Update to support Infineon v1.2 TPM

[openpts/openpts.git] / src / tss.c

diff --git a/src/tss.c b/src/tss.c
index f4792c9..da7db67 100644 (file)
--- a/src/tss.c
+++ b/src/tss.c
@@ -67,6 +67,8 @@
 
 #define TSS_PS_TYPE_BLOB   (0)   // not defined by TSS
 
+// TODO common secret
+#define TPMSIGKEY_SECRET "password"
 
 #ifdef CONFIG_NO_TSS
 /* ONLY for verifier side */
@@ -404,7 +406,14 @@ int printTssKeyList(int ps_type) {
  * 
  * TODO return PUBKEY blog
  */
-int createTssSignKey(PTS_UUID *uuid, int ps_type, char *filename, int force, int srk_password_mode) {
+int createTssSignKey(
+    PTS_UUID *uuid,
+    int ps_type,
+    char *filename,
+    int auth_type,
+    int force,
+    int srk_password_mode)
+{
     TSS_RESULT result = 0;
     TSS_HCONTEXT hContext;
     TSS_HTPM hTPM;
@@ -417,9 +426,9 @@ int createTssSignKey(PTS_UUID *uuid, int ps_type, char *filename, int force, int
     TSS_HKEY hKey;
     UINT32 keyLength;
     BYTE *keyBlob;
+    TSS_HPOLICY hKeyPolicy;
     int i;
     TSS_UUID tss_uuid;
-    TSS_FLAG initFlag = TSS_KEY_SIZE_2048 | TSS_KEY_TYPE_SIGNING;
 
     /* Open TSS */
     result = Tspi_Context_Create(&hContext);
@@ -490,14 +499,66 @@ int createTssSignKey(PTS_UUID *uuid, int ps_type, char *filename, int force, int
     /* UUID */
     memcpy(&tss_uuid, uuid, sizeof(TSS_UUID));
 
-    /* Create New Key object */
-    result = Tspi_Context_CreateObject(hContext,
-                                       TSS_OBJECT_TYPE_RSAKEY,
-                                       initFlag, &hKey);
-    if (result != TSS_SUCCESS) {
-        ERROR("Tspi_Context_CreateObject failed rc=0x%x\n",
-               result);
-        goto close;
+
+
+    if (auth_type == OPENPTS_AIK_AUTH_TYPE_COMMON) {
+        /* Create New Key object */
+        result = Tspi_Context_CreateObject(
+                    hContext,
+                    TSS_OBJECT_TYPE_RSAKEY,
+                    TSS_KEY_AUTHORIZATION | TSS_KEY_SIZE_2048 | TSS_KEY_TYPE_SIGNING,
+                    &hKey);
+        if (result != TSS_SUCCESS) {
+            ERROR("Tspi_Context_CreateObject failed rc=0x%x\n",
+                   result);
+            goto close;
+        }
+
+        // Noauth => uses Dummy Auth secret
+        result = Tspi_Context_CreateObject(
+                    hContext,
+                    TSS_OBJECT_TYPE_POLICY,
+                    TSS_POLICY_USAGE,
+                    &hKeyPolicy);
+        if (result != TSS_SUCCESS) {
+            printf
+            ("ERROR: Tspi_Context_CreateObject failed rc=0x%x\n",
+             result);
+            goto close;
+        }
+
+        result = Tspi_Policy_SetSecret(
+                    hKeyPolicy,
+                    TSS_SECRET_MODE_PLAIN,
+                    strlen(TPMSIGKEY_SECRET),
+                    (BYTE *)TPMSIGKEY_SECRET);
+        if (result != TSS_SUCCESS) {
+            printf
+            ("ERROR: Tspi_Policy_SetSecret failed rc=0x%x\n",
+             result);
+            goto close;
+        }
+
+        result = Tspi_Policy_AssignToObject(hKeyPolicy, hKey);
+
+        if (result != TSS_SUCCESS) {
+            printf
+            ("ERROR: Tspi_Policy_SetSecret failed rc=0x%x\n",
+             result);
+            goto close;
+        }
+    } else {
+        /* Create New Key object */
+        result = Tspi_Context_CreateObject(
+                    hContext,
+                    TSS_OBJECT_TYPE_RSAKEY,
+                    TSS_KEY_SIZE_2048 | TSS_KEY_TYPE_SIGNING,
+                    &hKey);
+        if (result != TSS_SUCCESS) {
+            ERROR("Tspi_Context_CreateObject failed rc=0x%x\n",
+                   result);
+            goto close;
+        }
     }
 
     /* create Key */
@@ -509,15 +570,22 @@ int createTssSignKey(PTS_UUID *uuid, int ps_type, char *filename, int force, int
     }
 
