1 /* SPDX-License-Identifier: BSD-2-Clause */
2 /*******************************************************************************
3 * Copyright 2017-2018, Fraunhofer SIT sponsored by Infineon Technologies AG
4 * All rights reserved.
5 *******************************************************************************/
6
7 #ifdef HAVE_CONFIG_H
8 #include <config.h>
9 #endif
10
11 #include <stdio.h>
12 #include <stdlib.h>
13 #include <string.h>
14 #include <stdint.h>
15
16 #include <tss2_esys.h>
17
18 #include "test.h"
19 #include "esys_types.h"
20 #include "esys_iutil.h"
21
22 #define LOGMODULE test
23 #include "util/log.h"
24 #include "util/aux_util.h"
25
26 /** This test is intended to test the unseal operation for the ESAPI command
27 * Unseal.
28 *
29 * We start by creating a primary key (Esys_CreatePrimary).
30 * Based on the primary key a second key with a password and the to be sealed
31 * data defined in the sensitive area will be created (Esys_Create).
32 * This key will be loaded and the unseal command (Esys_Unseal) will be used
33 * to retrieve the sealed data.
34 *
35 * Tested ESAPI commands:
36 * - Esys_Create() (M)
37 * - Esys_CreatePrimary() (M)
38 * - Esys_FlushContext() (M)
39 * - Esys_Load() (M)
40 * - Esys_Unseal() (M)
41 *
42 * @param[in,out] esys_context The ESYS_CONTEXT.
43 * @retval EXIT_FAILURE
44 * @retval EXIT_SUCCESS
45 */
46
47 int
test_esys_unseal_password_auth(ESYS_CONTEXT * esys_context)48 test_esys_unseal_password_auth(ESYS_CONTEXT * esys_context)
49 {
50 /*
51 * 1. Create Primary
52 */
53 TSS2_RC r;
54 ESYS_TR primaryHandle = ESYS_TR_NONE;
55 ESYS_TR loadedKeyHandle = ESYS_TR_NONE;
56
57 TPM2B_PUBLIC *outPublic = NULL;
58 TPM2B_CREATION_DATA *creationData = NULL;
59 TPM2B_DIGEST *creationHash = NULL;
60 TPMT_TK_CREATION *creationTicket = NULL;
61 TPM2B_PUBLIC *outPublic2 = NULL;
62 TPM2B_PRIVATE *outPrivate2 = NULL;
63 TPM2B_CREATION_DATA *creationData2 = NULL;
64 TPM2B_DIGEST *creationHash2 = NULL;
65 TPMT_TK_CREATION *creationTicket2 = NULL;
66 TPM2B_SENSITIVE_DATA *outData = NULL;
67
68 TPM2B_AUTH authValuePrimary = {
69 .size = 5,
70 .buffer = {1, 2, 3, 4, 5}
71 };
72
73 TPM2B_SENSITIVE_CREATE inSensitivePrimary = {
74 .size = 0,
75 .sensitive = {
76 .userAuth = {
77 .size = 0,
78 .buffer = {0 },
79 },
80 .data = {
81 .size = 0,
82 .buffer = {0},
83 },
84 },
85 };
86
87 inSensitivePrimary.sensitive.userAuth = authValuePrimary;
88
89 TPM2B_PUBLIC inPublic = {
90 .size = 0,
91 .publicArea = {
92 .type = TPM2_ALG_RSA,
93 .nameAlg = TPM2_ALG_SHA256,
94 .objectAttributes = (TPMA_OBJECT_USERWITHAUTH |
95 TPMA_OBJECT_RESTRICTED |
96 TPMA_OBJECT_DECRYPT |
97 TPMA_OBJECT_FIXEDTPM |
98 TPMA_OBJECT_FIXEDPARENT |
99 TPMA_OBJECT_SENSITIVEDATAORIGIN),
100 .authPolicy = {
101 .size = 0,
102 },
103 .parameters.rsaDetail = {
104 .symmetric = {
