~ubuntu-branches/ubuntu/karmic/trousers/karmic

Viewing changes to src/tspi/tsp_changeauth.c

Committer: Bazaar Package Importer
Author(s): Daniel Baumann
Date: 2008-01-23 22:03:00 UTC
mfrom: (1.1.1 upstream)
Revision ID: james.westby@ubuntu.com-20080123220300-fhtqja3c0oq0gp6z

Tags: 0.3.1-4

http://bugs.debian.org/457400

http://bugs.debian.org/459682

* Added patch from Aaron M. Ucko <ucko@debian.org> to allow trousers to
  build successfully on amd64, and presumably also other 64-bit
  architectures (Closes: #457400).
* Including udev rule for /dev/tpm from William Lima
  <wlima.amadeus@gmail.com> as suggested by David Smith <dds@google.com>
  (Closes: #459682).
* Added lintian overrides.

files added:
debian/TODO

debian/config

debian/config/45-trousers.rules

debian/libtspi-dev.docs

debian/lintian

debian/lintian/libtspi1

debian/lintian/trousers

debian/patches/01-tss-user.dpatch

debian/patches/02-manapge.dpatch

debian/patches/03-readme.dpatch

debian/patches/04-64bit-cleanliness.dpatch

debian/trousers.examples

man/man3/Tspi_Context_GetRegisteredKeysByUUID2.3

man/man3/Tspi_DAA_IssueCredential.3

man/man3/Tspi_DAA_IssueInit.3

man/man3/Tspi_DAA_IssueSetup.3

man/man3/Tspi_DAA_IssuerKeyVerification.3

man/man3/Tspi_DAA_VerifyInit.3

man/man3/Tspi_DAA_VerifySignature.3

man/man3/Tspi_DecodeBER_TssBlob.3

man/man3/Tspi_EncodeDER_TssBlob.3

man/man3/Tspi_TPM_DAA_JoinCreateDaaPubKey.3

man/man3/Tspi_TPM_DAA_JoinInit.3

man/man3/Tspi_TPM_DAA_JoinStoreCredential.3

man/man3/Tspi_TPM_DAA_Sign.3

man/man3/Tspi_TPM_GetAuditDigest.3

man/man3/Tspi_TPM_OwnerGetSRKPubKey.3

man/man3/Tspi_TPM_Quote2.3

src/include/authsess.h

src/include/obj_context.h

src/include/obj_daa.h

src/include/obj_delfamily.h

src/include/obj_encdata.h

src/include/obj_hash.h

src/include/obj_migdata.h

src/include/obj_nv.h

src/include/obj_pcrs.h

src/include/obj_policy.h

src/include/obj_rsakey.h

src/include/obj_tpm.h

src/include/rpc_tcstp.h

src/include/rpc_tcstp_tcs.h

src/include/rpc_tcstp_tsp.h

src/include/tcs_aik.h

src/include/tcs_context.h

src/include/tcs_key_ps.h

src/include/threads.h

src/include/tsp_audit.h

src/include/tsp_delegate.h

src/include/tsp_seal.h

src/include/tss/TSP.idl

src/include/tss/compat11b.h

src/include/tss/tcs.h

src/include/tss/tcs_defines.h

src/include/tss/tpm.h

src/include/tss/tpm_error.h

src/include/tss/tpm_ordinal.h

src/tcs/crypto

src/tcs/crypto/openssl

src/tcs/crypto/openssl/crypto.c

src/tcs/rpc

src/tcs/rpc/tcstp

src/tcs/rpc/tcstp/rpc.c

src/tcs/rpc/tcstp/rpc_admin.c

src/tcs/rpc/tcstp/rpc_aik.c

src/tcs/rpc/tcstp/rpc_audit.c

src/tcs/rpc/tcstp/rpc_auth.c

src/tcs/rpc/tcstp/rpc_bind.c

src/tcs/rpc/tcstp/rpc_caps.c

src/tcs/rpc/tcstp/rpc_caps_tpm.c

src/tcs/rpc/tcstp/rpc_certify.c

src/tcs/rpc/tcstp/rpc_changeauth.c

src/tcs/rpc/tcstp/rpc_cmk.c

src/tcs/rpc/tcstp/rpc_context.c

src/tcs/rpc/tcstp/rpc_counter.c

src/tcs/rpc/tcstp/rpc_daa.c

src/tcs/rpc/tcstp/rpc_delegate.c

src/tcs/rpc/tcstp/rpc_dir.c

src/tcs/rpc/tcstp/rpc_ek.c

src/tcs/rpc/tcstp/rpc_evlog.c

