~ubuntu-branches/ubuntu/karmic/trousers/karmic

Committer: Bazaar Package Importer
Author(s): Daniel Baumann
Date: 2008-01-23 22:03:00 UTC
mfrom: (1.1.1 upstream)
Revision ID: james.westby@ubuntu.com-20080123220300-fhtqja3c0oq0gp6z

Tags: 0.3.1-4

http://bugs.debian.org/457400

http://bugs.debian.org/459682

* Added patch from Aaron M. Ucko <ucko@debian.org> to allow trousers to
  build successfully on amd64, and presumably also other 64-bit
  architectures (Closes: #457400).
* Including udev rule for /dev/tpm from William Lima
  <wlima.amadeus@gmail.com> as suggested by David Smith <dds@google.com>
  (Closes: #459682).
* Added lintian overrides.

files added:
debian/TODO

debian/config

debian/config/45-trousers.rules

debian/libtspi-dev.docs

debian/lintian

debian/lintian/libtspi1

debian/lintian/trousers

debian/patches/01-tss-user.dpatch

debian/patches/02-manapge.dpatch

debian/patches/03-readme.dpatch

debian/patches/04-64bit-cleanliness.dpatch

debian/trousers.examples

man/man3/Tspi_Context_GetRegisteredKeysByUUID2.3

man/man3/Tspi_DAA_IssueCredential.3

man/man3/Tspi_DAA_IssueInit.3

man/man3/Tspi_DAA_IssueSetup.3

man/man3/Tspi_DAA_IssuerKeyVerification.3

man/man3/Tspi_DAA_VerifyInit.3

man/man3/Tspi_DAA_VerifySignature.3

man/man3/Tspi_DecodeBER_TssBlob.3

man/man3/Tspi_EncodeDER_TssBlob.3

man/man3/Tspi_TPM_DAA_JoinCreateDaaPubKey.3

man/man3/Tspi_TPM_DAA_JoinInit.3

man/man3/Tspi_TPM_DAA_JoinStoreCredential.3

man/man3/Tspi_TPM_DAA_Sign.3

man/man3/Tspi_TPM_GetAuditDigest.3

man/man3/Tspi_TPM_OwnerGetSRKPubKey.3

man/man3/Tspi_TPM_Quote2.3

src/include/authsess.h

src/include/obj_context.h

src/include/obj_daa.h

src/include/obj_delfamily.h

src/include/obj_encdata.h

src/include/obj_hash.h

src/include/obj_migdata.h

src/include/obj_nv.h

src/include/obj_pcrs.h

src/include/obj_policy.h

src/include/obj_rsakey.h

src/include/obj_tpm.h

src/include/rpc_tcstp.h

src/include/rpc_tcstp_tcs.h

src/include/rpc_tcstp_tsp.h

src/include/tcs_aik.h

src/include/tcs_context.h

src/include/tcs_key_ps.h

src/include/threads.h

src/include/tsp_audit.h

src/include/tsp_delegate.h

src/include/tsp_seal.h

src/include/tss/TSP.idl

src/include/tss/compat11b.h

src/include/tss/tcs.h

src/include/tss/tcs_defines.h

src/include/tss/tpm.h

src/include/tss/tpm_error.h

src/include/tss/tpm_ordinal.h

src/tcs/crypto

src/tcs/crypto/openssl

src/tcs/crypto/openssl/crypto.c

src/tcs/rpc

src/tcs/rpc/tcstp

src/tcs/rpc/tcstp/rpc.c

src/tcs/rpc/tcstp/rpc_admin.c

src/tcs/rpc/tcstp/rpc_aik.c

src/tcs/rpc/tcstp/rpc_audit.c

src/tcs/rpc/tcstp/rpc_auth.c

src/tcs/rpc/tcstp/rpc_bind.c

src/tcs/rpc/tcstp/rpc_caps.c

src/tcs/rpc/tcstp/rpc_caps_tpm.c

src/tcs/rpc/tcstp/rpc_certify.c

src/tcs/rpc/tcstp/rpc_changeauth.c

src/tcs/rpc/tcstp/rpc_cmk.c

src/tcs/rpc/tcstp/rpc_context.c

src/tcs/rpc/tcstp/rpc_counter.c

src/tcs/rpc/tcstp/rpc_daa.c

src/tcs/rpc/tcstp/rpc_delegate.c

src/tcs/rpc/tcstp/rpc_dir.c

src/tcs/rpc/tcstp/rpc_ek.c

src/tcs/rpc/tcstp/rpc_evlog.c

src/tcs/rpc/tcstp/rpc_key.c

src/tcs/rpc/tcstp/rpc_maint.c

src/tcs/rpc/tcstp/rpc_migration.c

src/tcs/rpc/tcstp/rpc_nv.c

src/tcs/rpc/tcstp/rpc_oper.c

src/tcs/rpc/tcstp/rpc_own.c

