Skip to content

Commit 0e96f7d

Browse files
salrashid123salrashid123
committed
add policy callback interface
1 parent 48ffc6c commit 0e96f7d

File tree

11 files changed

+323
-92
lines changed

11 files changed

+323
-92
lines changed

‎README.md

+1-2
Original file line numberDiff line numberDiff line change
@@ -92,10 +92,9 @@ If you just want to issue JWT's, see
9292

9393
r, err := saltpm.NewTPMCrypto(&saltpm.TPM{
9494
TpmDevice: rwc,
95-
AuthHandle: &tpm2.AuthHandle{
95+
NamedHandle: &tpm2.NamedHandle{
9696
Handle: tpm2.TPMHandle(*handle),
9797
Name: pub.Name,
98-
Auth: tpm2.PasswordAuth(nil),
9998
},
10099
})
101100
// the tpm is opened and then closed after every sign operation

‎example/README.md

+16-3
Original file line numberDiff line numberDiff line change
@@ -81,7 +81,7 @@ cd example/
8181
tpm2_flushcontext -t
8282

8383

84-
## for policyRSApersistentHandle
84+
## for policyPCR
8585

8686
tpm2_pcrread sha256:23
8787
tpm2_startauthsession -S session.dat
@@ -96,6 +96,16 @@ cd example/
9696
tpm2_evictcontrol -C o -c key.ctx 0x81008006
9797
tpm2_flushcontext -t
9898

99+
## for policyPassword
100+
101+
tpm2_createprimary -C o -G rsa2048:aes128cfb -g sha256 -c primary.ctx -a 'restricted|decrypt|fixedtpm|fixedparent|sensitivedataorigin|userwithauth|noda'
102+
tpm2_create -G rsa2048:rsassa:null -p testpwd -g sha256 -u key.pub -r key.priv -C primary.ctx
103+
tpm2_flushcontext -t
104+
tpm2_getcap handles-transient
105+
tpm2_load -C primary.ctx -u key.pub -r key.priv -c key.ctx
106+
tpm2_evictcontrol -C o -c key.ctx 0x81008007
107+
tpm2_flushcontext -t
108+
99109
## =====
100110

101111
cd example/
@@ -109,8 +119,11 @@ go run sign_verify_tpm/rsapss/main.go --handle=0x81008004 --tpm-path="127.0.0.1:
109119
## ECC
110120
go run sign_verify_tpm/ecc/main.go --handle=0x81008005 --tpm-path="127.0.0.1:2321"
111121