src/tcs/rpc/tcstp/rpc_key.c

src/tcs/rpc/tcstp/rpc_maint.c

src/tcs/rpc/tcstp/rpc_migration.c

src/tcs/rpc/tcstp/rpc_nv.c

src/tcs/rpc/tcstp/rpc_oper.c

src/tcs/rpc/tcstp/rpc_own.c

src/tcs/rpc/tcstp/rpc_pcr_extend.c

src/tcs/rpc/tcstp/rpc_ps.c

src/tcs/rpc/tcstp/rpc_quote.c

src/tcs/rpc/tcstp/rpc_quote2.c

src/tcs/rpc/tcstp/rpc_random.c

src/tcs/rpc/tcstp/rpc_seal.c

src/tcs/rpc/tcstp/rpc_selftest.c

src/tcs/rpc/tcstp/rpc_sign.c

src/tcs/rpc/tcstp/rpc_tick.c

src/tcs/rpc/tcstp/rpc_transport.c

src/tcs/tcs_aik.c

src/tcs/tcs_auth_mgr.c

src/tcs/tcs_caps.c

src/tcs/tcs_context.c

src/tcs/tcs_context_key.c

src/tcs/tcs_counter.c

src/tcs/tcs_evlog.c

src/tcs/tcs_evlog_biosem.c

src/tcs/tcs_evlog_imaem.c

src/tcs/tcs_key.c

src/tcs/tcs_key_mem_cache.c

src/tcs/tcs_key_ps.c

src/tcs/tcs_migration.c

src/tcs/tcs_pbg.c

src/tcs/tcs_ps.c

src/tcs/tcs_quote.c

src/tcs/tcs_quote2.c

src/tcs/tcs_req_mgr.c

src/tcs/tcs_seal.c

src/tcs/tcsi_admin.c

src/tcs/tcsi_aik.c

src/tcs/tcsi_audit.c

src/tcs/tcsi_auth.c

src/tcs/tcsi_bind.c

src/tcs/tcsi_caps.c

src/tcs/tcsi_caps_tpm.c

src/tcs/tcsi_certify.c

src/tcs/tcsi_changeauth.c

src/tcs/tcsi_cmk.c

src/tcs/tcsi_context.c

src/tcs/tcsi_counter.c

src/tcs/tcsi_daa.c

src/tcs/tcsi_delegate.c

src/tcs/tcsi_dir.c

src/tcs/tcsi_ek.c

src/tcs/tcsi_evlog.c

src/tcs/tcsi_key.c

src/tcs/tcsi_maint.c

src/tcs/tcsi_migration.c

src/tcs/tcsi_nv.c

src/tcs/tcsi_oper.c

src/tcs/tcsi_own.c

src/tcs/tcsi_pcr.c

src/tcs/tcsi_ps.c

src/tcs/tcsi_quote.c

src/tcs/tcsi_quote2.c

src/tcs/tcsi_random.c

src/tcs/tcsi_seal.c

src/tcs/tcsi_selftest.c

src/tcs/tcsi_sign.c

src/tcs/tcsi_tick.c

src/tcs/tcsi_transport.c

src/trspi/crypto/openssl/hash.c

src/trspi/crypto/openssl/rsa.c

src/trspi/crypto/openssl/symmetric.c

src/tspi/obj_daa.c

src/tspi/obj_delfamily.c

src/tspi/obj_migdata.c

src/tspi/obj_nv.c

src/tspi/rpc

src/tspi/rpc/hosttable.c

src/tspi/rpc/tcs_api.c

src/tspi/rpc/tcstp

src/tspi/rpc/tcstp/rpc.c

src/tspi/rpc/tcstp/rpc_admin.c

src/tspi/rpc/tcstp/rpc_aik.c

src/tspi/rpc/tcstp/rpc_audit.c

src/tspi/rpc/tcstp/rpc_auth.c

src/tspi/rpc/tcstp/rpc_bind.c

src/tspi/rpc/tcstp/rpc_caps.c

src/tspi/rpc/tcstp/rpc_caps_tpm.c

src/tspi/rpc/tcstp/rpc_certify.c

src/tspi/rpc/tcstp/rpc_changeauth.c

src/tspi/rpc/tcstp/rpc_cmk.c

src/tspi/rpc/tcstp/rpc_context.c

src/tspi/rpc/tcstp/rpc_counter.c

src/tspi/rpc/tcstp/rpc_daa.c

src/tspi/rpc/tcstp/rpc_delegate.c

src/tspi/rpc/tcstp/rpc_dir.c

src/tspi/rpc/tcstp/rpc_ek.c

src/tspi/rpc/tcstp/rpc_evlog.c

src/tspi/rpc/tcstp/rpc_key.c

src/tspi/rpc/tcstp/rpc_maint.c

src/tspi/rpc/tcstp/rpc_migration.c

src/tspi/rpc/tcstp/rpc_nv.c

src/tspi/rpc/tcstp/rpc_oper.c

src/tspi/rpc/tcstp/rpc_own.c

src/tspi/rpc/tcstp/rpc_pcr_extend.c

src/tspi/rpc/tcstp/rpc_ps.c

src/tspi/rpc/tcstp/rpc_quote.c

src/tspi/rpc/tcstp/rpc_quote2.c

src/tspi/rpc/tcstp/rpc_random.c

src/tspi/rpc/tcstp/rpc_seal.c

src/tspi/rpc/tcstp/rpc_selftest.c

src/tspi/rpc/tcstp/rpc_sign.c

src/tspi/rpc/tcstp/rpc_tick.c

src/tspi/rpc/tcstp/rpc_transport.c

src/tspi/tsp_admin.c

