~ubuntu-branches/ubuntu/hardy/trousers/hardy-proposed

Viewing changes to src/tspi/tspi_changeauth.c

Committer: Bazaar Package Importer
Author(s): Daniel Baumann
Date: 2008-01-23 22:03:00 UTC
mfrom: (1.1.1 upstream)
Revision ID: james.westby@ubuntu.com-20080123220300-fhtqja3c0oq0gp6z

Tags: 0.3.1-4

http://bugs.debian.org/457400

http://bugs.debian.org/459682

* Added patch from Aaron M. Ucko <ucko@debian.org> to allow trousers to
  build successfully on amd64, and presumably also other 64-bit
  architectures (Closes: #457400).
* Including udev rule for /dev/tpm from William Lima
  <wlima.amadeus@gmail.com> as suggested by David Smith <dds@google.com>
  (Closes: #459682).
* Added lintian overrides.

files added:
debian/TODO

debian/config

debian/config/45-trousers.rules

debian/libtspi-dev.docs

debian/lintian

debian/lintian/libtspi1

debian/lintian/trousers

debian/patches/01-tss-user.dpatch

debian/patches/02-manapge.dpatch

debian/patches/03-readme.dpatch

debian/patches/04-64bit-cleanliness.dpatch

debian/trousers.examples

man/man3/Tspi_Context_GetRegisteredKeysByUUID2.3

man/man3/Tspi_DAA_IssueCredential.3

man/man3/Tspi_DAA_IssueInit.3

man/man3/Tspi_DAA_IssueSetup.3

man/man3/Tspi_DAA_IssuerKeyVerification.3

man/man3/Tspi_DAA_VerifyInit.3

man/man3/Tspi_DAA_VerifySignature.3

man/man3/Tspi_DecodeBER_TssBlob.3

man/man3/Tspi_EncodeDER_TssBlob.3

man/man3/Tspi_TPM_DAA_JoinCreateDaaPubKey.3

man/man3/Tspi_TPM_DAA_JoinInit.3

man/man3/Tspi_TPM_DAA_JoinStoreCredential.3

man/man3/Tspi_TPM_DAA_Sign.3

man/man3/Tspi_TPM_GetAuditDigest.3

man/man3/Tspi_TPM_OwnerGetSRKPubKey.3

man/man3/Tspi_TPM_Quote2.3

src/include/authsess.h

src/include/obj_context.h

src/include/obj_daa.h

src/include/obj_delfamily.h

src/include/obj_encdata.h

src/include/obj_hash.h

src/include/obj_migdata.h

src/include/obj_nv.h

src/include/obj_pcrs.h

src/include/obj_policy.h

src/include/obj_rsakey.h

src/include/obj_tpm.h

src/include/rpc_tcstp.h

src/include/rpc_tcstp_tcs.h

src/include/rpc_tcstp_tsp.h

src/include/tcs_aik.h

src/include/tcs_context.h

src/include/tcs_key_ps.h

src/include/threads.h

src/include/tsp_audit.h

src/include/tsp_delegate.h

src/include/tsp_seal.h

src/include/tss/TSP.idl

src/include/tss/compat11b.h

src/include/tss/tcs.h

src/include/tss/tcs_defines.h

src/include/tss/tpm.h

src/include/tss/tpm_error.h

src/include/tss/tpm_ordinal.h

src/tcs/crypto

src/tcs/crypto/openssl

src/tcs/crypto/openssl/crypto.c

src/tcs/rpc

src/tcs/rpc/tcstp

src/tcs/rpc/tcstp/rpc.c

src/tcs/rpc/tcstp/rpc_admin.c

src/tcs/rpc/tcstp/rpc_aik.c

src/tcs/rpc/tcstp/rpc_audit.c

src/tcs/rpc/tcstp/rpc_auth.c

src/tcs/rpc/tcstp/rpc_bind.c

src/tcs/rpc/tcstp/rpc_caps.c

src/tcs/rpc/tcstp/rpc_caps_tpm.c

src/tcs/rpc/tcstp/rpc_certify.c

src/tcs/rpc/tcstp/rpc_changeauth.c

src/tcs/rpc/tcstp/rpc_cmk.c

src/tcs/rpc/tcstp/rpc_context.c

