// This file was extracted from the TCG Published
// Trusted Platform Module Library
// Part 4: Supporting Routines
// Family "2.0"
// Level 00 Revision 01.16
// October 30, 2014
#include "TPM_Types.h"
#include "CryptoEngine.h" // types shared by CryptUtil and CryptoEngine.
// Includes the function prototypes for the
// CryptoEngine functions.
#include "Global.h"
#include "InternalRoutines.h"
#include "MemoryLib_fp.h"
//#include "CryptSelfTest_fp.h"
//
//
// 10.2.2 TranslateCryptErrors()
//
// This function converts errors from the cryptographic library into TPM_RC_VALUES.
//
// Error Returns Meaning
//
// TPM_RC_VALUE CRYPT_FAIL
// TPM_RC_NO_RESULT CRYPT_NO_RESULT
// TPM_RC_SCHEME CRYPT_SCHEME
// TPM_RC_VALUE CRYPT_PARAMETER
// TPM_RC_SIZE CRYPT_UNDERFLOW
// TPM_RC_ECC_POINT CRYPT_POINT
// TPM_RC_CANCELLED CRYPT_CANCEL
//
static TPM_RC
TranslateCryptErrors (
CRYPT_RESULT retVal // IN: crypt error to evaluate
)
{
switch (retVal)
{
case CRYPT_SUCCESS:
return TPM_RC_SUCCESS;
case CRYPT_FAIL:
return TPM_RC_VALUE;
case CRYPT_NO_RESULT:
return TPM_RC_NO_RESULT;
case CRYPT_SCHEME:
return TPM_RC_SCHEME;
case CRYPT_PARAMETER:
return TPM_RC_VALUE;
case CRYPT_UNDERFLOW:
return TPM_RC_SIZE;
case CRYPT_POINT:
return TPM_RC_ECC_POINT;
case CRYPT_CANCEL:
return TPM_RC_CANCELED;
default: // Other unknown warnings
return TPM_RC_FAILURE;
}
}
//
//
// 10.2.3 Random Number Generation Functions
//
#ifdef TPM_ALG_NULL //%
#ifdef _DRBG_STATE_SAVE //%
//
//
// 10.2.3.1 CryptDrbgGetPutState()
//
// Read or write the current state from the DRBG in the cryptoEngine.
//
void
CryptDrbgGetPutState(
GET_PUT direction // IN: Get from or put to DRBG
)
{
_cpri__DrbgGetPutState(direction,
sizeof(go.drbgState),
(BYTE *)&go.drbgState);
}
#else //% 00
//%#define CryptDrbgGetPutState(ignored) // If not doing state save, turn this
//% // into a null macro
#endif //%
//
//
// 10.2.3.2 CryptStirRandom()
//
// Stir random entropy
//
void
CryptStirRandom(
UINT32 entropySize, // IN: size of entropy buffer
BYTE *buffer // IN: entropy buffer
)
{
// RNG self testing code may be inserted here
// Call crypto engine random number stirring function
_cpri__StirRandom(entropySize, buffer);
return;
}
//
//
// 10.2.3.3 CryptGenerateRandom()
//
// This is the interface to _cpri__GenerateRandom().
//
UINT16
CryptGenerateRandom(
UINT16 randomSize, // IN: size of random number
BYTE *buffer // OUT: buffer of random number
)
{
UINT16 result;
pAssert(randomSize <= MAX_RSA_KEY_BYTES || randomSize <= PRIMARY_SEED_SIZE);
if(randomSize == 0)
return 0;
// Call crypto engine random number generation
result = _cpri__GenerateRandom(randomSize, buffer);
if(result != randomSize)
FAIL(FATAL_ERROR_INTERNAL);
return result;
}
#endif //TPM_ALG_NULL //%
//
//
// 10.2.4 Hash/HMAC Functions
//
// 10.2.4.1 CryptGetContextAlg()
//
// This function returns the hash algorithm associated with a hash context.
//
#ifdef TPM_ALG_KEYEDHASH //% 1
TPM_ALG_ID
CryptGetContextAlg(
void *state // IN: the context to check
)
{
HASH_STATE *context = (HASH_STATE *)state;
return _cpri__GetContextAlg(&context->state);
}
//
//
// 10.2.4.2 CryptStartHash()
//
// This function starts a hash and return the size, in bytes, of the digest.
//
// Return Value Meaning
//
// >0 the digest size of the algorithm
// =0 the hashAlg was TPM_ALG_NULL
//
UINT16
CryptStartHash(
TPMI_ALG_HASH hashAlg, // IN: hash algorithm
HASH_STATE *hashState // OUT: the state of hash stack. It will be used
// in hash update and completion
)
{
CRYPT_RESULT retVal = 0;
pAssert(hashState != NULL);
TEST_HASH(hashAlg);
hashState->type = HASH_STATE_EMPTY;
// Call crypto engine start hash function
if((retVal = _cpri__StartHash(hashAlg, FALSE, &hashState->state)) > 0)
hashState->type = HASH_STATE_HASH;
return retVal;
}
//
//
//
// 10.2.4.3 CryptStartHashSequence()
//
// Start a hash stack for a sequence object and return the size, in bytes, of the digest. This call uses the
// form of the hash state that requires context save and restored.
//
// Return Value Meaning
//
// >0 the digest size of the algorithm
// =0 the hashAlg was TPM_ALG_NULL
//
UINT16
CryptStartHashSequence(
TPMI_ALG_HASH hashAlg, // IN: hash algorithm
HASH_STATE *hashState // OUT: the state of hash stack. It will be used
// in hash update and completion
)
{
CRYPT_RESULT retVal = 0;
pAssert(hashState != NULL);
TEST_HASH(hashAlg);
hashState->type = HASH_STATE_EMPTY;
// Call crypto engine start hash function
if((retVal = _cpri__StartHash(hashAlg, TRUE, &hashState->state)) > 0)
hashState->type = HASH_STATE_HASH;
return retVal;
}
//
//
// 10.2.4.4 CryptStartHMAC()
//
// This function starts an HMAC sequence and returns the size of the digest that will be produced.
// The caller must provide a block of memory in which the hash sequence state is kept. The caller should
// not alter the contents of this buffer until the hash sequence is completed or abandoned.
//
// Return Value Meaning
//
// >0 the digest size of the algorithm
// =0 the hashAlg was TPM_ALG_NULL
//
UINT16
CryptStartHMAC(
TPMI_ALG_HASH hashAlg, // IN: hash algorithm
UINT16 keySize, // IN: the size of HMAC key in byte
BYTE *key, // IN: HMAC key
HMAC_STATE *hmacState // OUT: the state of HMAC stack. It will be used
// in HMAC update and completion
)
{
HASH_STATE *hashState = (HASH_STATE *)hmacState;
CRYPT_RESULT retVal;
// This has to come before the pAssert in case we all calling this function
// during testing. If so, the first instance will have no arguments but the
// hash algorithm. The call from the test routine will have arguments. When
// the second call is done, then we return to the test dispatcher.
TEST_HASH(hashAlg);
pAssert(hashState != NULL);
hashState->type = HASH_STATE_EMPTY;
if((retVal = _cpri__StartHMAC(hashAlg, FALSE, &hashState->state, keySize, key,
&hmacState->hmacKey.b)) > 0)
hashState->type = HASH_STATE_HMAC;
return retVal;
}
//
//
// 10.2.4.5 CryptStartHMACSequence()
//
// This function starts an HMAC sequence and returns the size of the digest that will be produced.
// The caller must provide a block of memory in which the hash sequence state is kept. The caller should
// not alter the contents of this buffer until the hash sequence is completed or abandoned.
// This call is used to start a sequence HMAC that spans multiple TPM commands.
//
// Return Value Meaning
//
// >0 the digest size of the algorithm
// =0 the hashAlg was TPM_ALG_NULL
//
UINT16
CryptStartHMACSequence(
TPMI_ALG_HASH hashAlg, // IN: hash algorithm
UINT16 keySize, // IN: the size of HMAC key in byte
BYTE *key, // IN: HMAC key
HMAC_STATE *hmacState // OUT: the state of HMAC stack. It will be used
// in HMAC update and completion
)
{
HASH_STATE *hashState = (HASH_STATE *)hmacState;
CRYPT_RESULT retVal;
TEST_HASH(hashAlg);
hashState->type = HASH_STATE_EMPTY;
if((retVal = _cpri__StartHMAC(hashAlg, TRUE, &hashState->state,
keySize, key, &hmacState->hmacKey.b)) > 0)
hashState->type = HASH_STATE_HMAC;
return retVal;
}
//
//
// 10.2.4.6 CryptStartHMAC2B()
//
// This function starts an HMAC and returns the size of the digest that will be produced.
// This function is provided to support the most common use of starting an HMAC with a TPM2B key.
// The caller must provide a block of memory in which the hash sequence state is kept. The caller should
// not alter the contents of this buffer until the hash sequence is completed or abandoned.
//
//
//
//
// Return Value Meaning
//
// >0 the digest size of the algorithm
// =0 the hashAlg was TPM_ALG_NULL
//
LIB_EXPORT UINT16
CryptStartHMAC2B(
TPMI_ALG_HASH hashAlg, // IN: hash algorithm
TPM2B *key, // IN: HMAC key
HMAC_STATE *hmacState // OUT: the state of HMAC stack. It will be used
// in HMAC update and completion
)
{
return CryptStartHMAC(hashAlg, key->size, key->buffer, hmacState);
}
//
//
// 10.2.4.7 CryptStartHMACSequence2B()
//
// This function starts an HMAC sequence and returns the size of the digest that will be produced.
// This function is provided to support the most common use of starting an HMAC with a TPM2B key.
// The caller must provide a block of memory in which the hash sequence state is kept. The caller should
// not alter the contents of this buffer until the hash sequence is completed or abandoned.
//
// Return Value Meaning
//
// >0 the digest size of the algorithm
// =0 the hashAlg was TPM_ALG_NULL
//
UINT16
CryptStartHMACSequence2B(
TPMI_ALG_HASH hashAlg, // IN: hash algorithm
TPM2B *key, // IN: HMAC key
HMAC_STATE *hmacState // OUT: the state of HMAC stack. It will be used
// in HMAC update and completion
)
{
return CryptStartHMACSequence(hashAlg, key->size, key->buffer, hmacState);
}
//
//
// 10.2.4.8 CryptUpdateDigest()
//
// This function updates a digest (hash or HMAC) with an array of octets.
// This function can be used for both HMAC and hash functions so the digestState is void so that either
// state type can be passed.
//
LIB_EXPORT void
CryptUpdateDigest(
void *digestState, // IN: the state of hash stack
UINT32 dataSize, // IN: the size of data
BYTE *data // IN: data to be hashed
)
{
HASH_STATE *hashState = (HASH_STATE *)digestState;
pAssert(digestState != NULL);
if(hashState->type != HASH_STATE_EMPTY && data != NULL && dataSize != 0)
{
// Call crypto engine update hash function
_cpri__UpdateHash(&hashState->state, dataSize, data);
}
return;
}
//
//
// 10.2.4.9 CryptUpdateDigest2B()
//
// This function updates a digest (hash or HMAC) with a TPM2B.
// This function can be used for both HMAC and hash functions so the digestState is void so that either
// state type can be passed.
//
LIB_EXPORT void
CryptUpdateDigest2B(
void *digestState, // IN: the digest state
TPM2B *bIn // IN: 2B containing the data
)
{
// Only compute the digest if a pointer to the 2B is provided.
// In CryptUpdateDigest(), if size is zero or buffer is NULL, then no change
// to the digest occurs. This function should not provide a buffer if bIn is
// not provided.
if(bIn != NULL)
CryptUpdateDigest(digestState, bIn->size, bIn->buffer);
return;
}
//
//
// 10.2.4.10 CryptUpdateDigestInt()
//
// This function is used to include an integer value to a hash stack. The function marshals the integer into its
// canonical form before calling CryptUpdateHash().
//
LIB_EXPORT void
CryptUpdateDigestInt(
void *state, // IN: the state of hash stack
UINT32 intSize, // IN: the size of 'intValue' in byte
void *intValue // IN: integer value to be hashed
)
{
#if BIG_ENDIAN_TPM == YES
pAssert( intValue != NULL && (intSize == 1 || intSize == 2
|| intSize == 4 || intSize == 8));
CryptUpdateHash(state, inSize, (BYTE *)intValue);
#else
BYTE marshalBuffer[8];
// Point to the big end of an little-endian value
BYTE *p = &((BYTE *)intValue)[intSize - 1];
// Point to the big end of an big-endian value
BYTE *q = marshalBuffer;
pAssert(intValue != NULL);
switch (intSize)
{
case 8:
*q++ = *p--;
*q++ = *p--;
*q++ = *p--;
*q++ = *p--;
case 4:
*q++ = *p--;
*q++ = *p--;
case 2:
*q++ = *p--;
case 1:
*q = *p;
// Call update the hash
CryptUpdateDigest(state, intSize, marshalBuffer);
break;
default:
FAIL(0);
}
#endif
return;
}
//
//
// 10.2.4.11 CryptCompleteHash()
//
// This function completes a hash sequence and returns the digest.
// This function can be called to complete either an HMAC or hash sequence. The state type determines if
// the context type is a hash or HMAC. If an HMAC, then the call is forwarded to CryptCompleteHash().
// If digestSize is smaller than the digest size of hash/HMAC algorithm, the most significant bytes of
// required size will be returned
//
// Return Value Meaning
//
// >=0 the number of bytes placed in digest
//
LIB_EXPORT UINT16
CryptCompleteHash(
void *state, // IN: the state of hash stack
UINT16 digestSize, // IN: size of digest buffer
BYTE *digest // OUT: hash digest
)
{
HASH_STATE *hashState = (HASH_STATE *)state; // local value
// If the session type is HMAC, then could forward this to
// the HMAC processing and not cause an error. However, if no
// function calls this routine to forward it, then we can't get
// test coverage. The decision is to assert if this is called with
// the type == HMAC and fix anything that makes the wrong call.
pAssert(hashState->type == HASH_STATE_HASH);
// Set the state to empty so that it doesn't get used again
hashState->type = HASH_STATE_EMPTY;
// Call crypto engine complete hash function
return _cpri__CompleteHash(&hashState->state, digestSize, digest);
}
//
//
// 10.2.4.12 CryptCompleteHash2B()
//
// This function is the same as CypteCompleteHash() but the digest is placed in a TPM2B. This is the most
// common use and this is provided for specification clarity. 'digest.size' should be set to indicate the number
// of bytes to place in the buffer
//
//
//
//
// Return Value Meaning
//
// >=0 the number of bytes placed in 'digest.buffer'
//
LIB_EXPORT UINT16
CryptCompleteHash2B(
void *state, // IN: the state of hash stack
TPM2B *digest // IN: the size of the buffer Out: requested
// number of byte
)
{
UINT16 retVal = 0;
if(digest != NULL)
retVal = CryptCompleteHash(state, digest->size, digest->buffer);
return retVal;
}
//
//
// 10.2.4.13 CryptHashBlock()
//
// Hash a block of data and return the results. If the digest is larger than retSize, it is truncated and with the
// least significant octets dropped.
//
// Return Value Meaning
//
// >=0 the number of bytes placed in ret
//
LIB_EXPORT UINT16
CryptHashBlock(
TPM_ALG_ID algId, // IN: the hash algorithm to use
UINT16 blockSize, // IN: size of the data block
BYTE *block, // IN: address of the block to hash
UINT16 retSize, // IN: size of the return buffer
BYTE *ret // OUT: address of the buffer
)
{
TEST_HASH(algId);
return _cpri__HashBlock(algId, blockSize, block, retSize, ret);
}
//
//
// 10.2.4.14 CryptCompleteHMAC()
//
// This function completes a HMAC sequence and returns the digest. If digestSize is smaller than the digest
// size of the HMAC algorithm, the most significant bytes of required size will be returned.
