| Message ID | 20200912172643.9063-4-James.Bottomley@HansenPartnership.com (mailing list archive) |
|---|---|
| State | New |
| Headers | show |
| Series | TPM 2.0 trusted key rework | expand |
On Sat, Sep 12, 2020 at 10:26:41AM -0700, James Bottomley wrote: > In TPM 1.2 an authorization was a 20 byte number. The spec actually > recommended you to hash variable length passwords and use the sha1 > hash as the authorization. Because the spec doesn't require this > hashing, the current authorization for trusted keys is a 40 digit hex > number. For TPM 2.0 the spec allows the passing in of variable length > passwords and passphrases directly, so we should allow that in trusted > keys for ease of use. Update the 'blobauth' parameter to take this > into account, so we can now use plain text passwords for the keys. > > so before > > keyctl add trusted kmk "new 32 blobauth=f572d396fae9206628714fb2ce00f72e94f2258f" > > after we will accept both the old hex sha1 form as well as a new > directly supplied password: > > keyctl add trusted kmk "new 32 blobauth=hello keyhandle=81000001" > > Since a sha1 hex code must be exactly 40 bytes long and a direct > password must be 20 or less, we use the length as the discriminator > for which form is input. > > Note this is both and enhancement and a potential bug fix. The TPM > 2.0 spec requires us to strip leading zeros, meaning empyty > authorization is a zero length HMAC whereas we're currently passing in > 20 bytes of zeros. A lot of TPMs simply accept this as OK, but the > Microsoft TPM emulator rejects it with TPM_RC_BAD_AUTH, so this patch > makes the Microsoft TPM emulator work with trusted keys. > > Fixes: 0fe5480303a1 ("keys, trusted: seal/unseal with TPM 2.0 chips") > Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com> > Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> I created a key: $ sudo ./tpm2-root-key 0x80000000 $ sudo ./tpm2-list-handles 0x80000000 $ keyctl add trusted kmk "new 32 blobauth=hello keyhandle=0x80000000" <keyctl usage> $ lsmod Module Size Used by sha1_generic 16384 2 trusted 32768 0 asn1_encoder 16384 1 trusted x86_pkg_temp_thermal 20480 0 iwlmvm 356352 0 iwlwifi 315392 1 iwlmvm tpm_crb 16384 0 tpm_tis 16384 0 tpm_tis_core 24576 1 tpm_tis tpm 61440 4 tpm_tis,trusted,tpm_crb,tpm_tis_core efivarfs 16384 1 What could be wrong? Have the full seris applied on a test kernel. The root key creation is contained in create_root_key(): https://github.com/jsakkine-intel/tpm2-scripts/blob/master/tpm2.py /Jarkko
On Tue, 2020-09-15 at 12:09 +0300, Jarkko Sakkinen wrote: > On Sat, Sep 12, 2020 at 10:26:41AM -0700, James Bottomley wrote: > > In TPM 1.2 an authorization was a 20 byte number. The spec > > actually recommended you to hash variable length passwords and use > > the sha1 hash as the authorization. Because the spec doesn't > > require this hashing, the current authorization for trusted keys is > > a 40 digit hex number. For TPM 2.0 the spec allows the passing in > > of variable length passwords and passphrases directly, so we should > > allow that in trusted keys for ease of use. Update the 'blobauth' > > parameter to take this into account, so we can now use plain text > > passwords for the keys. > > > > so before > > > > keyctl add trusted kmk "new 32 > > blobauth=f572d396fae9206628714fb2ce00f72e94f2258f" > > > > after we will accept both the old hex sha1 form as well as a new > > directly supplied password: > > > > keyctl add trusted kmk "new 32 blobauth=hello keyhandle=81000001" > > > > Since a sha1 hex code must be exactly 40 bytes long and a direct > > password must be 20 or less, we use the length as the discriminator > > for which form is input. > > > > Note this is both and enhancement and a potential bug fix. The TPM > > 2.0 spec requires us to strip leading zeros, meaning empyty > > authorization is a zero length HMAC whereas we're currently passing > > in 20 bytes of zeros. A lot of TPMs simply accept this as OK, but > > the Microsoft TPM emulator rejects it with TPM_RC_BAD_AUTH, so this > > patch makes the Microsoft TPM emulator work with trusted keys. > > > > Fixes: 0fe5480303a1 ("keys, trusted: seal/unseal with TPM 2.0 > > chips") > > Signed-off-by: James Bottomley > > <James.Bottomley@HansenPartnership.com> > > Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> > > I created a key: > > $ sudo ./tpm2-root-key > 0x80000000 > $ sudo ./tpm2-list-handles > 0x80000000 > $ keyctl add trusted kmk "new 32 blobauth=hello keyhandle=0x80000000" > <keyctl usage> Well, you're getting that because the command isn't complete ... you need a keyring specifier at the end, like @u. However, even with that there's a bug in the code that would cause this to return EINVAL: the blobauth handler has a return 0 where it should have a break ... I think that happened as a result of the v6 rework which split up the if ... else if ... else chain. The result is the processing of options terminates at blobauth, so if it's last, as I've been testing with, everything is fine. If it's first as you specify, none of the options following the blobauth get processed. I'll fix this up and add an @u to the commit message. James
On Wed, Sep 16, 2020 at 12:52:14PM -0700, James Bottomley wrote: > On Tue, 2020-09-15 at 12:09 +0300, Jarkko Sakkinen wrote: > > On Sat, Sep 12, 2020 at 10:26:41AM -0700, James Bottomley wrote: > > > In TPM 1.2 an authorization was a 20 byte number. The spec > > > actually recommended you to hash variable length passwords and use > > > the sha1 hash as the authorization. Because the spec doesn't > > > require this hashing, the current authorization for trusted keys is > > > a 40 digit hex number. For TPM 2.0 the spec allows the passing in > > > of variable length passwords and passphrases directly, so we should > > > allow that in trusted keys for ease of use. Update the 'blobauth' > > > parameter to take this into account, so we can now use plain text > > > passwords for the keys. > > > > > > so before > > > > > > keyctl add trusted kmk "new 32 > > > blobauth=f572d396fae9206628714fb2ce00f72e94f2258f" > > > > > > after we will accept both the old hex sha1 form as well as a new > > > directly supplied password: > > > > > > keyctl add trusted kmk "new 32 blobauth=hello keyhandle=81000001" > > > > > > Since a sha1 hex code must be exactly 40 bytes long and a direct > > > password must be 20 or less, we use the length as the discriminator > > > for which form is input. > > > > > > Note this is both and enhancement and a potential bug fix. The TPM > > > 2.0 spec requires us to strip leading zeros, meaning empyty > > > authorization is a zero length HMAC whereas we're currently passing > > > in 20 bytes of zeros. A lot of TPMs simply accept this as OK, but > > > the Microsoft TPM emulator rejects it with TPM_RC_BAD_AUTH, so this > > > patch makes the Microsoft TPM emulator work with trusted keys. > > > > > > Fixes: 0fe5480303a1 ("keys, trusted: seal/unseal with TPM 2.0 > > > chips") > > > Signed-off-by: James Bottomley > > > <James.Bottomley@HansenPartnership.com> > > > Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> > > > > I created a key: > > > > $ sudo ./tpm2-root-key > > 0x80000000 > > $ sudo ./tpm2-list-handles > > 0x80000000 > > $ keyctl add trusted kmk "new 32 blobauth=hello keyhandle=0x80000000" > > <keyctl usage> > > Well, you're getting that because the command isn't complete ... you > need a keyring specifier at the end, like @u. However, even with that > there's a bug in the code that would cause this to return EINVAL: the > blobauth handler has a return 0 where it should have a break ... I > think that happened as a result of the v6 rework which split up the if > ... else if ... else chain. The result is the processing of options > terminates at blobauth, so if it's last, as I've been testing with, > everything is fine. If it's first as you specify, none of the options > following the blobauth get processed. I'll fix this up and add an @u > to the commit message. Ugh, it's true, missing @u from the tail :-) And I was looking for a long time old test script and this and wondering where is the difference... Fix those so that we can finally merge this :-) > > James > /Jarkko
