Skip to content

Commit f053cfc

Browse files
THS-onTHS-on
committed
enable non standard key sizes and curves for EK and AK
Signed-off-by: Thore Sommer <[email protected]>
1 parent cef457e commit f053cfc

File tree

5 files changed

+136
-36
lines changed

5 files changed

+136
-36
lines changed

‎keylime-agent/src/agent_handler.rs

+1-1
Original file line numberDiff line numberDiff line change
@@ -88,7 +88,7 @@ mod tests {
8888
async fn test_agent_info() {
8989
let (mut quotedata, mutex) = QuoteData::fixture().await.unwrap(); //#[allow_ci]
9090
quotedata.hash_alg = keylime::algorithms::HashAlgorithm::Sha256;
91-
quotedata.enc_alg = keylime::algorithms::EncryptionAlgorithm::Rsa;
91+
quotedata.enc_alg = keylime::algorithms::EncryptionAlgorithm::Rsa2048;
9292
quotedata.sign_alg = keylime::algorithms::SignAlgorithm::RsaSsa;
9393
quotedata.agent_uuid = "DEADBEEF".to_string();
9494
let data = web::Data::new(quotedata);

‎keylime-agent/src/common.rs

+1
Original file line numberDiff line numberDiff line change
@@ -303,6 +303,7 @@ mod tests {
303303
let ak = ctx.create_ak(
304304
ek_result.key_handle,
305305
tpm_hash_alg,
306+
tpm_encryption_alg,
306307
tpm_signing_alg,
307308
)?;
308309

‎keylime-agent/src/main.rs

+4-1
Original file line numberDiff line numberDiff line change
@@ -419,6 +419,7 @@ async fn main() -> Result<()> {
419419
let new_ak = ctx.create_ak(
420420
ek_result.key_handle,
421421
tpm_hash_alg,
422+
tpm_encryption_alg,
422423
tpm_signing_alg,
423424
)?;
424425
let ak_handle = ctx.load_ak(ek_result.key_handle, &new_ak)?;
@@ -1042,6 +1043,7 @@ mod testing {
10421043
.create_ak(
10431044
ek_result.key_handle,
10441045
tpm_hash_alg,
1046+
tpm_encryption_alg,
10451047
tpm_signing_alg,
10461048
)
10471049
.unwrap(); //#[allow_ci]
@@ -1119,7 +1121,8 @@ mod testing {
11191121
payload_tx,
11201122
revocation_tx,
11211123
hash_alg: keylime::algorithms::HashAlgorithm::Sha256,
1122-
enc_alg: keylime::algorithms::EncryptionAlgorithm::Rsa,
1124+
enc_alg:
1125+
keylime::algorithms::EncryptionAlgorithm::Rsa2048,
11231126
sign_alg: keylime::algorithms::SignAlgorithm::RsaSsa,
11241127
agent_uuid: test_config.agent.uuid,
11251128
allow_payload_revocation_actions: test_config

‎keylime/src/algorithms.rs

+99-12
Original file line numberDiff line numberDiff line change
@@ -6,8 +6,13 @@ use std::convert::TryFrom;
66
use std::fmt;
77
use thiserror::Error;
88
use tss_esapi::{
9-
interface_types::algorithm::{
10-
AsymmetricAlgorithm, HashingAlgorithm, SignatureSchemeAlgorithm,
9+
abstraction::AsymmetricAlgorithmSelection,
10+
interface_types::{
11+
algorithm::{
12+
AsymmetricAlgorithm, HashingAlgorithm, SignatureSchemeAlgorithm,
13+
},
14+
ecc::EccCurve,
15+
key_bits::RsaKeyBits,
1116
},
1217
structures::{HashScheme, SignatureScheme},
1318
};
@@ -89,15 +94,68 @@ impl From<HashAlgorithm> for MessageDigest {
8994

9095
#[derive(Copy, Clone, Debug, PartialEq, Eq, Hash, Serialize, Deserialize)]
9196
pub enum EncryptionAlgorithm {
92-
Rsa,
93-
Ecc,
97+
Rsa1024,
98+
Rsa2048,
99+
Rsa3072,
100+
Rsa4096,
101+
Ecc192,
102+
Ecc224,
103+
Ecc256,
104+
Ecc384,
105+
Ecc521,
106+
EccSm2,
94107
}
95108