     /* RegisterKey */
-    if (ps_type == TSS_PS_TYPE_BLOB) {
+    if (ps_type == OPENPTS_AIK_STORAGE_TYPE_BLOB) {
         /* save as blob */
         FILE *fp;
 
         if (filename == NULL) {
             ERROR("key blob filename is NULL\n");
+            result = TSS_E_KEY_NOT_LOADED;
             goto close;
         }
+
         fp = fopen(filename, "w");
+        if (fp==NULL) {
+            ERROR("file open fail, key blob file is %s",filename);
+            result = TSS_E_KEY_NOT_LOADED;
+            goto close;
+        }
 
         result = Tspi_GetAttribData(
                      hKey,
@@ -655,7 +723,9 @@ int getTssPubKey(
     int ps_type,
     int srk_password_mode,
     int resetdalock,
-    char *filename, int *pubkey_length, BYTE **pubkey) {
+    char *filename,
+    int auth_type,
+    int *pubkey_length, BYTE **pubkey) {
     TSS_RESULT result = 0;
     TSS_HCONTEXT hContext;
     TSS_HKEY hKey;
@@ -668,8 +738,6 @@ int getTssPubKey(
     BYTE *srk_auth;
     int srk_auth_len = 0;
     TSS_HPOLICY hKeyPolicy;
-    BYTE key_auth[1] = {0};
-
 
     if (resetdalock == 1) {
         // 2011-03-03 SM WEC TPM locks well.
@@ -752,13 +820,18 @@ int getTssPubKey(
     // TODO resetDaLock
 
     /* Load AIK or Sign key */
-    if (ps_type == 0) {
+    if (ps_type == OPENPTS_AIK_STORAGE_TYPE_BLOB) {
         /* Blob file */
         FILE *fp;
         BYTE blob[KEY_BLOB_SIZE];
         int len;
 
         fp = fopen(filename, "r");
+        if (fp==NULL) {
+            ERROR("file open fail, key blob file is %s",filename);
+            result = TSS_E_KEY_NOT_LOADED;
+            goto close;
+        }
         len = fread(blob, 1, KEY_BLOB_SIZE, fp);
         fclose(fp);
 
@@ -801,17 +874,34 @@ int getTssPubKey(
         goto close;
     }
 
-
-    /* Set Policy */
-    result = Tspi_Policy_SetSecret(
-                hKeyPolicy,
-                TSS_SECRET_MODE_PLAIN,
-                0,  // ""
-                key_auth);
-    if (result != TSS_SUCCESS) {
-        printf("ERROR: Tspi_Policy_SetSecret failed rc=0x%x\n",
-               result);
-        goto close;
+    if (auth_type == OPENPTS_AIK_AUTH_TYPE_COMMON) {
+        /* Set Policy - Dummy Secret */
+        // 2011-11-26 Munetoh - This fail with Infineon TPM(v1.2)
+        result = Tspi_Policy_SetSecret(
+                    hKeyPolicy,
+                    TSS_SECRET_MODE_PLAIN,
+                    strlen(TPMSIGKEY_SECRET),
+                    (BYTE *)TPMSIGKEY_SECRET);
+        if (result != TSS_SUCCESS) {
+            printf("ERROR: Tspi_Policy_SetSecret failed rc=0x%x\n",
+                   result);
+            goto close;
+        }
+    } else {
+        /* Set Policy - Null Secret */
+        // Atmel, Winbond, STM
+        BYTE key_auth[1] = {0};
+
+        result = Tspi_Policy_SetSecret(
+                    hKeyPolicy,
+                    TSS_SECRET_MODE_PLAIN,
+                    0,
+                    key_auth);
+        if (result != TSS_SUCCESS) {
+            printf("ERROR: Tspi_Policy_SetSecret failed rc=0x%x\n",
+                   result);
+            goto close;
+        }
     }
 
     /* get pubkey */
@@ -935,6 +1025,7 @@ int quoteTss(
         int ps_type,
         int srk_password_mode,
         char *filename,
+        int auth_type,
         /* Nonce */
         BYTE *nonce,
         /* PCR selection */
@@ -953,8 +1044,6 @@ int quoteTss(
 
     TSS_HKEY hKey;
     TSS_HPOLICY hKeyPolicy;
-    BYTE key_auth[1] = {0};
-
     TSS_UUID tss_uuid;
     TSS_HPCRS hPcrComposite;
     TSS_VALIDATION validation_data;  // local
@@ -1103,13 +1192,19 @@ int quoteTss(
 
 
     /* Load AIK or Sign key */
-    if (ps_type == 0) {
+    if (ps_type == OPENPTS_AIK_STORAGE_TYPE_BLOB) {
         /* Blob file */
         FILE *fp;
         BYTE blob[KEY_BLOB_SIZE];
         int len;
 
         fp = fopen(filename, "r");
+        if (fp==NULL) {
+            ERROR("file open fail, key blob file is %s",filename);
+            result = TSS_E_KEY_NOT_LOADED;
+            goto close;
+        }
+
         len = fread(blob, 1, KEY_BLOB_SIZE, fp);
         fclose(fp);
 