src/tcs/rpc/tcstp/rpc_pcr_extend.c

src/tcs/rpc/tcstp/rpc_ps.c

src/tcs/rpc/tcstp/rpc_quote.c

src/tcs/rpc/tcstp/rpc_quote2.c

src/tcs/rpc/tcstp/rpc_random.c

src/tcs/rpc/tcstp/rpc_seal.c

src/tcs/rpc/tcstp/rpc_selftest.c

src/tcs/rpc/tcstp/rpc_sign.c

src/tcs/rpc/tcstp/rpc_tick.c

src/tcs/rpc/tcstp/rpc_transport.c

src/tcs/tcs_aik.c

src/tcs/tcs_auth_mgr.c

src/tcs/tcs_caps.c

src/tcs/tcs_context.c

src/tcs/tcs_context_key.c

src/tcs/tcs_counter.c

src/tcs/tcs_evlog.c

src/tcs/tcs_evlog_biosem.c

src/tcs/tcs_evlog_imaem.c

src/tcs/tcs_key.c

src/tcs/tcs_key_mem_cache.c

src/tcs/tcs_key_ps.c

src/tcs/tcs_migration.c

src/tcs/tcs_pbg.c

src/tcs/tcs_ps.c

src/tcs/tcs_quote.c

src/tcs/tcs_quote2.c

src/tcs/tcs_req_mgr.c

src/tcs/tcs_seal.c

src/tcs/tcsi_admin.c

src/tcs/tcsi_aik.c

src/tcs/tcsi_audit.c

src/tcs/tcsi_auth.c

src/tcs/tcsi_bind.c

src/tcs/tcsi_caps.c

src/tcs/tcsi_caps_tpm.c

src/tcs/tcsi_certify.c

src/tcs/tcsi_changeauth.c

src/tcs/tcsi_cmk.c

src/tcs/tcsi_context.c

src/tcs/tcsi_counter.c

src/tcs/tcsi_daa.c

src/tcs/tcsi_delegate.c

src/tcs/tcsi_dir.c

src/tcs/tcsi_ek.c

src/tcs/tcsi_evlog.c

src/tcs/tcsi_key.c

src/tcs/tcsi_maint.c

src/tcs/tcsi_migration.c

src/tcs/tcsi_nv.c

src/tcs/tcsi_oper.c

src/tcs/tcsi_own.c

src/tcs/tcsi_pcr.c

src/tcs/tcsi_ps.c

src/tcs/tcsi_quote.c

src/tcs/tcsi_quote2.c

src/tcs/tcsi_random.c

src/tcs/tcsi_seal.c

src/tcs/tcsi_selftest.c

src/tcs/tcsi_sign.c

src/tcs/tcsi_tick.c

src/tcs/tcsi_transport.c

src/trspi/crypto/openssl/hash.c

src/trspi/crypto/openssl/rsa.c

src/trspi/crypto/openssl/symmetric.c

src/tspi/obj_daa.c

src/tspi/obj_delfamily.c

src/tspi/obj_migdata.c

src/tspi/obj_nv.c

src/tspi/rpc

src/tspi/rpc/hosttable.c

src/tspi/rpc/tcs_api.c

src/tspi/rpc/tcstp

src/tspi/rpc/tcstp/rpc.c

src/tspi/rpc/tcstp/rpc_admin.c

src/tspi/rpc/tcstp/rpc_aik.c

src/tspi/rpc/tcstp/rpc_audit.c

src/tspi/rpc/tcstp/rpc_auth.c

src/tspi/rpc/tcstp/rpc_bind.c

src/tspi/rpc/tcstp/rpc_caps.c

src/tspi/rpc/tcstp/rpc_caps_tpm.c

src/tspi/rpc/tcstp/rpc_certify.c

src/tspi/rpc/tcstp/rpc_changeauth.c

src/tspi/rpc/tcstp/rpc_cmk.c

src/tspi/rpc/tcstp/rpc_context.c

src/tspi/rpc/tcstp/rpc_counter.c

src/tspi/rpc/tcstp/rpc_daa.c

src/tspi/rpc/tcstp/rpc_delegate.c

src/tspi/rpc/tcstp/rpc_dir.c

src/tspi/rpc/tcstp/rpc_ek.c

src/tspi/rpc/tcstp/rpc_evlog.c

src/tspi/rpc/tcstp/rpc_key.c

src/tspi/rpc/tcstp/rpc_maint.c

src/tspi/rpc/tcstp/rpc_migration.c

src/tspi/rpc/tcstp/rpc_nv.c

src/tspi/rpc/tcstp/rpc_oper.c

src/tspi/rpc/tcstp/rpc_own.c

src/tspi/rpc/tcstp/rpc_pcr_extend.c

src/tspi/rpc/tcstp/rpc_ps.c

src/tspi/rpc/tcstp/rpc_quote.c

src/tspi/rpc/tcstp/rpc_quote2.c

src/tspi/rpc/tcstp/rpc_random.c

src/tspi/rpc/tcstp/rpc_seal.c

src/tspi/rpc/tcstp/rpc_selftest.c

src/tspi/rpc/tcstp/rpc_sign.c

src/tspi/rpc/tcstp/rpc_tick.c

src/tspi/rpc/tcstp/rpc_transport.c

src/tspi/tsp_admin.c

src/tspi/tsp_aik.c

src/tspi/tsp_asym.c

src/tspi/tsp_audit.c

src/tspi/tsp_auth.c

src/tspi/tsp_bind.c

src/tspi/tsp_caps.c

src/tspi/tsp_caps_tpm.c

src/tspi/tsp_certify.c

src/tspi/tsp_changeauth.c

src/tspi/tsp_context_mem.c

src/tspi/tsp_counter.c

src/tspi/tsp_daa.c

src/tspi/tsp_delegate.c

src/tspi/tsp_dir.c