//
// Return Value Meaning
//
// >=0 the number of bytes placed in digest
//
LIB_EXPORT UINT16
CryptCompleteHMAC(
HMAC_STATE *hmacState, // IN: the state of HMAC stack
UINT32 digestSize, // IN: size of digest buffer
BYTE *digest // OUT: HMAC digest
)
{
HASH_STATE *hashState;
pAssert(hmacState != NULL);
hashState = &hmacState->hashState;
pAssert(hashState->type == HASH_STATE_HMAC);
hashState->type = HASH_STATE_EMPTY;
return _cpri__CompleteHMAC(&hashState->state, &hmacState->hmacKey.b,
digestSize, digest);
}
//
//
// 10.2.4.15 CryptCompleteHMAC2B()
//
// This function is the same as CryptCompleteHMAC() but the HMAC result is returned in a TPM2B which is
// the most common use.
//
// Return Value Meaning
//
// >=0 the number of bytes placed in digest
//
LIB_EXPORT UINT16
CryptCompleteHMAC2B(
HMAC_STATE *hmacState, // IN: the state of HMAC stack
TPM2B *digest // OUT: HMAC
)
{
UINT16 retVal = 0;
if(digest != NULL)
retVal = CryptCompleteHMAC(hmacState, digest->size, digest->buffer);
return retVal;
}
//
//
// 10.2.4.16 CryptHashStateImportExport()
//
// This function is used to prepare a hash state context for LIB_EXPORT or to import it into the internal
// format. It is used by TPM2_ContextSave() and TPM2_ContextLoad() via SequenceDataImportExport().
// This is just a pass-through function to the crypto library.
//
void
CryptHashStateImportExport(
HASH_STATE *internalFmt, // IN: state to LIB_EXPORT
HASH_STATE *externalFmt, // OUT: exported state
IMPORT_EXPORT direction
)
{
_cpri__ImportExportHashState(&internalFmt->state,
(EXPORT_HASH_STATE *)&externalFmt->state,
direction);
}
//
//
// 10.2.4.17 CryptGetHashDigestSize()
//
// This function returns the digest size in bytes for a hash algorithm.
//
// Return Value Meaning
//
// 0 digest size for TPM_ALG_NULL
// >0 digest size
//
LIB_EXPORT UINT16
CryptGetHashDigestSize(
TPM_ALG_ID hashAlg // IN: hash algorithm
)
{
return _cpri__GetDigestSize(hashAlg);
}
//
//
// 10.2.4.18 CryptGetHashBlockSize()
//
// Get the digest size in byte of a hash algorithm.
//
// Return Value Meaning
//
// 0 block size for TPM_ALG_NULL
// >0 block size
//
LIB_EXPORT UINT16
CryptGetHashBlockSize(
TPM_ALG_ID hash // IN: hash algorithm to look up
)
{
return _cpri__GetHashBlockSize(hash);
}
//
//
// 10.2.4.19 CryptGetHashAlgByIndex()
//
// This function is used to iterate through the hashes. TPM_ALG_NULL is returned for all indexes that are
// not valid hashes. If the TPM implements 3 hashes, then an index value of 0 will return the first
// implemented hash and an index value of 2 will return the last implemented hash. All other index values
// will return TPM_ALG_NULL.
//
// Return Value Meaning
//
// TPM_ALG_xxx() a hash algorithm
// TPM_ALG_NULL this can be used as a stop value
//
LIB_EXPORT TPM_ALG_ID
CryptGetHashAlgByIndex(
UINT32 index // IN: the index
)
{
return _cpri__GetHashAlgByIndex(index);
}
//
//
// 10.2.4.20 CryptSignHMAC()
//
// Sign a digest using an HMAC key. This an HMAC of a digest, not an HMAC of a message.
//
// Error Returns Meaning
//
static TPM_RC
CryptSignHMAC(
OBJECT *signKey, // IN: HMAC key sign the hash
TPMT_SIG_SCHEME *scheme, // IN: signing scheme
TPM2B_DIGEST *hashData, // IN: hash to be signed
TPMT_SIGNATURE *signature // OUT: signature
)
{
//
HMAC_STATE hmacState;
UINT32 digestSize;
// HMAC algorithm self testing code may be inserted here
digestSize = CryptStartHMAC2B(scheme->details.hmac.hashAlg,
&signKey->sensitive.sensitive.bits.b,
&hmacState);
// The hash algorithm must be a valid one.
pAssert(digestSize > 0);
CryptUpdateDigest2B(&hmacState, &hashData->b);
CryptCompleteHMAC(&hmacState, digestSize,
(BYTE *) &signature->signature.hmac.digest);
// Set HMAC algorithm
signature->signature.hmac.hashAlg = scheme->details.hmac.hashAlg;
return TPM_RC_SUCCESS;
}
//
//
// 10.2.4.21 CryptHMACVerifySignature()
//
// This function will verify a signature signed by a HMAC key.
//
// Error Returns Meaning
//
// TPM_RC_SIGNATURE if invalid input or signature is not genuine
//
static TPM_RC
CryptHMACVerifySignature(
OBJECT *signKey, // IN: HMAC key signed the hash
TPM2B_DIGEST *hashData, // IN: digest being verified
TPMT_SIGNATURE *signature // IN: signature to be verified
)
{
HMAC_STATE hmacState;
TPM2B_DIGEST digestToCompare;
digestToCompare.t.size = CryptStartHMAC2B(signature->signature.hmac.hashAlg,
&signKey->sensitive.sensitive.bits.b, &hmacState);
CryptUpdateDigest2B(&hmacState, &hashData->b);
CryptCompleteHMAC2B(&hmacState, &digestToCompare.b);
// Compare digest
if(MemoryEqual(digestToCompare.t.buffer,
(BYTE *) &signature->signature.hmac.digest,
digestToCompare.t.size))
return TPM_RC_SUCCESS;
else
return TPM_RC_SIGNATURE;
}
//
//
// 10.2.4.22 CryptGenerateKeyedHash()
//
// This function creates a keyedHash object.
//
//
//
// Error Returns Meaning
//
// TPM_RC_SIZE sensitive data size is larger than allowed for the scheme
// TPM_RC_VALUE the publicArea nameAlg is invalid
//
static TPM_RC
CryptGenerateKeyedHash(
TPMT_PUBLIC *publicArea, // IN/OUT: the public area template
// for the new key.
TPMS_SENSITIVE_CREATE *sensitiveCreate, // IN: sensitive creation data
TPMT_SENSITIVE *sensitive, // OUT: sensitive area
TPM_ALG_ID kdfHashAlg, // IN: algorithm for the KDF
TPM2B_SEED *seed, // IN: the seed
TPM2B_NAME *name // IN: name of the object
)
{
TPMT_KEYEDHASH_SCHEME *scheme;
TPM_ALG_ID hashAlg;
UINT16 hashBlockSize;
// Check parameter values
if(publicArea->nameAlg == TPM_ALG_NULL)
{
return TPM_RC_VALUE;
}
scheme = &publicArea->parameters.keyedHashDetail.scheme;
pAssert(publicArea->type == TPM_ALG_KEYEDHASH);
// Pick the limiting hash algorithm
if(scheme->scheme == TPM_ALG_NULL)
hashAlg = publicArea->nameAlg;
else if(scheme->scheme == TPM_ALG_XOR)
hashAlg = scheme->details.xor_.hashAlg;
else
hashAlg = scheme->details.hmac.hashAlg;
hashBlockSize = CryptGetHashBlockSize(hashAlg);
// if this is a signing or a decryption key, then then the limit
// for the data size is the block size of the hash. This limit
// is set because larger values have lower entropy because of the
// HMAC function.
if(publicArea->objectAttributes.sensitiveDataOrigin == CLEAR)
{
if( ( publicArea->objectAttributes.decrypt
|| publicArea->objectAttributes.sign)
&& sensitiveCreate->data.t.size > hashBlockSize)
return TPM_RC_SIZE;
}
else
{
// If the TPM is going to generate the data, then set the size to be the
// size of the digest of the algorithm
sensitive->sensitive.sym.t.size = CryptGetHashDigestSize(hashAlg);
sensitiveCreate->data.t.size = 0;
}
// Fill in the sensitive area
CryptGenerateNewSymmetric(sensitiveCreate, sensitive, kdfHashAlg,
seed, name);
// Create unique area in public
CryptComputeSymmetricUnique(publicArea->nameAlg,
sensitive, &publicArea->unique.sym);
return TPM_RC_SUCCESS;
}
//
//
// 10.2.4.25 KDFa()
//
// This function is used by functions outside of CryptUtil() to access _cpri_KDFa().
//
void
KDFa(
TPM_ALG_ID hash, // IN: hash algorithm used in HMAC
TPM2B *key, // IN: HMAC key
const char *label, // IN: a null-terminated label for KDF
TPM2B *contextU, // IN: context U
TPM2B *contextV, // IN: context V
UINT32 sizeInBits, // IN: size of generated key in bit
BYTE *keyStream, // OUT: key buffer
UINT32 *counterInOut // IN/OUT: caller may provide the iteration
// counter for incremental operations to
// avoid large intermediate buffers.
)
{
CryptKDFa(hash, key, label, contextU, contextV, sizeInBits,
keyStream, counterInOut);
}
#endif //TPM_ALG_KEYEDHASH //% 1
//
//
// 10.2.5 RSA Functions
//
// 10.2.5.1 BuildRSA()
//
// Function to set the cryptographic elements of an RSA key into a structure to simplify the interface to
// _cpri__ RSA function. This can/should be eliminated by building this structure into the object structure.
//
#ifdef TPM_ALG_RSA //% 2
static void
BuildRSA(
OBJECT *rsaKey,
RSA_KEY *key
)
{
key->exponent = rsaKey->publicArea.parameters.rsaDetail.exponent;
if(key->exponent == 0)
key->exponent = RSA_DEFAULT_PUBLIC_EXPONENT;
key->publicKey = &rsaKey->publicArea.unique.rsa.b;
if(rsaKey->attributes.publicOnly || rsaKey->privateExponent.t.size == 0)
key->privateKey = NULL;
else
key->privateKey = &(rsaKey->privateExponent.b);
}
//
//
// 10.2.5.2 CryptTestKeyRSA()
//
// This function provides the interface to _cpri__TestKeyRSA(). If both p and q are provided, n will be set to
// p*q.
// If only p is provided, q is computed by q = n/p. If n mod p != 0, TPM_RC_BINDING is returned.
// The key is validated by checking that a d can be found such that e d mod ((p-1)*(q-1)) = 1. If d is found
// that satisfies this requirement, it will be placed in d.
// Page 286 TCG Published Family "2.0"
// October 30, 2014 Copyright © TCG 2006-2014 Level 00 Revision 01.16
// Part 4: Supporting Routines Trusted Platform Module Library
//
//
// Error Returns Meaning
//
// TPM_RC_BINDING the public and private portions of the key are not matched
//
TPM_RC
CryptTestKeyRSA(
TPM2B *d, // OUT: receives the private exponent
UINT32 e, // IN: public exponent
TPM2B *n, // IN/OUT: public modulu
TPM2B *p, // IN: a first prime
TPM2B *q // IN: an optional second prime
)
{
CRYPT_RESULT retVal;
TEST(ALG_NULL_VALUE);
pAssert(d != NULL && n != NULL && p != NULL);
// Set the exponent
if(e == 0)
e = RSA_DEFAULT_PUBLIC_EXPONENT;
// CRYPT_PARAMETER
retVal =_cpri__TestKeyRSA(d, e, n, p, q);
if(retVal == CRYPT_SUCCESS)
return TPM_RC_SUCCESS;
else
return TPM_RC_BINDING; // convert CRYPT_PARAMETER
}
//
//
// 10.2.5.3 CryptGenerateKeyRSA()
//
// This function is called to generate an RSA key from a provided seed. It calls _cpri__GenerateKeyRSA()
// to perform the computations. The implementation is vendor specific.
//
// Error Returns Meaning
//
// TPM_RC_RANGE the exponent value is not supported
// TPM_RC_CANCELLED key generation has been canceled
// TPM_RC_VALUE exponent is not prime or is less than 3; or could not find a prime using
// the provided parameters
//
static TPM_RC
CryptGenerateKeyRSA(
TPMT_PUBLIC *publicArea, // IN/OUT: The public area template for
// the new key. The public key
// area will be replaced by the
// product of two primes found by
// this function
TPMT_SENSITIVE *sensitive, // OUT: the sensitive area will be
// updated to contain the first
// prime and the symmetric
// encryption key
TPM_ALG_ID hashAlg, // IN: the hash algorithm for the KDF
TPM2B_SEED *seed, // IN: Seed for the creation
TPM2B_NAME *name, // IN: Object name
UINT32 *counter // OUT: last iteration of the counter
)
{
CRYPT_RESULT retVal;
UINT32 exponent = publicArea->parameters.rsaDetail.exponent;
TEST_HASH(hashAlg);
TEST(ALG_NULL_VALUE);
// In this implementation, only the default exponent is allowed
if(exponent != 0 && exponent != RSA_DEFAULT_PUBLIC_EXPONENT)
return TPM_RC_RANGE;
exponent = RSA_DEFAULT_PUBLIC_EXPONENT;
*counter = 0;
// _cpri_GenerateKeyRSA can return CRYPT_CANCEL or CRYPT_FAIL
retVal = _cpri__GenerateKeyRSA(&publicArea->unique.rsa.b,
&sensitive->sensitive.rsa.b,
publicArea->parameters.rsaDetail.keyBits,
exponent,
hashAlg,
&seed->b,
"RSA key by vendor",
&name->b,
counter);
// CRYPT_CANCEL -> TPM_RC_CANCELLED; CRYPT_FAIL -> TPM_RC_VALUE
return TranslateCryptErrors(retVal);
}
//
//
// 10.2.5.4 CryptLoadPrivateRSA()
//
// This function is called to generate the private exponent of an RSA key. It uses CryptTestKeyRSA().
//
// Error Returns Meaning
//
// TPM_RC_BINDING public and private parts of rsaKey are not matched
//
TPM_RC
CryptLoadPrivateRSA(
OBJECT *rsaKey // IN: the RSA key object
)
{
TPM_RC result;
TPMT_PUBLIC *publicArea = &rsaKey->publicArea;
TPMT_SENSITIVE *sensitive = &rsaKey->sensitive;
// Load key by computing the private exponent
// TPM_RC_BINDING
result = CryptTestKeyRSA(&(rsaKey->privateExponent.b),
publicArea->parameters.rsaDetail.exponent,
&(publicArea->unique.rsa.b),
&(sensitive->sensitive.rsa.b),
NULL);
if(result == TPM_RC_SUCCESS)
rsaKey->attributes.privateExp = SET;
return result;
}
//
//
// 10.2.5.5 CryptSelectRSAScheme()
//
// This function is used by TPM2_RSA_Decrypt() and TPM2_RSA_Encrypt(). It sets up the rules to select a
// scheme between input and object default. This function assume the RSA object is loaded. If a default
// scheme is defined in object, the default scheme should be chosen, otherwise, the input scheme should
// be chosen. In the case that both the object and scheme are not TPM_ALG_NULL, then if the schemes
//
//
// are the same, the input scheme will be chosen. if the scheme are not compatible, a NULL pointer will be
// returned.
// The return pointer may point to a TPM_ALG_NULL scheme.
//
TPMT_RSA_DECRYPT*
CryptSelectRSAScheme(
TPMI_DH_OBJECT rsaHandle, // IN: handle of sign key
TPMT_RSA_DECRYPT *scheme // IN: a sign or decrypt scheme
)
{
OBJECT *rsaObject;
TPMT_ASYM_SCHEME *keyScheme;
TPMT_RSA_DECRYPT *retVal = NULL;
// Get sign object pointer
rsaObject = ObjectGet(rsaHandle);
keyScheme = &rsaObject->publicArea.parameters.asymDetail.scheme;
// if the default scheme of the object is TPM_ALG_NULL, then select the
// input scheme
if(keyScheme->scheme == TPM_ALG_NULL)
{
retVal = scheme;
}
// if the object scheme is not TPM_ALG_NULL and the input scheme is
// TPM_ALG_NULL, then select the default scheme of the object.
else if(scheme->scheme == TPM_ALG_NULL)
{
// if input scheme is NULL
retVal = (TPMT_RSA_DECRYPT *)keyScheme;
}
// get here if both the object scheme and the input scheme are
// not TPM_ALG_NULL. Need to insure that they are the same.
