&offset, *pulRespDataLength, hashBlob, *prgbRespData);

1661

Trspi_LoadBlob_UINT32(&offset, sigSize, hashBlob);

1662

Trspi_LoadBlob(&offset, sigSize, hashBlob, sig);

1663

Trspi_Hash(TSS_HASH_SHA1, offset, hashBlob, hashDigest.digest);

1664

free(hashBlob);

1665

1666

if ((result = obj_policy_validate_auth_oiap(hPolicy, &hashDigest, &auth))) {

1667

free(sig);

1668

return result;

1669

}

1670

1671

if (pValidationData == NULL) {

1672

if ((result = Tspi_GetAttribData(hKey, TSS_TSPATTRIB_KEY_BLOB,

1673

TSS_TSPATTRIB_KEYBLOB_BLOB, &keyDataSize, &keyData))) {

1674

free(sig);

1675

LogError("Failed call to GetAttribData to get key blob");

1676

return TSPERR(TSS_E_INTERNAL_ERROR);

1677

}

1678

1679

offset = 0;

1680

Trspi_UnloadBlob_KEY(tspContext, &offset, keyData, &keyContainer);

1681

1682

offset = 0;

1683

hashBlob = malloc(*pulRespDataLength + sizeof(TCPA_NONCE));

1684

if (hashBlob == NULL) {

1685

LogError("malloc of %zd bytes failed.", *pulRespDataLength + sizeof(TCPA_NONCE));

1686

free(sig);

1687

return TSPERR(TSS_E_OUTOFMEMORY);

1688

}

1689

Trspi_LoadBlob(&offset, *pulRespDataLength, hashBlob, *prgbRespData);

1690

Trspi_LoadBlob(&offset, sizeof(TCPA_NONCE), hashBlob, antiReplay.nonce);

1691

1692

Trspi_Hash(TSS_HASH_SHA1, offset, hashBlob, hashDigest.digest);

1693

free(hashBlob);

1694

1695

if ((result = Trspi_Verify(TSS_HASH_SHA1, hashDigest.digest, 20,

1696

keyContainer.pubKey.key, keyContainer.pubKey.keyLength,

1697

sig, sigSize))) {

1698

free(sig);

1699

return TSPERR(TSS_E_VERIFICATION_FAILED);

1700

}

1701

1702

} else {

1703

pValidationData->DataLength = *pulRespDataLength + 20;

1704

pValidationData->Data = calloc_tspi(tspContext, *pulRespDataLength);

1705

if (pValidationData->Data == NULL) {

1706

LogError("malloc of %d bytes failed.", *pulRespDataLength);

1707

free(sig);

1708

return TSPERR(TSS_E_OUTOFMEMORY);

1709

}

1710

memcpy(pValidationData->Data, *prgbRespData, *pulRespDataLength);

1711

memcpy(&pValidationData->Data[(*pulRespDataLength)], antiReplay.nonce, 20);

1712

pValidationData->ValidationDataLength = sigSize;

1713

pValidationData->ValidationData = calloc_tspi(tspContext, sigSize);

1714

if (pValidationData->ValidationData == NULL) {

1715

LogError("malloc of %d bytes failed.", sigSize);

1716

free(sig);

1717

return TSPERR(TSS_E_OUTOFMEMORY);

1718

}

1719

memcpy(pValidationData->ValidationData, sig, sigSize);

1720

}

1721

1722

return TSS_SUCCESS;

1723

#endif

1724

}

1725

1726

TSS_RESULT

1727

Tspi_TPM_CreateMaintenanceArchive(TSS_HTPM hTPM, /* in */

1728

TSS_BOOL fGenerateRndNumber, /* in */

1729

UINT32 * pulRndNumberLength, /* out */

1730

BYTE ** prgbRndNumber, /* out */

1731

UINT32 * pulArchiveDataLength, /* out */

1732

BYTE ** prgbArchiveData) /* out */

1733

{

1734

TSS_RESULT result;

1735

TSS_HCONTEXT tspContext;

1736

TSS_HPOLICY hOwnerPolicy;

1737

TPM_AUTH ownerAuth;

1738

TCPA_DIGEST digest;

1739

UINT64 offset;

1740

BYTE hashBlob[512];

1741

1742

if (pulArchiveDataLength == NULL || prgbArchiveData == NULL)

1743

return TSPERR(TSS_E_BAD_PARAMETER);

1744

1745

if (fGenerateRndNumber &&

1746

(pulRndNumberLength == NULL || prgbRndNumber == NULL))

1747

return TSPERR(TSS_E_BAD_PARAMETER);

1748

1749

if ((result = obj_tpm_get_tsp_context(hTPM, &tspContext)))

1750

return result;

1751

1752

if ((result = Tspi_GetPolicyObject(hTPM, TSS_POLICY_USAGE, &hOwnerPolicy)))

1753

return result;

1754

1755

offset = 0;

1756

Trspi_LoadBlob_UINT32(&offset, TPM_ORD_CreateMaintenanceArchive, hashBlob);

1757

Trspi_LoadBlob_BYTE(&offset, fGenerateRndNumber, hashBlob);

1758

Trspi_Hash(TSS_HASH_SHA1, offset, hashBlob, digest.digest);

1759

1760

if ((result = secret_PerformAuth_OIAP(hTPM, TPM_ORD_CreateMaintenanceArchive,

1761

hOwnerPolicy, &digest,

1762

&ownerAuth)))

1763

return result;

1764

1765

if ((result = TCSP_CreateMaintenanceArchive(tspContext, fGenerateRndNumber, &ownerAuth,