diff --git a/include/keys/trusted-type.h b/include/keys/trusted-type.h index a94c03a61d8f..b2ed3481c6a0 100644 --- a/include/keys/trusted-type.h +++ b/include/keys/trusted-type.h @@ -30,6 +30,7 @@ struct trusted_key_options { uint16_t keytype; uint32_t keyhandle; unsigned char keyauth[TPM_DIGEST_SIZE]; + uint32_t blobauth_len; unsigned char blobauth[TPM_DIGEST_SIZE]; uint32_t pcrinfo_len; unsigned char pcrinfo[MAX_PCRINFO_SIZE]; diff --git a/security/keys/trusted-keys/trusted_tpm1.c b/security/keys/trusted-keys/trusted_tpm1.c index b9fe02e5f84f..dfb3e8ee8de1 100644 --- a/security/keys/trusted-keys/trusted_tpm1.c +++ b/security/keys/trusted-keys/trusted_tpm1.c @@ -781,13 +781,33 @@ static int getoptions(char *c, struct trusted_key_payload *pay, return -EINVAL; break; case Opt_blobauth: - if (strlen(args[0].from) != 2 * SHA1_DIGEST_SIZE) - return -EINVAL; - res = hex2bin(opt->blobauth, args[0].from, - SHA1_DIGEST_SIZE); - if (res < 0) - return -EINVAL; + /* + * TPM 1.2 authorizations are sha1 hashes passed in as + * hex strings. TPM 2.0 authorizations are simple + * passwords (although it can take a hash as well) + */ + opt->blobauth_len = strlen(args[0].from); + + if (opt->blobauth_len == 2 * TPM_DIGEST_SIZE) { + res = hex2bin(opt->blobauth, args[0].from, + TPM_DIGEST_SIZE); + if (res < 0) + return -EINVAL; + + opt->blobauth_len = TPM_DIGEST_SIZE; + return 0; + } + + if (tpm2 && opt->blobauth_len <= sizeof(opt->blobauth)) { + memcpy(opt->blobauth, args[0].from, + opt->blobauth_len); + return 0; + } + + return -EINVAL; + break; + case Opt_migratable: if (*args[0].from == '0') pay->migratable = 0; diff --git a/security/keys/trusted-keys/trusted_tpm2.c b/security/keys/trusted-keys/trusted_tpm2.c index 08ec7f48f01d..b4a5058107c2 100644 --- a/security/keys/trusted-keys/trusted_tpm2.c +++ b/security/keys/trusted-keys/trusted_tpm2.c @@ -91,10 +91,12 @@ int tpm2_seal_trusted(struct tpm_chip *chip, TPM_DIGEST_SIZE); /* sensitive */ - tpm_buf_append_u16(&buf, 4 + TPM_DIGEST_SIZE + payload->key_len + 1); + tpm_buf_append_u16(&buf, 4 + options->blobauth_len + payload->key_len + 1); + + tpm_buf_append_u16(&buf, options->blobauth_len); + if (options->blobauth_len) + tpm_buf_append(&buf, options->blobauth, options->blobauth_len); - tpm_buf_append_u16(&buf, TPM_DIGEST_SIZE); - tpm_buf_append(&buf, options->blobauth, TPM_DIGEST_SIZE); tpm_buf_append_u16(&buf, payload->key_len + 1); tpm_buf_append(&buf, payload->key, payload->key_len); tpm_buf_append_u8(&buf, payload->migratable); @@ -258,7 +260,7 @@ static int tpm2_unseal_cmd(struct tpm_chip *chip, NULL /* nonce */, 0, TPM2_SA_CONTINUE_SESSION, options->blobauth /* hmac */, - TPM_DIGEST_SIZE); + options->blobauth_len); rc = tpm_send(chip, buf.data, tpm_buf_length(&buf)); if (rc > 0)
In TPM 1.2 an authorization was a 20 byte number. The spec actually recommended you to hash variable length passwords and use the sha1 hash as the authorization. Because the spec doesn't require this hashing, the current authorization for trusted keys is a 40 digit hex number. For TPM 2.0 the spec allows the passing in of variable length passwords and passphrases directly, so we should allow that in trusted keys for ease of use. Update the 'blobauth' parameter to take this into account, so we can now use plain text passwords for the keys. so before keyctl add trusted kmk "new 32 blobauth=f572d396fae9206628714fb2ce00f72e94f2258f" after we will accept both the old hex sha1 form as well as a new directly supplied password: keyctl add trusted kmk "new 32 blobauth=hello keyhandle=81000001" Since a sha1 hex code must be exactly 40 bytes long and a direct password must be 20 or less, we use the length as the discriminator for which form is input. Note this is both and enhancement and a potential bug fix. The TPM 2.0 spec requires us to strip leading zeros, meaning empyty authorization is a zero length HMAC whereas we're currently passing in 20 bytes of zeros. A lot of TPMs simply accept this as OK, but the Microsoft TPM emulator rejects it with TPM_RC_BAD_AUTH, so this patch makes the Microsoft TPM emulator work with trusted keys. Fixes: 0fe5480303a1 ("keys, trusted: seal/unseal with TPM 2.0 chips") Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com> Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> --- v6: change comment, eliminate else clauses and add fixes tag v7: fixes before signoff --- include/keys/trusted-type.h | 1 + security/keys/trusted-keys/trusted_tpm1.c | 32 ++++++++++++++++++----- security/keys/trusted-keys/trusted_tpm2.c | 10 ++++--- 3 files changed, 33 insertions(+), 10 deletions(-)