From patchwork Mon Mar 2 12:27:53 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: James Bottomley X-Patchwork-Id: 11415421 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 16E3517E0 for ; Mon, 2 Mar 2020 12:28:17 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id EB1152173E for ; Mon, 2 Mar 2020 12:28:16 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=fail reason="signature verification failed" (1024-bit key) header.d=hansenpartnership.com header.i=@hansenpartnership.com header.b="G1Hbcz7C" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727715AbgCBM2Q (ORCPT ); Mon, 2 Mar 2020 07:28:16 -0500 Received: from bedivere.hansenpartnership.com ([66.63.167.143]:42400 "EHLO bedivere.hansenpartnership.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727519AbgCBM2Q (ORCPT ); Mon, 2 Mar 2020 07:28:16 -0500 Received: from localhost (localhost [127.0.0.1]) by bedivere.hansenpartnership.com (Postfix) with ESMTP id D55CD8EE17D; Mon, 2 Mar 2020 04:28:15 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=hansenpartnership.com; s=20151216; t=1583152095; bh=aUrA8TpMQ8qYcAWkjQOPTgkVcNDl17+zqhBrmCjh+mE=; h=From:To:Cc:Subject:Date:From; b=G1Hbcz7Cy7fgrKQ3T5d+DntHK7oOwX5YWNrH0LLANX0sg98owhGpx5qfF/z4oeYhU 9YZo4WYjh7VzhhVXHaUUR1LCM0cFnOFEOnu2M0szGGfSyPxadxHZv80Oqqnk+Vx0Yk m/sCKT2xEIuOcMhEPc+ywGGMwqoMFn5B4x6Qic/U= Received: from bedivere.hansenpartnership.com ([127.0.0.1]) by localhost (bedivere.hansenpartnership.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Y-XjYo-cQv8e; Mon, 2 Mar 2020 04:28:15 -0800 (PST) Received: from jarvis.int.hansenpartnership.com (jarvis.ext.hansenpartnership.com [153.66.160.226]) by bedivere.hansenpartnership.com (Postfix) with ESMTP id E89068EE11D; Mon, 2 Mar 2020 04:28:13 -0800 (PST) From: James Bottomley To: linux-integrity@vger.kernel.org Cc: Mimi Zohar , Jarkko Sakkinen , David Woodhouse , keyrings@vger.kernel.org Subject: [PATCH v6 0/6] TPM 2.0 trusted keys with attached policy Date: Mon, 2 Mar 2020 07:27:53 -0500 Message-Id: <20200302122759.5204-1-James.Bottomley@HansenPartnership.com> X-Mailer: git-send-email 2.16.4 Sender: linux-integrity-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org This is a respin to update patch 3/6 with comment tidying and if/else untangling. General cover letter: This patch updates the trusted key code to export keys in the ASN.1 format used by current TPM key tools (openssl_tpm2_engine and openconnect). It also simplifies the use of policy with keys because the ASN.1 format is designed to carry a description of how to construct the policy, with the result that simple policies (like authorization and PCR locking) can now be constructed and used in the kernel, bringing the TPM 2.0 policy use into line with how TPM 1.2 works. The key format is designed to be compatible with our two openssl engine implementations as well as with the format used by openconnect. I've added seal/unseal to my engine so I can use it for interoperability testing and I'll later use this for sealed symmetric keys via engine: https://git.kernel.org/pub/scm/linux/kernel/git/jejb/openssl_tpm2_engine.git/ James --- James Bottomley (6): lib: add ASN.1 encoder oid_registry: Add TCG defined OIDS for TPM keys security: keys: trusted: fix TPM2 authorizations security: keys: trusted: use ASN.1 TPM2 key format for the blobs security: keys: trusted: add ability to specify arbitrary policy security: keys: trusted: implement counter/timer policy Documentation/security/keys/trusted-encrypted.rst | 64 ++- include/keys/trusted-type.h | 7 +- include/linux/asn1_encoder.h | 32 ++ include/linux/oid_registry.h | 5 + include/linux/tpm.h | 8 + lib/Makefile | 2 +- lib/asn1_encoder.c | 431 ++++++++++++++++++++ security/keys/Kconfig | 2 + security/keys/trusted-keys/Makefile | 2 +- security/keys/trusted-keys/tpm2-policy.c | 463 ++++++++++++++++++++++ security/keys/trusted-keys/tpm2-policy.h | 31 ++ security/keys/trusted-keys/tpm2key.asn1 | 23 ++ security/keys/trusted-keys/trusted_tpm1.c | 56 ++- security/keys/trusted-keys/trusted_tpm2.c | 370 +++++++++++++++-- 14 files changed, 1459 insertions(+), 37 deletions(-) create mode 100644 include/linux/asn1_encoder.h create mode 100644 lib/asn1_encoder.c create mode 100644 security/keys/trusted-keys/tpm2-policy.c create mode 100644 security/keys/trusted-keys/tpm2-policy.h create mode 100644 security/keys/trusted-keys/tpm2key.asn1