src/tspi/tsp_ek.c

src/tspi/tsp_get_flags.c

src/tspi/tsp_key.c

src/tspi/tsp_maint.c

src/tspi/tsp_migration.c

src/tspi/tsp_nv.c

src/tspi/tsp_oper.c

src/tspi/tsp_own.c

src/tspi/tsp_pcr.c

src/tspi/tsp_pcr_extend.c

src/tspi/tsp_policy.c

src/tspi/tsp_ps.c

src/tspi/tsp_quote.c

src/tspi/tsp_quote2.c

src/tspi/tsp_random.c

src/tspi/tsp_seal.c

src/tspi/tsp_selftest.c

src/tspi/tsp_sign.c

src/tspi/tsp_tick.c

src/tspi/tsp_transport.c

src/tspi/tspi_admin.c

src/tspi/tspi_aik.c

src/tspi/tspi_asn1.c

src/tspi/tspi_audit.c

src/tspi/tspi_bind.c

src/tspi/tspi_caps.c

src/tspi/tspi_caps_tpm.c

src/tspi/tspi_certify.c

src/tspi/tspi_changeauth.c

src/tspi/tspi_cmk.c

src/tspi/tspi_context.c

src/tspi/tspi_counter.c

src/tspi/tspi_daa.c

src/tspi/tspi_delegate.c

src/tspi/tspi_dir.c

src/tspi/tspi_ek.c

src/tspi/tspi_getset.c

src/tspi/tspi_hash.c

src/tspi/tspi_key.c

src/tspi/tspi_maint.c

src/tspi/tspi_migration.c

src/tspi/tspi_nv.c

src/tspi/tspi_oper.c

src/tspi/tspi_own.c

src/tspi/tspi_pcr_comp.c

src/tspi/tspi_pcr_comp12.c

src/tspi/tspi_pcr_events.c

src/tspi/tspi_pcr_extend.c

src/tspi/tspi_policy.c

src/tspi/tspi_ps.c

src/tspi/tspi_quote.c

src/tspi/tspi_quote2.c

src/tspi/tspi_random.c

src/tspi/tspi_seal.c

src/tspi/tspi_selftest.c

src/tspi/tspi_sign.c

src/tspi/tspi_tick.c

src/tspi/tspi_transport.c

files removed:
autom4te.cache

autom4te.cache/output.0

autom4te.cache/output.1

autom4te.cache/requests

autom4te.cache/traces.0

autom4te.cache/traces.1

debian/45-trousers.rules

debian/patches/01_makefiles.diff

debian/patches/01_makefiles.dpatch

debian/patches/02_defaultgroup__tcsd.dpatch

debian/trousers.README.Debian

debian/trousers.default

debian/trousers.dirs

debian/watch

src/include/spi_internal_types.h

src/include/tcs_internal_types.h

src/include/trpctp.h

src/tcs/auth_mgr.c

src/tcs/biosem.c

src/tcs/cache.c

src/tcs/cxt.c

src/tcs/imaem.c

src/tcs/req_mgr.c

src/tcs/tcscm.c

src/tcs/tcsem.c

src/tcs/tcskcm.c

src/tcs/tcspbg.c

src/tcsd/tcsd_wrap.c

src/tcsd_api

src/tcsd_api/calltcsapi.c

src/tcsd_api/clntside.c

src/tcsd_api/hosttable.c

src/tcsd_api/tcstp.c

src/trspi/crypto/openssl/crypto.c

src/tspi/keyreg.c

src/tspi/memmgr.c

src/tspi/secrets.c

src/tspi/spi_context.c

src/tspi/spi_data.c

src/tspi/spi_getset.c

src/tspi/spi_hash.c

src/tspi/spi_key.c

src/tspi/spi_pcr.c

src/tspi/spi_policy.c

src/tspi/spi_tpm.c

files modified:
AUTHORS

ChangeLog

Makefile.in

README

config.guess

config.sub

configure

configure.in

debian/changelog

debian/control

debian/copyright

debian/libtspi-dev.install

debian/libtspi1.install

debian/patches/00list

debian/rules

debian/trousers.docs

debian/trousers.init

debian/trousers.install

debian/trousers.postinst

debian/trousers.postrm

dist/Makefile.in

dist/tcsd.conf.in

man/Makefile.in

man/man3/Makefile.am

man/man3/Makefile.in

man/man3/Tspi_Context_LoadKeyByUUID.3

man/man3/Tspi_TPM_GetPubEndorsementKey.3

man/man5/Makefile.in

man/man5/tcsd.conf.5.in

man/man8/Makefile.in

src/Makefile.in

src/include/Makefile.am

src/include/Makefile.in

src/include/auth_mgr.h

src/include/capabilities.h

src/include/hosttable.h

src/include/memmgr.h

