Skip to content

Commit

Permalink
enable non standard key sizes and curves for EK and AK
Browse files Browse the repository at this point in the history 
Signed-off-by: Thore Sommer <[email protected]>
  • Loading branch information
@THS-on
THS-on committed Oct 1, 2024
1 parent e2a2a79 commit 125482b
Show file tree
Hide file tree
Showing 3 changed files with 108 additions and 17 deletions.
4 changes: 3 additions & 1 deletion keylime-agent/src/main.rs
View file
Original file line number Diff line number Diff line change
Expand Up @@ -540,6 +540,7 @@ async fn main() -> Result<()> {
let new_ak = ctx.create_ak(
ek_result.key_handle,
tpm_hash_alg,
tpm_encryption_alg,
tpm_signing_alg,
)?;
let ak_handle = ctx.load_ak(ek_result.key_handle, &new_ak)?;
Expand Down Expand Up @@ -1148,6 +1149,7 @@ mod testing {
let ak_result = ctx.create_ak(
ek_result.key_handle,
tpm_hash_alg,
tpm_encryption_alg,
tpm_signing_alg,
)?;
let ak_handle = ctx.load_ak(ek_result.key_handle, &ak_result)?;
Expand Down Expand Up @@ -1216,7 +1218,7 @@ mod testing {
payload_tx,
revocation_tx,
hash_alg: keylime::algorithms::HashAlgorithm::Sha256,
enc_alg: keylime::algorithms::EncryptionAlgorithm::Rsa,
enc_alg: keylime::algorithms::EncryptionAlgorithm::Rsa2048,
sign_alg: keylime::algorithms::SignAlgorithm::RsaSsa,
agent_uuid: test_config.agent.uuid,
allow_payload_revocation_actions: test_config
Expand Down
111 changes: 99 additions & 12 deletions keylime/src/algorithms.rs
View file
Original file line number Diff line number Diff line change
Expand Up @@ -6,8 +6,13 @@ use std::convert::TryFrom;
use std::fmt;
use thiserror::Error;
use tss_esapi::{
interface_types::algorithm::{
AsymmetricAlgorithm, HashingAlgorithm, SignatureSchemeAlgorithm,
abstraction::AsymmetricAlgorithmSelection,
interface_types::{
algorithm::{
AsymmetricAlgorithm, HashingAlgorithm, SignatureSchemeAlgorithm,
},
ecc::EccCurve,
key_bits::RsaKeyBits,
},
structures::{HashScheme, SignatureScheme},
};
Expand Down Expand Up @@ -89,15 +94,68 @@ impl From<HashAlgorithm> for MessageDigest {

#[derive(Copy, Clone, Debug, PartialEq, Eq, Hash, Serialize, Deserialize)]
pub enum EncryptionAlgorithm {
Rsa,
Ecc,
Rsa1024,
Rsa2048,
Rsa3072,
Rsa4096,
Ecc192,
Ecc224,
Ecc256,
Ecc384,
Ecc521,
EccSm2,
}

impl From<EncryptionAlgorithm> for AsymmetricAlgorithm {
fn from(enc_alg: EncryptionAlgorithm) -> Self {
match enc_alg {
EncryptionAlgorithm::Rsa => AsymmetricAlgorithm::Rsa,
EncryptionAlgorithm::Ecc => AsymmetricAlgorithm::Ecc,
EncryptionAlgorithm::Rsa1024 => AsymmetricAlgorithm::Rsa,
EncryptionAlgorithm::Rsa2048 => AsymmetricAlgorithm::Rsa,
EncryptionAlgorithm::Rsa3072 => AsymmetricAlgorithm::Rsa,
EncryptionAlgorithm::Rsa4096 => AsymmetricAlgorithm::Rsa,
EncryptionAlgorithm::Ecc192 => AsymmetricAlgorithm::Ecc,
EncryptionAlgorithm::Ecc224 => AsymmetricAlgorithm::Ecc,
EncryptionAlgorithm::Ecc256 => AsymmetricAlgorithm::Ecc,
EncryptionAlgorithm::Ecc384 => AsymmetricAlgorithm::Ecc,
EncryptionAlgorithm::Ecc521 => AsymmetricAlgorithm::Ecc,
EncryptionAlgorithm::EccSm2 => AsymmetricAlgorithm::Ecc,
}
}
}

