Skip to content

Commit cde261e

Browse files
THS-onTHS-on
committed
enable non standard key sizes and curves for EK and AK
Signed-off-by: Thore Sommer <[email protected]>
1 parent e2a2a79 commit cde261e

File tree

5 files changed

+126
-27
lines changed

5 files changed

+126
-27
lines changed

‎keylime-agent/src/agent_handler.rs

+1-1
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,7 @@ mod tests {
4949
async fn test_agent_info() {
5050
let mut quotedata = QuoteData::fixture().unwrap(); //#[allow_ci]
5151
quotedata.hash_alg = keylime::algorithms::HashAlgorithm::Sha256;
52-
quotedata.enc_alg = keylime::algorithms::EncryptionAlgorithm::Rsa;
52+
quotedata.enc_alg = keylime::algorithms::EncryptionAlgorithm::Rsa2048;
5353
quotedata.sign_alg = keylime::algorithms::SignAlgorithm::RsaSsa;
5454
quotedata.agent_uuid = "DEADBEEF".to_string();
5555
let data = web::Data::new(quotedata);

‎keylime-agent/src/common.rs

+1
Original file line numberDiff line numberDiff line change
@@ -303,6 +303,7 @@ mod tests {
303303
let ak = ctx.create_ak(
304304
ek_result.key_handle,
305305
tpm_hash_alg,
306+
tpm_encryption_alg,
306307
tpm_signing_alg,
307308
)?;
308309

‎keylime-agent/src/main.rs

+3-1
Original file line numberDiff line numberDiff line change
@@ -540,6 +540,7 @@ async fn main() -> Result<()> {
540540
let new_ak = ctx.create_ak(
541541
ek_result.key_handle,
542542
tpm_hash_alg,
543+
tpm_encryption_alg,
543544
tpm_signing_alg,
544545
)?;
545546
let ak_handle = ctx.load_ak(ek_result.key_handle, &new_ak)?;
@@ -1148,6 +1149,7 @@ mod testing {
11481149
let ak_result = ctx.create_ak(
11491150
ek_result.key_handle,
11501151
tpm_hash_alg,
1152+
tpm_encryption_alg,
11511153
tpm_signing_alg,
11521154
)?;
11531155
let ak_handle = ctx.load_ak(ek_result.key_handle, &ak_result)?;
@@ -1216,7 +1218,7 @@ mod testing {
12161218
payload_tx,
12171219
revocation_tx,
12181220
hash_alg: keylime::algorithms::HashAlgorithm::Sha256,
1219-
enc_alg: keylime::algorithms::EncryptionAlgorithm::Rsa,
1221+
enc_alg: keylime::algorithms::EncryptionAlgorithm::Rsa2048,
12201222
sign_alg: keylime::algorithms::SignAlgorithm::RsaSsa,
12211223
agent_uuid: test_config.agent.uuid,
12221224
allow_payload_revocation_actions: test_config

‎keylime/src/algorithms.rs

+99-12
Original file line numberDiff line numberDiff line change
@@ -6,8 +6,13 @@ use std::convert::TryFrom;
66
use std::fmt;
77
use thiserror::Error;
88
use tss_esapi::{
9-
interface_types::algorithm::{
10-
AsymmetricAlgorithm, HashingAlgorithm, SignatureSchemeAlgorithm,
9+
abstraction::AsymmetricAlgorithmSelection,
10+
interface_types::{
11+
algorithm::{
12+
AsymmetricAlgorithm, HashingAlgorithm, SignatureSchemeAlgorithm,
13+
},
14+
ecc::EccCurve,
15+
key_bits::RsaKeyBits,
1116
},
1217
structures::{HashScheme, SignatureScheme},
1318
};
@@ -89,15 +94,68 @@ impl From<HashAlgorithm> for MessageDigest {
8994

9095
#[derive(Copy, Clone, Debug, PartialEq, Eq, Hash, Serialize, Deserialize)]
9196
pub enum EncryptionAlgorithm {
92-
Rsa,
93-
Ecc,
97+
Rsa1024,
98+
Rsa2048,
99+
Rsa3072,
100+
Rsa4096,
101+
Ecc192,
102+
Ecc224,
103+
Ecc256,
104+
Ecc384,
105+
Ecc521,
106+
EccSm2,
94107
}
95108