1766

pulRndNumberLength, prgbRndNumber,

1767

pulArchiveDataLength, prgbArchiveData)))

1768

return result;

1769

1770

offset = 0;

1771

Trspi_LoadBlob_UINT32(&offset, result, hashBlob);

1772

Trspi_LoadBlob_UINT32(&offset, TPM_ORD_CreateMaintenanceArchive, hashBlob);

1773

Trspi_LoadBlob_UINT32(&offset, *pulRndNumberLength, hashBlob);

1774

Trspi_LoadBlob(&offset, *pulRndNumberLength, hashBlob, *prgbRndNumber);

1775

Trspi_LoadBlob_UINT32(&offset, *pulArchiveDataLength, hashBlob);

1776

Trspi_LoadBlob(&offset, *pulArchiveDataLength, hashBlob, *prgbArchiveData);

1777

Trspi_Hash(TSS_HASH_SHA1, offset, hashBlob, digest.digest);

1778

1779

if ((result = obj_policy_validate_auth_oiap(hOwnerPolicy, &digest, &ownerAuth)))

1780

return result;

1781

1782

return TSS_SUCCESS;

1783

}

1784

1785

TSS_RESULT

1786

Tspi_TPM_KillMaintenanceFeature(TSS_HTPM hTPM) /* in */

1787

{

1788

TSS_RESULT result;

1789

TSS_HCONTEXT tspContext;

1790

TSS_HPOLICY hOwnerPolicy;

1791

TPM_AUTH ownerAuth;

1792

TCPA_DIGEST digest;

1793

UINT64 offset;

1794

BYTE hashBlob[128];

1795

1796

if ((result = obj_tpm_get_tsp_context(hTPM, &tspContext)))

1797

return result;

1798

1799

if ((result = Tspi_GetPolicyObject(hTPM, TSS_POLICY_USAGE, &hOwnerPolicy)))

1800

return result;

1801

1802

offset = 0;

1803

Trspi_LoadBlob_UINT32(&offset, TPM_ORD_KillMaintenanceFeature, hashBlob);

1804

Trspi_Hash(TSS_HASH_SHA1, offset, hashBlob, digest.digest);

1805

1806

if ((result = secret_PerformAuth_OIAP(hTPM,

1807

TPM_ORD_KillMaintenanceFeature,

1808

hOwnerPolicy, &digest,

1809

&ownerAuth)))

1810

return result;

1811

1812

if ((result = TCSP_KillMaintenanceFeature(tspContext, &ownerAuth)))

1813

return result;

1814

1815

offset = 0;

1816

Trspi_LoadBlob_UINT32(&offset, result, hashBlob);

1817

Trspi_LoadBlob_UINT32(&offset, TPM_ORD_KillMaintenanceFeature, hashBlob);

1818

Trspi_Hash(TSS_HASH_SHA1, offset, hashBlob, digest.digest);

1819

1820

if ((result = obj_policy_validate_auth_oiap(hOwnerPolicy, &digest, &ownerAuth)))

1821

return result;

1822

1823

return TSS_SUCCESS;

1824

}

1825

1826

TSS_RESULT

1827

Tspi_TPM_LoadMaintenancePubKey(TSS_HTPM hTPM, /* in */

1828

TSS_HKEY hMaintenanceKey, /* in */

1829

TSS_VALIDATION * pValidationData) /* in, out */

1830

{

1831

TSS_RESULT result;

1832

TSS_HCONTEXT tspContext;

1833

TCPA_DIGEST checkSum, digest;

1834

TCPA_NONCE nonce;

1835

UINT64 offset;

1836

UINT32 pubBlobSize;

1837

BYTE hashBlob[512], *pubBlob;

1838

1839

if ((result = obj_tpm_get_tsp_context(hTPM, &tspContext)))

1840

return result;

1841

1842

if (pValidationData == NULL) {

1843

if ((result = internal_GetRandomNonce(tspContext, &nonce)))

1844

return result;

1845

} else {

1846

if (pValidationData->ulExternalDataLength < sizeof(nonce.nonce))

1847

return TSPERR(TSS_E_BAD_PARAMETER);

1848

1849

memcpy(&nonce.nonce, pValidationData->rgbExternalData, sizeof(nonce.nonce));

1850

}

1851

1852

if ((result = obj_rsakey_get_pub_blob(hMaintenanceKey, &pubBlobSize, &pubBlob)))

1853

return result;

1854

1855

if ((result = TCSP_LoadManuMaintPub(tspContext, nonce, pubBlobSize, pubBlob, &checkSum)))

1856

return result;

1857

1858

offset = 0;

1859

Trspi_LoadBlob(&offset, pubBlobSize, hashBlob, pubBlob);

1860

Trspi_LoadBlob(&offset, TCPA_SHA1_160_HASH_LEN, hashBlob, (BYTE *)&nonce.nonce);

1861

1862

if (pValidationData == NULL) {

1863

if ((result = Trspi_Hash(TSS_HASH_SHA1, offset, hashBlob, digest.digest)))

1864

return result;

1865

1866

if (memcmp(&digest.digest, &checkSum.digest, TCPA_SHA1_160_HASH_LEN))

1867

result = TSPERR(TSS_E_FAIL);

1868

} else {

1869

if ((pValidationData->rgbData = calloc_tspi(tspContext, offset)) == NULL)

1870

return TSPERR(TSS_E_OUTOFMEMORY);

1871

1872

pValidationData->ulDataLength = offset;

1873

memcpy(pValidationData->rgbData, hashBlob, offset);

1874

1875

if ((pValidationData->rgbValidationData = calloc_tspi(tspContext,

1876

TCPA_SHA1_160_HASH_LEN))