src/tcs/rpc/tcstp/rpc_counter.c

src/tcs/rpc/tcstp/rpc_daa.c

src/tcs/rpc/tcstp/rpc_delegate.c

src/tcs/rpc/tcstp/rpc_dir.c

src/tcs/rpc/tcstp/rpc_ek.c

src/tcs/rpc/tcstp/rpc_evlog.c

src/tcs/rpc/tcstp/rpc_key.c

src/tcs/rpc/tcstp/rpc_maint.c

src/tcs/rpc/tcstp/rpc_migration.c

src/tcs/rpc/tcstp/rpc_nv.c

src/tcs/rpc/tcstp/rpc_oper.c

src/tcs/rpc/tcstp/rpc_own.c

src/tcs/rpc/tcstp/rpc_pcr_extend.c

src/tcs/rpc/tcstp/rpc_ps.c

src/tcs/rpc/tcstp/rpc_quote.c

src/tcs/rpc/tcstp/rpc_quote2.c

src/tcs/rpc/tcstp/rpc_random.c

src/tcs/rpc/tcstp/rpc_seal.c

src/tcs/rpc/tcstp/rpc_selftest.c

src/tcs/rpc/tcstp/rpc_sign.c

src/tcs/rpc/tcstp/rpc_tick.c

src/tcs/rpc/tcstp/rpc_transport.c

src/tcs/tcs_aik.c

src/tcs/tcs_auth_mgr.c

src/tcs/tcs_caps.c

src/tcs/tcs_context.c

src/tcs/tcs_context_key.c

src/tcs/tcs_counter.c

src/tcs/tcs_evlog.c

src/tcs/tcs_evlog_biosem.c

src/tcs/tcs_evlog_imaem.c

src/tcs/tcs_key.c

src/tcs/tcs_key_mem_cache.c

src/tcs/tcs_key_ps.c

src/tcs/tcs_migration.c

src/tcs/tcs_pbg.c

src/tcs/tcs_ps.c

src/tcs/tcs_quote.c

src/tcs/tcs_quote2.c

src/tcs/tcs_req_mgr.c

src/tcs/tcs_seal.c

src/tcs/tcsi_admin.c

src/tcs/tcsi_aik.c

src/tcs/tcsi_audit.c

src/tcs/tcsi_auth.c

src/tcs/tcsi_bind.c

src/tcs/tcsi_caps.c

src/tcs/tcsi_caps_tpm.c

src/tcs/tcsi_certify.c

src/tcs/tcsi_changeauth.c

src/tcs/tcsi_cmk.c

src/tcs/tcsi_context.c

src/tcs/tcsi_counter.c

src/tcs/tcsi_daa.c

src/tcs/tcsi_delegate.c

src/tcs/tcsi_dir.c

src/tcs/tcsi_ek.c

src/tcs/tcsi_evlog.c

src/tcs/tcsi_key.c

src/tcs/tcsi_maint.c

src/tcs/tcsi_migration.c

src/tcs/tcsi_nv.c

src/tcs/tcsi_oper.c

src/tcs/tcsi_own.c

src/tcs/tcsi_pcr.c

src/tcs/tcsi_ps.c

src/tcs/tcsi_quote.c

src/tcs/tcsi_quote2.c

src/tcs/tcsi_random.c

src/tcs/tcsi_seal.c

src/tcs/tcsi_selftest.c

src/tcs/tcsi_sign.c

src/tcs/tcsi_tick.c

src/tcs/tcsi_transport.c

src/trspi/crypto/openssl/hash.c

src/trspi/crypto/openssl/rsa.c

src/trspi/crypto/openssl/symmetric.c

src/tspi/obj_daa.c

src/tspi/obj_delfamily.c

src/tspi/obj_migdata.c

src/tspi/obj_nv.c

src/tspi/rpc

src/tspi/rpc/hosttable.c

src/tspi/rpc/tcs_api.c

src/tspi/rpc/tcstp

src/tspi/rpc/tcstp/rpc.c

src/tspi/rpc/tcstp/rpc_admin.c

src/tspi/rpc/tcstp/rpc_aik.c

src/tspi/rpc/tcstp/rpc_audit.c

src/tspi/rpc/tcstp/rpc_auth.c

src/tspi/rpc/tcstp/rpc_bind.c

src/tspi/rpc/tcstp/rpc_caps.c

src/tspi/rpc/tcstp/rpc_caps_tpm.c

src/tspi/rpc/tcstp/rpc_certify.c

src/tspi/rpc/tcstp/rpc_changeauth.c

src/tspi/rpc/tcstp/rpc_cmk.c

src/tspi/rpc/tcstp/rpc_context.c

src/tspi/rpc/tcstp/rpc_counter.c

src/tspi/rpc/tcstp/rpc_daa.c

src/tspi/rpc/tcstp/rpc_delegate.c

src/tspi/rpc/tcstp/rpc_dir.c

src/tspi/rpc/tcstp/rpc_ek.c

src/tspi/rpc/tcstp/rpc_evlog.c

src/tspi/rpc/tcstp/rpc_key.c

src/tspi/rpc/tcstp/rpc_maint.c

src/tspi/rpc/tcstp/rpc_migration.c

src/tspi/rpc/tcstp/rpc_nv.c

src/tspi/rpc/tcstp/rpc_oper.c

src/tspi/rpc/tcstp/rpc_own.c