src/include/obj.h

src/include/req_mgr.h

src/include/spi_utils.h

src/include/tcs_tsp.h

src/include/tcs_utils.h

src/include/tcsd.h

src/include/tcsd_ops.h

src/include/tcsd_wrap.h

src/include/tcsem.h

src/include/tcslog.h

src/include/tcsps.h

src/include/trousers/trousers.h

src/include/trousers/tss.h

src/include/trousers_types.h

src/include/tspps.h

src/include/tss/platform.h

src/include/tss/tcpa_defines.h

src/include/tss/tcpa_error.h

src/include/tss/tcpa_struct.h

src/include/tss/tcpa_typedef.h

src/include/tss/tcs_error.h

src/include/tss/tcs_structs.h

src/include/tss/tcs_typedef.h

src/include/tss/tddl_error.h

src/include/tss/tddlapi_error.h

src/include/tss/tddli.h

src/include/tss/tspi.h

src/include/tss/tss_defines.h

src/include/tss/tss_error.h

src/include/tss/tss_error_basics.h

src/include/tss/tss_structs.h

src/include/tss/tss_typedef.h

src/tcs/Makefile.am

src/tcs/Makefile.in

src/tcs/ps/ps_utils.c

src/tcs/ps/tcsps.c

src/tcs/tcs_utils.c

src/tcsd/Makefile.am

src/tcsd/Makefile.in

src/tcsd/platform.c

src/tcsd/svrside.c

src/tcsd/tcsd_conf.c

src/tcsd/tcsd_threads.c

src/tddl/Makefile.am

src/tddl/Makefile.in

src/trspi/Makefile.am

src/trspi/Makefile.in

src/trspi/trousers.c

src/tspi/Makefile.am

src/tspi/Makefile.in

src/tspi/obj.c

src/tspi/obj_context.c

src/tspi/obj_encdata.c

src/tspi/obj_hash.c

src/tspi/obj_pcrs.c

src/tspi/obj_policy.c

src/tspi/obj_rsakey.c

src/tspi/obj_tpm.c

src/tspi/ps/tspps.c

src/tspi/spi_utils.c

tools/Makefile.in

tools/ps_inspect.c

Show diffs side-by-side

added added

removed removed

src/tspi/tspi_cmk.c

* Licensed Materials - Property of IBM

* trousers - An open source TCG Software Stack

* (C) Copyright International Business Machines Corp. 2007

#include <stdlib.h>

#include <stdio.h>

#include <string.h>

#include <inttypes.h>

#include "trousers/tss.h"

#include "trousers/trousers.h"

#include "trousers_types.h"

#include "spi_utils.h"

#include "obj.h"

#include "tsplog.h"

TSS_RESULT

Tspi_TPM_CMKSetRestrictions(TSS_HTPM hTpm, /* in */

TSS_CMK_DELEGATE CmkDelegate) /* in */

{

TSS_HCONTEXT hContext;

TSS_HPOLICY hPolicy;

Trspi_HashCtx hashCtx;

TPM_DIGEST digest;

TPM_AUTH ownerAuth;

TSS_RESULT result;

if ((result = obj_tpm_get_tsp_context(hTpm, &hContext)))

return result;

if ((result = obj_tpm_get_policy(hTpm, TSS_POLICY_USAGE, &hPolicy)))

return result;

result = Trspi_HashInit(&hashCtx, TSS_HASH_SHA1);

result |= Trspi_Hash_UINT32(&hashCtx, TPM_ORD_CMK_SetRestrictions);

result |= Trspi_Hash_UINT32(&hashCtx, CmkDelegate);

if ((result |= Trspi_HashFinal(&hashCtx, digest.digest)))

return result;

if ((result = secret_PerformAuth_OIAP(hTpm, TPM_ORD_CMK_SetRestrictions,

hPolicy, FALSE, &digest, &ownerAuth)))

return result;

if ((result = RPC_CMK_SetRestrictions(hContext, CmkDelegate, &ownerAuth)))

return result;

result = Trspi_HashInit(&hashCtx, TSS_HASH_SHA1);

result |= Trspi_Hash_UINT32(&hashCtx, result);

result |= Trspi_Hash_UINT32(&hashCtx, TPM_ORD_CMK_SetRestrictions);

if ((result |= Trspi_HashFinal(&hashCtx, digest.digest)))

return result;

if ((result = obj_policy_validate_auth_oiap(hPolicy, &digest, &ownerAuth)))

return result;