96109
impl From<EncryptionAlgorithm> for AsymmetricAlgorithm {
97110
fn from(enc_alg: EncryptionAlgorithm) -> Self {
98111
match enc_alg {
99-
EncryptionAlgorithm::Rsa => AsymmetricAlgorithm::Rsa,
100-
EncryptionAlgorithm::Ecc => AsymmetricAlgorithm::Ecc,
112+
EncryptionAlgorithm::Rsa1024 => AsymmetricAlgorithm::Rsa,
113+
EncryptionAlgorithm::Rsa2048 => AsymmetricAlgorithm::Rsa,
114+
EncryptionAlgorithm::Rsa3072 => AsymmetricAlgorithm::Rsa,
115+
EncryptionAlgorithm::Rsa4096 => AsymmetricAlgorithm::Rsa,
116+
EncryptionAlgorithm::Ecc192 => AsymmetricAlgorithm::Ecc,
117+
EncryptionAlgorithm::Ecc224 => AsymmetricAlgorithm::Ecc,
118+
EncryptionAlgorithm::Ecc256 => AsymmetricAlgorithm::Ecc,
119+
EncryptionAlgorithm::Ecc384 => AsymmetricAlgorithm::Ecc,
120+
EncryptionAlgorithm::Ecc521 => AsymmetricAlgorithm::Ecc,
121+
EncryptionAlgorithm::EccSm2 => AsymmetricAlgorithm::Ecc,
122+
}
123+
}
124+
}
125+
126+
impl From<EncryptionAlgorithm> for AsymmetricAlgorithmSelection {
127+
fn from(enc_alg: EncryptionAlgorithm) -> Self {
128+
match enc_alg {
129+
EncryptionAlgorithm::Rsa1024 => {
130+
AsymmetricAlgorithmSelection::Rsa(RsaKeyBits::Rsa1024)
131+
}
132+
EncryptionAlgorithm::Rsa2048 => {
133+
AsymmetricAlgorithmSelection::Rsa(RsaKeyBits::Rsa2048)
134+
}
135+
EncryptionAlgorithm::Rsa3072 => {
136+
AsymmetricAlgorithmSelection::Rsa(RsaKeyBits::Rsa3072)
137+
}
138+
EncryptionAlgorithm::Rsa4096 => {
139+
AsymmetricAlgorithmSelection::Rsa(RsaKeyBits::Rsa4096)
140+
}
141+
EncryptionAlgorithm::Ecc192 => {
142+
AsymmetricAlgorithmSelection::Ecc(EccCurve::NistP192)
143+
}
144+
EncryptionAlgorithm::Ecc224 => {
145+
AsymmetricAlgorithmSelection::Ecc(EccCurve::NistP224)
146+
}
147+
EncryptionAlgorithm::Ecc256 => {
148+
AsymmetricAlgorithmSelection::Ecc(EccCurve::NistP256)
149+
}
150+
EncryptionAlgorithm::Ecc384 => {
151+
AsymmetricAlgorithmSelection::Ecc(EccCurve::NistP384)
152+
}
153+
EncryptionAlgorithm::Ecc521 => {
154+
AsymmetricAlgorithmSelection::Ecc(EccCurve::NistP521)
155+
}
156+
EncryptionAlgorithm::EccSm2 => {
157+
AsymmetricAlgorithmSelection::Ecc(EccCurve::Sm2P256)
158+
}
101159
}
102160
}
103161
}
@@ -107,8 +165,25 @@ impl TryFrom<&str> for EncryptionAlgorithm {
107165