src/tspi/rpc/tcstp/rpc_pcr_extend.c

src/tspi/rpc/tcstp/rpc_ps.c

src/tspi/rpc/tcstp/rpc_quote.c

src/tspi/rpc/tcstp/rpc_quote2.c

src/tspi/rpc/tcstp/rpc_random.c

src/tspi/rpc/tcstp/rpc_seal.c

src/tspi/rpc/tcstp/rpc_selftest.c

src/tspi/rpc/tcstp/rpc_sign.c

src/tspi/rpc/tcstp/rpc_tick.c

src/tspi/rpc/tcstp/rpc_transport.c

src/tspi/tsp_admin.c

src/tspi/tsp_aik.c

src/tspi/tsp_asym.c

src/tspi/tsp_audit.c

src/tspi/tsp_auth.c

src/tspi/tsp_bind.c

src/tspi/tsp_caps.c

src/tspi/tsp_caps_tpm.c

src/tspi/tsp_certify.c

src/tspi/tsp_changeauth.c

src/tspi/tsp_context_mem.c

src/tspi/tsp_counter.c

src/tspi/tsp_daa.c

src/tspi/tsp_delegate.c

src/tspi/tsp_dir.c

src/tspi/tsp_ek.c

src/tspi/tsp_get_flags.c

src/tspi/tsp_key.c

src/tspi/tsp_maint.c

src/tspi/tsp_migration.c

src/tspi/tsp_nv.c

src/tspi/tsp_oper.c

src/tspi/tsp_own.c

src/tspi/tsp_pcr.c

src/tspi/tsp_pcr_extend.c

src/tspi/tsp_policy.c

src/tspi/tsp_ps.c

src/tspi/tsp_quote.c

src/tspi/tsp_quote2.c

src/tspi/tsp_random.c

src/tspi/tsp_seal.c

src/tspi/tsp_selftest.c

src/tspi/tsp_sign.c

src/tspi/tsp_tick.c

src/tspi/tsp_transport.c

src/tspi/tspi_admin.c

src/tspi/tspi_aik.c

src/tspi/tspi_asn1.c

src/tspi/tspi_audit.c

src/tspi/tspi_bind.c

src/tspi/tspi_caps.c

src/tspi/tspi_caps_tpm.c

src/tspi/tspi_certify.c

src/tspi/tspi_changeauth.c

src/tspi/tspi_cmk.c

src/tspi/tspi_context.c

src/tspi/tspi_counter.c

src/tspi/tspi_daa.c

src/tspi/tspi_delegate.c

src/tspi/tspi_dir.c

src/tspi/tspi_ek.c

src/tspi/tspi_getset.c

src/tspi/tspi_hash.c

src/tspi/tspi_key.c

src/tspi/tspi_maint.c

src/tspi/tspi_migration.c

src/tspi/tspi_nv.c

src/tspi/tspi_oper.c

src/tspi/tspi_own.c

src/tspi/tspi_pcr_comp.c

src/tspi/tspi_pcr_comp12.c

src/tspi/tspi_pcr_events.c

src/tspi/tspi_pcr_extend.c

src/tspi/tspi_policy.c

src/tspi/tspi_ps.c

src/tspi/tspi_quote.c

src/tspi/tspi_quote2.c

src/tspi/tspi_random.c

src/tspi/tspi_seal.c

src/tspi/tspi_selftest.c

src/tspi/tspi_sign.c

src/tspi/tspi_tick.c

src/tspi/tspi_transport.c

files removed:
autom4te.cache

autom4te.cache/output.0

autom4te.cache/output.1

autom4te.cache/requests

autom4te.cache/traces.0

autom4te.cache/traces.1

debian/45-trousers.rules

debian/patches/01_makefiles.diff

debian/patches/01_makefiles.dpatch

debian/patches/02_defaultgroup__tcsd.dpatch

debian/trousers.README.Debian

debian/trousers.default

debian/trousers.dirs

debian/watch

src/include/spi_internal_types.h

src/include/tcs_internal_types.h

src/include/trpctp.h

src/tcs/auth_mgr.c

src/tcs/biosem.c

src/tcs/cache.c

src/tcs/cxt.c

src/tcs/imaem.c

src/tcs/req_mgr.c

src/tcs/tcscm.c

src/tcs/tcsem.c

src/tcs/tcskcm.c

src/tcs/tcspbg.c

src/tcsd/tcsd_wrap.c

src/tcsd_api

src/tcsd_api/calltcsapi.c

src/tcsd_api/clntside.c

src/tcsd_api/hosttable.c

src/tcsd_api/tcstp.c

src/trspi/crypto/openssl/crypto.c

src/tspi/keyreg.c

src/tspi/memmgr.c