}

TSS_RESULT

Tspi_TPM_CMKApproveMA(TSS_HTPM hTpm, /* in */

TSS_HMIGDATA hMaAuthData) /* in */

{

TSS_HCONTEXT hContext;

TSS_HPOLICY hPolicy;

UINT32 blobSize;

BYTE *blob;

TPM_DIGEST msaDigest;

TPM_HMAC msaHmac;

Trspi_HashCtx hashCtx;

TPM_DIGEST digest;

TPM_AUTH ownerAuth;

TSS_RESULT result;

if ((result = obj_tpm_get_tsp_context(hTpm, &hContext)))

return result;

if ((result = obj_tpm_get_policy(hTpm, TSS_POLICY_USAGE, &hPolicy)))

return result;

if ((result = obj_migdata_get_msa_digest(hMaAuthData, &blobSize, &blob)))

return result;

memcpy(msaDigest.digest, blob, sizeof(msaDigest.digest));

free_tspi(hContext, blob);

result = Trspi_HashInit(&hashCtx, TSS_HASH_SHA1);

result |= Trspi_Hash_UINT32(&hashCtx, TPM_ORD_CMK_ApproveMA);

result |= Trspi_Hash_DIGEST(&hashCtx, msaDigest.digest);

if ((result |= Trspi_HashFinal(&hashCtx, digest.digest)))

return result;

if ((result = secret_PerformAuth_OIAP(hTpm, TPM_ORD_CMK_ApproveMA,

100

hPolicy, FALSE, &digest, &ownerAuth)))

101

return result;

102

103

if ((result = RPC_CMK_ApproveMA(hContext, msaDigest, &ownerAuth, &msaHmac)))

104

return result;

105

106

result = Trspi_HashInit(&hashCtx, TSS_HASH_SHA1);

107

result |= Trspi_Hash_UINT32(&hashCtx, result);

108

result |= Trspi_Hash_UINT32(&hashCtx, TPM_ORD_CMK_ApproveMA);

109

result |= Trspi_Hash_HMAC(&hashCtx, msaHmac.digest);

110

if ((result |= Trspi_HashFinal(&hashCtx, digest.digest)))

111

return result;

112

113

if ((result = obj_policy_validate_auth_oiap(hPolicy, &digest, &ownerAuth)))

114

return result;

115

116

if ((result = obj_migdata_set_msa_hmac(hMaAuthData, sizeof(msaHmac.digest), msaHmac.digest)))

117

return result;

118

119

return result;

120

}

121

122

TSS_RESULT

123

Tspi_TPM_CMKCreateTicket(TSS_HTPM hTpm, /* in */

124

TSS_HKEY hVerifyKey, /* in */

125

TSS_HMIGDATA hSigData) /* in */

126

{

127

TSS_HCONTEXT hContext;

128

TSS_HPOLICY hPolicy;

129

UINT32 pubKeySize;

130

BYTE *pubKey = NULL;

131

UINT32 blobSize;

132

BYTE *blob;

133

TPM_DIGEST sigData;

134

UINT32 sigSize;

135

BYTE *sig = NULL;

136

TPM_HMAC sigTicket;

137

Trspi_HashCtx hashCtx;

138

TPM_DIGEST digest;

139

TPM_AUTH ownerAuth;

140

TSS_RESULT result;

141

142

if ((result = obj_tpm_get_tsp_context(hTpm, &hContext)))

143

return result;

144

145

if ((result = obj_tpm_get_policy(hTpm, TSS_POLICY_USAGE, &hPolicy)))

146

return result;

147

148

if ((result = obj_rsakey_get_pub_blob(hVerifyKey, &pubKeySize, &pubKey)))

149

return result;

150

151

if ((result = obj_migdata_get_sig_data(hSigData, &blobSize, &blob)))

152

goto done;

153

memcpy(sigData.digest, blob, sizeof(sigData.digest));

154

free_tspi(hContext, blob);

155

156

if ((result = obj_migdata_get_sig_value(hSigData, &sigSize, &sig)))

157

goto done;

158

159

result = Trspi_HashInit(&hashCtx, TSS_HASH_SHA1);

160

result |= Trspi_Hash_UINT32(&hashCtx, TPM_ORD_CMK_CreateTicket);

161

result |= Trspi_HashUpdate(&hashCtx, pubKeySize, pubKey);

162

result |= Trspi_Hash_DIGEST(&hashCtx, sigData.digest);

163

result |= Trspi_Hash_UINT32(&hashCtx, sigSize);

164

result |= Trspi_HashUpdate(&hashCtx, sigSize, sig);

165

if ((result |= Trspi_HashFinal(&hashCtx, digest.digest)))

166

goto done;

167

168

if ((result = secret_PerformAuth_OIAP(hTpm, TPM_ORD_CMK_CreateTicket,

169

hPolicy, FALSE, &digest, &ownerAuth)))

170

goto done;