1877

== NULL) {

1878

free_tspi(tspContext, pValidationData->rgbData);

1879

pValidationData->rgbData = NULL;

1880

pValidationData->ulDataLength = 0;

1881

return TSPERR(TSS_E_OUTOFMEMORY);

1882

}

1883

pValidationData->ulValidationDataLength = TCPA_SHA1_160_HASH_LEN;

1884

1885

memcpy(pValidationData->rgbValidationData, checkSum.digest, TCPA_SHA1_160_HASH_LEN);

1886

}

1887

1888

return result;

1889

}

1890

1891

TSS_RESULT

1892

Tspi_TPM_CheckMaintenancePubKey(TSS_HTPM hTPM, /* in */

1893

TSS_HKEY hMaintenanceKey, /* in */

1894

TSS_VALIDATION * pValidationData) /* in, out */

1895

{

1896

TSS_RESULT result;

1897

TSS_HCONTEXT tspContext;

1898

TCPA_DIGEST checkSum, digest;

1899

TCPA_NONCE nonce;

1900

UINT64 offset;

1901

UINT32 pubBlobSize;

1902

BYTE hashBlob[512], *pubBlob;

1903

1904

if ((pValidationData && hMaintenanceKey) || (!pValidationData && !hMaintenanceKey))

1905

return TSPERR(TSS_E_BAD_PARAMETER);

1906

1907

if ((result = obj_tpm_get_tsp_context(hTPM, &tspContext)))

1908

return result;

1909

1910

if (pValidationData == NULL) {

1911

if ((result = internal_GetRandomNonce(tspContext, &nonce)))

1912

return result;

1913

} else {

1914

if (pValidationData->ulExternalDataLength < sizeof(nonce.nonce))

1915

return TSPERR(TSS_E_BAD_PARAMETER);

1916

1917

memcpy(&nonce.nonce, pValidationData->rgbExternalData, sizeof(nonce.nonce));

1918

}

1919

1920

if ((result = TCSP_ReadManuMaintPub(tspContext, nonce, &checkSum)))

1921

return result;

1922

1923

if (pValidationData == NULL) {

1924

if ((result = obj_rsakey_get_pub_blob(hMaintenanceKey, &pubBlobSize, &pubBlob)))

1925

return result;

1926

1927

offset = 0;

1928

Trspi_LoadBlob(&offset, pubBlobSize, hashBlob, pubBlob);

1929

Trspi_LoadBlob(&offset, TCPA_SHA1_160_HASH_LEN, hashBlob, (BYTE *)&nonce.nonce);

1930

1931

if ((result = Trspi_Hash(TSS_HASH_SHA1, offset, hashBlob, digest.digest))) {

1932

free_tspi(tspContext, pubBlob);

1933

return result;

1934

}

1935

1936

if (memcmp(&digest.digest, &checkSum.digest, TCPA_SHA1_160_HASH_LEN))

1937

result = TSPERR(TSS_E_FAIL);

1938

1939

free_tspi(tspContext, pubBlob);

1940

} else {

1941

/* Ignore Data and DataLength, the application must already have this data.

1942

* Do, however, copy out the checksum so that the application can verify */

1943

if ((pValidationData->rgbValidationData = calloc_tspi(tspContext,

1944

TCPA_SHA1_160_HASH_LEN))

1945

== NULL)

1946

return TSPERR(TSS_E_OUTOFMEMORY);

1947

1948

pValidationData->ulValidationDataLength = TCPA_SHA1_160_HASH_LEN;

1949

memcpy(pValidationData->rgbValidationData, checkSum.digest, TCPA_SHA1_160_HASH_LEN);

1950

}

1951

1952

return result;

1953

}

1954

1955

TSS_RESULT

1956

Tspi_TPM_GetRandom(TSS_HTPM hTPM, /* in */

1957

UINT32 ulRandomDataLength, /* in */

1958

BYTE ** prgbRandomData) /* out */

1959

{

1960

TSS_HCONTEXT tspContext;

1961

TSS_RESULT result;

1962

1963

if (prgbRandomData == NULL || ulRandomDataLength > 4096)

1964

return TSPERR(TSS_E_BAD_PARAMETER);

1965

1966

if ((result = obj_tpm_get_tsp_context(hTPM, &tspContext)))

1967

return result;

1968

1969

if (ulRandomDataLength == 0)

1970

return TSS_SUCCESS;

1971

1972

if ((result = TCSP_GetRandom(tspContext, ulRandomDataLength, prgbRandomData)))

1973

return result;

1974

1975

return TSS_SUCCESS;

1976

}

1977

1978

TSS_RESULT

1979

Tspi_TPM_StirRandom(TSS_HTPM hTPM, /* in */

1980

UINT32 ulEntropyDataLength, /* in */

1981

BYTE * rgbEntropyData) /* in */

1982

{

1983

TSS_RESULT result;

1984

TSS_HCONTEXT tspContext;

1985

1986

if (ulEntropyDataLength > 0 && rgbEntropyData == NULL)

1987

return TSPERR(TSS_E_BAD_PARAMETER);

1988

1989

if ((result = obj_tpm_get_tsp_context(hTPM, &tspContext)))

1990

return result;

1991

1992

if ((result = TCSP_StirRandom(tspContext, ulEntropyDataLength, rgbEntropyData)))

1993

return result;

1994

1995

return TSS_SUCCESS;