impl From<EncryptionAlgorithm> for AsymmetricAlgorithmSelection {
fn from(enc_alg: EncryptionAlgorithm) -> Self {
match enc_alg {
EncryptionAlgorithm::Rsa1024 => {
AsymmetricAlgorithmSelection::Rsa(RsaKeyBits::Rsa1024)
}
EncryptionAlgorithm::Rsa2048 => {
AsymmetricAlgorithmSelection::Rsa(RsaKeyBits::Rsa2048)
}
EncryptionAlgorithm::Rsa3072 => {
AsymmetricAlgorithmSelection::Rsa(RsaKeyBits::Rsa3072)
}
EncryptionAlgorithm::Rsa4096 => {
AsymmetricAlgorithmSelection::Rsa(RsaKeyBits::Rsa4096)
}
EncryptionAlgorithm::Ecc192 => {
AsymmetricAlgorithmSelection::Ecc(EccCurve::NistP192)
}
EncryptionAlgorithm::Ecc224 => {
AsymmetricAlgorithmSelection::Ecc(EccCurve::NistP224)
}
EncryptionAlgorithm::Ecc256 => {
AsymmetricAlgorithmSelection::Ecc(EccCurve::NistP256)
}
EncryptionAlgorithm::Ecc384 => {
AsymmetricAlgorithmSelection::Ecc(EccCurve::NistP384)
}
EncryptionAlgorithm::Ecc521 => {
AsymmetricAlgorithmSelection::Ecc(EccCurve::NistP521)
}
EncryptionAlgorithm::EccSm2 => {
AsymmetricAlgorithmSelection::Ecc(EccCurve::Sm2P256)
}
}
}
}
Expand All @@ -107,8 +165,25 @@ impl TryFrom<&str> for EncryptionAlgorithm {