src/tspi/secrets.c

src/tspi/spi_context.c

src/tspi/spi_data.c

src/tspi/spi_getset.c

src/tspi/spi_hash.c

src/tspi/spi_key.c

src/tspi/spi_pcr.c

src/tspi/spi_policy.c

src/tspi/spi_tpm.c

files modified:
AUTHORS

ChangeLog

Makefile.in

README

config.guess

config.sub

configure

configure.in

debian/changelog

debian/control

debian/copyright

debian/libtspi-dev.install

debian/libtspi1.install

debian/patches/00list

debian/rules

debian/trousers.docs

debian/trousers.init

debian/trousers.install

debian/trousers.postinst

debian/trousers.postrm

dist/Makefile.in

dist/tcsd.conf.in

man/Makefile.in

man/man3/Makefile.am

man/man3/Makefile.in

man/man3/Tspi_Context_LoadKeyByUUID.3

man/man3/Tspi_TPM_GetPubEndorsementKey.3

man/man5/Makefile.in

man/man5/tcsd.conf.5.in

man/man8/Makefile.in

src/Makefile.in

src/include/Makefile.am

src/include/Makefile.in

src/include/auth_mgr.h

src/include/capabilities.h

src/include/hosttable.h

src/include/memmgr.h

src/include/obj.h

src/include/req_mgr.h

src/include/spi_utils.h

src/include/tcs_tsp.h

src/include/tcs_utils.h

src/include/tcsd.h

src/include/tcsd_ops.h

src/include/tcsd_wrap.h

src/include/tcsem.h

src/include/tcslog.h

src/include/tcsps.h

src/include/trousers/trousers.h

src/include/trousers/tss.h

src/include/trousers_types.h

src/include/tspps.h

src/include/tss/platform.h

src/include/tss/tcpa_defines.h

src/include/tss/tcpa_error.h

src/include/tss/tcpa_struct.h

src/include/tss/tcpa_typedef.h

src/include/tss/tcs_error.h

src/include/tss/tcs_structs.h

src/include/tss/tcs_typedef.h

src/include/tss/tddl_error.h

src/include/tss/tddlapi_error.h

src/include/tss/tddli.h

src/include/tss/tspi.h

src/include/tss/tss_defines.h

src/include/tss/tss_error.h

src/include/tss/tss_error_basics.h

src/include/tss/tss_structs.h

src/include/tss/tss_typedef.h

src/tcs/Makefile.am

src/tcs/Makefile.in

src/tcs/ps/ps_utils.c

src/tcs/ps/tcsps.c

src/tcs/tcs_utils.c

src/tcsd/Makefile.am

src/tcsd/Makefile.in

src/tcsd/platform.c

src/tcsd/svrside.c

src/tcsd/tcsd_conf.c

src/tcsd/tcsd_threads.c

src/tddl/Makefile.am

src/tddl/Makefile.in

src/trspi/Makefile.am

src/trspi/Makefile.in

src/trspi/trousers.c

src/tspi/Makefile.am

src/tspi/Makefile.in

src/tspi/obj.c

src/tspi/obj_context.c

src/tspi/obj_encdata.c

src/tspi/obj_hash.c

src/tspi/obj_pcrs.c

src/tspi/obj_policy.c

src/tspi/obj_rsakey.c

src/tspi/obj_tpm.c

src/tspi/ps/tspps.c

src/tspi/spi_utils.c

tools/Makefile.in

tools/ps_inspect.c

Show diffs side-by-side

added added

removed removed

src/tspi/tspi_changeauth.c

* Licensed Materials - Property of IBM

* trousers - An open source TCG Software Stack

* (C) Copyright International Business Machines Corp. 2004-2006

#include <stdlib.h>

#include <stdio.h>

#include <string.h>

#include <time.h>

#include <errno.h>

#include "trousers/tss.h"