@@ -1147,19 +1242,36 @@ int quoteTss(
         goto close;
     }
 
-    /* Set Policy */
-    result = Tspi_Policy_SetSecret(
-                hKeyPolicy,
-                TSS_SECRET_MODE_PLAIN,
-                0,  // ""
-                key_auth);
-    if (result != TSS_SUCCESS) {
-        printf("ERROR: Tspi_Policy_SetSecret failed rc=0x%x\n",
-               result);
-        goto close;
+    if (auth_type == OPENPTS_AIK_AUTH_TYPE_COMMON) {
+        /* Set Policy - Dummy Secret */
+        // 2011-11-26 Munetoh - This fail with Infineon TPM(v1.2)
+        result = Tspi_Policy_SetSecret(
+                    hKeyPolicy,
+                    TSS_SECRET_MODE_PLAIN,
+                    strlen(TPMSIGKEY_SECRET),
+                    (BYTE *)TPMSIGKEY_SECRET);
+        if (result != TSS_SUCCESS) {
+            printf("ERROR: Tspi_Policy_SetSecret failed rc=0x%x\n",
+                   result);
+            goto close;
+        }
+    } else {
+        /* Set Policy - Null Secret */
+        // Atmel, Winbond, STM
+        BYTE key_auth[] = "";
+
+        result = Tspi_Policy_SetSecret(
+                    hKeyPolicy,
+                    TSS_SECRET_MODE_PLAIN,
+                    0,
+                    key_auth);
+        if (result != TSS_SUCCESS) {
+            printf("ERROR: Tspi_Policy_SetSecret failed rc=0x%x\n",
+                   result);
+            goto close;
+        }
     }
 
-
     /* Setup (copy) Validation Data Structure */
     validation_data.versionInfo.bMajor = validationData->versionInfo.bMajor;
     validation_data.versionInfo.bMinor = validationData->versionInfo.bMinor;
@@ -1312,6 +1424,7 @@ int quote2Tss(
         int ps_type,
         int srk_password_mode,
         char *filename,
+        int auth_type,
         /* Nonce */
         BYTE *nonce,
         /* PCR selection */
@@ -1331,8 +1444,6 @@ int quote2Tss(
 
     TSS_HKEY hKey;
     TSS_HPOLICY hKeyPolicy;
-    BYTE key_auth[] = "";
-
     TSS_UUID tss_uuid;
     TSS_HPCRS hPcrComposite;
     TSS_VALIDATION validation_data;  // local
@@ -1486,13 +1597,20 @@ int quote2Tss(
 
 
     /* Load AIK or Sign key */
-    if (ps_type == 0) {
+    if (ps_type == OPENPTS_AIK_STORAGE_TYPE_BLOB) {
         /* Blob file */
         FILE *fp;
         BYTE blob[KEY_BLOB_SIZE];
         int len;
 
         fp = fopen(filename, "r");
+        if (fp==NULL) {
+            ERROR("file open fail, key blob file is %s",filename);
+            result = TSS_E_KEY_NOT_LOADED;
+            goto close;
+        }
+
+
         len = fread(blob, 1, KEY_BLOB_SIZE, fp);
         fclose(fp);
 
@@ -1530,16 +1648,34 @@ int quote2Tss(
         goto close;
     }
 
-    /* Set Policy */
-    result = Tspi_Policy_SetSecret(
-                hKeyPolicy,
-                TSS_SECRET_MODE_PLAIN,
-                0,
-                key_auth);
-    if (result != TSS_SUCCESS) {
-        printf("ERROR: Tspi_Policy_SetSecret failed rc=0x%x\n",
-               result);
-        goto close;
+    if (auth_type == OPENPTS_AIK_AUTH_TYPE_COMMON) {
+        /* Set Policy - Dummy Secret */
+        // 2011-11-26 Munetoh - This fail with Infineon TPM(v1.2)
+        result = Tspi_Policy_SetSecret(
+                    hKeyPolicy,
+                    TSS_SECRET_MODE_PLAIN,
+                    strlen(TPMSIGKEY_SECRET),
+                    (BYTE *)TPMSIGKEY_SECRET);
+        if (result != TSS_SUCCESS) {
+            printf("ERROR: Tspi_Policy_SetSecret failed rc=0x%x\n",
+                   result);
+            goto close;
+        }
+    } else {
+        /* Set Policy - Null Secret */
+        // Atmel, Winbond, STM
+        BYTE key_auth[] = "";
+
+        result = Tspi_Policy_SetSecret(
+                    hKeyPolicy,
+                    TSS_SECRET_MODE_PLAIN,
+                    0,
+                    key_auth);
+        if (result != TSS_SUCCESS) {
+            printf("ERROR: Tspi_Policy_SetSecret failed rc=0x%x\n",
+                   result);
+            goto close;
+        }
     }
 
     /* Nonce -> rgbExternalData */