1996

}

1997

1998

TSS_RESULT

1999

Tspi_TPM_AuthorizeMigrationTicket(TSS_HTPM hTPM, /* in */

2000

TSS_HKEY hMigrationKey, /* in */

2001

TSS_MIGRATION_SCHEME migrationScheme, /* in */

2002

UINT32 * pulMigTicketLength, /* out */

2003

BYTE ** prgbMigTicket) /* out */

2004

{

2005

UINT64 offset;

2006

BYTE hashblob[0x1000];

2007

TCPA_DIGEST digest;

2008

TCPA_RESULT result;

2009

TSS_HPOLICY hOwnerPolicy;

2010

UINT32 migrationKeySize;

2011

BYTE *migrationKeyBlob;

2012

TCPA_KEY tcpaKey;

2013

BYTE pubKeyBlob[0x1000];

2014

TPM_AUTH ownerAuth;

2015

UINT32 pubKeySize;

2016

TSS_HCONTEXT tspContext;

2017

UINT32 tpmMigrationScheme;

2018

2019

if (pulMigTicketLength == NULL || prgbMigTicket == NULL)

2020

return TSPERR(TSS_E_BAD_PARAMETER);

2021

2022

if ((result = obj_tpm_get_tsp_context(hTPM, &tspContext)))

2023

return result;

2024

2025

/* get the tpm Policy */

2026

if ((result = Tspi_GetPolicyObject(hTPM, TSS_POLICY_USAGE, &hOwnerPolicy)))

2027

return result;

2028

2029

switch (migrationScheme) {

2030

case TSS_MS_MIGRATE:

2031

tpmMigrationScheme = TCPA_MS_MIGRATE;

2032

break;

2033

case TSS_MS_REWRAP:

2034

tpmMigrationScheme = TCPA_MS_REWRAP;

2035

break;

2036

case TSS_MS_MAINT:

2037

tpmMigrationScheme = TCPA_MS_MAINT;

2038

break;

2039

default:

2040

return TSPERR(TSS_E_BAD_PARAMETER);

2041

break;

2042

}

2043

2044

/* Get the migration key blob */

2045

if ((result = obj_rsakey_get_blob(hMigrationKey,

2046

&migrationKeySize, &migrationKeyBlob)))

2047

return result;

2048

2049

/* First, turn the keyBlob into a TCPA_KEY structure */

2050

offset = 0;

2051

memset(&tcpaKey, 0, sizeof(TCPA_KEY));

2052

if ((result = Trspi_UnloadBlob_KEY(&offset, migrationKeyBlob, &tcpaKey))) {

2053

free_tspi(tspContext, migrationKeyBlob);

2054

return result;

2055

}

2056

free_tspi(tspContext, migrationKeyBlob);

2057

2058

/* Then pull the _PUBKEY portion out of that struct into a blob */

2059

offset = 0;

2060

Trspi_LoadBlob_KEY_PARMS(&offset, pubKeyBlob, &tcpaKey.algorithmParms);

2061

Trspi_LoadBlob_STORE_PUBKEY(&offset, pubKeyBlob, &tcpaKey.pubKey);

2062

pubKeySize = offset;

2063

free_key_refs(&tcpaKey);

2064

2065

/* Auth */

2066

offset = 0;

2067

Trspi_LoadBlob_UINT32(&offset, TPM_ORD_AuthorizeMigrationKey, hashblob);

2068

Trspi_LoadBlob_UINT16(&offset, tpmMigrationScheme, hashblob);

2069

Trspi_LoadBlob(&offset, pubKeySize, hashblob, pubKeyBlob);

2070

Trspi_Hash(TSS_HASH_SHA1, offset, hashblob, digest.digest);

2071

2072

if ((result = secret_PerformAuth_OIAP(hTPM,

2073

TPM_ORD_AuthorizeMigrationKey,

2074

hOwnerPolicy, &digest,

2075

&ownerAuth)))

2076

return result;

2077

2078

/* Send command */

2079

if ((result = TCSP_AuthorizeMigrationKey(tspContext, migrationScheme, pubKeySize,

2080

pubKeyBlob, &ownerAuth, pulMigTicketLength,

2081

prgbMigTicket)))

2082

return result;

2083

2084

/* Validate Auth */

2085

offset = 0;

2086

Trspi_LoadBlob_UINT32(&offset, result, hashblob);

2087

Trspi_LoadBlob_UINT32(&offset, TPM_ORD_AuthorizeMigrationKey, hashblob);

2088

Trspi_LoadBlob(&offset, *pulMigTicketLength, hashblob, *prgbMigTicket);

2089

Trspi_Hash(TSS_HASH_SHA1, offset, hashblob, digest.digest);

2090

2091

if ((result = obj_policy_validate_auth_oiap(hOwnerPolicy, &digest, &ownerAuth))) {

2092

free_tspi(tspContext, prgbMigTicket);

2093

return result;

2094

}

2095

2096

return TSS_SUCCESS;

2097

}

2098

2099

TSS_RESULT

2100

Tspi_TPM_GetEvent(TSS_HTPM hTPM, /* in */

2101

UINT32 ulPcrIndex, /* in */

2102

UINT32 ulEventNumber, /* in */

2103

TSS_PCR_EVENT * pPcrEvent) /* out */

2104

{

2105

TSS_HCONTEXT tspContext;

2106

TSS_RESULT result;

2107

TSS_PCR_EVENT *event = NULL;

2108

2109

if (pPcrEvent == NULL)

2110

return TSPERR(TSS_E_BAD_PARAMETER);

2111

2112

if ((result = obj_tpm_get_tsp_context(hTPM, &tspContext)))

2113

return result;

2114

2115

if ((result = TCS_GetPcrEvent(tspContext, ulPcrIndex, &ulEventNumber, &event)))