src/tspi/tsp_aik.c

src/tspi/tsp_asym.c

src/tspi/tsp_audit.c

src/tspi/tsp_auth.c

src/tspi/tsp_bind.c

src/tspi/tsp_caps.c

src/tspi/tsp_caps_tpm.c

src/tspi/tsp_certify.c

src/tspi/tsp_changeauth.c

src/tspi/tsp_context_mem.c

src/tspi/tsp_counter.c

src/tspi/tsp_daa.c

src/tspi/tsp_delegate.c

src/tspi/tsp_dir.c

src/tspi/tsp_ek.c

src/tspi/tsp_get_flags.c

src/tspi/tsp_key.c

src/tspi/tsp_maint.c

src/tspi/tsp_migration.c

src/tspi/tsp_nv.c

src/tspi/tsp_oper.c

src/tspi/tsp_own.c

src/tspi/tsp_pcr.c

src/tspi/tsp_pcr_extend.c

src/tspi/tsp_policy.c

src/tspi/tsp_ps.c

src/tspi/tsp_quote.c

src/tspi/tsp_quote2.c

src/tspi/tsp_random.c

src/tspi/tsp_seal.c

src/tspi/tsp_selftest.c

src/tspi/tsp_sign.c

src/tspi/tsp_tick.c

src/tspi/tsp_transport.c

src/tspi/tspi_admin.c

src/tspi/tspi_aik.c

src/tspi/tspi_asn1.c

src/tspi/tspi_audit.c

src/tspi/tspi_bind.c

src/tspi/tspi_caps.c

src/tspi/tspi_caps_tpm.c

src/tspi/tspi_certify.c

src/tspi/tspi_changeauth.c

src/tspi/tspi_cmk.c

src/tspi/tspi_context.c

src/tspi/tspi_counter.c

src/tspi/tspi_daa.c

src/tspi/tspi_delegate.c

src/tspi/tspi_dir.c

src/tspi/tspi_ek.c

src/tspi/tspi_getset.c

src/tspi/tspi_hash.c

src/tspi/tspi_key.c

src/tspi/tspi_maint.c

src/tspi/tspi_migration.c

src/tspi/tspi_nv.c

src/tspi/tspi_oper.c

src/tspi/tspi_own.c

src/tspi/tspi_pcr_comp.c

src/tspi/tspi_pcr_comp12.c

src/tspi/tspi_pcr_events.c

src/tspi/tspi_pcr_extend.c

src/tspi/tspi_policy.c

src/tspi/tspi_ps.c

src/tspi/tspi_quote.c

src/tspi/tspi_quote2.c

src/tspi/tspi_random.c

src/tspi/tspi_seal.c

src/tspi/tspi_selftest.c

src/tspi/tspi_sign.c

src/tspi/tspi_tick.c

src/tspi/tspi_transport.c

files removed:
autom4te.cache

autom4te.cache/output.0

autom4te.cache/output.1

autom4te.cache/requests

autom4te.cache/traces.0

autom4te.cache/traces.1

debian/45-trousers.rules

debian/patches/01_makefiles.diff

debian/patches/01_makefiles.dpatch

debian/patches/02_defaultgroup__tcsd.dpatch

debian/trousers.README.Debian

debian/trousers.default

debian/trousers.dirs

debian/watch

src/include/spi_internal_types.h

src/include/tcs_internal_types.h

src/include/trpctp.h

src/tcs/auth_mgr.c

src/tcs/biosem.c

src/tcs/cache.c

src/tcs/cxt.c

src/tcs/imaem.c

src/tcs/req_mgr.c

src/tcs/tcscm.c

src/tcs/tcsem.c

src/tcs/tcskcm.c

src/tcs/tcspbg.c

src/tcsd/tcsd_wrap.c

src/tcsd_api

src/tcsd_api/calltcsapi.c

src/tcsd_api/clntside.c

src/tcsd_api/hosttable.c

src/tcsd_api/tcstp.c

src/trspi/crypto/openssl/crypto.c

src/tspi/keyreg.c

src/tspi/memmgr.c

src/tspi/secrets.c

src/tspi/spi_context.c

src/tspi/spi_data.c

src/tspi/spi_getset.c

src/tspi/spi_hash.c

src/tspi/spi_key.c

src/tspi/spi_pcr.c

src/tspi/spi_policy.c

src/tspi/spi_tpm.c

files modified:
AUTHORS

ChangeLog

Makefile.in

README

config.guess

config.sub

configure

configure.in

debian/changelog

debian/control

debian/copyright

debian/libtspi-dev.install

debian/libtspi1.install

debian/patches/00list

debian/rules

debian/trousers.docs

debian/trousers.init

debian/trousers.install