// The hash algorithm match has to be verified for OAEP.
// IMPLEMENTATION NOTE: This could cause problems if future versions have
// schemes that have more values than just a hash algorithm. A new function
// (IsSchemeSame()) might be needed then.
else if (keyScheme->scheme == scheme->scheme
&& ((keyScheme->scheme != TPM_ALG_OAEP) ||
(keyScheme->details.anySig.hashAlg == scheme->details.anySig.hashAlg)))
{
retVal = scheme;
}
// two different, incompatible schemes specified will return NULL
return retVal;
}
//
//
// 10.2.5.6 CryptDecryptRSA()
//
// This function is the interface to _cpri__DecryptRSA(). It handles the return codes from that function and
// converts them from CRYPT_RESULT to TPM_RC values. The rsaKey parameter must reference an RSA
// decryption key
//
// Error Returns Meaning
//
// TPM_RC_BINDING Public and private parts of the key are not cryptographically bound.
// TPM_RC_SIZE Size of data to decrypt is not the same as the key size.
// TPM_RC_VALUE Numeric value of the encrypted data is greater than the public
// exponent, or output buffer is too small for the decrypted message.
//
TPM_RC
CryptDecryptRSA(
UINT16 *dataOutSize, // OUT: size of plain text in byte
BYTE *dataOut, // OUT: plain text
OBJECT *rsaKey, // IN: internal RSA key
TPMT_RSA_DECRYPT *scheme, // IN: selects the padding scheme
UINT16 cipherInSize, // IN: size of cipher text in byte
BYTE *cipherIn, // IN: cipher text
const char *label // IN: a label, when needed
)
{
RSA_KEY key;
CRYPT_RESULT retVal = CRYPT_SUCCESS;
UINT32 dSize; // Place to put temporary value for the
// returned data size
TPMI_ALG_HASH hashAlg = TPM_ALG_NULL; // hash algorithm in the selected
// padding scheme
TPM_RC result = TPM_RC_SUCCESS;
// pointer checks
pAssert( (dataOutSize != NULL) && (dataOut != NULL)
&& (rsaKey != NULL) && (cipherIn != NULL));
// The public type is a RSA decrypt key
pAssert( (rsaKey->publicArea.type == TPM_ALG_RSA
&& rsaKey->publicArea.objectAttributes.decrypt == SET));
// Must have the private portion loaded. This check is made before this
// function is called.
pAssert(rsaKey->attributes.publicOnly == CLEAR);
// decryption requires that the private modulus be present
if(rsaKey->attributes.privateExp == CLEAR)
{
// Load key by computing the private exponent
// CryptLoadPrivateRSA may return TPM_RC_BINDING
result = CryptLoadPrivateRSA(rsaKey);
}
// the input buffer must be the size of the key
if(result == TPM_RC_SUCCESS)
{
if(cipherInSize != rsaKey->publicArea.unique.rsa.t.size)
result = TPM_RC_SIZE;
else
{
BuildRSA(rsaKey, &key);
// Initialize the dOutSize parameter
dSize = *dataOutSize;
// For OAEP scheme, initialize the hash algorithm for padding
if(scheme->scheme == TPM_ALG_OAEP)
{
hashAlg = scheme->details.oaep.hashAlg;
TEST_HASH(hashAlg);
}
// See if the padding mode needs to be tested
TEST(scheme->scheme);
// _cpri__DecryptRSA may return CRYPT_PARAMETER CRYPT_FAIL CRYPT_SCHEME
retVal = _cpri__DecryptRSA(&dSize, dataOut, &key, scheme->scheme,
cipherInSize, cipherIn, hashAlg, label);
// Scheme must have been validated when the key was loaded/imported
pAssert(retVal != CRYPT_SCHEME);
// Set the return size
pAssert(dSize <= UINT16_MAX);
*dataOutSize = (UINT16)dSize;
// CRYPT_PARAMETER -> TPM_RC_VALUE, CRYPT_FAIL -> TPM_RC_VALUE
result = TranslateCryptErrors(retVal);
}
}
return result;
}
//
//
// 10.2.5.7 CryptEncryptRSA()
//
// This function provides the interface to _cpri__EncryptRSA(). The object referenced by rsaKey is required
// to be an RSA decryption key.
//
// Error Returns Meaning
//
// TPM_RC_SCHEME scheme is not supported
// TPM_RC_VALUE numeric value of dataIn is greater than the key modulus
//
TPM_RC
CryptEncryptRSA(
UINT16 *cipherOutSize, // OUT: size of cipher text in byte
BYTE *cipherOut, // OUT: cipher text
OBJECT *rsaKey, // IN: internal RSA key
TPMT_RSA_DECRYPT *scheme, // IN: selects the padding scheme
UINT16 dataInSize, // IN: size of plain text in byte
BYTE *dataIn, // IN: plain text
const char *label // IN: an optional label
)
{
RSA_KEY key;
CRYPT_RESULT retVal;
UINT32 cOutSize; // Conversion variable
TPMI_ALG_HASH hashAlg = TPM_ALG_NULL; // hash algorithm in selected
// padding scheme
// must have a pointer to a key and some data to encrypt
pAssert(rsaKey != NULL && dataIn != NULL);
// The public type is a RSA decryption key
pAssert( rsaKey->publicArea.type == TPM_ALG_RSA
&& rsaKey->publicArea.objectAttributes.decrypt == SET);
// If the cipher buffer must be provided and it must be large enough
// for the result
pAssert( cipherOut != NULL
&& cipherOutSize != NULL
&& *cipherOutSize >= rsaKey->publicArea.unique.rsa.t.size);
// Only need the public key and exponent for encryption
BuildRSA(rsaKey, &key);
// Copy the size to the conversion buffer
cOutSize = *cipherOutSize;
// For OAEP scheme, initialize the hash algorithm for padding
if(scheme->scheme == TPM_ALG_OAEP)
{
hashAlg = scheme->details.oaep.hashAlg;
TEST_HASH(hashAlg);
}
// This is a public key operation and does not require that the private key
// be loaded. To verify this, need to do the full algorithm
TEST(scheme->scheme);
// Encrypt the data with the public exponent
// _cpri__EncryptRSA may return CRYPT_PARAMETER or CRYPT_SCHEME
retVal = _cpri__EncryptRSA(&cOutSize,cipherOut, &key, scheme->scheme,
dataInSize, dataIn, hashAlg, label);
pAssert (cOutSize <= UINT16_MAX);
*cipherOutSize = (UINT16)cOutSize;
// CRYPT_PARAMETER -> TPM_RC_VALUE, CRYPT_SCHEME -> TPM_RC_SCHEME
return TranslateCryptErrors(retVal);
}
//
//
// 10.2.5.8 CryptSignRSA()
//
// This function is used to sign a digest with an RSA signing key.
//
// Error Returns Meaning
//
// TPM_RC_BINDING public and private part of signKey are not properly bound
// TPM_RC_SCHEME scheme is not supported
// TPM_RC_VALUE hashData is larger than the modulus of signKey, or the size of
// hashData does not match hash algorithm in scheme
//
static TPM_RC
CryptSignRSA(
OBJECT *signKey, // IN: RSA key signs the hash
TPMT_SIG_SCHEME *scheme, // IN: sign scheme
TPM2B_DIGEST *hashData, // IN: hash to be signed
TPMT_SIGNATURE *sig // OUT: signature
)
{
UINT32 signSize;
RSA_KEY key;
CRYPT_RESULT retVal;
TPM_RC result = TPM_RC_SUCCESS;
pAssert( (signKey != NULL) && (scheme != NULL)
&& (hashData != NULL) && (sig != NULL));
// assume that the key has private part loaded and that it is a signing key.
pAssert( (signKey->attributes.publicOnly == CLEAR)
&& (signKey->publicArea.objectAttributes.sign == SET));
// check if the private exponent has been computed
if(signKey->attributes.privateExp == CLEAR)
// May return TPM_RC_BINDING
result = CryptLoadPrivateRSA(signKey);
if(result == TPM_RC_SUCCESS)
{
BuildRSA(signKey, &key);
// Make sure that the hash is tested
TEST_HASH(sig->signature.any.hashAlg);
// Run a test of the RSA sign
TEST(scheme->scheme);
// _crypi__SignRSA can return CRYPT_SCHEME and CRYPT_PARAMETER
retVal = _cpri__SignRSA(&signSize,
sig->signature.rsassa.sig.t.buffer,
&key,
sig->sigAlg,
sig->signature.any.hashAlg,
hashData->t.size, hashData->t.buffer);
pAssert(signSize <= UINT16_MAX);
sig->signature.rsassa.sig.t.size = (UINT16)signSize;
// CRYPT_SCHEME -> TPM_RC_SCHEME; CRYPT_PARAMTER -> TPM_RC_VALUE
result = TranslateCryptErrors(retVal);
}
return result;
}
//
//
// 10.2.5.9 CryptRSAVerifySignature()
//
// This function is used to verify signature signed by a RSA key.
//
// Error Returns Meaning
//
// TPM_RC_SIGNATURE if signature is not genuine
// TPM_RC_SCHEME signature scheme not supported
//
static TPM_RC
CryptRSAVerifySignature(
OBJECT *signKey, // IN: RSA key signed the hash
TPM2B_DIGEST *digestData, // IN: digest being signed
TPMT_SIGNATURE *sig // IN: signature to be verified
)
{
RSA_KEY key;
CRYPT_RESULT retVal;
TPM_RC result;
// Validate parameter assumptions
pAssert((signKey != NULL) && (digestData != NULL) && (sig != NULL));
TEST_HASH(sig->signature.any.hashAlg);
TEST(sig->sigAlg);
// This is a public-key-only operation
BuildRSA(signKey, &key);
// Call crypto engine to verify signature
// _cpri_ValidateSignaturRSA may return CRYPT_FAIL or CRYPT_SCHEME
retVal = _cpri__ValidateSignatureRSA(&key,
sig->sigAlg,
sig->signature.any.hashAlg,
digestData->t.size,
digestData->t.buffer,
sig->signature.rsassa.sig.t.size,
sig->signature.rsassa.sig.t.buffer,
0);
// _cpri__ValidateSignatureRSA can return CRYPT_SUCCESS, CRYPT_FAIL, or
// CRYPT_SCHEME. Translate CRYPT_FAIL to TPM_RC_SIGNATURE
if(retVal == CRYPT_FAIL)
result = TPM_RC_SIGNATURE;
else
// CRYPT_SCHEME -> TPM_RC_SCHEME
result = TranslateCryptErrors(retVal);
return result;
}
//
#endif //TPM_ALG_RSA //% 2
//
//
// 10.2.6 ECC Functions
//
// 10.2.6.1 CryptEccGetCurveDataPointer()
//
// This function returns a pointer to an ECC_CURVE_VALUES structure that contains the parameters for
// the key size and schemes for a given curve.
//
#ifdef TPM_ALG_ECC //% 3
static const ECC_CURVE *
CryptEccGetCurveDataPointer(
TPM_ECC_CURVE curveID // IN: id of the curve
)
{
return _cpri__EccGetParametersByCurveId(curveID);
}
//
//
// 10.2.6.2 CryptEccGetKeySizeInBits()
//
// This function returns the size in bits of the key associated with a curve.
//
UINT16
CryptEccGetKeySizeInBits(
TPM_ECC_CURVE curveID // IN: id of the curve
)
{
const ECC_CURVE *curve = CryptEccGetCurveDataPointer(curveID);
UINT16 keySizeInBits = 0;
if(curve != NULL)
keySizeInBits = curve->keySizeBits;
return keySizeInBits;
}
//
//
// 10.2.6.4 CryptEccGetParameter()
//
// This function returns a pointer to an ECC curve parameter. The parameter is selected by a single
// character designator from the set of {pnabxyh}.
//
LIB_EXPORT const TPM2B *
CryptEccGetParameter(
char p, // IN: the parameter selector
TPM_ECC_CURVE curveId // IN: the curve id
)
{
const ECC_CURVE *curve = _cpri__EccGetParametersByCurveId(curveId);
const TPM2B *parameter = NULL;
if(curve != NULL)
{
switch (p)
{
case 'p':
parameter = curve->curveData->p;
break;
case 'n':
parameter = curve->curveData->n;
break;
case 'a':
parameter = curve->curveData->a;
break;
case 'b':
parameter = curve->curveData->b;
break;
case 'x':
parameter = curve->curveData->x;
break;
case 'y':
parameter = curve->curveData->y;
break;
case 'h':
parameter = curve->curveData->h;
break;
default:
break;
}
}
return parameter;
}
//
//
// 10.2.6.5 CryptGetCurveSignScheme()
//
// This function will return a pointer to the scheme of the curve.
//
const TPMT_ECC_SCHEME *
CryptGetCurveSignScheme(
TPM_ECC_CURVE curveId // IN: The curve selector
)
{
const ECC_CURVE *curve = _cpri__EccGetParametersByCurveId(curveId);
const TPMT_ECC_SCHEME *scheme = NULL;
if(curve != NULL)
scheme = &(curve->sign);
return scheme;
}
//
//
// 10.2.6.6 CryptEccIsPointOnCurve()
//
// This function will validate that an ECC point is on the curve of given curveID.
//
// Return Value Meaning
//
// TRUE if the point is on curve
// FALSE if the point is not on curve
//
BOOL
CryptEccIsPointOnCurve(
TPM_ECC_CURVE curveID, // IN: ECC curve ID
TPMS_ECC_POINT *Q // IN: ECC point
)
{
// Make sure that point multiply is working
TEST(TPM_ALG_ECC);
// Check point on curve logic by seeing if the test key is on the curve
// Call crypto engine function to check if a ECC public point is on the
// given curve
if(_cpri__EccIsPointOnCurve(curveID, Q))
return TRUE;
else
return FALSE;
}
//
//
// 10.2.6.7 CryptNewEccKey()
//
// This function creates a random ECC key that is not derived from other parameters as is a Primary Key.
//
TPM_RC
CryptNewEccKey(
TPM_ECC_CURVE curveID, // IN: ECC curve
TPMS_ECC_POINT *publicPoint, // OUT: public point
TPM2B_ECC_PARAMETER *sensitive // OUT: private area
)
{
TPM_RC result = TPM_RC_SUCCESS;
// _cpri__GetEphemeralECC may return CRYPT_PARAMETER
if(_cpri__GetEphemeralEcc(publicPoint, sensitive, curveID) != CRYPT_SUCCESS)
// Something is wrong with the key.
result = TPM_RC_KEY;
return result;
}
//
//
// 10.2.6.8 CryptEccPointMultiply()
//
// This function is used to perform a point multiply R = [d]Q. If Q is not provided, the multiplication is
// performed using the generator point of the curve.
//
// Error Returns Meaning
//
// TPM_RC_ECC_POINT invalid optional ECC point pIn
// TPM_RC_NO_RESULT multiplication resulted in a point at infinity
// TPM_RC_CANCELED if a self-test was done, it might have been aborted
//
TPM_RC
CryptEccPointMultiply(
TPMS_ECC_POINT *pOut, // OUT: output point
TPM_ECC_CURVE curveId, // IN: curve selector
TPM2B_ECC_PARAMETER *dIn, // IN: public scalar
TPMS_ECC_POINT *pIn // IN: optional point
)
{
TPM2B_ECC_PARAMETER *n = NULL;
CRYPT_RESULT retVal;
pAssert(pOut != NULL && dIn != NULL);
if(pIn != NULL)
{
n = dIn;
dIn = NULL;
}
// Do a test of point multiply
TEST(TPM_ALG_ECC);
// _cpri__EccPointMultiply may return CRYPT_POINT or CRYPT_NO_RESULT
retVal = _cpri__EccPointMultiply(pOut, curveId, dIn, pIn, n);
// CRYPT_POINT->TPM_RC_ECC_POINT and CRYPT_NO_RESULT->TPM_RC_NO_RESULT
return TranslateCryptErrors(retVal);
}
//
//
// 10.2.6.9 CryptGenerateKeyECC()
//
// This function generates an ECC key from a seed value.
// The method here may not work for objects that have an order (G) that with a different size than a private
// key.