105 .algorithm = TPM2_ALG_AES,
106 .keyBits.aes = 128,
107 .mode.aes = TPM2_ALG_CFB},
108 .scheme = {
109 .scheme = TPM2_ALG_NULL
110 },
111 .keyBits = 2048,
112 .exponent = 0,
113 },
114 .unique.rsa = {
115 .size = 0,
116 .buffer = {},
117 },
118 },
119 };
120
121 TPM2B_DATA outsideInfo = {
122 .size = 0,
123 .buffer = {},
124 };
125
126 TPML_PCR_SELECTION creationPCR = {
127 .count = 0,
128 };
129
130 TPM2B_AUTH authValue = {
131 .size = 0,
132 .buffer = {}
133 };
134
135 r = Esys_TR_SetAuth(esys_context, ESYS_TR_RH_OWNER, &authValue);
136 goto_if_error(r, "Error: TR_SetAuth", error);
137
138 RSRC_NODE_T *primaryHandle_node;
139
140 r = Esys_CreatePrimary(esys_context, ESYS_TR_RH_OWNER, ESYS_TR_PASSWORD,
141 ESYS_TR_NONE, ESYS_TR_NONE,
142 &inSensitivePrimary, &inPublic,
143 &outsideInfo, &creationPCR, &primaryHandle,
144 &outPublic, &creationData, &creationHash,
145 &creationTicket);
146 goto_if_error(r, "Error esys create primary", error);
147
148 r = esys_GetResourceObject(esys_context, primaryHandle,
149 &primaryHandle_node);
150 goto_if_error(r, "Error Esys GetResourceObject", error);
151
152 LOG_INFO("Created Primary with handle 0x%08x...",
153 primaryHandle_node->rsrc.handle);
154
155 r = Esys_TR_SetAuth(esys_context, primaryHandle, &authValuePrimary);
156 goto_if_error(r, "Error: TR_SetAuth", error);
157
158 /*
159 * 2. Create second key with sealed data
160 */
161
162 TPM2B_AUTH authKey2 = {
163 .size = 6,
164 .buffer = {6, 7, 8, 9, 10, 11}
165 };
166
167 TPM2B_SENSITIVE_CREATE inSensitive2 = {
168 .size = 0,
169 .sensitive = {
170 .userAuth = {
171 .size = 0,
172 .buffer = {0}
173 },
174 .data = {
175 .size = 8,
176 .buffer = {3,2,3,2,3,2,3,2}
177 }
178 }
179 };
180
181 inSensitive2.sensitive.userAuth = authKey2;
182
183 TPM2B_PUBLIC inPublic2 = {
184 .size = 0,
185 .publicArea = {
186 /* type = TPM2_ALG_RSA, */
187 .type = TPM2_ALG_KEYEDHASH,
188 .nameAlg = TPM2_ALG_SHA256,
189 .objectAttributes = (
190 TPMA_OBJECT_USERWITHAUTH |
191 /* TPMA_OBJECT_RESTRICTED | */
192 /* TPMA_OBJECT_DECRYPT | */
193 TPMA_OBJECT_FIXEDTPM |
194 TPMA_OBJECT_FIXEDPARENT
195 /* TPMA_OBJECT_SENSITIVEDATAORIGIN */
196 ),
197
198 .authPolicy = {
199 .size = 0,
200 },
201 /*
202 .parameters.rsaDetail = {
203 .symmetric = {
204 .algorithm = TPM2_ALG_AES,
205 .keyBits.aes = 128,
206 .mode.aes = TPM2_ALG_CFB
207 },
208 .scheme = {
209 .scheme = TPM2_ALG_NULL,
210 },
211 .keyBits = 2048,
212 .exponent = 0
213 },
214 .unique.rsa = {
215 .size = 0,
216 .buffer = {}
217 ,
218 }
219 */
220 .parameters.keyedHashDetail = {
221 .scheme = {
222 .scheme = TPM2_ALG_NULL,
223 .details = {
224 .hmac = {
225 .hashAlg = TPM2_ALG_SHA256
226 }
227 }
228 }
229 },
230 .unique.keyedHash = {
231 .size = 0,
232 .buffer = {},
233 },
234 }
235 };
236
237 TPM2B_DATA outsideInfo2 = {
238 .size = 0,
239 .buffer = {}
240 ,