171

172

if ((result = RPC_CMK_CreateTicket(hContext, pubKeySize, pubKey, sigData, sigSize, sig,

173

&ownerAuth, &sigTicket)))

174

goto done;

175

176

result = Trspi_HashInit(&hashCtx, TSS_HASH_SHA1);

177

result |= Trspi_Hash_UINT32(&hashCtx, result);

178

result |= Trspi_Hash_UINT32(&hashCtx, TPM_ORD_CMK_CreateTicket);

179

result |= Trspi_Hash_HMAC(&hashCtx, sigTicket.digest);

180

if ((result |= Trspi_HashFinal(&hashCtx, digest.digest)))

181

goto done;

182

183

if ((result = obj_policy_validate_auth_oiap(hPolicy, &digest, &ownerAuth)))

184

goto done;

185

186

if ((result = obj_migdata_set_sig_ticket(hSigData, sizeof(sigTicket.digest), sigTicket.digest)))

187

goto done;

188

189

done:

190

free_tspi(hContext, pubKey);

191

free_tspi(hContext, sig);

192

193

return result;

194

}

195

196

TSS_RESULT

197

Tspi_Key_CMKCreateBlob(TSS_HKEY hKeyToMigrate, /* in */

198

TSS_HKEY hParentKey, /* in */

199

TSS_HMIGDATA hMigrationData, /* in */

200

UINT32* pulRandomLength, /* out */

201

BYTE** prgbRandom) /* out */

202

{

203

TSS_HCONTEXT hContext;

204

TSS_HPOLICY hPolicy;

205

TSS_BOOL usageAuth;

206

TCS_KEY_HANDLE tcsKeyHandle;

207

TSS_MIGRATE_SCHEME migScheme;

208

UINT32 migTicketSize;

209

BYTE *migTicket = NULL;

210

TPM_MIGRATIONKEYAUTH tpmMigKeyAuth;

211

UINT32 msaListSize, restrictTicketSize, sigTicketSize, blobSize;

212

BYTE *msaList = NULL, *restrictTicket = NULL, *blob = NULL;

213

BYTE *sigTicket = NULL;

214

UINT32 pubBlobSize;

215

BYTE *pubBlob = NULL;

216

TPM_DIGEST srcPubKeyDigest;

217

TSS_KEY tssKey;

218

UINT32 randomDataSize, outDataSize, newBlobSize;

219

BYTE *randomData = NULL, *outData = NULL, *newBlob = NULL;

220

Trspi_HashCtx hashCtx;

221

TPM_DIGEST digest;

222

TPM_AUTH parentAuth, *pAuth;

223

UINT64 offset;

224

TSS_RESULT result;

225

226

memset(&tssKey, 0, sizeof(tssKey));

227

228

if (!pulRandomLength || !prgbRandom)

229

return TSPERR(TSS_E_BAD_PARAMETER);

230

231

if (!obj_rsakey_is_cmk(hKeyToMigrate))

232

return TSPERR(TSS_E_BAD_PARAMETER);

233

234

if ((result = obj_rsakey_get_tsp_context(hKeyToMigrate, &hContext)))

235

return result;

236

237

if ((result = obj_rsakey_get_policy(hParentKey, TSS_POLICY_USAGE, &hPolicy, &usageAuth)))

238

return result;

239

240

if ((result = obj_rsakey_get_tcs_handle(hParentKey, &tcsKeyHandle)))

241

return result;

242

243

if ((result = obj_migdata_get_ticket_blob(hMigrationData, &migTicketSize, &migTicket)))

244

return result;

245

246

/* Just to get the migration scheme... */

247

offset = 0;

248

if ((result = Trspi_UnloadBlob_MIGRATIONKEYAUTH(&offset, migTicket, &tpmMigKeyAuth)))

249

goto done;

250

/* ... so free everything now */

251

free(tpmMigKeyAuth.migrationKey.algorithmParms.parms);

252

free(tpmMigKeyAuth.migrationKey.pubKey.key);

253

migScheme = tpmMigKeyAuth.migrationScheme;

254

255

if ((result = obj_rsakey_get_pub_blob(hKeyToMigrate, &pubBlobSize, &pubBlob)))

256

goto done;

257

if ((result = obj_migdata_calc_pubkey_digest(pubBlobSize, pubBlob, &srcPubKeyDigest)))

258

goto done;

259

260

if ((result = obj_migdata_get_msa_list_blob(hMigrationData, &msaListSize, &msaList)))

261

goto done;

262

263

if (tpmMigKeyAuth.migrationScheme == TPM_MS_RESTRICT_APPROVE_DOUBLE) {

264

if ((result = obj_migdata_get_cmk_auth_blob(hMigrationData, &restrictTicketSize,

265

&restrictTicket)))

266

goto done;

267

if ((result = obj_migdata_get_sig_ticket(hMigrationData, &sigTicketSize,

268

&sigTicket)))

269

goto done;

270

} else {

271

restrictTicketSize = 0;

272

sigTicketSize = 0;