//
// Error Returns Meaning
//
// TPM_RC_VALUE hash algorithm is not supported
//
static TPM_RC
CryptGenerateKeyECC(
TPMT_PUBLIC *publicArea, // IN/OUT: The public area template for the new
// key.
TPMT_SENSITIVE *sensitive, // IN/OUT: the sensitive area
TPM_ALG_ID hashAlg, // IN: algorithm for the KDF
TPM2B_SEED *seed, // IN: the seed value
TPM2B_NAME *name, // IN: the name of the object
UINT32 *counter // OUT: the iteration counter
)
{
CRYPT_RESULT retVal;
TEST_HASH(hashAlg);
TEST(ALG_ECDSA_VALUE); // ECDSA is used to verify each key
// The iteration counter has no meaning for ECC key generation. The parameter
// will be overloaded for those implementations that have a requirement for
// doing pair-wise consistency checks on signing keys. If the counter parameter
// is 0 or NULL, then no consistency check is done. If it is other than 0, then
// a consistency check is run. This modification allow this code to work with
// the existing versions of the CrytpoEngine and with FIPS-compliant versions
// as well.
*counter = (UINT32)(publicArea->objectAttributes.sign == SET);
// _cpri__GenerateKeyEcc only has one error return (CRYPT_PARAMETER) which means
// that the hash algorithm is not supported. This should not be possible
retVal = _cpri__GenerateKeyEcc(&publicArea->unique.ecc,
&sensitive->sensitive.ecc,
publicArea->parameters.eccDetail.curveID,
hashAlg, &seed->b, "ECC key by vendor",
&name->b, counter);
// This will only be useful if _cpri__GenerateKeyEcc return CRYPT_CANCEL
return TranslateCryptErrors(retVal);
}
//
//
// 10.2.6.10 CryptSignECC()
//
// This function is used for ECC signing operations. If the signing scheme is a split scheme, and the signing
// operation is successful, the commit value is retired.
//
//
// Error Returns Meaning
//
// TPM_RC_SCHEME unsupported scheme
// TPM_RC_VALUE invalid commit status (in case of a split scheme) or failed to generate
// r value.
//
static TPM_RC
CryptSignECC(
OBJECT *signKey, // IN: ECC key to sign the hash
TPMT_SIG_SCHEME *scheme, // IN: sign scheme
TPM2B_DIGEST *hashData, // IN: hash to be signed
TPMT_SIGNATURE *signature // OUT: signature
)
{
TPM2B_ECC_PARAMETER r;
TPM2B_ECC_PARAMETER *pr = NULL;
CRYPT_RESULT retVal;
// Run a test of the ECC sign and verify if it has not already been run
TEST_HASH(scheme->details.any.hashAlg);
TEST(scheme->scheme);
if(CryptIsSplitSign(scheme->scheme))
{
// When this code was written, the only split scheme was ECDAA
// (which can also be used for U-Prove).
if(!CryptGenerateR(&r,
&scheme->details.ecdaa.count,
signKey->publicArea.parameters.eccDetail.curveID,
&signKey->name))
return TPM_RC_VALUE;
pr = &r;
}
// Call crypto engine function to sign
// _cpri__SignEcc may return CRYPT_SCHEME
retVal = _cpri__SignEcc(&signature->signature.ecdsa.signatureR,
&signature->signature.ecdsa.signatureS,
scheme->scheme,
scheme->details.any.hashAlg,
signKey->publicArea.parameters.eccDetail.curveID,
&signKey->sensitive.sensitive.ecc,
&hashData->b,
pr
);
if(CryptIsSplitSign(scheme->scheme) && retVal == CRYPT_SUCCESS)
CryptEndCommit(scheme->details.ecdaa.count);
// CRYPT_SCHEME->TPM_RC_SCHEME
return TranslateCryptErrors(retVal);
}
//
//
// 10.2.6.11 CryptECCVerifySignature()
//
// This function is used to verify a signature created with an ECC key.
//
// Error Returns Meaning
//
// TPM_RC_SIGNATURE if signature is not valid
// TPM_RC_SCHEME the signing scheme or hashAlg is not supported
//
static TPM_RC
CryptECCVerifySignature(
OBJECT *signKey, // IN: ECC key signed the hash
TPM2B_DIGEST *digestData, // IN: digest being signed
TPMT_SIGNATURE *signature // IN: signature to be verified
)
{
CRYPT_RESULT retVal;
TEST_HASH(signature->signature.any.hashAlg);
TEST(signature->sigAlg);
// This implementation uses the fact that all the defined ECC signing
// schemes have the hash as the first parameter.
// _cpriValidateSignatureEcc may return CRYPT_FAIL or CRYP_SCHEME
retVal = _cpri__ValidateSignatureEcc(&signature->signature.ecdsa.signatureR,
&signature->signature.ecdsa.signatureS,
signature->sigAlg,
signature->signature.any.hashAlg,
signKey->publicArea.parameters.eccDetail.curveID,
&signKey->publicArea.unique.ecc,
&digestData->b);
if(retVal == CRYPT_FAIL)
return TPM_RC_SIGNATURE;
// CRYPT_SCHEME->TPM_RC_SCHEME
return TranslateCryptErrors(retVal);
}
//
//
// 10.2.6.12 CryptGenerateR()
//
// This function computes the commit random value for a split signing scheme.
// If c is NULL, it indicates that r is being generated for TPM2_Commit(). If c is not NULL, the TPM will
// validate that the gr.commitArray bit associated with the input value of c is SET. If not, the TPM returns
// FALSE and no r value is generated.
//
// Return Value Meaning
//
// TRUE r value computed
// FALSE no r value computed
//
BOOL
CryptGenerateR(
TPM2B_ECC_PARAMETER *r, // OUT: the generated random value
UINT16 *c, // IN/OUT: count value.
TPMI_ECC_CURVE curveID, // IN: the curve for the value
TPM2B_NAME *name // IN: optional name of a key to
// associate with 'r'
)
{
// This holds the marshaled g_commitCounter.
TPM2B_TYPE(8B, 8);
TPM2B_8B cntr = {.b.size = 8};
UINT32 iterations;
const TPM2B *n;
UINT64 currentCount = gr.commitCounter;
// This is just to suppress a compiler warning about a conditional expression
// being a constant. This is because of the macro expansion of ryptKDFa
TPMI_ALG_HASH hashAlg = CONTEXT_INTEGRITY_HASH_ALG;
n = CryptEccGetParameter('n', curveID);
pAssert(r != NULL && n != NULL);
// If this is the commit phase, use the current value of the commit counter
if(c != NULL)
//
{
UINT16 t1;
// if the array bit is not set, can't use the value.
if(!BitIsSet((*c & COMMIT_INDEX_MASK), gr.commitArray,
sizeof(gr.commitArray)))
return FALSE;
// If it is the sign phase, figure out what the counter value was
// when the commitment was made.
//
// When gr.commitArray has less than 64K bits, the extra
// bits of 'c' are used as a check to make sure that the
// signing operation is not using an out of range count value
t1 = (UINT16)currentCount;
// If the lower bits of c are greater or equal to the lower bits of t1
// then the upper bits of t1 must be one more than the upper bits
// of c
if((*c & COMMIT_INDEX_MASK) >= (t1 & COMMIT_INDEX_MASK))
// Since the counter is behind, reduce the current count
currentCount = currentCount - (COMMIT_INDEX_MASK + 1);
t1 = (UINT16)currentCount;
if((t1 & ~COMMIT_INDEX_MASK) != (*c & ~COMMIT_INDEX_MASK))
return FALSE;
// set the counter to the value that was
// present when the commitment was made
currentCount = (currentCount & 0xffffffffffff0000) | *c;
}
// Marshal the count value to a TPM2B buffer for the KDF
cntr.t.size = sizeof(currentCount);
UINT64_TO_BYTE_ARRAY(currentCount, cntr.t.buffer);
// Now can do the KDF to create the random value for the signing operation
// During the creation process, we may generate an r that does not meet the
// requirements of the random value.
// want to generate a new r.
r->t.size = n->size;
// Arbitrary upper limit on the number of times that we can look for
// a suitable random value. The normally number of tries will be 1.
for(iterations = 1; iterations < 1000000;)
{
BYTE *pr = &r->b.buffer[0];
int i;
CryptKDFa(hashAlg, &gr.commitNonce.b, "ECDAA Commit",
name, &cntr.b, n->size * 8, r->t.buffer, &iterations);
// random value must be less than the prime
if(CryptCompare(r->b.size, r->b.buffer, n->size, n->buffer) >= 0)
continue;
// in this implementation it is required that at least bit
// in the upper half of the number be set
for(i = n->size/2; i > 0; i--)
if(*pr++ != 0)
return TRUE;
}
return FALSE;
}
//
//
//
// 10.2.6.13 CryptCommit()
//
// This function is called when the count value is committed. The gr.commitArray value associated with the
// current count value is SET and g_commitCounter is incremented. The low-order 16 bits of old value of the
// counter is returned.
//
UINT16
CryptCommit(
void
)
{
UINT16 oldCount = (UINT16)gr.commitCounter;
gr.commitCounter++;
BitSet(oldCount & COMMIT_INDEX_MASK, gr.commitArray, sizeof(gr.commitArray));
return oldCount;
}
//
//
// 10.2.6.14 CryptEndCommit()
//
// This function is called when the signing operation using the committed value is completed. It clears the
// gr.commitArray bit associated with the count value so that it can't be used again.
//
void
CryptEndCommit(
UINT16 c // IN: the counter value of the commitment
)
{
BitClear((c & COMMIT_INDEX_MASK), gr.commitArray, sizeof(gr.commitArray));
}
//
//
// 10.2.6.15 CryptCommitCompute()
//
// This function performs the computations for the TPM2_Commit() command. This could be a macro.
//
// Error Returns Meaning
//
// TPM_RC_NO_RESULT K, L, or E is the point at infinity
// TPM_RC_CANCELLED command was canceled
//
TPM_RC
CryptCommitCompute(
TPMS_ECC_POINT *K, // OUT: [d]B
TPMS_ECC_POINT *L, // OUT: [r]B
TPMS_ECC_POINT *E, // OUT: [r]M
TPM_ECC_CURVE curveID, // IN: The curve for the computation
TPMS_ECC_POINT *M, // IN: M (P1)
TPMS_ECC_POINT *B, // IN: B (x2, y2)
TPM2B_ECC_PARAMETER *d, // IN: the private scalar
TPM2B_ECC_PARAMETER *r // IN: the computed r value
)
{
TEST(ALG_ECDH_VALUE);
// CRYPT_NO_RESULT->TPM_RC_NO_RESULT CRYPT_CANCEL->TPM_RC_CANCELLED
return TranslateCryptErrors(
_cpri__EccCommitCompute(K, L , E, curveID, M, B, d, r));
}
//
//
//
// 10.2.6.16 CryptEccGetParameters()
//
// This function returns the ECC parameter details of the given curve
//
// Return Value Meaning
//
// TRUE Get parameters success
// FALSE Unsupported ECC curve ID
//
BOOL
CryptEccGetParameters(
TPM_ECC_CURVE curveId, // IN: ECC curve ID
TPMS_ALGORITHM_DETAIL_ECC *parameters // OUT: ECC parameter
)
{
const ECC_CURVE *curve = _cpri__EccGetParametersByCurveId(curveId);
const ECC_CURVE_DATA *data;
BOOL found = curve != NULL;
if(found)
{
data = curve->curveData;
parameters->curveID = curve->curveId;
// Key size in bit
parameters->keySize = curve->keySizeBits;
// KDF
parameters->kdf = curve->kdf;
// Sign
parameters->sign = curve->sign;
// Copy p value
MemoryCopy2B(¶meters->p.b, data->p, sizeof(parameters->p.t.buffer));
// Copy a value
MemoryCopy2B(¶meters->a.b, data->a, sizeof(parameters->a.t.buffer));
// Copy b value
MemoryCopy2B(¶meters->b.b, data->b, sizeof(parameters->b.t.buffer));
// Copy Gx value
MemoryCopy2B(¶meters->gX.b, data->x, sizeof(parameters->gX.t.buffer));
// Copy Gy value
MemoryCopy2B(¶meters->gY.b, data->y, sizeof(parameters->gY.t.buffer));
// Copy n value
MemoryCopy2B(¶meters->n.b, data->n, sizeof(parameters->n.t.buffer));
// Copy h value
MemoryCopy2B(¶meters->h.b, data->h, sizeof(parameters->h.t.buffer));
}
return found;
}
#if CC_ZGen_2Phase == YES
//
// CryptEcc2PhaseKeyExchange() This is the interface to the key exchange function.
//
TPM_RC
CryptEcc2PhaseKeyExchange(
TPMS_ECC_POINT *outZ1, // OUT: the computed point
TPMS_ECC_POINT *outZ2, // OUT: optional second point
TPM_ALG_ID scheme, // IN: the key exchange scheme
TPM_ECC_CURVE curveId, // IN: the curve for the computation
TPM2B_ECC_PARAMETER *dsA, // IN: static private TPM key
TPM2B_ECC_PARAMETER *deA, // IN: ephemeral private TPM key
TPMS_ECC_POINT *QsB, // IN: static public party B key
TPMS_ECC_POINT *QeB // IN: ephemeral public party B key
)
{
return (TranslateCryptErrors(_cpri__C_2_2_KeyExchange(outZ1,
outZ2,
scheme,
curveId,
dsA,
deA,
QsB,
QeB)));
}
#endif // CC_ZGen_2Phase
#endif //TPM_ALG_ECC //% 3
//
//
// 10.2.6.17 CryptIsSchemeAnonymous()
//
// This function is used to test a scheme to see if it is an anonymous scheme The only anonymous scheme
// is ECDAA. ECDAA can be used to do things like U-Prove.
//
BOOL
CryptIsSchemeAnonymous(
TPM_ALG_ID scheme // IN: the scheme algorithm to test
)
{
#ifdef TPM_ALG_ECDAA
return (scheme == TPM_ALG_ECDAA);
#else
UNREFERENCED(scheme);
return 0;
#endif
}
//
//
// 10.2.7 Symmetric Functions
//
// 10.2.7.1 ParmDecryptSym()
//
// This function performs parameter decryption using symmetric block cipher.
//
void
ParmDecryptSym(
TPM_ALG_ID symAlg, // IN: the symmetric algorithm
TPM_ALG_ID hash, // IN: hash algorithm for KDFa
UINT16 keySizeInBits, // IN: key key size in bit
TPM2B *key, // IN: KDF HMAC key
TPM2B *nonceCaller, // IN: nonce caller
TPM2B *nonceTpm, // IN: nonce TPM
UINT32 dataSize, // IN: size of parameter buffer
BYTE *data // OUT: buffer to be decrypted
)
{
// KDF output buffer
// It contains parameters for the CFB encryption
// From MSB to LSB, they are the key and iv
BYTE symParmString[MAX_SYM_KEY_BYTES + MAX_SYM_BLOCK_SIZE];
// Symmetric key size in byte
UINT16 keySize = (keySizeInBits + 7) / 8;
TPM2B_IV iv;
iv.t.size = CryptGetSymmetricBlockSize(symAlg, keySizeInBits);
// If there is decryption to do...
if(iv.t.size > 0)
{
// Generate key and iv
CryptKDFa(hash, key, "CFB", nonceCaller, nonceTpm,
keySizeInBits + (iv.t.size * 8), symParmString, NULL);
MemoryCopy(iv.t.buffer, &symParmString[keySize], iv.t.size,
sizeof(iv.t.buffer));
CryptSymmetricDecrypt(data, symAlg, keySizeInBits, TPM_ALG_CFB,
symParmString, &iv, dataSize, data);
}
return;
}
//
//
// 10.2.7.2 ParmEncryptSym()
//
// This function performs parameter encryption using symmetric block cipher.