2116

return result;

2117

2118

memcpy(pPcrEvent, event, sizeof(TSS_PCR_EVENT));

2119

free(event);

2120

2121

return TSS_SUCCESS;

2122

}

2123

2124

TSS_RESULT

2125

Tspi_TPM_GetEvents(TSS_HTPM hTPM, /* in */

2126

UINT32 ulPcrIndex, /* in */

2127

UINT32 ulStartNumber, /* in */

2128

UINT32 * pulEventNumber, /* in, out */

2129

TSS_PCR_EVENT ** prgbPcrEvents) /* out */

2130

{

2131

TSS_HCONTEXT tspContext;

2132

TSS_RESULT result;

2133

TSS_PCR_EVENT *events = NULL;

2134

2135

if (pulEventNumber == NULL)

2136

return TSPERR(TSS_E_BAD_PARAMETER);

2137

2138

if ((result = obj_tpm_get_tsp_context(hTPM, &tspContext)))

2139

return result;

2140

2141

if (prgbPcrEvents) {

2142

if ((result = TCS_GetPcrEventsByPcr(tspContext, ulPcrIndex, ulStartNumber,

2143

pulEventNumber, &events)))

2144

return result;

2145

2146

*prgbPcrEvents = events;

2147

} else {

2148

/* if the pointer to receive events is NULL, the app only

2149

* wants a total number of events for this PCR. */

2150

if ((result = TCS_GetPcrEvent(tspContext, ulPcrIndex, pulEventNumber, NULL)))

2151

return result;

2152

}

2153

2154

return TSS_SUCCESS;

2155

}

2156

2157

TSS_RESULT

2158

Tspi_TPM_GetEventLog(TSS_HTPM hTPM, /* in */

2159

UINT32 * pulEventNumber, /* out */

2160

TSS_PCR_EVENT ** prgbPcrEvents) /* out */

2161

{

2162

TSS_HCONTEXT tspContext;

2163

TSS_RESULT result;

2164

2165

if (pulEventNumber == NULL)

2166

return TSPERR(TSS_E_BAD_PARAMETER);

2167

2168

if ((result = obj_tpm_get_tsp_context(hTPM, &tspContext)))

2169

return result;

2170

2171

/* if the pointer to receive events is NULL, the app only wants a

2172

* total number of events for all PCRs. */

2173

if (prgbPcrEvents == NULL) {

2174

UINT16 numPcrs = get_num_pcrs(tspContext); /* XXX Error check needed */

2175

UINT32 i, numEvents = 0;

2176

2177

*pulEventNumber = 0;

2178

for (i = 0; i < numPcrs; i++) {

2179

if ((result = TCS_GetPcrEvent(tspContext, i, &numEvents, NULL)))

2180

return result;

2181

2182

*pulEventNumber += numEvents;

2183

}

2184

} else {

2185

return TCS_GetPcrEventLog(tspContext, pulEventNumber, prgbPcrEvents);

2186

}

2187

2188

return TSS_SUCCESS;

2189

}

2190

2191

TSS_RESULT

2192

Tspi_TPM_Quote(TSS_HTPM hTPM, /* in */

2193

TSS_HKEY hIdentKey, /* in */

2194

TSS_HPCRS hPcrComposite, /* in */

2195

TSS_VALIDATION * pValidationData) /* in, out */

2196

{

2197

TCPA_RESULT result;

2198

TPM_AUTH privAuth;

2199

TPM_AUTH *pPrivAuth = &privAuth;

2200

UINT64 offset;

2201

BYTE hashBlob[1000];

2202

TCPA_DIGEST digest, composite;

2203

TCS_KEY_HANDLE tcsKeyHandle;

2204

TSS_HPOLICY hPolicy;

2205

TCPA_NONCE antiReplay;

2206

UINT32 pcrDataSize;

2207

BYTE pcrData[128];

2208

TCPA_PCR_SELECTION pcrSelect;

2209

UINT32 validationLength = 0;

2210

BYTE *validationData = NULL;

2211

UINT32 pcrDataOutSize;

2212

BYTE *pcrDataOut;

2213

UINT32 keyDataSize;

2214

BYTE *keyData;

2215

TCPA_KEY keyContainer;

2216

BYTE quoteinfo[1024];

2217

TSS_BOOL usesAuth;

2218

TSS_HCONTEXT tspContext;

2219

2220

if ((result = obj_tpm_get_tsp_context(hTPM, &tspContext)))

2221

return result;

2222

2223

if (hPcrComposite && !obj_is_pcrs(hPcrComposite))

2224

return TSPERR(TSS_E_INVALID_HANDLE);

2225

2226

/* get the identKey Policy */

2227

if ((result = obj_rsakey_get_policy(hIdentKey, TSS_POLICY_USAGE,

2228

&hPolicy, &usesAuth)))

2229

return result;

2230

2231

/* get the Identity TCS keyHandle */

2232

if ((result = obj_rsakey_get_tcs_handle(hIdentKey, &tcsKeyHandle)))

2233

return result;

2234

2235

if (pValidationData == NULL) {

2236

if ((result = internal_GetRandomNonce(tspContext, &antiReplay)))

2237

return result;

2238

} else {

2239

if (pValidationData->ulExternalDataLength < sizeof(antiReplay.nonce))

2240

return TSPERR(TSS_E_BAD_PARAMETER);

2241

2242

memcpy(antiReplay.nonce, pValidationData->rgbExternalData,

2243

sizeof(antiReplay.nonce));

2244

}

2245

2246

pcrDataSize = 0;

