Skip to content

Commit ba36eba

Browse files
dgarskedgarske
committed
Add support for crypto callback key generation that exports the encrypted private portion. Fixes and test for WOLFTPM2_USE_SW_ECDHE.
1 parent c95cc63 commit ba36eba

3 files changed

Lines changed: 83 additions & 33 deletions

File tree

‎.github/workflows/make-test-swtpm.yml‎

Lines changed: 20 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -161,6 +161,26 @@ jobs:
161161
- name: make not provisioning
162162
run: make
163163

164+
# test with symmetric encryption
165+
- name: configure symmetric
166+
run: ./configure --enable-swtpm CFLAGS="-DWOLFTPM_USE_SYMMETRIC"
167+
- name: make symmetric
168+
run: make
169+
- name: make check symmetric
170+
run: |
171+
make check
172+
WOLFSSL_PATH=./wolfssl ./examples/run_examples.sh
173+
174+
# test with software ecdhe
175+
- name: configure swecdhe
176+
run: ./configure --enable-swtpm CFLAGS="-DWOLFTPM2_USE_SW_ECDHE"
177+
- name: make swecdhe
178+
run: make
179+
- name: make check swecdhe
180+
run: |
181+
make check
182+
WOLFSSL_PATH=./wolfssl ./examples/run_examples.sh
183+
164184
# test without ECC
165185
- name: wolfssl no ECC
166186
working-directory: ./wolfssl
@@ -240,16 +260,6 @@ jobs:
240260
make check
241261
WOLFSSL_PATH=./wolfssl NO_PUBASPRIV=1 ./examples/run_examples.sh
242262
243-
# test with symmetric encryption
244-
- name: configure symmetric
245-
run: ./configure --enable-swtpm CFLAGS="-DWOLFTPM_USE_SYMMETRIC"
246-
- name: make symmetric
247-
run: make
248-
- name: make check symmetric
249-
run: |
250-
make check
251-
WOLFSSL_PATH=./wolfssl ./examples/run_examples.sh
252-
253263
# capture logs on failure
254264
- name: Upload failure logs
255265
if: failure()

‎src/tpm2_cryptocb.c‎

Lines changed: 60 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -177,28 +177,41 @@ int wolfTPM2_CryptoDevCb(int devId, wc_CryptoInfo* info, void* ctx)
177177
#endif /* !NO_RSA */
178178
#ifdef HAVE_ECC
179179
if (info->pk.type == WC_PK_TYPE_EC_KEYGEN) {
180-
#ifdef WOLFTPM2_USE_SW_ECDHE
181-
rc = exit_rc;
182-
#else
183180
int curve_id;
184181
WOLFTPM2_KEY* key;
185182

183+
if ( tlsCtx->eccKey == NULL
184+
&& tlsCtx->ecdsaKey == NULL
185+
#ifndef WOLFTPM2_USE_SW_ECDHE
186+
&& tlsCtx->ecdhKey == NULL
187+
#endif
188+
) {
189+
#ifdef DEBUG_WOLFTPM
190+
printf("No crypto callback key pointer set!\n");
191+
#endif
192+
return BAD_FUNC_ARG;
193+
}
194+
186195
/* Make sure an ECDH key has been set and curve is supported */
187196
curve_id = info->pk.eckg.curveId;
188197
if (curve_id == 0 && info->pk.eckg.key->dp != NULL) {
189198
curve_id = info->pk.eckg.key->dp->id; /* use dp */
190199
}
191200
rc = TPM2_GetTpmCurve(curve_id);
192-
if (rc < 0 || (tlsCtx->ecdhKey == NULL && tlsCtx->eccKey == NULL)) {
201+
if (rc < 0) {
193202
return exit_rc;
194203
}
195204
curve_id = rc;
196205
rc = 0;
197206