96109
impl From<EncryptionAlgorithm> for AsymmetricAlgorithm {
97110
fn from(enc_alg: EncryptionAlgorithm) -> Self {
98111
match enc_alg {
99-
EncryptionAlgorithm::Rsa => AsymmetricAlgorithm::Rsa,
100-
EncryptionAlgorithm::Ecc => AsymmetricAlgorithm::Ecc,
112+
EncryptionAlgorithm::Rsa1024 => AsymmetricAlgorithm::Rsa,
113+
EncryptionAlgorithm::Rsa2048 => AsymmetricAlgorithm::Rsa,
114+
EncryptionAlgorithm::Rsa3072 => AsymmetricAlgorithm::Rsa,
115+
EncryptionAlgorithm::Rsa4096 => AsymmetricAlgorithm::Rsa,
116+
EncryptionAlgorithm::Ecc192 => AsymmetricAlgorithm::Ecc,
117+
EncryptionAlgorithm::Ecc224 => AsymmetricAlgorithm::Ecc,
118+
EncryptionAlgorithm::Ecc256 => AsymmetricAlgorithm::Ecc,
119+
EncryptionAlgorithm::Ecc384 => AsymmetricAlgorithm::Ecc,
120+
EncryptionAlgorithm::Ecc521 => AsymmetricAlgorithm::Ecc,
121+
EncryptionAlgorithm::EccSm2 => AsymmetricAlgorithm::Ecc,
122+
}
123+
}
124+
}
125+
126+
impl From<EncryptionAlgorithm> for AsymmetricAlgorithmSelection {
127+
fn from(enc_alg: EncryptionAlgorithm) -> Self {
128+
match enc_alg {
129+
EncryptionAlgorithm::Rsa1024 => {
130+
AsymmetricAlgorithmSelection::Rsa(RsaKeyBits::Rsa1024)
131+
}
132+
EncryptionAlgorithm::Rsa2048 => {
133+
AsymmetricAlgorithmSelection::Rsa(RsaKeyBits::Rsa2048)
134+
}
135+
EncryptionAlgorithm::Rsa3072 => {
136+
AsymmetricAlgorithmSelection::Rsa(RsaKeyBits::Rsa3072)
137+
}
138+
EncryptionAlgorithm::Rsa4096 => {
139+
AsymmetricAlgorithmSelection::Rsa(RsaKeyBits::Rsa4096)
140+
}
141+
EncryptionAlgorithm::Ecc192 => {
142+
AsymmetricAlgorithmSelection::Ecc(EccCurve::NistP192)
143+
}
144+
EncryptionAlgorithm::Ecc224 => {
145+
AsymmetricAlgorithmSelection::Ecc(EccCurve::NistP224)
146+
}
147+
EncryptionAlgorithm::Ecc256 => {
148+
AsymmetricAlgorithmSelection::Ecc(EccCurve::NistP256)
149+
}
150+
EncryptionAlgorithm::Ecc384 => {
151+
AsymmetricAlgorithmSelection::Ecc(EccCurve::NistP384)
152+
}
153+
EncryptionAlgorithm::Ecc521 => {
154+
AsymmetricAlgorithmSelection::Ecc(EccCurve::NistP521)
155+
}
156+
EncryptionAlgorithm::EccSm2 => {
157+
AsymmetricAlgorithmSelection::Ecc(EccCurve::Sm2P256)
158+
}
101159
}
102160
}
103161
}
@@ -107,8 +165,25 @@ impl TryFrom<&str> for EncryptionAlgorithm {
107165

