Skip to content

Commit b7e0bf6

Browse files
dgarskedgarske
committed
Peer review fixes
1 parent cfceb4e commit b7e0bf6

2 files changed

Lines changed: 55 additions & 36 deletions

File tree

‎examples/endorsement/get_ek_certs.c‎

Lines changed: 44 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -259,7 +259,7 @@ int TPM2_EndorsementCert_Example(void* userCtx, int argc, char *argv[])
259259
for (nvIdx=0; nvIdx<(int)handles.count; nvIdx++) {
260260
nvIndex = handles.handle[nvIdx];
261261

262-
XMEMSET(&nv, 0, sizeof(nv)); /* Must reset the NV for each read */
262+
XMEMSET(&nv, 0, sizeof(nv)); /* Reset NV handle for each index */
263263
XMEMSET(certBuf, 0, sizeof(certBuf));
264264

265265
printf("TCG Handle 0x%x\n", nvIndex);
@@ -268,45 +268,54 @@ int TPM2_EndorsementCert_Example(void* userCtx, int argc, char *argv[])
268268
rc = wolfTPM2_GetKeyTemplate_EKIndex(nvIndex, &publicTemplate);
269269
if (rc != 0) {
270270
const char* indexType = "Unknown";
271-
word32 offset = nvIndex - TPM_20_TCG_NV_SPACE;
271+
word32 offset;
272272

273273
/* Identify the type of NV index based on offset */
274274
if (nvIndex < TPM_20_TCG_NV_SPACE) {
275275
indexType = "Non-TCG (below TCG NV space)";
276276
}
277-
else if (offset >= 0x2 && offset <= 0xC) {
278-
indexType = "EK Low Range";
279-
if (offset == 0x2) indexType = "EK Low Range (RSA 2048 Cert)";
280-
else if (offset == 0x3) indexType = "EK Low Range (RSA 2048 Nonce)";
281-
else if (offset == 0x4) indexType = "EK Low Range (RSA 2048 Template)";
282-
else if (offset == 0xA) indexType = "EK Low Range (ECC P256 Cert)";
283-
else if (offset == 0xB) indexType = "EK Low Range (ECC P256 Nonce)";
284-
else if (offset == 0xC) indexType = "EK Low Range (ECC P256 Template)";
285-
}
286-
else if (offset >= 0x12 && offset < 0x100) {
287-
indexType = "EK High Range";
288-
if (offset == 0x12) indexType = "EK High Range (RSA 2048 Cert)";
289-
else if (offset == 0x14) indexType = "EK High Range (ECC P256 Cert)";
290-
else if (offset == 0x16) indexType = "EK High Range (ECC P384 Cert)";
291-
else if (offset == 0x18) indexType = "EK High Range (ECC P521 Cert)";
292-
else if (offset == 0x1A) indexType = "EK High Range (ECC SM2 Cert)";
293-
else if (offset == 0x1C) indexType = "EK High Range (RSA 3072 Cert)";
294-
else if (offset == 0x1E) indexType = "EK High Range (RSA 4096 Cert)";
295-
else if ((offset & 1) == 0) indexType = "EK High Range (Cert, even index)";
296-
else indexType = "EK High Range (Template, odd index)";
297-
}
298-
else if (offset >= 0x100 && offset < 0x200) {
299-
indexType = "EK Certificate Chain";
300-
}
301-
else if (offset >= 0x7F01 && offset <= 0x7F04) {
302-
indexType = "EK Policy Index";
303-
if (offset == 0x7F01) indexType = "EK Policy Index (SHA256)";
304-
else if (offset == 0x7F02) indexType = "EK Policy Index (SHA384)";
305-
else if (offset == 0x7F03) indexType = "EK Policy Index (SHA512)";
306-
else if (offset == 0x7F04) indexType = "EK Policy Index (SM3_256)";
307-
}
308-
else if (nvIndex > TPM_20_TCG_NV_SPACE + 0x7FFF) {
309-
indexType = "Vendor-specific (beyond TCG range)";
277+
else {
278+
offset = nvIndex - TPM_20_TCG_NV_SPACE;
279+
280+
if (offset >= 0x2 && offset <= 0xC) {
281+
indexType = "EK Low Range";
282+
if (offset == 0x2) indexType = "EK Low Range (RSA 2048 Cert)";
283+
else if (offset == 0x3) indexType = "EK Low Range (RSA 2048 Nonce)";
284+
else if (offset == 0x4) indexType = "EK Low Range (RSA 2048 Template)";
285+
else if (offset == 0xA) indexType = "EK Low Range (ECC P256 Cert)";
286+
else if (offset == 0xB) indexType = "EK Low Range (ECC P256 Nonce)";
287+
else if (offset == 0xC) indexType = "EK Low Range (ECC P256 Template)";
288+
}
289+
else if (offset >= 0x12 && offset < 0x100) {
290+
indexType = "EK High Range";
291+
if (offset == 0x12) indexType = "EK High Range (RSA 2048 Cert)";
292+
else if (offset == 0x14) indexType = "EK High Range (ECC P256 Cert)";
293+
else if (offset == 0x16) indexType = "EK High Range (ECC P384 Cert)";
294+
else if (offset == 0x18) indexType = "EK High Range (ECC P521 Cert)";
295+
else if (offset == 0x1A) indexType = "EK High Range (ECC SM2 Cert)";
296+
else if (offset == 0x1C) indexType = "EK High Range (RSA 3072 Cert)";
297+
else if (offset == 0x1E) indexType = "EK High Range (RSA 4096 Cert)";
298+
else if ((offset & 1) == 0) indexType = "EK High Range (Cert, even index)";
299+
else indexType = "EK High Range (Template, odd index)";
300+
}
301+
else if (offset >= 0x100 && offset < 0x200) {
302+
indexType = "EK Certificate Chain";
303+
}
304+
else if (offset == (TPM2_NV_EK_POLICY_SHA256 - TPM_20_TCG_NV_SPACE)) {
305+
indexType = "EK Policy Index (SHA256)";
306+
}
307+
else if (offset == (TPM2_NV_EK_POLICY_SHA384 - TPM_20_TCG_NV_SPACE)) {
308+
indexType = "EK Policy Index (SHA384)";
309+
}
310+
else if (offset == (TPM2_NV_EK_POLICY_SHA512 - TPM_20_TCG_NV_SPACE)) {
311+
indexType = "EK Policy Index (SHA512)";
312+
}
313+
else if (offset == (TPM2_NV_EK_POLICY_SM3_256 - TPM_20_TCG_NV_SPACE)) {
314+
indexType = "EK Policy Index (SM3_256)";
315+
}
316+
else if (nvIndex > TPM_20_TCG_NV_SPACE + 0x7FFF) {
317+
indexType = "Vendor-specific (beyond TCG range)";
318+
}
310319
}
311320