debian/trousers.postinst

debian/trousers.postrm

dist/Makefile.in

dist/tcsd.conf.in

man/Makefile.in

man/man3/Makefile.am

man/man3/Makefile.in

man/man3/Tspi_Context_LoadKeyByUUID.3

man/man3/Tspi_TPM_GetPubEndorsementKey.3

man/man5/Makefile.in

man/man5/tcsd.conf.5.in

man/man8/Makefile.in

src/Makefile.in

src/include/Makefile.am

src/include/Makefile.in

src/include/auth_mgr.h

src/include/capabilities.h

src/include/hosttable.h

src/include/memmgr.h

src/include/obj.h

src/include/req_mgr.h

src/include/spi_utils.h

src/include/tcs_tsp.h

src/include/tcs_utils.h

src/include/tcsd.h

src/include/tcsd_ops.h

src/include/tcsd_wrap.h

src/include/tcsem.h

src/include/tcslog.h

src/include/tcsps.h

src/include/trousers/trousers.h

src/include/trousers/tss.h

src/include/trousers_types.h

src/include/tspps.h

src/include/tss/platform.h

src/include/tss/tcpa_defines.h

src/include/tss/tcpa_error.h

src/include/tss/tcpa_struct.h

src/include/tss/tcpa_typedef.h

src/include/tss/tcs_error.h

src/include/tss/tcs_structs.h

src/include/tss/tcs_typedef.h

src/include/tss/tddl_error.h

src/include/tss/tddlapi_error.h

src/include/tss/tddli.h

src/include/tss/tspi.h

src/include/tss/tss_defines.h

src/include/tss/tss_error.h

src/include/tss/tss_error_basics.h

src/include/tss/tss_structs.h

src/include/tss/tss_typedef.h

src/tcs/Makefile.am

src/tcs/Makefile.in

src/tcs/ps/ps_utils.c

src/tcs/ps/tcsps.c

src/tcs/tcs_utils.c

src/tcsd/Makefile.am

src/tcsd/Makefile.in

src/tcsd/platform.c

src/tcsd/svrside.c

src/tcsd/tcsd_conf.c

src/tcsd/tcsd_threads.c

src/tddl/Makefile.am

src/tddl/Makefile.in

src/trspi/Makefile.am

src/trspi/Makefile.in

src/trspi/trousers.c

src/tspi/Makefile.am

src/tspi/Makefile.in

src/tspi/obj.c

src/tspi/obj_context.c

src/tspi/obj_encdata.c

src/tspi/obj_hash.c

src/tspi/obj_pcrs.c

src/tspi/obj_policy.c

src/tspi/obj_rsakey.c

src/tspi/obj_tpm.c

src/tspi/ps/tspps.c

src/tspi/spi_utils.c

tools/Makefile.in

tools/ps_inspect.c

Show diffs side-by-side

added added

removed removed

src/tspi/tsp_changeauth.c

* Licensed Materials - Property of IBM

* trousers - An open source TCG Software Stack

* (C) Copyright International Business Machines Corp. 2004-2006

#include <stdlib.h>

#include <stdio.h>

#include <string.h>

#include <time.h>

#include <errno.h>

#include "trousers/tss.h"

#include "trousers/trousers.h"

#include "trousers_types.h"

#include "spi_utils.h"

#include "capabilities.h"

#include "tsplog.h"

#include "obj.h"

#include "authsess.h"

TSS_RESULT

Trspi_UnloadBlob_STORED_DATA(UINT64 *offset, BYTE *blob, TCPA_STORED_DATA *data)

{

Trspi_UnloadBlob_TCPA_VERSION(offset, blob, &data->ver);

Trspi_UnloadBlob_UINT32(offset, &data->sealInfoSize, blob);

if (data->sealInfoSize > 0) {

data->sealInfo = malloc(data->sealInfoSize);

if (data->sealInfo == NULL) {

LogError("malloc of %d bytes failed.", data->sealInfoSize);

return TSPERR(TSS_E_OUTOFMEMORY);

}

Trspi_UnloadBlob(offset, data->sealInfoSize, blob, data->sealInfo);

} else {

data->sealInfo = NULL;