108166
fn try_from(value: &str) -> Result<Self, Self::Error> {
109167
match value {
110-
"rsa" => Ok(EncryptionAlgorithm::Rsa),
111-
"ecc" => Ok(EncryptionAlgorithm::Ecc),
168+
/* Use default key size and curve if not explicitly specified */
169+
"rsa" => Ok(EncryptionAlgorithm::Rsa2048),
170+
"ecc" => Ok(EncryptionAlgorithm::Ecc256),
171+
"rsa1024" => Ok(EncryptionAlgorithm::Rsa1024),
172+
"rsa2048" => Ok(EncryptionAlgorithm::Rsa2048),
173+
"rsa3072" => Ok(EncryptionAlgorithm::Rsa3072),
174+
"rsa4096" => Ok(EncryptionAlgorithm::Rsa4096),
175+
"ecc192" => Ok(EncryptionAlgorithm::Ecc192),
176+
"ecc_nist_p192" => Ok(EncryptionAlgorithm::Ecc192),
177+
"ecc224" => Ok(EncryptionAlgorithm::Ecc224),
178+
"ecc_nist_p224" => Ok(EncryptionAlgorithm::Ecc224),
179+
"ecc256" => Ok(EncryptionAlgorithm::Ecc256),
180+
"ecc_nist_p256" => Ok(EncryptionAlgorithm::Ecc256),
181+
"ecc384" => Ok(EncryptionAlgorithm::Ecc384),
182+
"ecc_nist_p384" => Ok(EncryptionAlgorithm::Ecc384),
183+
"ecc521" => Ok(EncryptionAlgorithm::Ecc521),
184+
"ecc_nist_p521" => Ok(EncryptionAlgorithm::Ecc521),
185+
"ecc_sm2" => Ok(EncryptionAlgorithm::EccSm2),
186+
"ecc_sm2_p256" => Ok(EncryptionAlgorithm::EccSm2),
112187
_ => Err(AlgorithmError::UnsupportedEncryptionAlgorithm(
113188
value.into(),
114189
)),
@@ -119,8 +194,16 @@ impl TryFrom<&str> for EncryptionAlgorithm {
119194
impl fmt::Display for EncryptionAlgorithm {
120195
fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
121196
let value = match self {
122-
EncryptionAlgorithm::Rsa => "rsa",
123-
EncryptionAlgorithm::Ecc => "ecc",
197+
EncryptionAlgorithm::Rsa1024 => "rsa1024",
198+
EncryptionAlgorithm::Rsa2048 => "rsa2048",
199+
EncryptionAlgorithm::Rsa3072 => "rsa3072",
200+
EncryptionAlgorithm::Rsa4096 => "rsa4096",
201+
EncryptionAlgorithm::Ecc192 => "ecc192",
202+
EncryptionAlgorithm::Ecc224 => "ecc224",
203+
EncryptionAlgorithm::Ecc256 => "ecc256",
204+
EncryptionAlgorithm::Ecc384 => "ecc384",
205+
EncryptionAlgorithm::Ecc521 => "ecc521",
206+
EncryptionAlgorithm::EccSm2 => "ecc_sm2",
124207
};
125208
write!(f, "{value}")
126209
}
@@ -219,9 +302,13 @@ mod tests {
219302
#[test]
220303
fn test_encrypt_try_from() {
221304
let result = EncryptionAlgorithm::try_from("rsa");
222-
assert!(result.is_ok());
305+
assert!(result.is_ok_and(|r| r == EncryptionAlgorithm::Rsa2048));
223306
let result = EncryptionAlgorithm::try_from("ecc");
224-
assert!(result.is_ok());
307+
assert!(result.is_ok_and(|r| r == EncryptionAlgorithm::Ecc256));
308+
let result = EncryptionAlgorithm::try_from("rsa4096");
309+
assert!(result.is_ok_and(|r| r == EncryptionAlgorithm::Rsa4096));
310+
let result = EncryptionAlgorithm::try_from("ecc256");
311+
assert!(result.is_ok_and(|r| r == EncryptionAlgorithm::Ecc256));
225312
}
226313
#[test]
227314
fn test_unsupported_encrypt_try_from() {

‎keylime/src/tpm.rs

+22-13
Original file line numberDiff line numberDiff line change
@@ -574,19 +574,22 @@ impl Context {
574574
///
575575
/// * `handle`: The associated EK handle
576576
/// * `hash_alg`: The digest algorithm used for signing with the created AK
577+
/// * `key_alg`: The key type used for signing with the created AK
577578
/// * `sign_alg`: The created AK signing algorithm
578579
///
579580
/// Returns an `AKResult` structure if successful and a `TPMError` otherwise
580581
pub fn create_ak(
581582
&mut self,
582583
handle: KeyHandle,
583584
hash_alg: HashAlgorithm,
585+
key_alg: EncryptionAlgorithm,
584586
sign_alg: SignAlgorithm,
585587
) -> Result<AKResult> {
586588
let ak = ak::create_ak(
587589
&mut self.inner,
588590
handle,
589591
hash_alg.into(),
592+
key_alg.into(),
590593
sign_alg.into(),
591594
None,
592595
DefaultKey,
@@ -1784,9 +1787,7 @@ pub fn get_idevid_template(
17841787
"H-4" => (AsymmetricAlgorithm::Ecc, HashingAlgorithm::Sha512),
17851788
"H-5" => (AsymmetricAlgorithm::Ecc, HashingAlgorithm::Sm3_256),
17861789
_ => (
1787-
AsymmetricAlgorithm::from(EncryptionAlgorithm::try_from(
1788-
asym_alg_str,
1789-
)?),
1790+
EncryptionAlgorithm::try_from(asym_alg_str)?.into(),
17901791
HashingAlgorithm::from(HashAlgorithm::try_from(name_alg_str)?),
17911792
),
17921793
};
@@ -2102,7 +2103,8 @@ pub mod testing {
21022103
#[cfg(feature = "testing")]
21032104
fn test_create_ek() {
21042105
let mut ctx = Context::new().unwrap(); //#[allow_ci]
2105-
let algs = [EncryptionAlgorithm::Rsa, EncryptionAlgorithm::Ecc];
2106+
let algs =
2107+
[EncryptionAlgorithm::Rsa2048, EncryptionAlgorithm::Ecc256];
21062108
// TODO: create persistent handle and add to be tested: Some("0x81000000"),
21072109
let handles = [Some(""), None];
21082110