273

}

274

275

if ((result = obj_rsakey_get_blob(hKeyToMigrate, &blobSize, &blob)))

276

goto done;

277

278

offset = 0;

279

if ((result = UnloadBlob_TSS_KEY(&offset, blob, &tssKey)))

280

goto done;

281

282

if (usageAuth) {

283

pAuth = &parentAuth;

284

285

result = Trspi_HashInit(&hashCtx, TSS_HASH_SHA1);

286

result |= Trspi_Hash_UINT32(&hashCtx, TPM_ORD_CMK_CreateBlob);

287

result |= Trspi_Hash_UINT16(&hashCtx, migScheme);

288

result |= Trspi_HashUpdate(&hashCtx, migTicketSize, migTicket);

289

result |= Trspi_Hash_DIGEST(&hashCtx, srcPubKeyDigest.digest);

290

result |= Trspi_Hash_UINT32(&hashCtx, msaListSize);

291

result |= Trspi_HashUpdate(&hashCtx, msaListSize, msaList);

292

result |= Trspi_Hash_UINT32(&hashCtx, restrictTicketSize);

293

result |= Trspi_HashUpdate(&hashCtx, restrictTicketSize, restrictTicket);

294

result |= Trspi_Hash_UINT32(&hashCtx, sigTicketSize);

295

result |= Trspi_HashUpdate(&hashCtx, sigTicketSize, sigTicket);

296

result |= Trspi_Hash_UINT32(&hashCtx, tssKey.encSize);

297

result |= Trspi_HashUpdate(&hashCtx, tssKey.encSize, tssKey.encData);

298

if ((result |= Trspi_HashFinal(&hashCtx, digest.digest)))

299

goto done;

300

301

if ((result = secret_PerformAuth_OIAP(hParentKey, TPM_ORD_CMK_CreateBlob,

302

hPolicy, FALSE, &digest, pAuth)))

303

goto done;

304

} else

305

pAuth = NULL;

306

307

if ((result = RPC_CMK_CreateBlob(hContext, tcsKeyHandle, migScheme,

308

migTicketSize, migTicket, srcPubKeyDigest, msaListSize, msaList,

309

restrictTicketSize, restrictTicket, sigTicketSize, sigTicket,

310

tssKey.encSize, tssKey.encData, pAuth, &randomDataSize, &randomData,

311

&outDataSize, &outData)))

312

goto done;

313

314

if (pAuth) {

315

result = Trspi_HashInit(&hashCtx, TSS_HASH_SHA1);

316

result |= Trspi_Hash_UINT32(&hashCtx, result);

317

result |= Trspi_Hash_UINT32(&hashCtx, TPM_ORD_CMK_CreateBlob);

318

result |= Trspi_Hash_UINT32(&hashCtx, randomDataSize);

319

result |= Trspi_HashUpdate(&hashCtx, randomDataSize, randomData);

320

result |= Trspi_Hash_UINT32(&hashCtx, outDataSize);

321

result |= Trspi_HashUpdate(&hashCtx, outDataSize, outData);

322

if ((result |= Trspi_HashFinal(&hashCtx, digest.digest)))

323

goto done;

324

}

325

326

if ((result = obj_policy_validate_auth_oiap(hPolicy, &digest, pAuth)))

327

goto done;

328

329

/* Create the migdata key blob */

330

free(tssKey.encData);

331

tssKey.encSize = outDataSize;

332

tssKey.encData = outData;

333

/* Set outData to null since it will now be freed during key ref freeing */

334

outData = NULL;

335

336

offset = 0;

337

LoadBlob_TSS_KEY(&offset, NULL, &tssKey);

338

339

newBlobSize = offset;

340

if ((newBlob = malloc(newBlobSize)) == NULL) {

341

LogError("malloc of %u bytes failed.", newBlobSize);

342

result = TSPERR(TSS_E_OUTOFMEMORY);

343

goto done;

344

}

345

offset = 0;

346

LoadBlob_TSS_KEY(&offset, newBlob, &tssKey);

347

348

if ((result = obj_migdata_set_blob(hMigrationData, newBlobSize, newBlob)))

349

goto done;

350

351

if ((*prgbRandom = calloc_tspi(hContext, randomDataSize)) == NULL) {

352

LogError("malloc of %u bytes failed.", randomDataSize);

353

result = TSPERR(TSS_E_OUTOFMEMORY);

354

goto done;

355

}

356

memcpy(*prgbRandom, randomData, randomDataSize);

357

*pulRandomLength = randomDataSize;

358

359

done:

360

free_tspi(hContext, migTicket);

361

free_tspi(hContext, pubBlob);

362

free_tspi(hContext, msaList);

363

free_tspi(hContext, restrictTicket);

364

free_tspi(hContext, sigTicket);

365

free_tspi(hContext, blob);

366

free(randomData);

367

free(outData);

368

free(newBlob);

369

free_key_refs(&tssKey);

370

371

return result;