#include "trousers/trousers.h"

#include "trousers_types.h"

#include "spi_utils.h"

#include "capabilities.h"

#include "tsplog.h"

#include "obj.h"

#include "authsess.h"

TSS_RESULT

Tspi_ChangeAuth(TSS_HOBJECT hObjectToChange, /* in */

TSS_HOBJECT hParentObject, /* in */

TSS_HPOLICY hNewPolicy) /* in */

{

UINT32 keyToChangeHandle;

TSS_RESULT result;

TSS_HCONTEXT tspContext;

if ((result = obj_policy_get_tsp_context(hNewPolicy, &tspContext)))

return result;

/* if the object to change is the TPM object, then the parent should

* be NULL. If the object to change is not the TPM, then the parent

* object must be either an rsakey or the TPM */

if (obj_is_tpm(hObjectToChange)) {

if (hParentObject != NULL_HOBJECT)

return TSPERR(TSS_E_BAD_PARAMETER);

} else if (!obj_is_rsakey(hParentObject) && !obj_is_tpm(hParentObject)) {

return TSPERR(TSS_E_INVALID_HANDLE);

}

if (obj_is_tpm(hObjectToChange)) {

if ((result = changeauth_owner(tspContext, hObjectToChange, NULL_HTPM, hNewPolicy)))

return result;

} else if (obj_is_rsakey(hObjectToChange)) {

if ((result = obj_rsakey_get_tcs_handle(hObjectToChange, &keyToChangeHandle)))

return result;

if (keyToChangeHandle == TPM_KEYHND_SRK) {

if ((result = changeauth_srk(tspContext, hObjectToChange, hParentObject,

hNewPolicy)))

return result;

} else {

if ((result = changeauth_key(tspContext, hObjectToChange, hParentObject,

hNewPolicy)))

return result;

}

} else if (obj_is_encdata(hObjectToChange)) {

if ((result = changeauth_encdata(tspContext, hObjectToChange, hParentObject,

hNewPolicy)))

return result;

} else if (obj_is_policy(hObjectToChange) || obj_is_hash(hObjectToChange) ||

obj_is_pcrs(hObjectToChange) || obj_is_context(hObjectToChange)) {

return TSPERR(TSS_E_BAD_PARAMETER);

} else {

return TSPERR(TSS_E_INVALID_HANDLE);

}

if ((result = obj_policy_set_type(hNewPolicy, TSS_POLICY_USAGE)))

return result;

return Tspi_Policy_AssignToObject(hNewPolicy, hObjectToChange);

}

TSS_RESULT

Tspi_ChangeAuthAsym(TSS_HOBJECT hObjectToChange, /* in */

TSS_HOBJECT hParentObject, /* in */

TSS_HKEY hIdentKey, /* in */

TSS_HPOLICY hNewPolicy) /* in */

{

#if 0

TPM_AUTH auth;

UINT64 offset;

BYTE hashBlob[0x1000];

TCPA_DIGEST digest;

TCPA_RESULT result;

UINT32 keyHandle;

UINT32 idHandle;

TSS_HPOLICY hPolicy;

TSS_HPOLICY hParentPolicy;

100

UINT32 keyToChangeHandle;

101

TCPA_NONCE antiReplay;

102

UINT32 bytesRequested;

103

UINT64 tempSize;

104

BYTE tempKey[512];

105

TCPA_KEY_PARMS keyParms;

106

/* XXX Wow... */

107

BYTE ephParms[] = { 0, 0, 0x08, 0, 0, 0, 0, 0x02, 0, 0, 0, 0 };

108

UINT32 KeySizeOut;

109

BYTE *KeyDataOut;

110

UINT32 CertifyInfoSize;

111

BYTE *CertifyInfo;

112

UINT32 sigSize;

113

BYTE *sig;

114

UINT32 ephHandle;

115

TPM_CHANGEAUTH_VALIDATE caValidate;

116

TCPA_SECRET newSecret, oldSecret;

117

BYTE seed[20];

118

BYTE a1[256];

119

UINT32 a1Size;

120

TSS_KEY ephemeralKey;

121

TCPA_DIGEST newAuthLink;