@@ -2119,7 +2121,7 @@ pub mod testing {
21192121
fn test_create_and_load_ak() {
21202122
let mut ctx = Context::new().unwrap(); //#[allow_ci]
21212123

2122-
let r = ctx.create_ek(EncryptionAlgorithm::Rsa, None);
2124+
let r = ctx.create_ek(EncryptionAlgorithm::Rsa2048, None);
21232125
assert!(r.is_ok());
21242126

21252127
let ek_result = r.unwrap(); //#[allow_ci]
@@ -2134,6 +2136,9 @@ pub mod testing {
21342136
//HashingAlgorithm::Sha3_512, // Not supported by swtpm
21352137
//HashingAlgorithm::Sha1, // Not supported by swtpm
21362138
];
2139+
let eng_algs =
2140+
[EncryptionAlgorithm::Rsa1024, EncryptionAlgorithm::Rsa2048];
2141+
21372142
let sign_algs = [
21382143
SignAlgorithm::RsaSsa,
21392144
SignAlgorithm::RsaPss,
@@ -2145,14 +2150,16 @@ pub mod testing {
21452150
];
21462151

21472152
for sign in sign_algs {
2148-
for hash in hash_algs {
2149-
let r = ctx.create_ak(ek_handle, hash, sign);
2150-
assert!(r.is_ok());
2153+
for enc in eng_algs {
2154+
for hash in hash_algs {
2155+
let r = ctx.create_ak(ek_handle, hash, enc, sign);
2156+
assert!(r.is_ok());
21512157

2152-
let ak = r.unwrap(); //#[allow_ci]
2158+
let ak = r.unwrap(); //#[allow_ci]
21532159

2154-
let r = ctx.load_ak(ek_handle, &ak);
2155-
assert!(r.is_ok());
2160+
let r = ctx.load_ak(ek_handle, &ak);
2161+
assert!(r.is_ok());
2162+
}
21562163
}
21572164
}
21582165
}
@@ -2212,7 +2219,7 @@ pub mod testing {
22122219

22132220
// Create EK
22142221
let ek_result = ctx
2215-
.create_ek(EncryptionAlgorithm::Rsa, None)
2222+
.create_ek(EncryptionAlgorithm::Rsa2048, None)
22162223
.expect("failed to create EK");
22172224
let ek_handle = ek_result.key_handle;
22182225

@@ -2221,6 +2228,7 @@ pub mod testing {
22212228
.create_ak(
22222229
ek_handle,
22232230
HashAlgorithm::Sha256,
2231+
EncryptionAlgorithm::Rsa2048,
22242232
SignAlgorithm::RsaSsa,
22252233
)
22262234
.expect("failed to create AK");
@@ -2261,7 +2269,7 @@ pub mod testing {
22612269

22622270
// Create EK
22632271
let ek_result = ctx
2264-
.create_ek(EncryptionAlgorithm::Rsa, None)
2272+
.create_ek(EncryptionAlgorithm::Rsa2048, None)
22652273
.expect("failed to create EK");
22662274
let ek_handle = ek_result.key_handle;
22672275

@@ -2270,6 +2278,7 @@ pub mod testing {
22702278
.create_ak(
22712279
ek_handle,
22722280
HashAlgorithm::Sha256,
2281+
EncryptionAlgorithm::Rsa2048,
22732282
SignAlgorithm::RsaSsa,
22742283
)
22752284
.expect("failed to create ak");

0 commit comments

Comments
 (0)