312321
printf("NV Index 0x%08x: %s (not a recognized EK certificate index)\n",

‎src/tpm2_wrap.c‎

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6445,13 +6445,23 @@ int wolfTPM2_GetKeyTemplate_EKIndex(word32 nvIndex,
64456445
TPM_ECC_CURVE curveID = TPM_ECC_NONE;
64466446
uint32_t keyBits = 0;
64476447
int highRange = 0;
6448+
word32 offset;
64486449

6449-
/* validate index is in TCG NV space range (0x01C00000 - 0x01C07FFF) */
6450+
/* Validate index is in TCG NV space */
64506451
if (nvIndex < TPM_20_TCG_NV_SPACE ||
64516452
nvIndex > TPM_20_TCG_NV_SPACE + 0x7FFF) {
64526453
return BAD_FUNC_ARG;
64536454
}
64546455

6456+
offset = nvIndex - TPM_20_TCG_NV_SPACE;
6457+
6458+
/* Reject indices in dead zones that cannot produce valid templates:
6459+
* - Between High Range (0x1FF) and Policy Indices (0x7F01)
6460+
* - After Policy Indices (0x7F04) */
6461+
if ((offset > 0x1FF && offset < 0x7F01) || offset > 0x7F04) {
6462+
return BAD_FUNC_ARG;
6463+
}
6464+
64556465
/* determine if low or high range */
64566466
if (nvIndex >= TPM2_NV_EK_RSA2048) {
64576467
highRange = 1;

0 commit comments

Comments
 (0)