}

Trspi_UnloadBlob_UINT32(offset, &data->encDataSize, blob);

if (data->encDataSize > 0) {

data->encData = malloc(data->encDataSize);

if (data->encData == NULL) {

LogError("malloc of %d bytes failed.", data->encDataSize);

free(data->sealInfo);

data->sealInfo = NULL;

return TSPERR(TSS_E_OUTOFMEMORY);

}

Trspi_UnloadBlob(offset, data->encDataSize, blob, data->encData);

} else {

data->encData = NULL;

}

return TSS_SUCCESS;

}

void

Trspi_LoadBlob_STORED_DATA(UINT64 *offset, BYTE *blob, TCPA_STORED_DATA *data)

{

Trspi_LoadBlob_TCPA_VERSION(offset, blob, data->ver);

Trspi_LoadBlob_UINT32(offset, data->sealInfoSize, blob);

Trspi_LoadBlob(offset, data->sealInfoSize, blob, data->sealInfo);

Trspi_LoadBlob_UINT32(offset, data->encDataSize, blob);

Trspi_LoadBlob(offset, data->encDataSize, blob, data->encData);

}

TSS_RESULT

changeauth_owner(TSS_HCONTEXT tspContext,

TSS_HOBJECT hObjectToChange,

TSS_HOBJECT hParentObject,

TSS_HPOLICY hNewPolicy)

{

TPM_DIGEST digest;

TSS_RESULT result;

Trspi_HashCtx hashCtx;

struct authsess *xsap = NULL;

if ((result = authsess_xsap_init(tspContext, hObjectToChange, hNewPolicy,

TSS_AUTH_POLICY_REQUIRED, TPM_ORD_ChangeAuthOwner,

TPM_ET_OWNER, &xsap)))

return result;

/* calculate auth data */

result = Trspi_HashInit(&hashCtx, TSS_HASH_SHA1);

result |= Trspi_Hash_UINT32(&hashCtx, TPM_ORD_ChangeAuthOwner);

result |= Trspi_Hash_UINT16(&hashCtx, TCPA_PID_ADCP);

result |= Trspi_Hash_ENCAUTH(&hashCtx, xsap->encAuthUse.authdata);

result |= Trspi_Hash_UINT16(&hashCtx, TCPA_ET_OWNER);

if ((result |= Trspi_HashFinal(&hashCtx, digest.digest)))

goto error;

100

if ((result = authsess_xsap_hmac(xsap, &digest)))

101

goto error;

102

103

if ((result = TCS_API(tspContext)->ChangeAuthOwner(tspContext, TCPA_PID_ADCP,

104

&xsap->encAuthUse, TPM_ET_OWNER,

105

xsap->pAuth)))

106

goto error;

107

108

result = Trspi_HashInit(&hashCtx, TSS_HASH_SHA1);

109

result |= Trspi_Hash_UINT32(&hashCtx, TPM_SUCCESS);

110

result |= Trspi_Hash_UINT32(&hashCtx, TPM_ORD_ChangeAuthOwner);

111

if ((result |= Trspi_HashFinal(&hashCtx, digest.digest)))

112

goto error;

113

114

result = authsess_xsap_verify(xsap, &digest);

115

error:

116

authsess_free(xsap);

117

118

return result;

119

}

120

121

TSS_RESULT

122

changeauth_srk(TSS_HCONTEXT tspContext,

123

TSS_HOBJECT hObjectToChange,

124

TSS_HOBJECT hParentObject,

125

TSS_HPOLICY hNewPolicy)

126

{

127

TPM_DIGEST digest;

128

TSS_RESULT result;

129

Trspi_HashCtx hashCtx;

130

struct authsess *xsap = NULL;

131

132

133

if ((result = authsess_xsap_init(tspContext, hParentObject, hNewPolicy,

134

TSS_AUTH_POLICY_REQUIRED, TPM_ORD_ChangeAuthOwner,

135

TPM_ET_OWNER, &xsap)))

136

return result;

137

138

/* calculate auth data */

139

result = Trspi_HashInit(&hashCtx, TSS_HASH_SHA1);

140

result |= Trspi_Hash_UINT32(&hashCtx, TPM_ORD_ChangeAuthOwner);

141

result |= Trspi_Hash_UINT16(&hashCtx, TCPA_PID_ADCP);

142

result |= Trspi_Hash_ENCAUTH(&hashCtx, xsap->encAuthUse.authdata);

143

result |= Trspi_Hash_UINT16(&hashCtx, TCPA_ET_SRK);

144

if ((result |= Trspi_HashFinal(&hashCtx, digest.digest)))

145

goto error;

146

147

if ((result = authsess_xsap_hmac(xsap, &digest)))

148

goto error;

149

150

if ((result = TCS_API(tspContext)->ChangeAuthOwner(tspContext, TCPA_PID_ADCP,

151

&xsap->encAuthUse, TPM_ET_SRK,

152

xsap->pAuth)))

153

goto error;