2247

if (hPcrComposite) {

2248

offset = 0;

2249

/* calling get_composite first forces the TSP to call the TCS

2250

* to make sure the pcr selection structure is correct */

2251

if ((result = obj_pcrs_get_composite(hPcrComposite, &composite)))

2252

return result;

2253

2254

if ((result = obj_pcrs_get_selection(hPcrComposite, &pcrSelect)))

2255

return result;

2256

2257

Trspi_LoadBlob_PCR_SELECTION(&offset, pcrData, &pcrSelect);

2258

pcrDataSize = offset;

2259

free(pcrSelect.pcrSelect);

2260

}

2261

2262

offset = 0;

2263

Trspi_LoadBlob_UINT32(&offset, TPM_ORD_Quote, hashBlob);

2264

Trspi_LoadBlob(&offset, 20, hashBlob, antiReplay.nonce);

2265

Trspi_LoadBlob(&offset, pcrDataSize, hashBlob, pcrData);

2266

Trspi_Hash(TSS_HASH_SHA1, offset, hashBlob, digest.digest);

2267

2268

if (usesAuth) {

2269

if ((result = secret_PerformAuth_OIAP(hIdentKey, TPM_ORD_Quote,

2270

hPolicy, &digest,

2271

&privAuth))) {

2272

return result;

2273

}

2274

pPrivAuth = &privAuth;

2275

} else {

2276

pPrivAuth = NULL;

2277

}

2278

2279

if ((result = TCSP_Quote(tspContext, tcsKeyHandle, antiReplay, pcrDataSize, pcrData,

2280

pPrivAuth, &pcrDataOutSize, &pcrDataOut, &validationLength,

2281

&validationData)))

2282

return result;

2283

2284

offset = 0;

2285

Trspi_LoadBlob_UINT32(&offset, result, hashBlob);

2286

Trspi_LoadBlob_UINT32(&offset, TPM_ORD_Quote, hashBlob);

2287

Trspi_LoadBlob(&offset, pcrDataOutSize, hashBlob, pcrDataOut);

2288

Trspi_LoadBlob_UINT32(&offset, validationLength, hashBlob);

2289

Trspi_LoadBlob(&offset, validationLength, hashBlob, validationData);

2290

Trspi_Hash(TSS_HASH_SHA1, offset, hashBlob, digest.digest);

2291

2292

if (usesAuth == TRUE) {

2293

if ((result = obj_policy_validate_auth_oiap(hPolicy, &digest, &privAuth))) {

2294

free(pcrDataOut);

2295

free(validationData);

2296

return result;

2297

}

2298

}

2299

2300

if (hPcrComposite) {

2301

TCPA_PCR_COMPOSITE pcrComp;

2302

2303

offset = 0;

2304

if ((result = Trspi_UnloadBlob_PCR_COMPOSITE(&offset, pcrDataOut,

2305

&pcrComp))) {

2306

free(pcrDataOut);

2307

free(validationData);

2308

return result;

2309

}

2310

2311

if ((result = obj_pcrs_set_values(hPcrComposite, &pcrComp))) {

2312

free(pcrDataOut);

2313

free(validationData);

2314

return result;

2315

}

2316

}

2317

2318

if ((result = Tspi_GetAttribData(hIdentKey, TSS_TSPATTRIB_KEY_BLOB,

2319

TSS_TSPATTRIB_KEYBLOB_BLOB,

2320

&keyDataSize, &keyData))) {

2321

free(pcrDataOut);

2322

free(validationData);

2323

return result;

2324

}

2325

2326

/* create the validation data */

2327

offset = 0;

2328

memset(&keyContainer, 0, sizeof(TCPA_KEY));

2329

if ((result = Trspi_UnloadBlob_KEY(&offset, keyData, &keyContainer)))

2330

return result;

2331

2332

/* creating pcrCompositeHash */

2333

Trspi_Hash(TSS_HASH_SHA1, pcrDataOutSize, pcrDataOut, digest.digest);

2334

free(pcrDataOut);

2335

2336

/* generate Quote_info struct */

2337

/* 1. add version */

2338

offset = 0;

2339

Trspi_LoadBlob_TCPA_VERSION(&offset, quoteinfo, keyContainer.ver);

2340

/* 2. add "QUOT" */

2341

quoteinfo[offset++] = 'Q';

2342

quoteinfo[offset++] = 'U';

2343

quoteinfo[offset++] = 'O';

2344

quoteinfo[offset++] = 'T';

2345

/* 3. Composite Hash */

2346

Trspi_LoadBlob(&offset, TCPA_SHA1_160_HASH_LEN, quoteinfo,

2347

digest.digest);

2348

/* 4. AntiReplay Nonce */

2349

Trspi_LoadBlob(&offset, TCPA_SHA1_160_HASH_LEN, quoteinfo,

2350

antiReplay.nonce);

2351

2352

if (pValidationData == NULL) {

2353

/* validate the data here */

2354

Trspi_Hash(TSS_HASH_SHA1, offset, quoteinfo, digest.digest);

2355

2356

if ((result = Trspi_Verify(TSS_HASH_SHA1, digest.digest, 20,

2357

keyContainer.pubKey.key,

2358

keyContainer.pubKey.keyLength,

2359

validationData,

2360

validationLength))) {

2361

free_key_refs(&keyContainer);

2362

free(validationData);

2363

return result;

2364

}

2365

free_key_refs(&keyContainer);

2366

} else {

2367

free_key_refs(&keyContainer);

2368

2369

pValidationData->rgbValidationData = calloc_tspi(tspContext, validationLength);