122

UINT32 encObjectSize;

123

BYTE *encObject = NULL;

124

UINT32 encDataSizeOut;

125

BYTE *encDataOut;

126

TCPA_NONCE saltNonce;

127

TCPA_DIGEST changeProof;

128

TSS_HPOLICY hOldPolicy;

129

UINT32 caValidSize;

130

UINT32 keyObjectSize;

131

BYTE *keyObject;

132

TSS_KEY keyContainer;

133

TCPA_STORED_DATA dataContainer;

134

BYTE *dataObject;

135

UINT32 dataObjectSize;

136

UINT16 entityType;

137

TSS_BOOL useAuth = TRUE; // XXX

138

TPM_AUTH *pAuth;

139

BYTE dataBlob[1024];

140

TSS_HCONTEXT tspContext;

141

Trspi_HashCtx hashCtx;

142

143

if ((result = obj_policy_get_tsp_context(hNewPolicy, &tspContext)))

144

return result;

145

146

/* grab all of the needed handles */

147

if ((result = obj_rsakey_get_tcs_handle(hIdentKey, &idHandle)))

148

return result;

149

150

/* get the secret for the parent */

151

if ((result = obj_rsakey_get_policy(hIdentKey, TSS_POLICY_USAGE, &hPolicy, &useAuth)))

152

return result;

153

154

/* get the parent secret */

155

if ((result = Tspi_GetPolicyObject(hParentObject, TSS_POLICY_USAGE, &hParentPolicy)))

156

return result;

157

158

if (!obj_is_rsakey(hParentObject) && !obj_is_tpm(hParentObject))

159

return TSPERR(TSS_E_INVALID_HANDLE);

160

161

/* get the keyObject */

162

if ((result = obj_rsakey_get_tcs_handle(hParentObject, &keyHandle)))

163

return result;

164

165

if (obj_is_rsakey(hObjectToChange) ||

166

obj_is_encdata(hObjectToChange)) {

167

168

if ((result = obj_rsakey_get_tcs_handle(hObjectToChange, &keyToChangeHandle)))

169

return result;

170

171

if (keyToChangeHandle == TPM_KEYHND_SRK) {

172

return TSPERR(TSS_E_BAD_PARAMETER);

173

} else {

174

/* generate container for ephemeral key */

175

keyParms.algorithmID = 1; /* rsa */

176

keyParms.encScheme = 3;

177

keyParms.sigScheme = 1;

178

keyParms.parmSize = 12;

179

keyParms.parms = malloc(12);

180

if (keyParms.parms == NULL) {

181

LogError("malloc of %d bytes failed.", 12);

182

return TSPERR(TSS_E_OUTOFMEMORY);

183

}

184

memcpy(keyParms.parms, ephParms, 12);

185

186

tempSize = 0;

187

Trspi_LoadBlob_KEY_PARMS(&tempSize, tempKey, &keyParms);

188

189

/* generate antireplay nonce */

190

bytesRequested = 20;

191

if ((result = get_local_random(tspContext, FALSE, bytesRequested,

192

(BYTE **)antiReplay.nonce)))

193

return result;

194

195

/* caluculate auth data */

196

result = Trspi_HashInit(&hashCtx, TSS_HASH_SHA1);

197

result |= Trspi_Hash_UINT32(&hashCtx, TPM_ORD_ChangeAuthAsymStart);

198

result |= Trspi_HashUpdate(&hashCtx, TCPA_SHA1_160_HASH_LEN,

199

antiReplay.nonce);

200

result |= Trspi_Hash_KEY_PARMS(&hashCtx, &keyParms);

201

if ((result |= Trspi_HashFinal(&hashCtx, digest.digest)))

202

return result;

203

204

if (useAuth) {

205

if ((result = secret_PerformAuth_OIAP(hIdentKey,

206

TPM_ORD_ChangeAuthAsymStart,

207

hPolicy, FALSE, &digest,

208

&auth)))

209

return result;

210

211

pAuth = &auth;

212

} else {

213

pAuth = NULL;

214

}

215

216

if ((result = TCSP_ChangeAuthAsymStart(tspContext, idHandle, antiReplay,

217

tempSize, tempKey, pAuth,

218

&KeySizeOut, &KeyDataOut,

219

&CertifyInfoSize, &CertifyInfo,

220

&sigSize, &sig, &ephHandle)))

221

return result;

222

223

/* Validate the Auth's */

224

result = Trspi_HashInit(&hashCtx, TSS_HASH_SHA1);