//
void
ParmEncryptSym(
TPM_ALG_ID symAlg, // IN: symmetric algorithm
TPM_ALG_ID hash, // IN: hash algorithm for KDFa
UINT16 keySizeInBits, // IN: AES key size in bit
TPM2B *key, // IN: KDF HMAC key
TPM2B *nonceCaller, // IN: nonce caller
TPM2B *nonceTpm, // IN: nonce TPM
UINT32 dataSize, // IN: size of parameter buffer
BYTE *data // OUT: buffer to be encrypted
)
{
// KDF output buffer
// It contains parameters for the CFB encryption
BYTE symParmString[MAX_SYM_KEY_BYTES + MAX_SYM_BLOCK_SIZE];
// Symmetric key size in bytes
UINT16 keySize = (keySizeInBits + 7) / 8;
TPM2B_IV iv;
iv.t.size = CryptGetSymmetricBlockSize(symAlg, keySizeInBits);
// See if there is any encryption to do
if(iv.t.size > 0)
{
// Generate key and iv
CryptKDFa(hash, key, "CFB", nonceTpm, nonceCaller,
keySizeInBits + (iv.t.size * 8), symParmString, NULL);
MemoryCopy(iv.t.buffer, &symParmString[keySize], iv.t.size,
sizeof(iv.t.buffer));
CryptSymmetricEncrypt(data, symAlg, keySizeInBits, TPM_ALG_CFB,
symParmString, &iv, dataSize, data);
}
return;
}
//
//
//
// 10.2.7.3 CryptGenerateNewSymmetric()
//
// This function creates the sensitive symmetric values for an HMAC or symmetric key. If the sensitive area
// is zero, then the sensitive creation key data is copied. If it is not zero, then the TPM will generate a
// random value of the selected size.
//
void
CryptGenerateNewSymmetric(
TPMS_SENSITIVE_CREATE *sensitiveCreate, // IN: sensitive creation data
TPMT_SENSITIVE *sensitive, // OUT: sensitive area
TPM_ALG_ID hashAlg, // IN: hash algorithm for the KDF
TPM2B_SEED *seed, // IN: seed used in creation
TPM2B_NAME *name // IN: name of the object
)
{
// This function is called to create a key and obfuscation value for a
// symmetric key that can either be a block cipher or an XOR key. The buffer
// in sensitive->sensitive will hold either. When we call the function
// to copy the input value or generated value to the sensitive->sensitive
// buffer we will need to have a size for the output buffer. This define
// computes the maximum that it might need to be and uses that. It will always
// be smaller than the largest value that will fit.
#define MAX_SENSITIVE_SIZE \
(MAX(sizeof(sensitive->sensitive.bits.t.buffer), \
sizeof(sensitive->sensitive.sym.t.buffer)))
// set the size of the obfuscation value
sensitive->seedValue.t.size = CryptGetHashDigestSize(hashAlg);
// If the input sensitive size is zero, then create both the sensitive data
// and the obfuscation value
if(sensitiveCreate->data.t.size == 0)
{
BYTE symValues[MAX(MAX_DIGEST_SIZE, MAX_SYM_KEY_BYTES)
+ MAX_DIGEST_SIZE];
UINT16 requestSize;
// Set the size of the request to be the size of the key and the
// obfuscation value
requestSize = sensitive->sensitive.sym.t.size
+ sensitive->seedValue.t.size;
pAssert(requestSize <= sizeof(symValues));
requestSize = _cpri__GenerateSeededRandom(requestSize, symValues, hashAlg,
&seed->b,
"symmetric sensitive", &name->b,
NULL);
pAssert(requestSize != 0);
// Copy the new key
MemoryCopy(sensitive->sensitive.sym.t.buffer,
symValues, sensitive->sensitive.sym.t.size,
MAX_SENSITIVE_SIZE);
// copy the obfuscation value
MemoryCopy(sensitive->seedValue.t.buffer,
&symValues[sensitive->sensitive.sym.t.size],
sensitive->seedValue.t.size,
sizeof(sensitive->seedValue.t.buffer));
}
else
{
// Copy input symmetric key to sensitive area as long as it will fit
MemoryCopy2B(&sensitive->sensitive.sym.b, &sensitiveCreate->data.b,
MAX_SENSITIVE_SIZE);
// Create the obfuscation value
_cpri__GenerateSeededRandom(sensitive->seedValue.t.size,
sensitive->seedValue.t.buffer,
hashAlg, &seed->b,
"symmetric obfuscation", &name->b, NULL);
}
return;
}
//
//
// 10.2.7.4 CryptGenerateKeySymmetric()
//
// This function derives a symmetric cipher key from the provided seed.
//
// Error Returns Meaning
//
// TPM_RC_KEY_SIZE key size in the public area does not match the size in the sensitive
// creation area
// TPM_RC_VALUE the publicArea nameAlg is invalid
//
static TPM_RC
CryptGenerateKeySymmetric(
TPMT_PUBLIC *publicArea, // IN/OUT: The public area template
// for the new key.
TPMS_SENSITIVE_CREATE *sensitiveCreate, // IN: sensitive creation data
TPMT_SENSITIVE *sensitive, // OUT: sensitive area
TPM_ALG_ID hashAlg, // IN: hash algorithm for the KDF
TPM2B_SEED *seed, // IN: seed used in creation
TPM2B_NAME *name // IN: name of the object
)
{
// Check parameter values
if(publicArea->nameAlg == TPM_ALG_NULL)
{
return TPM_RC_VALUE;
}
// If this is not a new key, then the provided key data must be the right size
if(publicArea->objectAttributes.sensitiveDataOrigin == CLEAR)
{
if( (sensitiveCreate->data.t.size * 8)
!= publicArea->parameters.symDetail.sym.keyBits.sym)
return TPM_RC_KEY_SIZE;
// Make sure that the key size is OK.
// This implementation only supports symmetric key sizes that are
// multiples of 8
if(publicArea->parameters.symDetail.sym.keyBits.sym % 8 != 0)
return TPM_RC_KEY_SIZE;
}
else
{
// TPM is going to generate the key so set the size
sensitive->sensitive.sym.t.size
= publicArea->parameters.symDetail.sym.keyBits.sym / 8;
sensitiveCreate->data.t.size = 0;
}
// Fill in the sensitive area
CryptGenerateNewSymmetric(sensitiveCreate, sensitive, hashAlg,
seed, name);
// Create unique area in public
CryptComputeSymmetricUnique(publicArea->nameAlg,
sensitive, &publicArea->unique.sym);
return TPM_RC_SUCCESS;
}
//
//
//
// 10.2.7.5 CryptXORObfuscation()
//
// This function implements XOR obfuscation. It should not be called if the hash algorithm is not
// implemented. The only return value from this function is TPM_RC_SUCCESS.
//
#ifdef TPM_ALG_KEYEDHASH //% 5
void
CryptXORObfuscation(
TPM_ALG_ID hash, // IN: hash algorithm for KDF
TPM2B *key, // IN: KDF key
TPM2B *contextU, // IN: contextU
TPM2B *contextV, // IN: contextV
UINT32 dataSize, // IN: size of data buffer
BYTE *data // IN/OUT: data to be XORed in place
)
{
BYTE mask[MAX_DIGEST_SIZE]; // Allocate a digest sized buffer
BYTE *pm;
UINT32 i;
UINT32 counter = 0;
UINT16 hLen = CryptGetHashDigestSize(hash);
UINT32 requestSize = dataSize * 8;
INT32 remainBytes = (INT32) dataSize;
pAssert((key != NULL) && (data != NULL) && (hLen != 0));
// Call KDFa to generate XOR mask
for(; remainBytes > 0; remainBytes -= hLen)
{
// Make a call to KDFa to get next iteration
CryptKDFaOnce(hash, key, "XOR", contextU, contextV,
requestSize, mask, &counter);
// XOR next piece of the data
pm = mask;
for(i = hLen < remainBytes ? hLen : remainBytes; i > 0; i--)
*data++ ^= *pm++;
}
return;
}
#endif //TPM_ALG_KEYED_HASH //%5
//
//
// 10.2.8 Initialization and shut down
//
// 10.2.8.1 CryptInitUnits()
//
// This function is called when the TPM receives a _TPM_Init() indication. After function returns, the hash
// algorithms should be available.
//
// NOTE: The hash algorithms do not have to be tested, they just need to be available. They have to be tested before the
// TPM can accept HMAC authorization or return any result that relies on a hash algorithm.
//
void
CryptInitUnits(
void
)
{
// Initialize the vector of implemented algorithms
AlgorithmGetImplementedVector(&g_implementedAlgorithms);
// Indicate that all test are necessary
CryptInitializeToTest();
//
// Call crypto engine unit initialization
// It is assumed that crypt engine initialization should always succeed.
// Otherwise, TPM should go to failure mode.
if(_cpri__InitCryptoUnits(&TpmFail) != CRYPT_SUCCESS)
FAIL(FATAL_ERROR_INTERNAL);
return;
}
//
//
// 10.2.8.2 CryptStopUnits()
//
// This function is only used in a simulated environment. There should be no reason to shut down the
// cryptography on an actual TPM other than loss of power. After receiving TPM2_Startup(), the TPM should
// be able to accept commands until it loses power and, unless the TPM is in Failure Mode, the
// cryptographic algorithms should be available.
//
void
CryptStopUnits(
void
)
{
// Call crypto engine unit stopping
_cpri__StopCryptoUnits();
return;
}
//
//
// 10.2.8.3 CryptUtilStartup()
//
// This function is called by TPM2_Startup() to initialize the functions in this crypto library and in the
// provided CryptoEngine(). In this implementation, the only initialization required in this library is
// initialization of the Commit nonce on TPM Reset.
// This function returns false if some problem prevents the functions from starting correctly. The TPM should
// go into failure mode.
//
BOOL
CryptUtilStartup(
STARTUP_TYPE type // IN: the startup type
)
{
// Make sure that the crypto library functions are ready.
// NOTE: need to initialize the crypto before loading
// the RND state may trigger a self-test which
// uses the
if( !_cpri__Startup())
return FALSE;
// Initialize the state of the RNG.
CryptDrbgGetPutState(PUT_STATE);
if(type == SU_RESET)
{
#ifdef TPM_ALG_ECC
// Get a new random commit nonce
gr.commitNonce.t.size = sizeof(gr.commitNonce.t.buffer);
_cpri__GenerateRandom(gr.commitNonce.t.size, gr.commitNonce.t.buffer);
// Reset the counter and commit array
gr.commitCounter = 0;
MemorySet(gr.commitArray, 0, sizeof(gr.commitArray));
#endif // TPM_ALG_ECC
}
// If the shutdown was orderly, then the values recovered from NV will
// be OK to use. If the shutdown was not orderly, then a TPM Reset was required
// and we would have initialized in the code above.
return TRUE;
}
//
//
// 10.2.9 Algorithm-Independent Functions
//
// 10.2.9.1 Introduction
//
// These functions are used generically when a function of a general type (e.g., symmetric encryption) is
// required. The functions will modify the parameters as required to interface to the indicated algorithms.
//
// 10.2.9.2 CryptIsAsymAlgorithm()
//
// This function indicates if an algorithm is an asymmetric algorithm.
//
// Return Value Meaning
//
// TRUE if it is an asymmetric algorithm
// FALSE if it is not an asymmetric algorithm
//
BOOL
CryptIsAsymAlgorithm(
TPM_ALG_ID algID // IN: algorithm ID
)
{
return (
#ifdef TPM_ALG_RSA
algID == TPM_ALG_RSA
#endif
#if defined TPM_ALG_RSA && defined TPM_ALG_ECC
||
#endif
#ifdef TPM_ALG_ECC
algID == TPM_ALG_ECC
#endif
);
}
//
//
// 10.2.9.3 CryptGetSymmetricBlockSize()
//
// This function returns the size in octets of the symmetric encryption block used by an algorithm and key
// size combination.
//
INT16
CryptGetSymmetricBlockSize(
TPMI_ALG_SYM algorithm, // IN: symmetric algorithm
UINT16 keySize // IN: key size in bit
)
{
return _cpri__GetSymmetricBlockSize(algorithm, keySize);
}
//
//
//
// 10.2.9.4 CryptSymmetricEncrypt()
//
// This function does in-place encryption of a buffer using the indicated symmetric algorithm, key, IV, and
// mode. If the symmetric algorithm and mode are not defined, the TPM will fail.
//
void
CryptSymmetricEncrypt(
BYTE *encrypted, // OUT: the encrypted data
TPM_ALG_ID algorithm, // IN: algorithm for encryption
UINT16 keySizeInBits, // IN: key size in bit
TPMI_ALG_SYM_MODE mode, // IN: symmetric encryption mode
BYTE *key, // IN: encryption key
TPM2B_IV *ivIn, // IN/OUT: Input IV and output chaining
// value for the next block
UINT32 dataSize, // IN: data size in byte
BYTE *data // IN/OUT: data buffer
)
{
TPM2B_IV defaultIv = {};
TPM2B_IV *iv = (ivIn != NULL) ? ivIn : &defaultIv;
TEST(algorithm);
pAssert(encrypted != NULL && key != NULL);
// this check can pass but the case below can fail. ALG_xx_VALUE values are
// defined for all algorithms but the TPM_ALG_xx might not be.
if(algorithm == ALG_AES_VALUE || algorithm == ALG_SM4_VALUE)
{
if(mode != TPM_ALG_ECB)
defaultIv.t.size = 16;
// A provided IV has to be the right size
pAssert(mode == TPM_ALG_ECB || iv->t.size == 16);
}
switch(algorithm)
{
#ifdef TPM_ALG_AES
case TPM_ALG_AES:
{
switch (mode)
{
case TPM_ALG_CTR:
_cpri__AESEncryptCTR(encrypted, keySizeInBits, key,
iv->t.buffer, dataSize, data);
break;
case TPM_ALG_OFB:
_cpri__AESEncryptOFB(encrypted, keySizeInBits, key,
iv->t.buffer, dataSize, data);
break;
case TPM_ALG_CBC:
_cpri__AESEncryptCBC(encrypted, keySizeInBits, key,
iv->t.buffer, dataSize, data);
break;
case TPM_ALG_CFB:
_cpri__AESEncryptCFB(encrypted, keySizeInBits, key,
iv->t.buffer, dataSize, data);
break;
case TPM_ALG_ECB:
_cpri__AESEncryptECB(encrypted, keySizeInBits, key,
dataSize, data);
break;
default:
pAssert(0);
}
}
break;
#endif
#ifdef TPM_ALG_SM4
case TPM_ALG_SM4:
{
switch (mode)
{
case TPM_ALG_CTR:
_cpri__SM4EncryptCTR(encrypted, keySizeInBits, key,
iv->t.buffer, dataSize, data);
break;
case TPM_ALG_OFB:
_cpri__SM4EncryptOFB(encrypted, keySizeInBits, key,
iv->t.buffer, dataSize, data);
break;
case TPM_ALG_CBC:
_cpri__SM4EncryptCBC(encrypted, keySizeInBits, key,
iv->t.buffer, dataSize, data);
break;
case TPM_ALG_CFB:
_cpri__SM4EncryptCFB(encrypted, keySizeInBits, key,
iv->t.buffer, dataSize, data);
break;
case TPM_ALG_ECB:
_cpri__SM4EncryptECB(encrypted, keySizeInBits, key,
dataSize, data);
break;
default:
pAssert(0);
}
}
break;
#endif
default:
pAssert(FALSE);
break;
}
return;
}
//
//
// 10.2.9.5 CryptSymmetricDecrypt()
//
// This function does in-place decryption of a buffer using the indicated symmetric algorithm, key, IV, and
// mode. If the symmetric algorithm and mode are not defined, the TPM will fail.