2370

if (pValidationData->rgbValidationData == NULL) {

2371

LogError("malloc of %u bytes failed.", validationLength);

2372

return TSPERR(TSS_E_OUTOFMEMORY);

2373

}

2374

pValidationData->ulValidationDataLength = validationLength;

2375

memcpy(pValidationData->rgbValidationData, validationData, validationLength);

2376

free(validationData);

2377

2378

pValidationData->rgbData = calloc_tspi(tspContext, offset);

2379

if (pValidationData->rgbData == NULL) {

2380

LogError("malloc of %" PRIu64 " bytes failed.", offset);

2381

free_tspi(tspContext, pValidationData->rgbValidationData);

2382

pValidationData->rgbValidationData = NULL;

2383

pValidationData->ulValidationDataLength = 0;

2384

return TSPERR(TSS_E_OUTOFMEMORY);

2385

}

2386

pValidationData->ulDataLength = (UINT32)offset;

2387

memcpy(pValidationData->rgbData, quoteinfo, offset);

2388

}

2389

2390

return TSS_SUCCESS;

2391

}

2392

2393

TSS_RESULT

2394

Tspi_TPM_PcrExtend(TSS_HTPM hTPM, /* in */

2395

UINT32 ulPcrIndex, /* in */

2396

UINT32 ulPcrDataLength, /* in */

2397

BYTE *pbPcrData, /* in */

2398

TSS_PCR_EVENT *pPcrEvent, /* in */

2399

UINT32 * pulPcrValueLength, /* out */

2400

BYTE ** prgbPcrValue) /* out */

2401

{

2402

TCPA_PCRVALUE outDigest;

2403

TSS_RESULT result;

2404

BYTE *extendData, *hashData;

2405

TCPA_DIGEST digest;

2406

UINT32 number, dataSize;

2407

TSS_HCONTEXT tspContext;

2408

UINT64 offset;

2409

2410

if (pulPcrValueLength == NULL || prgbPcrValue == NULL)

2411

return TSPERR(TSS_E_BAD_PARAMETER);

2412

2413

if (ulPcrDataLength > 0 && pbPcrData == NULL)

2414

return TSPERR(TSS_E_BAD_PARAMETER);

2415

2416

if ((result = obj_tpm_get_tsp_context(hTPM, &tspContext)))

2417

return result;

2418

2419

if (pPcrEvent) {

2420

dataSize = (2 * sizeof(UINT32)) + pPcrEvent->ulEventLength + ulPcrDataLength;

2421

if ((hashData = malloc(dataSize)) == NULL) {

2422

LogError("malloc of %u bytes failed.", dataSize);

2423

return TSPERR(TSS_E_OUTOFMEMORY);

2424

}

2425

2426

/* Create data to extend according to the TSS 1.2 spec section 2.6.2

2427

* 'TSS_PCR_EVENT', in the 'rgbPcrValue' parameter description. */

2428

offset = 0;

2429

Trspi_LoadBlob_UINT32(&offset, ulPcrIndex, hashData);

2430

Trspi_LoadBlob(&offset, ulPcrDataLength, hashData, pbPcrData);

2431

Trspi_LoadBlob_UINT32(&offset, pPcrEvent->eventType, hashData);

2432

Trspi_LoadBlob(&offset, pPcrEvent->ulEventLength, hashData, pPcrEvent->rgbEvent);

2433

if ((result = Trspi_Hash(TSS_HASH_SHA1, offset, hashData, digest.digest))) {

2434

free(hashData);

2435

return result;

2436

}

2437

free(hashData);

2438

2439

extendData = (BYTE *)&digest.digest;

2440

} else {

2441

if (ulPcrDataLength != TCPA_SHA1_160_HASH_LEN)

2442

return TSPERR(TSS_E_BAD_PARAMETER);

2443

2444

extendData = pbPcrData;

2445

}

2446

2447

if ((result = TCSP_Extend(tspContext, ulPcrIndex, *(TCPA_DIGEST *)extendData, &outDigest)))

2448

return result;

2449

2450

/* log the event structure if its passed in */

2451

if (pPcrEvent) {

2452

/* Set the PCR index in the event struct */

2453

pPcrEvent->ulPcrIndex = ulPcrIndex;

2454

2455

/* Allocate space for and set the data extended into the TPM in the event struct */

2456

if ((pPcrEvent->rgbPcrValue = calloc_tspi(tspContext,

2457

TCPA_SHA1_160_HASH_LEN)) == NULL) {

2458

LogError("malloc of %d bytes failed.", TCPA_SHA1_160_HASH_LEN);

2459

return TSPERR(TSS_E_OUTOFMEMORY);

2460

}

2461

2462

memcpy(pPcrEvent->rgbPcrValue, extendData, TCPA_SHA1_160_HASH_LEN);

2463

pPcrEvent->ulPcrValueLength = TCPA_SHA1_160_HASH_LEN;

2464

2465

/* Set the version info in the event struct */

2466

memcpy(&pPcrEvent->versionInfo, &VERSION_1_1, sizeof(TCPA_VERSION));

2467

2468

/* Send the log to the TCS */

2469

if ((result = TCS_LogPcrEvent(tspContext, *pPcrEvent, &number)))

2470

return result;

2471

}

2472

2473

*prgbPcrValue = calloc_tspi(tspContext, sizeof(TCPA_PCRVALUE));

2474

if (*prgbPcrValue == NULL) {

2475

LogError("malloc of %zd bytes failed.", sizeof(TCPA_PCRVALUE));

2476

return TSPERR(TSS_E_OUTOFMEMORY);