225

result |= Trspi_Hash_UINT32(&hashCtx, result);

226

result |= Trspi_Hash_UINT32(&hashCtx, TPM_ORD_ChangeAuthAsymStart);

227

result |= Trspi_HashUpdate(&hashCtx, CertifyInfoSize, CertifyInfo);

228

result |= Trspi_Hash_UINT32(&hashCtx, sigSize);

229

result |= Trspi_HashUpdate(&hashCtx, sigSize, sig);

230

result |= Trspi_Hash_UINT32(&hashCtx, ephHandle);

231

result |= Trspi_HashUpdate(&hashCtx, KeySizeOut, KeyDataOut);

232

if ((result |= Trspi_HashFinal(&hashCtx, digest.digest)))

233

return result;

234

235

if (useAuth) {

236

if ((result = obj_policy_validate_auth_oiap(hPolicy, &digest,

237

&auth)))

238

return result;

239

}

240

241

/* generate random data for asymfinish */

242

if ((result = get_local_random(tspContext, FALSE, bytesRequested,

243

(BYTE **)&caValidate.n1.nonce)))

244

return result;

245

246

if ((result = get_local_random(tspContext, FALSE, bytesRequested,

247

(BYTE **)&antiReplay.nonce)))

248

return result;

249

250

if ((result = get_local_random(tspContext, FALSE, bytesRequested,

251

(BYTE **)&seed)))

252

return result;

253

254

if ((result = Tspi_GetPolicyObject(hObjectToChange, TSS_POLICY_USAGE,

255

&hOldPolicy)))

256

return result;

257

258

if ((result = obj_policy_get_secret(hNewPolicy, TR_SECRET_CTX_NEW,

259

&newSecret)))

260

return result;

261

if ((result = obj_policy_get_secret(hOldPolicy, TR_SECRET_CTX_NOT_NEW,

262

&oldSecret)))

263

return result;

264

265

/* Encrypt the ChangeAuthValidate structure with the

266

* ephemeral key */

267

268

memcpy(caValidate.newAuthSecret.authdata, newSecret.authdata, 20);

269

270

offset = 0;

271

Trspi_LoadBlob_CHANGEAUTH_VALIDATE(&offset, hashBlob, &caValidate);

272

caValidSize = offset;

273

274

offset = 0;

275

if ((result = UnloadBlob_TSS_KEY(&offset, KeyDataOut, &ephemeralKey)))

276

return result;

277

278

Trspi_RSA_Encrypt(hashBlob, caValidSize, a1, &a1Size,

279

ephemeralKey.pubKey.key,

280

ephemeralKey.pubKey.keyLength);

281

282

free_key_refs(&ephemeralKey);

283

284

Trspi_HMAC(TSS_HASH_SHA1, 20, oldSecret.authdata,

285

20, newSecret.authdata,

286

newAuthLink.digest);

287

288

if (obj_is_rsakey(hObjectToChange)) {

289

if ((result = obj_rsakey_get_blob(hObjectToChange,

290

&keyObjectSize, &keyObject)))

291

return result;

292

293

memset(&keyContainer, 0, sizeof(TSS_KEY));

294

295

offset = 0;

296

if ((result = UnloadBlob_TSS_KEY(&offset,

297

keyObject,

298

&keyContainer)))

299

return result;

300

301

encObjectSize = keyContainer.encSize;

302

encObject = malloc(encObjectSize);

303

if (encObject == NULL) {

304

LogError("malloc of %d bytes failed.",

305

encObjectSize);

306

free_key_refs(&keyContainer);

307

return TSPERR(TSS_E_OUTOFMEMORY);

308

}

309

memcpy(encObject, keyContainer.encData,

310

encObjectSize);

311

entityType = TCPA_ET_KEY;

312

} else {

313

if ((result = obj_encdata_get_data(hObjectToChange,

314

&dataObjectSize, &dataObject)))

315

return result;

316

317

offset = 0;

318

if ((result = Trspi_UnloadBlob_STORED_DATA(&offset,

319

dataObject,

320

&dataContainer)))

321

return result;

322

323

encObjectSize = dataContainer.encDataSize;

324

encObject = malloc(encObjectSize);

325

if (encObject == NULL) {

326

LogError("malloc of %d bytes failed.", encObjectSize);

327

free(dataContainer.sealInfo);

328

free(dataContainer.encData);

329

return TSPERR(TSS_E_OUTOFMEMORY);