372

}

373

374

TSS_RESULT

375

Tspi_Key_CMKConvertMigration(TSS_HKEY hKeyToMigrate, /* in */

376

TSS_HKEY hParentKey, /* in */

377

TSS_HMIGDATA hMigrationData, /* in */

378

UINT32 ulRandomLength, /* in */

379

BYTE* rgbRandom) /* in */

380

{

381

TSS_HCONTEXT hContext;

382

TSS_HPOLICY hPolicy;

383

TSS_BOOL usageAuth;

384

TCS_KEY_HANDLE tcsKeyHandle;

385

TPM_CMK_AUTH restrictTicket;

386

UINT32 blobSize;

387

BYTE *blob;

388

TPM_HMAC sigTicket;

389

UINT32 migDataSize, msaListSize;

390

BYTE *migData = NULL, *msaList = NULL;

391

UINT32 outDataSize;

392

BYTE *outData = NULL;

393

Trspi_HashCtx hashCtx;

394

TPM_DIGEST digest;

395

TPM_AUTH parentAuth, *pAuth;

396

TSS_RESULT result;

397

398

if ((result = obj_rsakey_get_tsp_context(hKeyToMigrate, &hContext)))

399

return result;

400

401

if ((result = obj_rsakey_get_policy(hParentKey, TSS_POLICY_USAGE, &hPolicy, &usageAuth)))

402

return result;

403

404

if ((result = obj_rsakey_get_tcs_handle(hParentKey, &tcsKeyHandle)))

405

return result;

406

407

if ((result = obj_migdata_get_cmk_auth(hMigrationData, &restrictTicket)))

408

return result;

409

410

if ((result = obj_migdata_get_sig_ticket(hMigrationData, &blobSize, &blob)))

411

return result;

412

memcpy(sigTicket.digest, blob, sizeof(sigTicket.digest));

413

free_tspi(hContext, blob);

414

415

if ((result = obj_migdata_get_blob(hMigrationData, &migDataSize, &migData)))

416

goto done;

417

418

if ((result = obj_migdata_get_msa_list_blob(hMigrationData, &msaListSize, &msaList)))

419

goto done;

420

421

if (usageAuth) {

422

pAuth = &parentAuth;

423

424

result = Trspi_HashInit(&hashCtx, TSS_HASH_SHA1);

425

result |= Trspi_Hash_UINT32(&hashCtx, TPM_ORD_CMK_ConvertMigration);

426

result |= Trspi_HashUpdate(&hashCtx, sizeof(restrictTicket),

427

(BYTE *)&restrictTicket);

428

result |= Trspi_Hash_HMAC(&hashCtx, sigTicket.digest);

429

result |= Trspi_HashUpdate(&hashCtx, migDataSize, migData);

430

result |= Trspi_Hash_UINT32(&hashCtx, msaListSize);

431

result |= Trspi_HashUpdate(&hashCtx, msaListSize, msaList);

432

result |= Trspi_Hash_UINT32(&hashCtx, ulRandomLength);

433

result |= Trspi_HashUpdate(&hashCtx, ulRandomLength, rgbRandom);

434

if ((result |= Trspi_HashFinal(&hashCtx, digest.digest)))

435

goto done;

436

437

if ((result = secret_PerformAuth_OIAP(hParentKey, TPM_ORD_CMK_ConvertMigration,

438

hPolicy, FALSE, &digest, pAuth)))

439

goto done;

440

} else

441

pAuth = NULL;

442

443

if ((result = RPC_CMK_ConvertMigration(hContext, tcsKeyHandle, restrictTicket, sigTicket,

444

migDataSize, migData, msaListSize, msaList, ulRandomLength, rgbRandom,

445

pAuth, &outDataSize, &outData)))

446

goto done;

447

448

if (pAuth) {

449

result = Trspi_HashInit(&hashCtx, TSS_HASH_SHA1);

450

result |= Trspi_Hash_UINT32(&hashCtx, result);

451

result |= Trspi_Hash_UINT32(&hashCtx, TPM_ORD_CMK_ConvertMigration);

452

result |= Trspi_Hash_UINT32(&hashCtx, outDataSize);

453

result |= Trspi_HashUpdate(&hashCtx, outDataSize, outData);

454

if ((result |= Trspi_HashFinal(&hashCtx, digest.digest)))

455

goto done;

456

}

457

458

if ((result = obj_policy_validate_auth_oiap(hPolicy, &digest, pAuth)))

459

goto done;

460

461

/* Set the key object to the now migrated key */

462

if ((result = obj_rsakey_set_tcpakey(hKeyToMigrate, migDataSize, migData)))

463

goto done;

464

if ((result = obj_rsakey_set_privkey(hKeyToMigrate, TRUE, outDataSize, outData)))

465

goto done;

466

result = obj_rsakey_set_tcs_handle(hKeyToMigrate, 0);

467

468

done:

469

free_tspi(hContext, migData);

470

free_tspi(hContext, msaList);

471

free(outData);

472

473

return result;

474

}

475

Older »