154

155

/* Validate the Auths */

156

result = Trspi_HashInit(&hashCtx, TSS_HASH_SHA1);

157

result |= Trspi_Hash_UINT32(&hashCtx, TPM_SUCCESS);

158

result |= Trspi_Hash_UINT32(&hashCtx, TPM_ORD_ChangeAuthOwner);

159

if ((result |= Trspi_HashFinal(&hashCtx, digest.digest)))

160

goto error;

161

162

result = authsess_xsap_verify(xsap, &digest);

163

error:

164

authsess_free(xsap);

165

166

return result;

167

}

168

169

TSS_RESULT

170

changeauth_encdata(TSS_HCONTEXT tspContext,

171

TSS_HOBJECT hObjectToChange,

172

TSS_HOBJECT hParentObject,

173

TSS_HPOLICY hNewPolicy)

174

{

175

TPM_DIGEST digest;

176

TSS_RESULT result;

177

Trspi_HashCtx hashCtx;

178

TSS_HPOLICY hPolicy;

179

TCS_KEY_HANDLE keyHandle;

180

UINT64 offset;

181

struct authsess *xsap = NULL;

182

TPM_STORED_DATA storedData;

183

UINT32 dataBlobLength, newEncSize;

184

BYTE *dataBlob, *newEncData;

185

TPM_AUTH auth2;

186

187

/* get the secret for the parent */

188

if ((result = obj_encdata_get_policy(hObjectToChange, TSS_POLICY_USAGE, &hPolicy)))

189

return result;

190

191

/* get the data Object */

192

if ((result = obj_encdata_get_data(hObjectToChange, &dataBlobLength, &dataBlob)))

193

return result;

194

195

offset = 0;

196

if ((result = Trspi_UnloadBlob_STORED_DATA(&offset, dataBlob, &storedData)))

197

return result;

198

199

if ((result = obj_rsakey_get_tcs_handle(hParentObject, &keyHandle)))

200

return result;

201

202

if ((result = authsess_xsap_init(tspContext, hParentObject, hNewPolicy,

203

TSS_AUTH_POLICY_REQUIRED, TPM_ORD_ChangeAuth,

204

TPM_ET_KEYHANDLE, &xsap)))

205

return result;

206

207

/* caluculate auth data */

208

result = Trspi_HashInit(&hashCtx, TSS_HASH_SHA1);

209

result |= Trspi_Hash_UINT32(&hashCtx, TPM_ORD_ChangeAuth);

210

result |= Trspi_Hash_UINT16(&hashCtx, TPM_PID_ADCP);

211

result |= Trspi_Hash_ENCAUTH(&hashCtx, xsap->encAuthUse.authdata);

212

result |= Trspi_Hash_UINT16(&hashCtx, TPM_ET_DATA);

213

result |= Trspi_Hash_UINT32(&hashCtx, storedData.encDataSize);

214

result |= Trspi_HashUpdate(&hashCtx, storedData.encDataSize, storedData.encData);

215

if ((result |= Trspi_HashFinal(&hashCtx, digest.digest)))

216

goto error;

217

218

if ((result = authsess_xsap_hmac(xsap, &digest)))

219

goto error;

220

221

if ((result = secret_PerformAuth_OIAP(hObjectToChange, TPM_ORD_ChangeAuth,

222

hPolicy, FALSE, &digest, &auth2)))

223

goto error;

224

225

if ((result = TCS_API(tspContext)->ChangeAuth(tspContext, keyHandle, TPM_PID_ADCP,

226

&xsap->encAuthUse, TPM_ET_DATA,

227

storedData.encDataSize, storedData.encData,

228

xsap->pAuth, &auth2, &newEncSize,

229

&newEncData)))

230

goto error;

231

232

/* Validate the Auths */

233

result = Trspi_HashInit(&hashCtx, TSS_HASH_SHA1);

234

result |= Trspi_Hash_UINT32(&hashCtx, TPM_SUCCESS);

235

result |= Trspi_Hash_UINT32(&hashCtx, TPM_ORD_ChangeAuth);

236

result |= Trspi_Hash_UINT32(&hashCtx, newEncSize);

237

result |= Trspi_HashUpdate(&hashCtx, newEncSize, newEncData);

238

if ((result |= Trspi_HashFinal(&hashCtx, digest.digest)))

239

goto error;

240

241

if ((result = authsess_xsap_verify(xsap, &digest)))

242

goto error;

243

244

if ((result = obj_policy_validate_auth_oiap(hPolicy, &digest, &auth2)))

245

goto error;

246

247

memcpy(storedData.encData, newEncData, newEncSize);

248

free(newEncData);

249

storedData.encDataSize = newEncSize;

250

251

offset = 0;

252

Trspi_LoadBlob_STORED_DATA(&offset, dataBlob, &storedData);

