From patchwork Thu Feb 16 20:40:15 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: James Bottomley X-Patchwork-Id: 13143808 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 946ADC61DA4 for ; Thu, 16 Feb 2023 20:40:19 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229513AbjBPUkT (ORCPT ); Thu, 16 Feb 2023 15:40:19 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:53524 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229492AbjBPUkS (ORCPT ); Thu, 16 Feb 2023 15:40:18 -0500 Received: from bedivere.hansenpartnership.com (bedivere.hansenpartnership.com [96.44.175.130]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7D1781CF49; Thu, 16 Feb 2023 12:40:17 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=hansenpartnership.com; s=20151216; t=1676580017; bh=5EwqDN+hWjx/K2/3gSzoNXkyvfn5rpW6z/3xwTv17Hc=; h=Message-ID:Subject:From:To:Date:In-Reply-To:References:From; b=ELYEppL7YyFVWGPeX3wxiwqAV4TUh3XlQ48Q2/YvHbwS9jyLWSddAgf/8w6pPq5T0 UU90yZff3MgYcr+8B6WZGuTUvCIMVQTgDw1DHUMhL1oynNZR+DPqnDxxfjqD7JDkzJ 0VK/XV01E8NQMgSoQk+mg6aId5BHWbI7coAmH408= Received: from localhost (localhost [127.0.0.1]) by bedivere.hansenpartnership.com (Postfix) with ESMTP id 345A3128142B; Thu, 16 Feb 2023 15:40:17 -0500 (EST) Received: from bedivere.hansenpartnership.com ([127.0.0.1]) by localhost (bedivere.hansenpartnership.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Rh-qOGgXOl3T; Thu, 16 Feb 2023 15:40:17 -0500 (EST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=hansenpartnership.com; s=20151216; t=1676580016; bh=5EwqDN+hWjx/K2/3gSzoNXkyvfn5rpW6z/3xwTv17Hc=; h=Message-ID:Subject:From:To:Date:In-Reply-To:References:From; b=xTQ6PsxBG0Ow3nmYxQx7xGmR+8SiGkCMeksua49o3+Qy0lg2JeetJPc5bRQCMA4gD fy2FdR6gvmQ7qCg7mjcJIC8N8tmTNRVmHyhfABTyYdGJ42K9EAvXAwuqAdlVvWKeM6 7qPyxRynyBgEoKgSD5GSBv/wloMyH8Sovrga5D6w= Received: from lingrow.int.hansenpartnership.com (unknown [IPv6:2601:5c4:4302:c21::c14]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange ECDHE (prime256v1) server-signature RSA-PSS (2048 bits) server-digest SHA256) (Client did not present a certificate) by bedivere.hansenpartnership.com (Postfix) with ESMTPSA id 8B0F41280E69; Thu, 16 Feb 2023 15:40:16 -0500 (EST) Message-ID: <93740b6b42e67caa2a1854520b7e68f0966e5024.camel@HansenPartnership.com> Subject: [PATCH 11/12] tpm: add the null key name as a sysfs export From: James Bottomley To: linux-integrity@vger.kernel.org Cc: Jarkko Sakkinen , keyrings@vger.kernel.org, Ard Biesheuvel Date: Thu, 16 Feb 2023 15:40:15 -0500 In-Reply-To: <20230216201410.15010-1-James.Bottomley@HansenPartnership.com> References: <20230216201410.15010-1-James.Bottomley@HansenPartnership.com> User-Agent: Evolution 3.42.4 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: keyrings@vger.kernel.org This is the last component of encrypted tpm2 session handling that allows us to verify from userspace that the key derived from the NULL seed genuinely belongs to the TPM and has not been spoofed. The procedure for doing this involves creating an attestation identity key (which requires verification of the TPM EK certificate) and then using that AIK to sign a certification of the Elliptic Curve key over the NULL seed. Userspace must create this EC Key using the parameters prescribed in TCG TPM v2.0 Provisioning Guidance for the SRK ECC; if this is done correctly the names will match and the TPM can then run a TPM2_Certify operation on this derived primary key using the newly created AIK. Signed-off-by: James Bottomley --- drivers/char/tpm/tpm-sysfs.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/drivers/char/tpm/tpm-sysfs.c b/drivers/char/tpm/tpm-sysfs.c index 54c71473aa29..6044a2765da2 100644 --- a/drivers/char/tpm/tpm-sysfs.c +++ b/drivers/char/tpm/tpm-sysfs.c @@ -309,6 +309,21 @@ static ssize_t tpm_version_major_show(struct device *dev, } static DEVICE_ATTR_RO(tpm_version_major); +#ifdef CONFIG_TPM_BUS_SECURITY +static ssize_t null_name_show(struct device *dev, struct device_attribute *attr, + char *buf) +{ + struct tpm_chip *chip = to_tpm_chip(dev); + int size = TPM2_NAME_SIZE; + + bin2hex(buf, chip->tpmkeyname, size); + size *= 2; + buf[size++] = '\n'; + return size; +} +static DEVICE_ATTR_RO(null_name); +#endif + static struct attribute *tpm1_dev_attrs[] = { &dev_attr_pubek.attr, &dev_attr_pcrs.attr, @@ -326,6 +341,9 @@ static struct attribute *tpm1_dev_attrs[] = { static struct attribute *tpm2_dev_attrs[] = { &dev_attr_tpm_version_major.attr, +#if CONFIG_TPM_BUS_SECURITY + &dev_attr_null_name.attr, +#endif NULL };