//
void
CryptSymmetricDecrypt(
BYTE *decrypted,
TPM_ALG_ID algorithm, // IN: algorithm for encryption
UINT16 keySizeInBits, // IN: key size in bit
TPMI_ALG_SYM_MODE mode, // IN: symmetric encryption mode
BYTE *key, // IN: encryption key
TPM2B_IV *ivIn, // IN/OUT: IV for next block
UINT32 dataSize, // IN: data size in byte
BYTE *data // IN/OUT: data buffer
)
{
BYTE *iv = NULL;
BYTE defaultIV[sizeof(TPMT_HA)];
TEST(algorithm);
if(
#ifdef TPM_ALG_AES
algorithm == TPM_ALG_AES
#endif
#if defined TPM_ALG_AES && defined TPM_ALG_SM4
||
#endif
#ifdef TPM_ALG_SM4
algorithm == TPM_ALG_SM4
#endif
)
{
// Both SM4 and AES have block size of 128 bits
// If the iv is not provided, create a default of 0
if(ivIn == NULL)
{
// Initialize the default IV
iv = defaultIV;
MemorySet(defaultIV, 0, 16);
}
else
{
// A provided IV has to be the right size
pAssert(mode == TPM_ALG_ECB || ivIn->t.size == 16);
iv = &(ivIn->t.buffer[0]);
}
}
switch(algorithm)
{
#ifdef TPM_ALG_AES
case TPM_ALG_AES:
{
switch (mode)
{
case TPM_ALG_CTR:
_cpri__AESDecryptCTR(decrypted, keySizeInBits, key, iv,
dataSize, data);
break;
case TPM_ALG_OFB:
_cpri__AESDecryptOFB(decrypted, keySizeInBits, key, iv,
dataSize, data);
break;
case TPM_ALG_CBC:
_cpri__AESDecryptCBC(decrypted, keySizeInBits, key, iv,
dataSize, data);
break;
case TPM_ALG_CFB:
_cpri__AESDecryptCFB(decrypted, keySizeInBits, key, iv,
dataSize, data);
break;
case TPM_ALG_ECB:
_cpri__AESDecryptECB(decrypted, keySizeInBits, key,
dataSize, data);
break;
default:
pAssert(0);
}
break;
}
#endif //TPM_ALG_AES
#ifdef TPM_ALG_SM4
case TPM_ALG_SM4 :
switch (mode)
{
case TPM_ALG_CTR:
_cpri__SM4DecryptCTR(decrypted, keySizeInBits, key, iv,
dataSize, data);
break;
case TPM_ALG_OFB:
_cpri__SM4DecryptOFB(decrypted, keySizeInBits, key, iv,
dataSize, data);
break;
case TPM_ALG_CBC:
_cpri__SM4DecryptCBC(decrypted, keySizeInBits, key, iv,
dataSize, data);
break;
case TPM_ALG_CFB:
_cpri__SM4DecryptCFB(decrypted, keySizeInBits, key, iv,
dataSize, data);
break;
case TPM_ALG_ECB:
_cpri__SM4DecryptECB(decrypted, keySizeInBits, key,
dataSize, data);
break;
default:
pAssert(0);
}
break;
#endif //TPM_ALG_SM4
default:
pAssert(FALSE);
break;
}
return;
}
//
//
// 10.2.9.6 CryptSecretEncrypt()
//
// This function creates a secret value and its associated secret structure using an asymmetric algorithm.
// This function is used by TPM2_Rewrap() TPM2_MakeCredential(), and TPM2_Duplicate().
//
// Error Returns Meaning
//
// TPM_RC_ATTRIBUTES keyHandle does not reference a valid decryption key
// TPM_RC_KEY invalid ECC key (public point is not on the curve)
// TPM_RC_SCHEME RSA key with an unsupported padding scheme
// TPM_RC_VALUE numeric value of the data to be decrypted is greater than the RSA
// key modulus
//
TPM_RC
CryptSecretEncrypt(
TPMI_DH_OBJECT keyHandle, // IN: encryption key handle
const char *label, // IN: a null-terminated string as L
TPM2B_DATA *data, // OUT: secret value
TPM2B_ENCRYPTED_SECRET *secret // OUT: secret structure
)
{
TPM_RC result = TPM_RC_SUCCESS;
OBJECT *encryptKey = ObjectGet(keyHandle); // TPM key used for encrypt
pAssert(data != NULL && secret != NULL);
// The output secret value has the size of the digest produced by the nameAlg.
data->t.size = CryptGetHashDigestSize(encryptKey->publicArea.nameAlg);
pAssert(encryptKey->publicArea.objectAttributes.decrypt == SET);
switch(encryptKey->publicArea.type)
{
#ifdef TPM_ALG_RSA
case TPM_ALG_RSA:
{
TPMT_RSA_DECRYPT scheme;
// Use OAEP scheme
scheme.scheme = TPM_ALG_OAEP;
scheme.details.oaep.hashAlg = encryptKey->publicArea.nameAlg;
// Create secret data from RNG
CryptGenerateRandom(data->t.size, data->t.buffer);
// Encrypt the data by RSA OAEP into encrypted secret
result = CryptEncryptRSA(&secret->t.size, secret->t.secret,
encryptKey, &scheme,
data->t.size, data->t.buffer, label);
}
break;
#endif //TPM_ALG_RSA
#ifdef TPM_ALG_ECC
case TPM_ALG_ECC:
{
TPMS_ECC_POINT eccPublic;
TPM2B_ECC_PARAMETER eccPrivate;
TPMS_ECC_POINT eccSecret;
BYTE *buffer = secret->t.secret;
INT32 bufferSize = sizeof(TPMS_ECC_POINT);
// Need to make sure that the public point of the key is on the
// curve defined by the key.
if(!_cpri__EccIsPointOnCurve(
encryptKey->publicArea.parameters.eccDetail.curveID,
&encryptKey->publicArea.unique.ecc))
result = TPM_RC_KEY;
else
{
// Call crypto engine to create an auxiliary ECC key
// We assume crypt engine initialization should always success.
// Otherwise, TPM should go to failure mode.
CryptNewEccKey(encryptKey->publicArea.parameters.eccDetail.curveID,
&eccPublic, &eccPrivate);
// Marshal ECC public to secret structure. This will be used by the
// recipient to decrypt the secret with their private key.
secret->t.size = TPMS_ECC_POINT_Marshal(&eccPublic, &buffer, &bufferSize);
// Compute ECDH shared secret which is R = [d]Q where d is the
// private part of the ephemeral key and Q is the public part of a
// TPM key. TPM_RC_KEY error return from CryptComputeECDHSecret
// because the auxiliary ECC key is just created according to the
// parameters of input ECC encrypt key.
if( CryptEccPointMultiply(&eccSecret,
encryptKey->publicArea.parameters.eccDetail.curveID,
&eccPrivate,
&encryptKey->publicArea.unique.ecc)
!= CRYPT_SUCCESS)
result = TPM_RC_KEY;
else
// The secret value is computed from Z using KDFe as:
// secret := KDFe(HashID, Z, Use, PartyUInfo, PartyVInfo, bits)
// Where:
// HashID the nameAlg of the decrypt key
// Z the x coordinate (Px) of the product (P) of the point
// (Q) of the secret and the private x coordinate (de,V)
// of the decryption key
// Use a null-terminated string containing "SECRET"
// PartyUInfo the x coordinate of the point in the secret
// (Qe,U )
// PartyVInfo the x coordinate of the public key (Qs,V )
// bits the number of bits in the digest of HashID
// Retrieve seed from KDFe
CryptKDFe(encryptKey->publicArea.nameAlg, &eccSecret.x.b,
label, &eccPublic.x.b,
&encryptKey->publicArea.unique.ecc.x.b,
data->t.size * 8, data->t.buffer);
}
}
break;
#endif //TPM_ALG_ECC
default:
FAIL(FATAL_ERROR_INTERNAL);
break;
}
return result;
}
//
//
// 10.2.9.7 CryptSecretDecrypt()
//
// Decrypt a secret value by asymmetric (or symmetric) algorithm This function is used for
// ActivateCredential() and Import for asymmetric decryption, and StartAuthSession() for both asymmetric
// and symmetric decryption process
//
// Error Returns Meaning
//
// TPM_RC_ATTRIBUTES RSA key is not a decryption key
// TPM_RC_BINDING Invalid RSA key (public and private parts are not cryptographically
// bound.
// TPM_RC_ECC_POINT ECC point in the secret is not on the curve
// TPM_RC_INSUFFICIENT failed to retrieve ECC point from the secret
// TPM_RC_NO_RESULT multiplication resulted in ECC point at infinity
// TPM_RC_SIZE data to decrypt is not of the same size as RSA key
// TPM_RC_VALUE For RSA key, numeric value of the encrypted data is greater than the
// modulus, or the recovered data is larger than the output buffer. For
// keyedHash or symmetric key, the secret is larger than the size of the
// digest produced by the name algorithm.
// TPM_RC_FAILURE internal error
//
TPM_RC
CryptSecretDecrypt(
TPM_HANDLE tpmKey, // IN: decrypt key
TPM2B_NONCE *nonceCaller, // IN: nonceCaller. It is needed for
// symmetric decryption. For
// asymmetric decryption, this
// parameter is NULL
const char *label, // IN: a null-terminated string as L
TPM2B_ENCRYPTED_SECRET *secret, // IN: input secret
TPM2B_DATA *data // OUT: decrypted secret value
)
{
TPM_RC result = TPM_RC_SUCCESS;
OBJECT *decryptKey = ObjectGet(tpmKey); //TPM key used for decrypting
// Decryption for secret
switch(decryptKey->publicArea.type)
{
#ifdef TPM_ALG_RSA
case TPM_ALG_RSA:
{
TPMT_RSA_DECRYPT scheme;
// Use OAEP scheme
scheme.scheme = TPM_ALG_OAEP;
scheme.details.oaep.hashAlg = decryptKey->publicArea.nameAlg;
// Set the output buffer capacity
data->t.size = sizeof(data->t.buffer);
// Decrypt seed by RSA OAEP
result = CryptDecryptRSA(&data->t.size, data->t.buffer, decryptKey,
&scheme,
secret->t.size, secret->t.secret,label);
if( (result == TPM_RC_SUCCESS)
&& (data->t.size
> CryptGetHashDigestSize(decryptKey->publicArea.nameAlg)))
result = TPM_RC_VALUE;
}
break;
#endif //TPM_ALG_RSA
#ifdef TPM_ALG_ECC
case TPM_ALG_ECC:
{
TPMS_ECC_POINT eccPublic;
TPMS_ECC_POINT eccSecret;
BYTE *buffer = secret->t.secret;
INT32 size = secret->t.size;
// Retrieve ECC point from secret buffer
result = TPMS_ECC_POINT_Unmarshal(&eccPublic, &buffer, &size);
if(result == TPM_RC_SUCCESS)
{
result = CryptEccPointMultiply(&eccSecret,
decryptKey->publicArea.parameters.eccDetail.curveID,
&decryptKey->sensitive.sensitive.ecc,
&eccPublic);
if(result == TPM_RC_SUCCESS)
{
// Set the size of the "recovered" secret value to be the size
// of the digest produced by the nameAlg.
data->t.size =
CryptGetHashDigestSize(decryptKey->publicArea.nameAlg);
// The secret value is computed from Z using KDFe as:
// secret := KDFe(HashID, Z, Use, PartyUInfo, PartyVInfo, bits)
// Where:
// HashID -- the nameAlg of the decrypt key
// Z -- the x coordinate (Px) of the product (P) of the point
// (Q) of the secret and the private x coordinate (de,V)
// of the decryption key
// Use -- a null-terminated string containing "SECRET"
// PartyUInfo -- the x coordinate of the point in the secret
// (Qe,U )
// PartyVInfo -- the x coordinate of the public key (Qs,V )
// bits -- the number of bits in the digest of HashID
// Retrieve seed from KDFe
CryptKDFe(decryptKey->publicArea.nameAlg, &eccSecret.x.b, label,
&eccPublic.x.b,
&decryptKey->publicArea.unique.ecc.x.b,
data->t.size * 8, data->t.buffer);
}
}
}
break;
#endif //TPM_ALG_ECC
case TPM_ALG_KEYEDHASH:
// The seed size can not be bigger than the digest size of nameAlg
if(secret->t.size >
CryptGetHashDigestSize(decryptKey->publicArea.nameAlg))
result = TPM_RC_VALUE;
else
{
// Retrieve seed by XOR Obfuscation:
// seed = XOR(secret, hash, key, nonceCaller, nullNonce)
// where:
// secret the secret parameter from the TPM2_StartAuthHMAC
// command
// which contains the seed value
// hash nameAlg of tpmKey
// key the key or data value in the object referenced by
// entityHandle in the TPM2_StartAuthHMAC command
// nonceCaller the parameter from the TPM2_StartAuthHMAC command
// nullNonce a zero-length nonce
// XOR Obfuscation in place
CryptXORObfuscation(decryptKey->publicArea.nameAlg,
&decryptKey->sensitive.sensitive.bits.b,
&nonceCaller->b, NULL,
secret->t.size, secret->t.secret);
// Copy decrypted seed
MemoryCopy2B(&data->b, &secret->b, sizeof(data->t.buffer));
}
break;
case TPM_ALG_SYMCIPHER:
{
TPM2B_IV iv = {};
TPMT_SYM_DEF_OBJECT *symDef;
// The seed size can not be bigger than the digest size of nameAlg
if(secret->t.size >
CryptGetHashDigestSize(decryptKey->publicArea.nameAlg))
result = TPM_RC_VALUE;
else
{
symDef = &decryptKey->publicArea.parameters.symDetail.sym;
iv.t.size = CryptGetSymmetricBlockSize(symDef->algorithm,
symDef->keyBits.sym);
pAssert(iv.t.size != 0);
if(nonceCaller->t.size >= iv.t.size)
MemoryCopy(iv.t.buffer, nonceCaller->t.buffer, iv.t.size,
sizeof(iv.t.buffer));
else
MemoryCopy(iv.b.buffer, nonceCaller->t.buffer,
nonceCaller->t.size, sizeof(iv.t.buffer));
// CFB decrypt in place, using nonceCaller as iv
CryptSymmetricDecrypt(secret->t.secret, symDef->algorithm,
symDef->keyBits.sym, TPM_ALG_CFB,
decryptKey->sensitive.sensitive.sym.t.buffer,
&iv, secret->t.size, secret->t.secret);
// Copy decrypted seed
MemoryCopy2B(&data->b, &secret->b, sizeof(data->t.buffer));
}
}
break;
default:
pAssert(0);
break;
}
return result;
}
//
//
// 10.2.9.8 CryptParameterEncryption()
//
// This function does in-place encryption of a response parameter.
//
void
CryptParameterEncryption(
TPM_HANDLE handle, // IN: encrypt session handle
TPM2B *nonceCaller, // IN: nonce caller
UINT16 leadingSizeInByte, // IN: the size of the leading size field in
// byte
TPM2B_AUTH *extraKey, // IN: additional key material other than
// session auth
BYTE *buffer // IN/OUT: parameter buffer to be encrypted
)
{
SESSION *session = SessionGet(handle); // encrypt session
TPM2B_TYPE(SYM_KEY, ( sizeof(extraKey->t.buffer)
+ sizeof(session->sessionKey.t.buffer)));
TPM2B_SYM_KEY key; // encryption key
UINT32 cipherSize = 0; // size of cipher text
pAssert(session->sessionKey.t.size + extraKey->t.size <= sizeof(key.t.buffer));
// Retrieve encrypted data size.
if(leadingSizeInByte == 2)
{
// Extract the first two bytes as the size field as the data size
// encrypt
cipherSize = (UINT32)BYTE_ARRAY_TO_UINT16(buffer);
// advance the buffer
buffer = &buffer[2];
}
#ifdef TPM4B
else if(leadingSizeInByte == 4)
{
// use the first four bytes to indicate the number of bytes to encrypt
cipherSize = BYTE_ARRAY_TO_UINT32(buffer);
//advance pointer
buffer = &buffer[4];
}
#endif
else
{
pAssert(FALSE);
}
//
// Compute encryption key by concatenating sessionAuth with extra key
MemoryCopy2B(&key.b, &session->sessionKey.b, sizeof(key.t.buffer));
MemoryConcat2B(&key.b, &extraKey->b, sizeof(key.t.buffer));
if (session->symmetric.algorithm == TPM_ALG_XOR)
// XOR parameter encryption formulation:
// XOR(parameter, hash, sessionAuth, nonceNewer, nonceOlder)
CryptXORObfuscation(session->authHashAlg, &(key.b),
&(session->nonceTPM.b),
nonceCaller, cipherSize, buffer);
else
ParmEncryptSym(session->symmetric.algorithm, session->authHashAlg,
session->symmetric.keyBits.aes, &(key.b),
nonceCaller, &(session->nonceTPM.b),
cipherSize, buffer);
return;
}
//
//
// 10.2.9.9 CryptParameterDecryption()
//
// This function does in-place decryption of a command parameter.