108166
fn try_from(value: &str) -> Result<Self, Self::Error> {
109167
match value {
110-
"rsa" => Ok(EncryptionAlgorithm::Rsa),
111-
"ecc" => Ok(EncryptionAlgorithm::Ecc),
168+
/* Use default key size and curve if not explicitly specified */
169+
"rsa" => Ok(EncryptionAlgorithm::Rsa2048),
170+
"ecc" => Ok(EncryptionAlgorithm::Ecc256),
171+
"rsa1024" => Ok(EncryptionAlgorithm::Rsa1024),
172+
"rsa2048" => Ok(EncryptionAlgorithm::Rsa2048),
173+
"rsa3072" => Ok(EncryptionAlgorithm::Rsa3072),
174+
"rsa4096" => Ok(EncryptionAlgorithm::Rsa4096),
175+
"ecc192" => Ok(EncryptionAlgorithm::Ecc192),
176+
"ecc_nist_p192" => Ok(EncryptionAlgorithm::Ecc192),
177+
"ecc224" => Ok(EncryptionAlgorithm::Ecc224),
178+
"ecc_nist_p224" => Ok(EncryptionAlgorithm::Ecc224),
179+
"ecc256" => Ok(EncryptionAlgorithm::Ecc256),
180+
"ecc_nist_p256" => Ok(EncryptionAlgorithm::Ecc256),
181+
"ecc384" => Ok(EncryptionAlgorithm::Ecc384),
182+
"ecc_nist_p384" => Ok(EncryptionAlgorithm::Ecc384),
183+
"ecc521" => Ok(EncryptionAlgorithm::Ecc521),
184+
"ecc_nist_p521" => Ok(EncryptionAlgorithm::Ecc521),
185+
"ecc_sm2" => Ok(EncryptionAlgorithm::EccSm2),
186+
"ecc_sm2_p256" => Ok(EncryptionAlgorithm::EccSm2),
112187
_ => Err(AlgorithmError::UnsupportedEncryptionAlgorithm(
113188
value.into(),
114189
)),
@@ -119,8 +194,16 @@ impl TryFrom<&str> for EncryptionAlgorithm {
119194
impl fmt::Display for EncryptionAlgorithm {
120195
fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
121196
let value = match self {
122-
EncryptionAlgorithm::Rsa => "rsa",
123-
EncryptionAlgorithm::Ecc => "ecc",
197+
EncryptionAlgorithm::Rsa1024 => "rsa1024",
198+
EncryptionAlgorithm::Rsa2048 => "rsa", /* for backwards compatibility */
199+
EncryptionAlgorithm::Rsa3072 => "rsa3072",
200+
EncryptionAlgorithm::Rsa4096 => "rsa4096",
201+
EncryptionAlgorithm::Ecc192 => "ecc192",
202+
EncryptionAlgorithm::Ecc224 => "ecc224",
203+
EncryptionAlgorithm::Ecc256 => "ecc", /* for backwards compatibility */
204+
EncryptionAlgorithm::Ecc384 => "ecc384",
205+
EncryptionAlgorithm::Ecc521 => "ecc521",
206+
EncryptionAlgorithm::EccSm2 => "ecc_sm2",
124207
};
125208
write!(f, "{value}")
126209
}
@@ -219,9 +302,13 @@ mod tests {
219302
#[test]
220303
fn test_encrypt_try_from() {
221304
let result = EncryptionAlgorithm::try_from("rsa");
222-
assert!(result.is_ok());
305+
assert!(result.is_ok_and(|r| r == EncryptionAlgorithm::Rsa2048));
223306
let result = EncryptionAlgorithm::try_from("ecc");
224-
assert!(result.is_ok());
307+
assert!(result.is_ok_and(|r| r == EncryptionAlgorithm::Ecc256));
308+
let result = EncryptionAlgorithm::try_from("rsa4096");
309+
assert!(result.is_ok_and(|r| r == EncryptionAlgorithm::Rsa4096));
310+
let result = EncryptionAlgorithm::try_from("ecc256");
311+
assert!(result.is_ok_and(|r| r == EncryptionAlgorithm::Ecc256));
225312
}
226313
#[test]
227314
fn test_unsupported_encrypt_try_from() {

‎keylime/src/tpm.rs

+31-22
Original file line numberDiff line numberDiff line change
@@ -562,7 +562,7 @@ impl Context<'_> {
562562
let key_handle: KeyHandle = match handle {
563563
Some(v) => {
564564
if v.is_empty() {
565-
ek::create_ek_object(&mut ctx, alg.into(), DefaultKey)
565+
ek::create_ek_object_2(&mut ctx, alg.into(), DefaultKey)
566566
.map_err(|source| TpmError::TSSCreateEKError {
567567
source,
568568
})?
@@ -591,7 +591,7 @@ impl Context<'_> {
591591
.into()
592592
}
593593
}
594-
None => ek::create_ek_object(&mut ctx, alg.into(), DefaultKey)
594+
None => ek::create_ek_object_2(&mut ctx, alg.into(), DefaultKey)
595595
.map_err(|source| TpmError::TSSCreateEKError { source })?,
596596
};
597597

@@ -625,19 +625,22 @@ impl Context<'_> {
625625
///
626626
/// * `handle`: The associated EK handle
627627
/// * `hash_alg`: The digest algorithm used for signing with the created AK
628+
/// * `key_alg`: The key type used for signing with the created AK
628629
/// * `sign_alg`: The created AK signing algorithm
629630
///
630631
/// Returns an `AKResult` structure if successful and a `TPMError` otherwise
631632
pub fn create_ak(
632633
&mut self,
633634
handle: KeyHandle,
634635
hash_alg: HashAlgorithm,
636+
key_alg: EncryptionAlgorithm,
635637
sign_alg: SignAlgorithm,
636638
) -> Result<AKResult> {
637-
let ak = ak::create_ak(
639+
let ak = ak::create_ak_2(
638640
&mut self.inner.lock().unwrap(), //#[allow_ci]
639641
handle,
640642
hash_alg.into(),
643+
key_alg.into(),
641644
sign_alg.into(),
642645
None,
643646
DefaultKey,
@@ -1921,9 +1924,7 @@ pub fn get_idevid_template(
19211924
"H-4" => (AsymmetricAlgorithm::Ecc, HashingAlgorithm::Sha512),
19221925
"H-5" => (AsymmetricAlgorithm::Ecc, HashingAlgorithm::Sm3_256),
19231926
_ => (
1924-
AsymmetricAlgorithm::from(EncryptionAlgorithm::try_from(
1925-
asym_alg_str,
1926-
)?),
1927+
EncryptionAlgorithm::try_from(asym_alg_str)?.into(),
19271928
HashingAlgorithm::from(HashAlgorithm::try_from(name_alg_str)?),
19281929
),
19291930
};
@@ -2421,7 +2422,8 @@ pub mod tests {
24212422
async fn test_create_ek() {
24222423
let _mutex = testing::lock_tests().await;
24232424
let mut ctx = Context::new().unwrap(); //#[allow_ci]
2424-
let algs = [EncryptionAlgorithm::Rsa, EncryptionAlgorithm::Ecc];
2425+
let algs =
2426+
[EncryptionAlgorithm::Rsa2048, EncryptionAlgorithm::Ecc256];
24252427
// TODO: create persistent handle and add to be tested: Some("0x81000000"),
24262428
let handles = [Some(""), None];
24272429