198207
/* If ecdhKey is NULL then it is a signing key */
199-
if (tlsCtx->ecdhKey == NULL) {
208+
#ifndef WOLFTPM2_USE_SW_ECDHE
209+
if (tlsCtx->ecdhKey == NULL)
210+
#endif
211+
{
200212
/* Create an ECC key for ECDSA - if one isn't already created */
201-
key = tlsCtx->eccKey;
213+
key = (tlsCtx->ecdsaKey != NULL) ?
214+
(WOLFTPM2_KEY*)tlsCtx->ecdsaKey : tlsCtx->eccKey;
202215
if (key->handle.hndl == 0 ||
203216
key->handle.hndl == TPM_RH_NULL
204217
) {
@@ -210,47 +223,72 @@ int wolfTPM2_CryptoDevCb(int devId, wc_CryptoInfo* info, void* ctx)
210223
TPMA_OBJECT_sign | TPMA_OBJECT_noDA,
211224
curve_id, TPM_ALG_ECDSA);
212225
if (rc == 0) {
213-
publicTemplate.nameAlg = TPM_ALG_SHA256; /* make sure its SHA256 */
214-
rc = wolfTPM2_CreateAndLoadKey(tlsCtx->dev, key,
215-
&tlsCtx->storageKey->handle, &publicTemplate,
216-
(byte*)key->handle.auth.buffer,
217-
key->handle.auth.size);
226+
if (curve_id == TPM_ECC_NIST_P521)
227+
publicTemplate.nameAlg = TPM_ALG_SHA512;
228+
else if (curve_id == TPM_ECC_NIST_P384)
229+
publicTemplate.nameAlg = TPM_ALG_SHA384;
230+
else
231+
publicTemplate.nameAlg = TPM_ALG_SHA256;
232+
233+
if (tlsCtx->ecdsaKey != NULL) {
234+
/* Use create key and load key directly instead to make
235+
* sure the private portion is populated */
236+
rc = wolfTPM2_CreateKey(tlsCtx->dev, tlsCtx->ecdsaKey,
237+
&tlsCtx->storageKey->handle, &publicTemplate,
238+
(byte*)key->handle.auth.buffer,
239+
key->handle.auth.size);
240+
if (rc == TPM_RC_SUCCESS) {
241+
rc = wolfTPM2_LoadKey(tlsCtx->dev, tlsCtx->ecdsaKey,
242+
&tlsCtx->storageKey->handle);
243+
}
244+
}
245+
else {
246+
/* Create and load key - encrypted private is not exported */
247+
rc = wolfTPM2_CreateAndLoadKey(tlsCtx->dev, tlsCtx->eccKey,
248+
&tlsCtx->storageKey->handle, &publicTemplate,
249+
(byte*)key->handle.auth.buffer,
250+
key->handle.auth.size);
251+
}
218252
}
219253
}
220254
}
255+
#ifndef WOLFTPM2_USE_SW_ECDHE
221256
else {
222257
/* Generate ephemeral key - if one isn't already created */
223258
key = tlsCtx->ecdhKey;
224259
if (key->handle.hndl == 0 ||
225260
key->handle.hndl == TPM_RH_NULL) {
226-
rc = wolfTPM2_ECDHGenKey(tlsCtx->dev, key, curve_id,
227-
NULL, 0 /* no auth for ephemeral key */
261+
rc = wolfTPM2_ECDHGenKey(tlsCtx->dev, tlsCtx->ecdhKey,
262+
curve_id, NULL, 0 /* no auth for ephemeral key */
228263
);
229264
}
230265
}
266+
#endif
267+
231268
if (rc == 0) {
232269
/* Export public key info to wolf ecc_key */
233270
rc = wolfTPM2_EccKey_TpmToWolf(tlsCtx->dev, key,
234271
info->pk.eckg.key);
235272
if (rc != 0) {
236273
/* if failure, release key */
237-
wolfTPM2_UnloadHandle(tlsCtx->dev, &tlsCtx->ecdhKey->handle);
274+
wolfTPM2_UnloadHandle(tlsCtx->dev, &key->handle);
238275
}
239276
}
240277
else if (rc & TPM_RC_CURVE) {
241278
/* if the curve is not supported on TPM, then fall-back to software */
242279
rc = exit_rc;
243-
/* Make sure ECDHE key indicates nothing loaded */
280+
/* Make sure key indicates nothing loaded */
244281
key->handle.hndl = TPM_RH_NULL;
245282
}
246-
#endif /* WOLFTPM2_USE_SW_ECDHE */
247283
}
248284
else if (info->pk.type == WC_PK_TYPE_ECDSA_SIGN) {
249285
byte sigRS[MAX_ECC_BYTES*2];
250286
word32 rsLen = sizeof(sigRS), keySz;
251287
word32 inlen = info->pk.eccsign.inlen;
288+
WOLFTPM2_KEY* key = (tlsCtx->ecdsaKey != NULL) ?
289+
(WOLFTPM2_KEY*)tlsCtx->ecdsaKey : tlsCtx->eccKey;
252290

253-
if (tlsCtx->eccKey == NULL) {
291+
if (key == NULL) {
254292
/* TPM key not setup, fallback to software */
255293
return exit_rc;
256294
}
@@ -260,13 +298,13 @@ int wolfTPM2_CryptoDevCb(int devId, wc_CryptoInfo* info, void* ctx)
260298
if (keySz == 0) {
261299
/* if not populated fallback to key size for TPM key */
262300
keySz = TPM2_GetCurveSize(
263-
tlsCtx->eccKey->pub.publicArea.parameters.eccDetail.curveID);
301+
key->pub.publicArea.parameters.eccDetail.curveID);
264302
}
265303
/* truncate input to match key size */
266304
if (inlen > keySz)
267305
inlen = keySz;
268306

269-
rc = wolfTPM2_SignHash(tlsCtx->dev, tlsCtx->eccKey,
307+
rc = wolfTPM2_SignHash(tlsCtx->dev, key,
270308
info->pk.eccsign.in, inlen, sigRS, (int*)&rsLen);
271309
if (rc == 0) {
272310
byte *r, *s;
@@ -335,8 +373,9 @@ int wolfTPM2_CryptoDevCb(int devId, wc_CryptoInfo* info, void* ctx)
335373
TPM2B_ECC_POINT pubPoint;
336374

337375
/* Make sure an ECDH key has been set */
338-
if (tlsCtx->ecdhKey == NULL || tlsCtx->eccKey == NULL ||
339-
tlsCtx->ecdhKey->handle.hndl == TPM_RH_NULL) {
376+
if (tlsCtx->ecdhKey == NULL ||
377+
tlsCtx->ecdhKey->handle.hndl == TPM_RH_NULL ||
378+
tlsCtx->ecdhKey->handle.hndl == 0) {
340379
return exit_rc;
341380
}
342381

‎wolftpm/tpm2_wrap.h‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3345,9 +3345,10 @@ typedef struct TpmCryptoDevCtx {
33453345
#endif
33463346
#endif
33473347
#ifdef HAVE_ECC
3348-
WOLFTPM2_KEY* eccKey; /* ECDSA */
3348+
WOLFTPM2_KEY* eccKey; /* ECDSA - public only */
3349+
WOLFTPM2_KEYBLOB* ecdsaKey; /* ECDSA - retain encrypted private portion from keygen */
33493350
#ifndef WOLFTPM2_USE_SW_ECDHE
3350-
WOLFTPM2_KEY* ecdhKey; /* ECDH */
3351+
WOLFTPM2_KEY* ecdhKey; /* ECDH */
33513352
#endif
33523353
#endif
33533354
WOLFTPM2_KEY* storageKey;

0 commit comments

Comments
 (0)