//
// Error Returns Meaning
//
// TPM_RC_SIZE The number of bytes in the input buffer is less than the number of
// bytes to be decrypted.
//
TPM_RC
CryptParameterDecryption(
TPM_HANDLE handle, // IN: encrypted session handle
TPM2B *nonceCaller, // IN: nonce caller
UINT32 bufferSize, // IN: size of parameter buffer
UINT16 leadingSizeInByte, // IN: the size of the leading size field in
// byte
TPM2B_AUTH *extraKey, // IN: the authValue
BYTE *buffer // IN/OUT: parameter buffer to be decrypted
)
{
SESSION *session = SessionGet(handle); // encrypt session
// The HMAC key is going to be the concatenation of the session key and any
// additional key material (like the authValue). The size of both of these
// is the size of the buffer which can contain a TPMT_HA.
TPM2B_TYPE(HMAC_KEY, ( sizeof(extraKey->t.buffer)
+ sizeof(session->sessionKey.t.buffer)));
TPM2B_HMAC_KEY key; // decryption key
UINT32 cipherSize = 0; // size of cipher text
pAssert(session->sessionKey.t.size + extraKey->t.size <= sizeof(key.t.buffer));
// Retrieve encrypted data size.
if(leadingSizeInByte == 2)
{
// The first two bytes of the buffer are the size of the
// data to be decrypted
cipherSize = (UINT32)BYTE_ARRAY_TO_UINT16(buffer);
buffer = &buffer[2]; // advance the buffer
}
#ifdef TPM4B
else if(leadingSizeInByte == 4)
{
// the leading size is four bytes so get the four byte size field
cipherSize = BYTE_ARRAY_TO_UINT32(buffer);
buffer = &buffer[4]; //advance pointer
}
#endif
else
{
pAssert(FALSE);
}
if(cipherSize > bufferSize)
return TPM_RC_SIZE;
// Compute decryption key by concatenating sessionAuth with extra input key
MemoryCopy2B(&key.b, &session->sessionKey.b, sizeof(key.t.buffer));
MemoryConcat2B(&key.b, &extraKey->b, sizeof(key.t.buffer));
if(session->symmetric.algorithm == TPM_ALG_XOR)
// XOR parameter decryption formulation:
// XOR(parameter, hash, sessionAuth, nonceNewer, nonceOlder)
// Call XOR obfuscation function
CryptXORObfuscation(session->authHashAlg, &key.b, nonceCaller,
&(session->nonceTPM.b), cipherSize, buffer);
else
// Assume that it is one of the symmetric block ciphers.
ParmDecryptSym(session->symmetric.algorithm, session->authHashAlg,
session->symmetric.keyBits.sym,
&key.b, nonceCaller, &session->nonceTPM.b,
cipherSize, buffer);
return TPM_RC_SUCCESS;
}
//
//
// 10.2.9.10 CryptComputeSymmetricUnique()
//
// This function computes the unique field in public area for symmetric objects.
//
void
CryptComputeSymmetricUnique(
TPMI_ALG_HASH nameAlg, // IN: object name algorithm
TPMT_SENSITIVE *sensitive, // IN: sensitive area
TPM2B_DIGEST *unique // OUT: unique buffer
)
{
HASH_STATE hashState;
pAssert(sensitive != NULL && unique != NULL);
// Compute the public value as the hash of sensitive.symkey || unique.buffer
unique->t.size = CryptGetHashDigestSize(nameAlg);
CryptStartHash(nameAlg, &hashState);
// Add obfuscation value
CryptUpdateDigest2B(&hashState, &sensitive->seedValue.b);
// Add sensitive value
CryptUpdateDigest2B(&hashState, &sensitive->sensitive.any.b);
CryptCompleteHash2B(&hashState, &unique->b);
return;
}
#if 0 //%
//
//
//
// 10.2.9.11 CryptComputeSymValue()
//
// This function computes the seedValue field in asymmetric sensitive areas.
//
void
CryptComputeSymValue(
TPM_HANDLE parentHandle, // IN: parent handle of the object to be created
TPMT_PUBLIC *publicArea, // IN/OUT: the public area template
TPMT_SENSITIVE *sensitive, // IN: sensitive area
TPM2B_SEED *seed, // IN: the seed
TPMI_ALG_HASH hashAlg, // IN: hash algorithm for KDFa
TPM2B_NAME *name // IN: object name
)
{
TPM2B_AUTH *proof = NULL;
if(CryptIsAsymAlgorithm(publicArea->type))
{
// Generate seedValue only when an asymmetric key is a storage key
if(publicArea->objectAttributes.decrypt == SET
&& publicArea->objectAttributes.restricted == SET)
{
// If this is a primary object in the endorsement hierarchy, use
// ehProof in the creation of the symmetric seed so that child
// objects in the endorsement hierarchy are voided on TPM2_Clear()
// or TPM2_ChangeEPS()
if( parentHandle == TPM_RH_ENDORSEMENT
&& publicArea->objectAttributes.fixedTPM == SET)
proof = &gp.ehProof;
}
else
{
sensitive->seedValue.t.size = 0;
return;
}
}
// For all object types, the size of seedValue is the digest size of nameAlg
sensitive->seedValue.t.size = CryptGetHashDigestSize(publicArea->nameAlg);
// Compute seedValue using implementation-dependent method
_cpri__GenerateSeededRandom(sensitive->seedValue.t.size,
sensitive->seedValue.t.buffer,
hashAlg,
&seed->b,
"seedValue",
&name->b,
(TPM2B *)proof);
return;
}
#endif //%
//
//
// 10.2.9.12 CryptCreateObject()
//
// This function creates an object. It:
// a) fills in the created key in public and sensitive area;
// b) creates a random number in sensitive area for symmetric keys; and
// c) compute the unique id in public area for symmetric keys.
//
//
//
//
// Error Returns Meaning
//
// TPM_RC_KEY_SIZE key size in the public area does not match the size in the sensitive
// creation area for a symmetric key
// TPM_RC_RANGE for an RSA key, the exponent is not supported
// TPM_RC_SIZE sensitive data size is larger than allowed for the scheme for a keyed
// hash object
// TPM_RC_VALUE exponent is not prime or could not find a prime using the provided
// parameters for an RSA key; unsupported name algorithm for an ECC
// key; unsupported name algorithm for symmetric algorithms
//
TPM_RC
CryptCreateObject(
TPM_HANDLE parentHandle, // IN/OUT: indication of the seed
// source
TPMT_PUBLIC *publicArea, // IN/OUT: public area
TPMS_SENSITIVE_CREATE *sensitiveCreate, // IN: sensitive creation
TPMT_SENSITIVE *sensitive // OUT: sensitive area
)
{
// Next value is a placeholder for a random seed that is used in
// key creation when the parent is not a primary seed. It has the same
// size as the primary seed.
TPM2B_SEED localSeed; // data to seed key creation if this
// is not a primary seed
TPM2B_SEED *seed = NULL;
TPM_RC result = TPM_RC_SUCCESS;
TPM2B_NAME name;
TPM_ALG_ID hashAlg = CONTEXT_INTEGRITY_HASH_ALG;
OBJECT *parent;
UINT32 counter;
// Set the sensitive type for the object
sensitive->sensitiveType = publicArea->type;
ObjectComputeName(publicArea, &name);
// For all objects, copy the initial auth data
sensitive->authValue = sensitiveCreate->userAuth;
// If this is a permanent handle assume that it is a hierarchy
if(HandleGetType(parentHandle) == TPM_HT_PERMANENT)
{
seed = HierarchyGetPrimarySeed(parentHandle);
}
else
{
// If not hierarchy handle, get parent
parent = ObjectGet(parentHandle);
hashAlg = parent->publicArea.nameAlg;
// Use random value as seed for non-primary objects
localSeed.t.size = PRIMARY_SEED_SIZE;
CryptGenerateRandom(PRIMARY_SEED_SIZE, localSeed.t.buffer);
seed = &localSeed;
}
switch(publicArea->type)
{
#ifdef TPM_ALG_RSA
// Create RSA key
case TPM_ALG_RSA:
result = CryptGenerateKeyRSA(publicArea, sensitive,
hashAlg, seed, &name, &counter);
break;
#endif // TPM_ALG_RSA
#ifdef TPM_ALG_ECC
// Create ECC key
case TPM_ALG_ECC:
result = CryptGenerateKeyECC(publicArea, sensitive,
hashAlg, seed, &name, &counter);
break;
#endif // TPM_ALG_ECC
// Collect symmetric key information
case TPM_ALG_SYMCIPHER:
return CryptGenerateKeySymmetric(publicArea, sensitiveCreate,
sensitive, hashAlg, seed, &name);
break;
case TPM_ALG_KEYEDHASH:
return CryptGenerateKeyedHash(publicArea, sensitiveCreate,
sensitive, hashAlg, seed, &name);
break;
default:
pAssert(0);
break;
}
if(result == TPM_RC_SUCCESS)
{
TPM2B_AUTH *proof = NULL;
if(publicArea->objectAttributes.decrypt == SET
&& publicArea->objectAttributes.restricted == SET)
{
// If this is a primary object in the endorsement hierarchy, use
// ehProof in the creation of the symmetric seed so that child
// objects in the endorsement hierarchy are voided on TPM2_Clear()
// or TPM2_ChangeEPS()
if( parentHandle == TPM_RH_ENDORSEMENT
&& publicArea->objectAttributes.fixedTPM == SET)
proof = &gp.ehProof;
// For all object types, the size of seedValue is the digest size
// of its nameAlg
sensitive->seedValue.t.size
= CryptGetHashDigestSize(publicArea->nameAlg);
// Compute seedValue using implementation-dependent method
_cpri__GenerateSeededRandom(sensitive->seedValue.t.size,
sensitive->seedValue.t.buffer,
hashAlg,
&seed->b,
"seedValuea",
&name.b,
(TPM2B *)proof);
}
else
{
sensitive->seedValue.t.size = 0;
}
}
return result;
}
//
// 10.2.9.13 CryptObjectIsPublicConsistent()
//
// This function checks that the key sizes in the public area are consistent. For an asymmetric key, the size
// of the public key must match the size indicated by the public->parameters.
// Checks for the algorithm types matching the key type are handled by the unmarshaling operation.
//
// Return Value Meaning
//
// TRUE sizes are consistent
// FALSE sizes are not consistent
//
BOOL
CryptObjectIsPublicConsistent(
TPMT_PUBLIC *publicArea // IN: public area
)
{
BOOL OK = TRUE;
switch (publicArea->type)
{
#ifdef TPM_ALG_RSA
case TPM_ALG_RSA:
OK = CryptAreKeySizesConsistent(publicArea);
break;
#endif //TPM_ALG_RSA
#ifdef TPM_ALG_ECC
case TPM_ALG_ECC:
{
const ECC_CURVE *curveValue;
// Check that the public point is on the indicated curve.
OK = CryptEccIsPointOnCurve(
publicArea->parameters.eccDetail.curveID,
&publicArea->unique.ecc);
if(OK)
{
curveValue = CryptEccGetCurveDataPointer(
publicArea->parameters.eccDetail.curveID);
pAssert(curveValue != NULL);
// The input ECC curve must be a supported curve
// IF a scheme is defined for the curve, then that scheme must
// be used.
OK = (curveValue->sign.scheme == TPM_ALG_NULL
|| ( publicArea->parameters.eccDetail.scheme.scheme
== curveValue->sign.scheme));
OK = OK && CryptAreKeySizesConsistent(publicArea);
}
}
break;
#endif //TPM_ALG_ECC
default:
// Symmetric object common checks
// There is noting to check with a symmetric key that is public only.
// Also not sure that there is anything useful to be done with it
// either.
break;
}
return OK;
}
//
//
//
// 10.2.9.14 CryptObjectPublicPrivateMatch()
//
// This function checks the cryptographic binding between the public and sensitive areas.
//
// Error Returns Meaning
//
// TPM_RC_TYPE the type of the public and private areas are not the same
// TPM_RC_FAILURE crypto error
// TPM_RC_BINDING the public and private areas are not cryptographically matched.
//
TPM_RC
CryptObjectPublicPrivateMatch(
OBJECT *object // IN: the object to check
)
{
TPMT_PUBLIC *publicArea;
TPMT_SENSITIVE *sensitive;
TPM_RC result = TPM_RC_SUCCESS;
BOOL isAsymmetric = FALSE;
pAssert(object != NULL);
publicArea = &object->publicArea;
sensitive = &object->sensitive;
if(publicArea->type != sensitive->sensitiveType)
return TPM_RC_TYPE;
switch(publicArea->type)
{
#ifdef TPM_ALG_RSA
case TPM_ALG_RSA:
isAsymmetric = TRUE;
// The public and private key sizes need to be consistent
if(sensitive->sensitive.rsa.t.size != publicArea->unique.rsa.t.size/2)
result = TPM_RC_BINDING;
else
// Load key by computing the private exponent
result = CryptLoadPrivateRSA(object);
break;
#endif
#ifdef TPM_ALG_ECC
// This function is called from ObjectLoad() which has already checked to
// see that the public point is on the curve so no need to repeat that
// check.
case TPM_ALG_ECC:
isAsymmetric = TRUE;
if( publicArea->unique.ecc.x.t.size
!= sensitive->sensitive.ecc.t.size)
result = TPM_RC_BINDING;
else if(publicArea->nameAlg != TPM_ALG_NULL)
{
TPMS_ECC_POINT publicToCompare;
// Compute ECC public key
CryptEccPointMultiply(&publicToCompare,
publicArea->parameters.eccDetail.curveID,
&sensitive->sensitive.ecc, NULL);
// Compare ECC public key
if( (!Memory2BEqual(&publicArea->unique.ecc.x.b,
&publicToCompare.x.b))
|| (!Memory2BEqual(&publicArea->unique.ecc.y.b,
&publicToCompare.y.b)))
result = TPM_RC_BINDING;
}
break;
//
#endif
case TPM_ALG_KEYEDHASH:
break;
case TPM_ALG_SYMCIPHER:
if( (publicArea->parameters.symDetail.sym.keyBits.sym + 7)/8
!= sensitive->sensitive.sym.t.size)
result = TPM_RC_BINDING;
break;
default:
// The choice here is an assert or a return of a bad type for the object
pAssert(0);
break;
}
// For asymmetric keys, the algorithm for validating the linkage between
// the public and private areas is algorithm dependent. For symmetric keys
// the linkage is based on hashing the symKey and obfuscation values.
if( result == TPM_RC_SUCCESS && !isAsymmetric
&& publicArea->nameAlg != TPM_ALG_NULL)
{
TPM2B_DIGEST uniqueToCompare;
// Compute unique for symmetric key
CryptComputeSymmetricUnique(publicArea->nameAlg, sensitive,
&uniqueToCompare);
// Compare unique
if(!Memory2BEqual(&publicArea->unique.sym.b,
&uniqueToCompare.b))
result = TPM_RC_BINDING;
}
return result;
}
//
//
// 10.2.9.15 CryptGetSignHashAlg()
//
// Get the hash algorithm of signature from a TPMT_SIGNATURE structure. It assumes the signature is not
// NULL This is a function for easy access
//
TPMI_ALG_HASH
CryptGetSignHashAlg(
TPMT_SIGNATURE *auth // IN: signature
)
{
pAssert(auth->sigAlg != TPM_ALG_NULL);
// Get authHash algorithm based on signing scheme
switch(auth->sigAlg)
{
#ifdef TPM_ALG_RSA
case TPM_ALG_RSASSA:
return auth->signature.rsassa.hash;
case TPM_ALG_RSAPSS:
return auth->signature.rsapss.hash;
#endif //TPM_ALG_RSA
#ifdef TPM_ALG_ECC
case TPM_ALG_ECDSA:
return auth->signature.ecdsa.hash;
#endif //TPM_ALG_ECC
case TPM_ALG_HMAC:
return auth->signature.hmac.hashAlg;
default:
return TPM_ALG_NULL;
}
}
//
//
// 10.2.9.16 CryptIsSplitSign()
//
// This function us used to determine if the signing operation is a split signing operation that required a
// TPM2_Commit().