330

}

331

memcpy(encObject, dataContainer.encData,

332

encObjectSize);

333

entityType = TCPA_ET_DATA;

334

}

335

336

result = Trspi_HashInit(&hashCtx, TSS_HASH_SHA1);

337

result |= Trspi_Hash_UINT32(&hashCtx, TPM_ORD_ChangeAuthAsymFinish);

338

result |= Trspi_Hash_UINT16(&hashCtx, entityType);

339

result |= Trspi_HashUpdate(&hashCtx, TCPA_SHA1_160_HASH_LEN,

340

newAuthLink.digest);

341

result |= Trspi_Hash_UINT32(&hashCtx, a1Size);

342

result |= Trspi_HashUpdate(&hashCtx, a1Size, a1);

343

result |= Trspi_Hash_UINT32(&hashCtx, encObjectSize);

344

result |= Trspi_HashUpdate(&hashCtx, encObjectSize, encObject);

345

if ((result |= Trspi_HashFinal(&hashCtx, digest.digest)))

346

return result;

347

348

if (useAuth) {

349

if ((result = secret_PerformAuth_OIAP(hParentObject,

350

TPM_ORD_ChangeAuthAsymFinish,

351

hParentPolicy, FALSE,

352

&digest, &auth))) {

353

free(encObject);

354

free_key_refs(&keyContainer);

355

return result;

356

}

357

pAuth = &auth;

358

} else {

359

pAuth = NULL;

360

}

361

362

if ((result = TCSP_ChangeAuthAsymFinish(tspContext, keyHandle, ephHandle,

363

entityType, newAuthLink, a1Size, a1,

364

encObjectSize, encObject, pAuth,

365

&encDataSizeOut, &encDataOut,

366

&saltNonce, &changeProof))) {

367

free_key_refs(&keyContainer);

368

free(encObject);

369

return result;

370

}

371

372

/* --- Validate the Auth's */

373

result = Trspi_HashInit(&hashCtx, TSS_HASH_SHA1);

374

result |= Trspi_Hash_UINT32(&hashCtx, result);

375

result |= Trspi_Hash_UINT32(&hashCtx, TPM_ORD_ChangeAuthAsymFinish);

376

result |= Trspi_Hash_UINT32(&hashCtx, encDataSizeOut);

377

result |= Trspi_HashUpdate(&hashCtx, encDataSizeOut, encDataOut);

378

result |= Trspi_HashUpdate(&hashCtx, TCPA_SHA1_160_HASH_LEN,

379

saltNonce.nonce);

380

result |= Trspi_HashUpdate(&hashCtx, TCPA_SHA1_160_HASH_LEN,

381

changeProof.digest);

382

if ((result |= Trspi_HashFinal(&hashCtx, digest.digest)))

383

return result;

384

385

if (useAuth) {

386

if ((result = obj_policy_validate_auth_oiap(hParentPolicy,

387

&digest,

388

&auth))) {

389

free_key_refs(&keyContainer);

390

free(encObject);

391

return result;

392

}

393

}

394

395

if (entityType == TCPA_ET_KEY ||

396

entityType == TCPA_ET_KEYHANDLE) {

397

memcpy(keyContainer.encData, encDataOut, encDataSizeOut);

398

keyContainer.encSize = encDataSizeOut;

399

400

offset = 0;

401

LoadBlob_TSS_KEY(&offset, keyObject, &keyContainer);

402

free_key_refs(&keyContainer);

403

if ((result = obj_rsakey_set_tcpakey(hObjectToChange, offset,

404

keyObject))) {

405

free(encObject);

406

return result;

407

}

408

}

409

410

if (entityType == TCPA_ET_DATA) {

411

memcpy(dataContainer.encData, encDataOut,

412

encDataSizeOut);

413

dataContainer.encDataSize = encDataSizeOut;

414

415

offset = 0;

416

Trspi_LoadBlob_STORED_DATA(&offset, dataBlob,

417

&dataContainer);

418

free(dataContainer.sealInfo);

419

free(dataContainer.encData);

420

obj_encdata_set_data(hObjectToChange,

421

offset, dataBlob);

422

}

423

}

424

} else

425

return TSPERR(TSS_E_BAD_PARAMETER);

426

427

free(encObject);

428

429

return Tspi_Policy_AssignToObject(hNewPolicy, hObjectToChange);

430

#else

431

return TSPERR(TSS_E_NOTIMPL);

432

#endif

433

}

434

Older »