112-
## RSA with policy
113-
go run sign_verify_tpm/policy/main.go --handle=0x81008006 --tpm-path="127.0.0.1:2321"
122+
## RSA with pcr policy
123+
go run sign_verify_tpm/policy_pcr/main.go --handle=0x81008006 --tpm-path="127.0.0.1:2321"
124+
125+
## RSA with password policy
126+
go run sign_verify_tpm/policy_password/main.go --handle=0x81008007 --tpm-path="127.0.0.1:2321"
114127
```
115128

116129
---

‎example/sign_verify_tpm/ecc/main.go

+2-4
Original file line numberDiff line numberDiff line change
@@ -88,10 +88,9 @@ func main() {
8888

8989
er, err := saltpm.NewTPMCrypto(&saltpm.TPM{
9090
TpmDevice: rwc,
91-
AuthHandle: &tpm2.AuthHandle{
91+
NamedHandle: &tpm2.NamedHandle{
9292
Handle: tpm2.TPMHandle(*handle),
9393
Name: pub.Name,
94-
Auth: tpm2.PasswordAuth(nil),
9594
},
9695
ECCRawOutput: true, // use raw output; not asn1
9796
})
@@ -131,10 +130,9 @@ func main() {
131130
// now verify with ASN1 output format for ecc using library managed device
132131
erasn, err := saltpm.NewTPMCrypto(&saltpm.TPM{
133132
TpmDevice: rwc,
134-
AuthHandle: &tpm2.AuthHandle{
133+
NamedHandle: &tpm2.NamedHandle{
135134
Handle: tpm2.TPMHandle(*handle),
136135
Name: pub.Name,
137-
Auth: tpm2.PasswordAuth(nil),
138136
},
139137
//ECCRawOutput: false,
140138
})

‎example/sign_verify_tpm/policy_password/main.go

+134
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,134 @@
1+
package main
2+
3+
import (
4+
"crypto"
5+
"crypto/rand"
6+
"crypto/rsa"
7+
"crypto/sha256"
8+
"encoding/base64"
9+
"flag"
10+
"fmt"
11+
"io"
12+
"log"
13+
"net"
14+
"os"
15+
"slices"
16+
17+
"github.com/google/go-tpm-tools/simulator"
18+
"github.com/google/go-tpm/tpm2"
19+
"github.com/google/go-tpm/tpm2/transport"
20+
"github.com/google/go-tpm/tpmutil"
21+
22+
saltpm "github.com/salrashid123/signer/tpm"
23+
)
24+
25+
const (
26+
emptyPassword = ""
27+
defaultPassword = ""
28+
)
29+
30+
/*
31+
32+
## RSA - password
33+
tpm2_createprimary -C o -G rsa2048:aes128cfb -g sha256 -c primary.ctx -a 'restricted|decrypt|fixedtpm|fixedparent|sensitivedataorigin|userwithauth|noda'
34+
tpm2_create -G rsa2048:rsassa:null -p testpwd -g sha256 -u key.pub -r key.priv -C primary.ctx
35+
tpm2_flushcontext -t
36+
tpm2_getcap handles-transient
37+
tpm2_load -C primary.ctx -u key.pub -r key.priv -c key.ctx
38+
tpm2_evictcontrol -C o -c key.ctx 0x81008006
39+
tpm2_flushcontext -t
40+
41+
go run sign_verify_tpm/policy_password/main.go --handle=0x81008006
42+
*/
43+
44+
var (
45+
tpmPath = flag.String("tpm-path", "/dev/tpmrm0", "Path to the TPM device (character device or a Unix socket).")
46+
handle = flag.Uint("handle", 0x81008006, "rsa Handle value")
47+
keyPass = flag.String("keyPass", "testpwd", "KeyPassword")
48+
)
49+
50+
var TPMDEVICES = []string{"/dev/tpm0", "/dev/tpmrm0"}
51+
52+
func OpenTPM(path string) (io.ReadWriteCloser, error) {
53+
if slices.Contains(TPMDEVICES, path) {
54+
return tpmutil.OpenTPM(path)
55+
} else if path == "simulator" {
56+
return simulator.GetWithFixedSeedInsecure(1073741825)
57+
} else {
58+
return net.Dial("tcp", path)
59+
}
60+
}
61+
62+
func main() {
63+
64+
flag.Parse()
65+
66+
rwc, err := OpenTPM(*tpmPath)
67+
if err != nil {
68+
log.Fatalf("can't open TPM %q: %v", *tpmPath, err)
69+
}
70+
defer func() {
71+
if err := rwc.Close(); err != nil {
72+
log.Fatalf("can't close TPM %q: %v", *tpmPath, err)
73+
}
74+
}()
75+
76+
rwr := transport.FromReadWriter(rwc)
77+
78+
pub, err := tpm2.ReadPublic{
79+
ObjectHandle: tpm2.TPMHandle(*handle),