fn try_from(value: &str) -> Result<Self, Self::Error> {
match value {
"rsa" => Ok(EncryptionAlgorithm::Rsa),
"ecc" => Ok(EncryptionAlgorithm::Ecc),
/* Use default key size and curve if not explicitly specified */
"rsa" => Ok(EncryptionAlgorithm::Rsa2048),
"ecc" => Ok(EncryptionAlgorithm::Ecc256),
"rsa1024" => Ok(EncryptionAlgorithm::Rsa1024),
"rsa2048" => Ok(EncryptionAlgorithm::Rsa2048),
"rsa3072" => Ok(EncryptionAlgorithm::Rsa3072),
"rsa4096" => Ok(EncryptionAlgorithm::Rsa4096),
"ecc192" => Ok(EncryptionAlgorithm::Ecc192),
"ecc_nist_p192" => Ok(EncryptionAlgorithm::Ecc192),
"ecc224" => Ok(EncryptionAlgorithm::Ecc224),
"ecc_nist_p224" => Ok(EncryptionAlgorithm::Ecc224),
"ecc256" => Ok(EncryptionAlgorithm::Ecc256),
"ecc_nist_p256" => Ok(EncryptionAlgorithm::Ecc256),
"ecc384" => Ok(EncryptionAlgorithm::Ecc384),
"ecc_nist_p384" => Ok(EncryptionAlgorithm::Ecc384),
"ecc521" => Ok(EncryptionAlgorithm::Ecc521),
"ecc_nist_p521" => Ok(EncryptionAlgorithm::Ecc521),
"ecc_sm2" => Ok(EncryptionAlgorithm::EccSm2),
"ecc_sm2_p256" => Ok(EncryptionAlgorithm::EccSm2),
_ => Err(AlgorithmError::UnsupportedEncryptionAlgorithm(
value.into(),
)),
Expand All @@ -119,8 +194,16 @@ impl TryFrom<&str> for EncryptionAlgorithm {
impl fmt::Display for EncryptionAlgorithm {
fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
let value = match self {
EncryptionAlgorithm::Rsa => "rsa",
EncryptionAlgorithm::Ecc => "ecc",
EncryptionAlgorithm::Rsa1024 => "rsa1024",
EncryptionAlgorithm::Rsa2048 => "rsa2048",
EncryptionAlgorithm::Rsa3072 => "rsa3072",
EncryptionAlgorithm::Rsa4096 => "rsa4096",
EncryptionAlgorithm::Ecc192 => "ecc192",
EncryptionAlgorithm::Ecc224 => "ecc224",
EncryptionAlgorithm::Ecc256 => "ecc256",
EncryptionAlgorithm::Ecc384 => "ecc384",
EncryptionAlgorithm::Ecc521 => "ecc521",
EncryptionAlgorithm::EccSm2 => "ecc_sm2",
};
write!(f, "{value}")
}
Expand Down Expand Up @@ -219,9 +302,13 @@ mod tests {
#[test]
fn test_encrypt_try_from() {
let result = EncryptionAlgorithm::try_from("rsa");
assert!(result.is_ok());
assert!(result.is_ok_and(|r| r == EncryptionAlgorithm::Rsa2048));
let result = EncryptionAlgorithm::try_from("ecc");
assert!(result.is_ok());
assert!(result.is_ok_and(|r| r == EncryptionAlgorithm::Ecc256));
let result = EncryptionAlgorithm::try_from("rsa4096");
assert!(result.is_ok_and(|r| r == EncryptionAlgorithm::Rsa4096));
let result = EncryptionAlgorithm::try_from("ecc256");
assert!(result.is_ok_and(|r| r == EncryptionAlgorithm::Ecc256));
}
#[test]
fn test_unsupported_encrypt_try_from() {
Expand Down
10 changes: 6 additions & 4 deletions keylime/src/tpm.rs
View file
Original file line number Diff line number Diff line change
Expand Up @@ -574,19 +574,22 @@ impl Context {
///
/// * `handle`: The associated EK handle
/// * `hash_alg`: The digest algorithm used for signing with the created AK
/// * `key_alg`: The key type used for signing with the created AK
/// * `sign_alg`: The created AK signing algorithm
///
/// Returns an `AKResult` structure if successful and a `TPMError` otherwise
pub fn create_ak(
&mut self,
handle: KeyHandle,
hash_alg: HashAlgorithm,
key_alg: EncryptionAlgorithm,
sign_alg: SignAlgorithm,
) -> Result<AKResult> {
let ak = ak::create_ak(
&mut self.inner,
handle,
hash_alg.into(),
key_alg.into(),
sign_alg.into(),
None,
DefaultKey,
Expand Down Expand Up @@ -1784,9 +1787,7 @@ pub fn get_idevid_template(
"H-4" => (AsymmetricAlgorithm::Ecc, HashingAlgorithm::Sha512),
"H-5" => (AsymmetricAlgorithm::Ecc, HashingAlgorithm::Sm3_256),
_ => (
AsymmetricAlgorithm::from(EncryptionAlgorithm::try_from(
asym_alg_str,
)?),
EncryptionAlgorithm::try_from(asym_alg_str)?.into(),
HashingAlgorithm::from(HashAlgorithm::try_from(name_alg_str)?),
),
};
Expand Down Expand Up @@ -2261,7 +2262,7 @@ pub mod testing {

// Create EK
let ek_result = ctx
.create_ek(EncryptionAlgorithm::Rsa, None)
.create_ek(EncryptionAlgorithm::Rsa2048, None)
.expect("failed to create EK");
let ek_handle = ek_result.key_handle;

Expand All @@ -2270,6 +2271,7 @@ pub mod testing {
.create_ak(
ek_handle,
HashAlgorithm::Sha256,
EncryptionAlgorithm::Rsa2048,
SignAlgorithm::RsaSsa,
)
.expect("failed to create ak");
Expand Down

0 comments on commit 125482b

Please sign in to comment.