253

254

result = obj_encdata_set_data(hObjectToChange, offset, dataBlob);

255

256

error:

257

authsess_free(xsap);

258

free(storedData.sealInfo);

259

free(storedData.encData);

260

261

return result;

262

263

}

264

265

TSS_RESULT

266

changeauth_key(TSS_HCONTEXT tspContext,

267

TSS_HOBJECT hObjectToChange,

268

TSS_HOBJECT hParentObject,

269

TSS_HPOLICY hNewPolicy)

270

{

271

TPM_DIGEST digest;

272

Trspi_HashCtx hashCtx;

273

TSS_RESULT result;

274

TSS_KEY keyToChange;

275

TCS_KEY_HANDLE keyHandle;

276

struct authsess *xsap = NULL;

277

UINT32 objectLength;

278

TSS_HPOLICY hPolicy;

279

BYTE *keyBlob;

280

UINT32 newEncSize;

281

BYTE *newEncData;

282

TPM_AUTH auth2;

283

UINT64 offset;

284

285

286

if ((result = obj_rsakey_get_blob(hObjectToChange, &objectLength, &keyBlob)))

287

return result;

288

289

offset = 0;

290

if ((result = UnloadBlob_TSS_KEY(&offset, keyBlob, &keyToChange))) {

291

LogDebug("UnloadBlob_TSS_KEY failed. "

292

"result=0x%x", result);

293

return result;

294

}

295

296

if ((result = obj_rsakey_get_policy(hObjectToChange, TSS_POLICY_USAGE, &hPolicy, NULL)))

297

return result;

298

299

if ((result = obj_rsakey_get_tcs_handle(hParentObject, &keyHandle)))

300

return result;

301

302

if ((result = authsess_xsap_init(tspContext, hParentObject, hNewPolicy,

303

TSS_AUTH_POLICY_REQUIRED, TPM_ORD_ChangeAuth,

304

keyHandle == TPM_KEYHND_SRK ?

305

TPM_ET_SRK : TPM_ET_KEYHANDLE, &xsap)))

306

return result;

307

308

/* caluculate auth data */

309

result = Trspi_HashInit(&hashCtx, TSS_HASH_SHA1);

310

result |= Trspi_Hash_UINT32(&hashCtx, TPM_ORD_ChangeAuth);

311

result |= Trspi_Hash_UINT16(&hashCtx, TCPA_PID_ADCP);

312

result |= Trspi_Hash_ENCAUTH(&hashCtx, xsap->encAuthUse.authdata);

313

result |= Trspi_Hash_UINT16(&hashCtx, TCPA_ET_KEY);

314

result |= Trspi_Hash_UINT32(&hashCtx, keyToChange.encSize);

315

result |= Trspi_HashUpdate(&hashCtx, keyToChange.encSize,

316

keyToChange.encData);

317

if ((result |= Trspi_HashFinal(&hashCtx, digest.digest)))

318

goto error;

319

320

if ((result = authsess_xsap_hmac(xsap, &digest)))

321

goto error;

322

323

if ((result = secret_PerformAuth_OIAP(hObjectToChange, TPM_ORD_ChangeAuth,

324

hPolicy, FALSE, &digest, &auth2)))

325

goto error;

326

327

if ((result = TCS_API(tspContext)->ChangeAuth(tspContext, keyHandle, TPM_PID_ADCP,

328

&xsap->encAuthUse, TPM_ET_KEY,

329

keyToChange.encSize, keyToChange.encData,

330

xsap->pAuth, &auth2, &newEncSize,

331

&newEncData)))

332

goto error;

333

334

/* Validate the Auths */

335

result = Trspi_HashInit(&hashCtx, TSS_HASH_SHA1);

336

result |= Trspi_Hash_UINT32(&hashCtx, result);

337

result |= Trspi_Hash_UINT32(&hashCtx, TPM_ORD_ChangeAuth);

338

result |= Trspi_Hash_UINT32(&hashCtx, newEncSize);

339

result |= Trspi_HashUpdate(&hashCtx, newEncSize, newEncData);

340

if ((result |= Trspi_HashFinal(&hashCtx, digest.digest)))

341

goto error;

342

343

if ((result = authsess_xsap_verify(xsap, &digest)))

344

goto error;

345

346

if ((result = obj_policy_validate_auth_oiap(hPolicy, &digest, &auth2)))

347

return result;

348

349

memcpy(keyToChange.encData, newEncData, newEncSize);

350

free(newEncData);

351

352

offset = 0;

353

LoadBlob_TSS_KEY(&offset, keyBlob, &keyToChange);

354

objectLength = offset;

355

356

result = obj_rsakey_set_tcpakey(hObjectToChange, objectLength, keyBlob);

357

error:

358

authsess_free(xsap);

359

360

return result;