//
BOOL
CryptIsSplitSign(
TPM_ALG_ID scheme // IN: the algorithm selector
)
{
if( 0
# ifdef TPM_ALG_ECDAA
|| scheme == TPM_ALG_ECDAA
# endif // TPM_ALG_ECDAA
)
return TRUE;
return FALSE;
}
//
//
// 10.2.9.17 CryptIsSignScheme()
//
// This function indicates if a scheme algorithm is a sign algorithm.
//
BOOL
CryptIsSignScheme(
TPMI_ALG_ASYM_SCHEME scheme
)
{
BOOL isSignScheme = FALSE;
switch(scheme)
{
#ifdef TPM_ALG_RSA
// If RSA is implemented, then both signing schemes are required
case TPM_ALG_RSASSA:
case TPM_ALG_RSAPSS:
isSignScheme = TRUE;
break;
#endif //TPM_ALG_RSA
#ifdef TPM_ALG_ECC
// If ECC is implemented ECDSA is required
case TPM_ALG_ECDSA:
#ifdef TPM_ALG_ECDAA
// ECDAA is optional
case TPM_ALG_ECDAA:
#endif
#ifdef TPM_ALG_ECSCHNORR
// Schnorr is also optional
case TPM_ALG_ECSCHNORR:
#endif
#ifdef TPM_ALG_SM2
case TPM_ALG_SM2:
#endif
isSignScheme = TRUE;
break;
#endif //TPM_ALG_ECC
default:
break;
}
return isSignScheme;
}
//
//
// 10.2.9.18 CryptIsDecryptScheme()
//
// This function indicate if a scheme algorithm is a decrypt algorithm.
//
BOOL
CryptIsDecryptScheme(
TPMI_ALG_ASYM_SCHEME scheme
)
{
BOOL isDecryptScheme = FALSE;
switch(scheme)
{
#ifdef TPM_ALG_RSA
// If RSA is implemented, then both decrypt schemes are required
case TPM_ALG_RSAES:
case TPM_ALG_OAEP:
isDecryptScheme = TRUE;
break;
#endif //TPM_ALG_RSA
#ifdef TPM_ALG_ECC
// If ECC is implemented ECDH is required
case TPM_ALG_ECDH:
#ifdef TPM_ALG_SM2
case TPM_ALG_SM2:
#endif
#ifdef TPM_ALG_ECMQV
case TPM_ALG_ECMQV:
#endif
isDecryptScheme = TRUE;
break;
#endif //TPM_ALG_ECC
default:
break;
}
return isDecryptScheme;
}
//
//
// 10.2.9.19 CryptSelectSignScheme()
//
// This function is used by the attestation and signing commands. It implements the rules for selecting the
// signature scheme to use in signing. This function requires that the signing key either be TPM_RH_NULL
// or be loaded.
// If a default scheme is defined in object, the default scheme should be chosen, otherwise, the input
// scheme should be chosen. In the case that both object and input scheme has a non-NULL scheme
// algorithm, if the schemes are compatible, the input scheme will be chosen.
//
//
//
//
// Error Returns Meaning
//
// TPM_RC_KEY key referenced by signHandle is not a signing key
// TPM_RC_SCHEME both scheme and key's default scheme are empty; or scheme is
// empty while key's default scheme requires explicit input scheme (split
// signing); or non-empty default key scheme differs from scheme
//
TPM_RC
CryptSelectSignScheme(
TPMI_DH_OBJECT signHandle, // IN: handle of signing key
TPMT_SIG_SCHEME *scheme // IN/OUT: signing scheme
)
{
OBJECT *signObject;
TPMT_SIG_SCHEME *objectScheme;
TPMT_PUBLIC *publicArea;
TPM_RC result = TPM_RC_SUCCESS;
// If the signHandle is TPM_RH_NULL, then the NULL scheme is used, regardless
// of the setting of scheme
if(signHandle == TPM_RH_NULL)
{
scheme->scheme = TPM_ALG_NULL;
scheme->details.any.hashAlg = TPM_ALG_NULL;
}
else
{
// sign handle is not NULL so...
// Get sign object pointer
signObject = ObjectGet(signHandle);
publicArea = &signObject->publicArea;
// is this a signing key?
if(!publicArea->objectAttributes.sign)
result = TPM_RC_KEY;
else
{
// "parms" defined to avoid long code lines.
TPMU_PUBLIC_PARMS *parms = &publicArea->parameters;
if(CryptIsAsymAlgorithm(publicArea->type))
objectScheme = (TPMT_SIG_SCHEME *)&parms->asymDetail.scheme;
else
objectScheme = (TPMT_SIG_SCHEME *)&parms->keyedHashDetail.scheme;
// If the object doesn't have a default scheme, then use the
// input scheme.
if(objectScheme->scheme == TPM_ALG_NULL)
{
// Input and default can't both be NULL
if(scheme->scheme == TPM_ALG_NULL)
result = TPM_RC_SCHEME;
// Assume that the scheme is compatible with the key. If not,
// we will generate an error in the signing operation.
}
else if(scheme->scheme == TPM_ALG_NULL)
{
// input scheme is NULL so use default
// First, check to see if the default requires that the caller
// provided scheme data
if(CryptIsSplitSign(objectScheme->scheme))
result = TPM_RC_SCHEME;
else
{
scheme->scheme = objectScheme->scheme;
scheme->details.any.hashAlg
= objectScheme->details.any.hashAlg;
}
}
else
{
// Both input and object have scheme selectors
// If the scheme and the hash are not the same then...
if( objectScheme->scheme != scheme->scheme
|| ( objectScheme->details.any.hashAlg
!= scheme->details.any.hashAlg))
result = TPM_RC_SCHEME;
}
}
}
return result;
}
//
//
// 10.2.9.20 CryptSign()
//
// Sign a digest with asymmetric key or HMAC. This function is called by attestation commands and the
// generic TPM2_Sign() command. This function checks the key scheme and digest size. It does not check
// if the sign operation is allowed for restricted key. It should be checked before the function is called. The
// function will assert if the key is not a signing key.
//
// Error Returns Meaning
//
// TPM_RC_SCHEME signScheme is not compatible with the signing key type
// TPM_RC_VALUE digest value is greater than the modulus of signHandle or size of
// hashData does not match hash algorithm insignScheme (for an RSA
// key); invalid commit status or failed to generate r value (for an ECC
// key)
//
TPM_RC
CryptSign(
TPMI_DH_OBJECT signHandle, // IN: The handle of sign key
TPMT_SIG_SCHEME *signScheme, // IN: sign scheme.
TPM2B_DIGEST *digest, // IN: The digest being signed
TPMT_SIGNATURE *signature // OUT: signature
)
{
OBJECT *signKey = ObjectGet(signHandle);
TPM_RC result = TPM_RC_SCHEME;
// check if input handle is a sign key
pAssert(signKey->publicArea.objectAttributes.sign == SET);
// Must have the private portion loaded. This check is made during
// authorization.
pAssert(signKey->attributes.publicOnly == CLEAR);
// Initialize signature scheme
signature->sigAlg = signScheme->scheme;
// If the signature algorithm is TPM_ALG_NULL, then we are done
if(signature->sigAlg == TPM_ALG_NULL)
return TPM_RC_SUCCESS;
// All the schemes other than TPM_ALG_NULL have a hash algorithm
TEST_HASH(signScheme->details.any.hashAlg);
// Initialize signature hash
// Note: need to do the check for alg null first because the null scheme
// doesn't have a hashAlg member.
signature->signature.any.hashAlg = signScheme->details.any.hashAlg;
// perform sign operation based on different key type
switch (signKey->publicArea.type)
{
#ifdef TPM_ALG_RSA
case TPM_ALG_RSA:
result = CryptSignRSA(signKey, signScheme, digest, signature);
break;
#endif //TPM_ALG_RSA
#ifdef TPM_ALG_ECC
case TPM_ALG_ECC:
result = CryptSignECC(signKey, signScheme, digest, signature);
break;
#endif //TPM_ALG_ECC
case TPM_ALG_KEYEDHASH:
result = CryptSignHMAC(signKey, signScheme, digest, signature);
break;
default:
break;
}
return result;
}
//
//
// 10.2.9.21 CryptVerifySignature()
//
// This function is used to verify a signature. It is called by TPM2_VerifySignature() and
// TPM2_PolicySigned().
// Since this operation only requires use of a public key, no consistency checks are necessary for the key to
// signature type because a caller can load any public key that they like with any scheme that they like. This
// routine simply makes sure that the signature is correct, whatever the type.
// This function requires that auth is not a NULL pointer.
//
// Error Returns Meaning
//
// TPM_RC_SIGNATURE the signature is not genuine
// TPM_RC_SCHEME the scheme is not supported
// TPM_RC_HANDLE an HMAC key was selected but the private part of the key is not
// loaded
//
TPM_RC
CryptVerifySignature(
TPMI_DH_OBJECT keyHandle, // IN: The handle of sign key
TPM2B_DIGEST *digest, // IN: The digest being validated
TPMT_SIGNATURE *signature // IN: signature
)
{
// NOTE: ObjectGet will either return a pointer to a loaded object or
// will assert. It will never return a non-valid value. This makes it save
// to initialize 'publicArea' with the return value from ObjectGet() without
// checking it first.
OBJECT *authObject = ObjectGet(keyHandle);
TPMT_PUBLIC *publicArea = &authObject->publicArea;
TPM_RC result = TPM_RC_SCHEME;
// The input unmarshaling should prevent any input signature from being
// a NULL signature, but just in case
if(signature->sigAlg == TPM_ALG_NULL)
return TPM_RC_SIGNATURE;
switch (publicArea->type)
{
#ifdef TPM_ALG_RSA
case TPM_ALG_RSA:
result = CryptRSAVerifySignature(authObject, digest, signature);
break;
#endif //TPM_ALG_RSA
#ifdef TPM_ALG_ECC
case TPM_ALG_ECC:
result = CryptECCVerifySignature(authObject, digest, signature);
break;
#endif // TPM_ALG_ECC
case TPM_ALG_KEYEDHASH:
if(authObject->attributes.publicOnly)
result = TPM_RC_HANDLE;
else
result = CryptHMACVerifySignature(authObject, digest, signature);
break;
default:
break;
}
return result;
}
//
//
// 10.2.10 Math functions
//
// 10.2.10.1 CryptDivide()
//
// This function interfaces to the math library for large number divide.
//
// Error Returns Meaning
//
// TPM_RC_SIZE quotient or remainder is too small to receive the result
//
TPM_RC
CryptDivide(
TPM2B *numerator, // IN: numerator
TPM2B *denominator, // IN: denominator
TPM2B *quotient, // OUT: quotient = numerator / denominator.
TPM2B *remainder // OUT: numerator mod denominator.
)
{
pAssert( numerator != NULL && denominator!= NULL
&& (quotient != NULL || remainder != NULL)
);
// assume denominator is not 0
pAssert(denominator->size != 0);
return TranslateCryptErrors(_math__Div(numerator,
denominator,
quotient,
remainder)
);
}
//
//
// 10.2.10.2 CryptCompare()
//
// This function interfaces to the math library for large number, unsigned compare.
//
// Return Value Meaning
//
// 1 if a > b
// 0 if a = b
// -1 if a < b
//
LIB_EXPORT int
CryptCompare(
const UINT32 aSize, // IN: size of a
const BYTE *a, // IN: a buffer
const UINT32 bSize, // IN: size of b
const BYTE *b // IN: b buffer
)
{
return _math__uComp(aSize, a, bSize, b);
}
//
//
// 10.2.10.3 CryptCompareSigned()
//
// This function interfaces to the math library for large number, signed compare.
//
// Return Value Meaning
//
// 1 if a > b
// 0 if a = b
// -1 if a < b
//
int
CryptCompareSigned(
UINT32 aSize, // IN: size of a
BYTE *a, // IN: a buffer
UINT32 bSize, // IN: size of b
BYTE *b // IN: b buffer
)
{
return _math__Comp(aSize, a, bSize, b);
}
//
//
// 10.2.10.4 CryptGetTestResult
//
// This function returns the results of a self-test function.
//
// NOTE: the behavior in this function is NOT the correct behavior for a real TPM implementation. An artificial behavior is
// placed here due to the limitation of a software simulation environment. For the correct behavior, consult the
// part 3 specification for TPM2_GetTestResult().
//
TPM_RC
CryptGetTestResult(
TPM2B_MAX_BUFFER *outData // OUT: test result data
)
{
outData->t.size = 0;
return TPM_RC_SUCCESS;
}
//
//
// 10.2.11 Capability Support
//
// 10.2.11.1 CryptCapGetECCCurve()
//
// This function returns the list of implemented ECC curves.
//
// Return Value Meaning
//
// YES if no more ECC curve is available
// NO if there are more ECC curves not reported
//
#ifdef TPM_ALG_ECC //% 5
TPMI_YES_NO
CryptCapGetECCCurve(
TPM_ECC_CURVE curveID, // IN: the starting ECC curve
UINT32 maxCount, // IN: count of returned curve
TPML_ECC_CURVE *curveList // OUT: ECC curve list
)
{
TPMI_YES_NO more = NO;
UINT16 i;
UINT32 count = _cpri__EccGetCurveCount();
TPM_ECC_CURVE curve;
// Initialize output property list
curveList->count = 0;
// The maximum count of curves we may return is MAX_ECC_CURVES
if(maxCount > MAX_ECC_CURVES) maxCount = MAX_ECC_CURVES;
// Scan the eccCurveValues array
for(i = 0; i < count; i++)
{
curve = _cpri__GetCurveIdByIndex(i);
// If curveID is less than the starting curveID, skip it
if(curve < curveID)
continue;
if(curveList->count < maxCount)
{
// If we have not filled up the return list, add more curves to
// it
curveList->eccCurves[curveList->count] = curve;
curveList->count++;
}
else
{
// If the return list is full but we still have curves
// available, report this and stop iterating
more = YES;
break;
}
}
return more;
}
//
//
// 10.2.11.2 CryptCapGetEccCurveNumber()
//
// This function returns the number of ECC curves supported by the TPM.
//
UINT32
CryptCapGetEccCurveNumber(
void
)
{
// There is an array that holds the curve data. Its size divided by the
// size of an entry is the number of values in the table.
return _cpri__EccGetCurveCount();
}
#endif //TPM_ALG_ECC //% 5
//
//
// 10.2.11.3 CryptAreKeySizesConsistent()
//
// This function validates that the public key size values are consistent for an asymmetric key.
//
// NOTE: This is not a comprehensive test of the public key.
//
//
// Return Value Meaning
//
// TRUE sizes are consistent
// FALSE sizes are not consistent
//
BOOL
CryptAreKeySizesConsistent(
TPMT_PUBLIC *publicArea // IN: the public area to check
)
{
BOOL consistent = FALSE;
switch (publicArea->type)
{
#ifdef TPM_ALG_RSA
case TPM_ALG_RSA:
// The key size in bits is filtered by the unmarshaling
consistent = ( ((publicArea->parameters.rsaDetail.keyBits+7)/8)
== publicArea->unique.rsa.t.size);
break;
#endif //TPM_ALG_RSA
#ifdef TPM_ALG_ECC
case TPM_ALG_ECC:
{
UINT16 keySizeInBytes;
TPM_ECC_CURVE curveId = publicArea->parameters.eccDetail.curveID;
keySizeInBytes = CryptEccGetKeySizeInBytes(curveId);
consistent = keySizeInBytes > 0
&& publicArea->unique.ecc.x.t.size <= keySizeInBytes
&& publicArea->unique.ecc.y.t.size <= keySizeInBytes;
}
break;
#endif //TPM_ALG_ECC
default:
break;
}
return consistent;
}
//
//
// 10.2.11.4 CryptAlgSetImplemented()
//
// This function initializes the bit vector with one bit for each implemented algorithm. This function is called
// from _TPM_Init(). The vector of implemented algorithms should be generated by the part 2 parser so that
// the g_implementedAlgorithms vector can be a const. That's not how it is now
//
void
CryptAlgsSetImplemented(
void
)
{
AlgorithmGetImplementedVector(&g_implementedAlgorithms);
}