2477

}

2478

2479

memcpy(*prgbPcrValue, &outDigest, sizeof(TCPA_PCRVALUE));

2480

*pulPcrValueLength = sizeof(TCPA_PCRVALUE);

2481

2482

return result;

2483

}

2484

2485

TSS_RESULT

2486

Tspi_TPM_PcrRead(TSS_HTPM hTPM, /* in */

2487

UINT32 ulPcrIndex, /* in */

2488

UINT32 *pulPcrValueLength, /* out */

2489

BYTE **prgbPcrValue) /* out */

2490

{

2491

TCPA_PCRVALUE outDigest;

2492

TSS_RESULT result;

2493

TSS_HCONTEXT tspContext;

2494

2495

if (pulPcrValueLength == NULL || prgbPcrValue == NULL)

2496

return TSPERR(TSS_E_BAD_PARAMETER);

2497

2498

if ((result = obj_tpm_get_tsp_context(hTPM, &tspContext)))

2499

return result;

2500

2501

if ((result = TCSP_PcrRead(tspContext, ulPcrIndex, &outDigest)))

2502

return result;

2503

2504

*prgbPcrValue = calloc_tspi(tspContext, sizeof(TCPA_PCRVALUE));

2505

if (*prgbPcrValue == NULL) {

2506

LogError("malloc of %zd bytes failed.", sizeof(TCPA_PCRVALUE));

2507

return TSPERR(TSS_E_OUTOFMEMORY);

2508

}

2509

memcpy(*prgbPcrValue, outDigest.digest, sizeof(TCPA_PCRVALUE));

2510

*pulPcrValueLength = sizeof(TCPA_PCRVALUE);

2511

2512

return TSS_SUCCESS;

2513

}

2514

2515

TSS_RESULT

2516

Tspi_TPM_DirWrite(TSS_HTPM hTPM, /* in */

2517

UINT32 ulDirIndex, /* in */

2518

UINT32 ulDirDataLength, /* in */

2519

BYTE * rgbDirData) /* in */

2520

{

2521

TSS_HCONTEXT tspContext;

2522

TCPA_RESULT result;

2523

TPM_AUTH auth;

2524

TCPA_DIGEST hashDigest;

2525

UINT64 offset;

2526

BYTE hashBlob[32];

2527

TSS_HPOLICY hPolicy;

2528

TCPA_DIRVALUE dirValue = { { 0 } };

2529

2530

if (rgbDirData == NULL || (ulDirDataLength != (UINT32)sizeof(TCPA_DIRVALUE)))

2531

return TSPERR(TSS_E_BAD_PARAMETER);

2532

2533

if ((result = obj_tpm_get_tsp_context(hTPM, &tspContext)))

2534

return result;

2535

2536

if ((result = obj_tpm_get_policy(hTPM, &hPolicy)))

2537

return result;

2538

2539

memcpy((BYTE *)&dirValue, rgbDirData, ulDirDataLength);

2540

2541

/* hash to be used for the OIAP calc */

2542

offset = 0;

2543

Trspi_LoadBlob_UINT32(&offset, TPM_ORD_DirWriteAuth, hashBlob);

2544

Trspi_LoadBlob_UINT32(&offset, ulDirIndex, hashBlob);

2545

Trspi_LoadBlob(&offset, (UINT32)sizeof(TCPA_DIRVALUE), hashBlob, (BYTE *)&dirValue);

2546

Trspi_Hash(TSS_HASH_SHA1, offset, hashBlob, hashDigest.digest);

2547

2548

/* hashDigest now has the hash result */

2549

if ((result = secret_PerformAuth_OIAP(hTPM, TPM_ORD_DirWriteAuth,

2550

hPolicy, &hashDigest,

2551

&auth)))

2552

return result;

2553

2554

if ((result = TCSP_DirWriteAuth(tspContext, ulDirIndex, dirValue, &auth)))

2555

return result;

2556

2557

offset = 0;

2558

Trspi_LoadBlob_UINT32(&offset, result, hashBlob);

2559

Trspi_LoadBlob_UINT32(&offset, TPM_ORD_DirWriteAuth, hashBlob);

2560

Trspi_Hash(TSS_HASH_SHA1, offset, hashBlob, hashDigest.digest);

2561

2562

return obj_policy_validate_auth_oiap(hPolicy, &hashDigest, &auth);

2563

}

2564

2565

TSS_RESULT

2566

Tspi_TPM_DirRead(TSS_HTPM hTPM, /* in */

2567

UINT32 ulDirIndex, /* in */

2568

UINT32 * pulDirDataLength, /* out */

2569

BYTE ** prgbDirData) /* out */

2570

{

2571

TCPA_DIRVALUE dirValue;

2572

TSS_RESULT result;

2573

TSS_HCONTEXT tspContext;

2574

2575

if (pulDirDataLength == NULL || prgbDirData == NULL)

2576

return TSPERR(TSS_E_BAD_PARAMETER);

2577

2578

if ((result = obj_tpm_get_tsp_context(hTPM, &tspContext)))

2579

return result;

2580

2581

if ((result = TCSP_DirRead(tspContext, ulDirIndex, &dirValue)))

2582

return result;

2583

2584

*pulDirDataLength = 20;

2585

*prgbDirData = calloc_tspi(tspContext, *pulDirDataLength);

2586

if (*prgbDirData == NULL) {

2587

LogError("malloc of %d bytes failed.", *pulDirDataLength);

2588

return TSPERR(TSS_E_OUTOFMEMORY);

2589

}

2590

memcpy(*prgbDirData, dirValue.digest, *pulDirDataLength);

2591

return TSS_SUCCESS;

2592

}

Older »