@@ -2444,12 +2446,15 @@ pub mod tests {
24442446
let _mutex = testing::lock_tests().await;
24452447
let mut ctx = Context::new().unwrap(); //#[allow_ci]
24462448

2447-
let r = ctx.create_ek(EncryptionAlgorithm::Rsa, None);
2449+
let r = ctx.create_ek(EncryptionAlgorithm::Rsa2048, None);
24482450
assert!(r.is_ok(), "Result: {r:?}");
24492451

24502452
let ek_result = r.unwrap(); //#[allow_ci]
24512453
let ek_handle = ek_result.key_handle;
24522454

2455+
let eng_algs =
2456+
[EncryptionAlgorithm::Rsa1024, EncryptionAlgorithm::Rsa2048];
2457+
24532458
let hash_algs = [
24542459
HashAlgorithm::Sha256,
24552460
HashAlgorithm::Sha384,
@@ -2470,18 +2475,20 @@ pub mod tests {
24702475
];
24712476

24722477
for sign in sign_algs {
2473-
for hash in hash_algs {
2474-
let r = ctx.create_ak(ek_handle, hash, sign);
2475-
assert!(r.is_ok(), "Result: {r:?}");
2476-
let ak = r.unwrap(); //#[allow_ci]
2477-
2478-
let r = ctx.load_ak(ek_handle, &ak);
2479-
assert!(r.is_ok(), "Result: {r:?}");
2480-
let handle = r.unwrap(); //#[allow_ci]
2481-
2482-
// Flush context to free TPM memory
2483-
let r = ctx.flush_context(handle.into());
2484-
assert!(r.is_ok(), "Result: {r:?}");
2478+
for enc in eng_algs {
2479+
for hash in hash_algs {
2480+
let r = ctx.create_ak(ek_handle, hash, enc, sign);
2481+
assert!(r.is_ok(), "Result: {r:?}");
2482+
let ak = r.unwrap(); //#[allow_ci]
2483+
2484+
let r = ctx.load_ak(ek_handle, &ak);
2485+
assert!(r.is_ok(), "Result: {r:?}");
2486+
let handle = r.unwrap(); //#[allow_ci]
2487+
2488+
// Flush context to free TPM memory
2489+
let r = ctx.flush_context(handle.into());
2490+
assert!(r.is_ok(), "Result: {r:?}");
2491+
}
24852492
}
24862493
}
24872494

@@ -2562,7 +2569,7 @@ pub mod tests {
25622569

25632570
// Create EK
25642571
let ek_result = ctx
2565-
.create_ek(EncryptionAlgorithm::Rsa, None)
2572+
.create_ek(EncryptionAlgorithm::Rsa2048, None)
25662573
.expect("failed to create EK");
25672574
let ek_handle = ek_result.key_handle;
25682575

@@ -2571,6 +2578,7 @@ pub mod tests {
25712578
.create_ak(
25722579
ek_handle,
25732580
HashAlgorithm::Sha256,
2581+
EncryptionAlgorithm::Rsa2048,
25742582
SignAlgorithm::RsaSsa,
25752583
)
25762584
.expect("failed to create AK");
@@ -2618,7 +2626,7 @@ pub mod tests {
26182626

26192627
// Create EK
26202628
let ek_result = ctx
2621-
.create_ek(EncryptionAlgorithm::Rsa, None)
2629+
.create_ek(EncryptionAlgorithm::Rsa2048, None)
26222630
.expect("failed to create EK");
26232631
let ek_handle = ek_result.key_handle;
26242632

@@ -2627,6 +2635,7 @@ pub mod tests {
26272635
.create_ak(
26282636
ek_handle,
26292637
HashAlgorithm::Sha256,
2638+
EncryptionAlgorithm::Rsa2048,
26302639
SignAlgorithm::RsaSsa,
26312640
)
26322641
.expect("failed to create ak");

0 commit comments

Comments
 (0)