241 };
242
243 TPML_PCR_SELECTION creationPCR2 = {
244 .count = 0,
245 };
246
247 r = Esys_Create(esys_context,
248 primaryHandle,
249 ESYS_TR_PASSWORD, ESYS_TR_NONE, ESYS_TR_NONE,
250 &inSensitive2,
251 &inPublic2,
252 &outsideInfo2,
253 &creationPCR2,
254 &outPrivate2,
255 &outPublic2,
256 &creationData2, &creationHash2, &creationTicket2);
257
258 goto_if_error(r, "Error esys create ", error);
259
260 LOG_INFO("\nSecond key created.");
261
262 /*
263 * 3. Load second key
264 */
265
266 r = Esys_Load(esys_context,
267 primaryHandle,
268 ESYS_TR_PASSWORD,
269 ESYS_TR_NONE,
270 ESYS_TR_NONE, outPrivate2, outPublic2, &loadedKeyHandle);
271 goto_if_error(r, "Error esys load ", error);
272
273 LOG_INFO("\nSecond Key loaded.");
274
275 r = Esys_TR_SetAuth(esys_context, loadedKeyHandle, &authKey2);
276 goto_if_error(r, "Error esys TR_SetAuth ", error);
277
278 /*
279 * 4. Unseal key
280 */
281
282 r = Esys_Unseal(esys_context, loadedKeyHandle, ESYS_TR_PASSWORD,
283 ESYS_TR_NONE, ESYS_TR_NONE, &outData);
284 goto_if_error(r, "Error esys Unseal ", error);
285
286 if(memcmp(&(outData->buffer), &(inSensitive2.sensitive.data.buffer),
287 inSensitive2.sensitive.data.size)!=0){
288 LOG_ERROR("Error: Unsealed Data is unequal.");
289 goto error;
290 }
291
292 LOG_INFO("\nData successfully unsealed.");
293
294 /*
295 * 5. Flush Context
296 */
297
298 r = Esys_FlushContext(esys_context, primaryHandle);
299 goto_if_error(r, "Error during FlushContext", error);
300
301 primaryHandle = ESYS_TR_NONE;
302
303 r = Esys_FlushContext(esys_context, loadedKeyHandle);
304 goto_if_error(r, "Error during FlushContext", error);
305
306 Esys_Free(outPublic);
307 Esys_Free(creationData);
308 Esys_Free(creationHash);
309 Esys_Free(creationTicket);
310 Esys_Free(outPublic2);
311 Esys_Free(outPrivate2);
312 Esys_Free(creationData2);
313 Esys_Free(creationHash2);
314 Esys_Free(creationTicket2);
315 Esys_Free(outData);
316 return EXIT_SUCCESS;
317
318 error:
319
320 if (loadedKeyHandle != ESYS_TR_NONE) {
321 if (Esys_FlushContext(esys_context, loadedKeyHandle) != TSS2_RC_SUCCESS) {
322 LOG_ERROR("Cleanup loadedKeyHandle failed.");
323 }
324 }
325
326 if (primaryHandle != ESYS_TR_NONE) {
327 if (Esys_FlushContext(esys_context, primaryHandle) != TSS2_RC_SUCCESS) {
328 LOG_ERROR("Cleanup primaryHandle failed.");
329 }
330 }
331
332 Esys_Free(outPublic);
333 Esys_Free(creationData);
334 Esys_Free(creationHash);
335 Esys_Free(creationTicket);
336 Esys_Free(outPublic2);
337 Esys_Free(outPrivate2);
338 Esys_Free(creationData2);
339 Esys_Free(creationHash2);
340 Esys_Free(creationTicket2);
341 Esys_Free(outData);
342 return EXIT_FAILURE;
343 }
344
345 int
test_invoke_esapi(ESYS_CONTEXT * esys_context)346 test_invoke_esapi(ESYS_CONTEXT * esys_context) {
347 return test_esys_unseal_password_auth(esys_context);
348 }
349