361

}

362

363

364

#ifdef TSS_BUILD_TRANSPORT

365

TSS_RESULT

366

Transport_ChangeAuth(TSS_HCONTEXT tspContext, /* in */

367

TCS_KEY_HANDLE parentHandle, /* in */

368

TCPA_PROTOCOL_ID protocolID, /* in */

369

TCPA_ENCAUTH *newAuth, /* in */

370

TCPA_ENTITY_TYPE entityType, /* in */

371

UINT32 encDataSize, /* in */

372

BYTE * encData, /* in */

373

TPM_AUTH * ownerAuth, /* in, out */

374

TPM_AUTH * entityAuth, /* in, out */

375

UINT32 * outDataSize, /* out */

376

BYTE ** outData) /* out */

377

{

378

TSS_RESULT result;

379

UINT32 handlesLen, dataLen, decLen;

380

TCS_HANDLE *handles, handle;

381

BYTE *dec = NULL;

382

TPM_DIGEST pubKeyHash;

383

Trspi_HashCtx hashCtx;

384

UINT64 offset;

385

BYTE *data;

386

387

if ((result = obj_context_transport_init(tspContext)))

388

return result;

389

390

LogDebugFn("Executing in a transport session");

391

392

if ((result = obj_tcskey_get_pubkeyhash(parentHandle, pubKeyHash.digest)))

393

return result;

394

395

result = Trspi_HashInit(&hashCtx, TSS_HASH_SHA1);

396

result |= Trspi_Hash_DIGEST(&hashCtx, pubKeyHash.digest);

397

if ((result |= Trspi_HashFinal(&hashCtx, pubKeyHash.digest)))

398

return result;

399

400

handlesLen = 1;

401

handle = parentHandle;

402

handles = &handle;

403

404

dataLen = sizeof(TCPA_PROTOCOL_ID) + sizeof(TCPA_ENCAUTH)

405

+ sizeof(TCPA_ENTITY_TYPE)

406

+ sizeof(UINT32)

407

+ encDataSize;

408

if ((data = malloc(dataLen)) == NULL) {

409

LogError("malloc of %u bytes failed", dataLen);

410

return TSPERR(TSS_E_OUTOFMEMORY);

411

}

412

413

offset = 0;

414

Trspi_LoadBlob_UINT16(&offset, protocolID, data);

415

Trspi_LoadBlob(&offset, sizeof(TCPA_ENCAUTH), data, newAuth->authdata);

416

Trspi_LoadBlob_UINT16(&offset, entityType, data);

417

Trspi_LoadBlob_UINT32(&offset, encDataSize, data);

418

Trspi_LoadBlob(&offset, encDataSize, data, encData);

419

420

if ((result = obj_context_transport_execute(tspContext, TPM_ORD_ChangeAuth, dataLen, data,

421

&pubKeyHash, &handlesLen, &handles,

422

ownerAuth, entityAuth, &decLen, &dec))) {

423

free(data);

424

return result;

425

}

426

free(data);

427

428

offset = 0;

429

Trspi_UnloadBlob_UINT32(&offset, outDataSize, dec);

430

431

if ((*outData = malloc(*outDataSize)) == NULL) {

432

free(dec);

433

LogError("malloc of %u bytes failed", *outDataSize);

434

*outDataSize = 0;

435

return TSPERR(TSS_E_OUTOFMEMORY);

436

}

437

Trspi_UnloadBlob(&offset, *outDataSize, dec, *outData);

438

439

free(dec);

440

441

return result;

442

}

443

444

TSS_RESULT

445

Transport_ChangeAuthOwner(TSS_HCONTEXT tspContext, /* in */

446

TCPA_PROTOCOL_ID protocolID, /* in */

447

TCPA_ENCAUTH *newAuth, /* in */

448

TCPA_ENTITY_TYPE entityType, /* in */

449

TPM_AUTH * ownerAuth) /* in, out */

450

{

451

TSS_RESULT result;

452

UINT32 handlesLen = 0;

453

UINT64 offset;

454

BYTE data[sizeof(TCPA_PROTOCOL_ID) + sizeof(TCPA_ENCAUTH) + sizeof(TCPA_ENTITY_TYPE)];

455

456

if ((result = obj_context_transport_init(tspContext)))

457

return result;

458

459

LogDebugFn("Executing in a transport session");

460

461

offset = 0;

462

Trspi_LoadBlob_UINT16(&offset, protocolID, data);

463

Trspi_LoadBlob(&offset, sizeof(TCPA_ENCAUTH), data, newAuth->authdata);

464

Trspi_LoadBlob_UINT16(&offset, entityType, data);

465

466

return obj_context_transport_execute(tspContext, TPM_ORD_ChangeAuthOwner, sizeof(data),

467

data, NULL, &handlesLen, NULL, ownerAuth, NULL, NULL,

468

NULL);

469

}

470

#endif

Older »