80+
}.Execute(rwr)
81+
if err != nil {
82+
log.Fatalf("error executing tpm2.ReadPublic %v", err)
83+
}
84+
85+
stringToSign := "foo"
86+
fmt.Printf("Data to sign %s\n", stringToSign)
87+
88+
b := []byte(stringToSign)
89+
90+
h := sha256.New()
91+
h.Write(b)
92+
digest := h.Sum(nil)
93+
94+
se, err := saltpm.NewPasswordSession(rwr, []byte(*keyPass))
95+
if err != nil {
96+
fmt.Println(err)
97+
os.Exit(1)
98+
}
99+
100+
rr, err := saltpm.NewTPMCrypto(&saltpm.TPM{
101+
TpmDevice: rwc,
102+
NamedHandle: &tpm2.NamedHandle{
103+
Handle: tpm2.TPMHandle(*handle),
104+
Name: pub.Name,
105+
},
106+
AuthSession: se,
107+
})
108+
109+
if err != nil {
110+
fmt.Println(err)
111+
os.Exit(1)
112+
}
113+
114+
rs, err := rr.Sign(rand.Reader, digest, crypto.SHA256)
115+
if err != nil {
116+
log.Println(err)
117+
os.Exit(1)
118+
}
119+
fmt.Printf("RSA Signed String: %s\n", base64.StdEncoding.EncodeToString(rs))
120+
121+
rrsaPubKey, ok := rr.Public().(*rsa.PublicKey)
122+
if !ok {
123+
fmt.Println(err)
124+
os.Exit(1)
125+
}
126+
127+
err = rsa.VerifyPKCS1v15(rrsaPubKey, crypto.SHA256, digest, rs)
128+
if err != nil {
129+
fmt.Println(err)
130+
os.Exit(1)
131+
}
132+
fmt.Printf("RSA Signed String verified\n")
133+
134+
}

‎example/sign_verify_tpm/policy/main.go ‎example/sign_verify_tpm/policy_pcr/main.go

+9-22
Original file line numberDiff line numberDiff line change
@@ -99,37 +99,24 @@ func main() {
9999
h.Write(b)
100100
digest := h.Sum(nil)
101101

102-
sess, cleanup, err := tpm2.PolicySession(rwr, tpm2.TPMAlgSHA256, 16)
103-
if err != nil {
104-
log.Fatalf("error executing tpm2.ReadPublic %v", err)
105-
}
106-
defer cleanup()
107-
108-
_, err = tpm2.PolicyPCR{
109-
PolicySession: sess.Handle(),
110-
Pcrs: tpm2.TPMLPCRSelection{
111-
PCRSelections: []tpm2.TPMSPCRSelection{
112-
{
113-
Hash: tpm2.TPMAlgSHA256,
114-
PCRSelect: tpm2.PCClientCompatible.PCRs(uint(*pcr)),
115-
},
116-
},
102+
se, err := saltpm.NewPCRSession(rwr, []tpm2.TPMSPCRSelection{
103+
{
104+
Hash: tpm2.TPMAlgSHA256,
105+
PCRSelect: tpm2.PCClientCompatible.PCRs(uint(*pcr)),
117106
},
118-
}.Execute(rwr)
107+
})
119108
if err != nil {
120-
log.Fatalf("error executing tpm2.ReadPublic %v", err)
109+
fmt.Println(err)
110+
os.Exit(1)
121111
}
122112

123-
defer func() {
124-
_, err = tpm2.FlushContext{FlushHandle: sess.Handle()}.Execute(rwr)
125-
}()
126113
rr, err := saltpm.NewTPMCrypto(&saltpm.TPM{
127114
TpmDevice: rwc,
128-
AuthHandle: &tpm2.AuthHandle{
115+
NamedHandle: &tpm2.NamedHandle{
129116
Handle: tpm2.TPMHandle(*handle),
130117
Name: pub.Name,
131-
Auth: sess,
132118
},
119+
AuthSession: se,
133120
})
134121

135122
if err != nil {

‎example/sign_verify_tpm/rsapss/main.go

+1-2
Original file line numberDiff line numberDiff line change
@@ -88,10 +88,9 @@ func main() {
8888

8989
r, err := saltpm.NewTPMCrypto(&saltpm.TPM{
9090
TpmDevice: rwc,
91-
AuthHandle: &tpm2.AuthHandle{
91+
NamedHandle: &tpm2.NamedHandle{
9292
Handle: tpm2.TPMHandle(*handle),
9393
Name: pub.Name,
94-
Auth: tpm2.PasswordAuth(nil),
9594
},
9695
})
9796

‎example/sign_verify_tpm/rsassa/main.go

+1-2
Original file line numberDiff line numberDiff line change
@@ -87,10 +87,9 @@ func main() {
8787

8888
r, err := saltpm.NewTPMCrypto(&saltpm.TPM{
8989
TpmDevice: rwc,
90-
AuthHandle: &tpm2.AuthHandle{
90+
NamedHandle: &tpm2.NamedHandle{
9191
Handle: tpm2.TPMHandle(*handle),
9292
Name: pub.Name,
93-
Auth: tpm2.PasswordAuth(nil),
9493
},
9594
})
9695

0 commit comments

Comments
 (0)