tpm2_asymmetric is a key type for external keys generated outside the TPM chip but later imported to the chip's key hierarchy as leaf keys.
The key type supports ECC-NIST-P256/384/521 and RSA keys and provides signing and verification operations for each. In addition, for RSA encryption and decryption operations are supported. Co-developed-by: James Prestwood <[email protected]> Signed-off-by: James Prestwood <[email protected]> Signed-off-by: Jarkko Sakkinen <[email protected]> --- crypto/asymmetric_keys/Kconfig | 17 + crypto/asymmetric_keys/Makefile | 1 + crypto/asymmetric_keys/tpm2_asymmetric.c | 1096 ++++++++++++++++++++++ include/linux/tpm.h | 10 + 4 files changed, 1124 insertions(+) create mode 100644 crypto/asymmetric_keys/tpm2_asymmetric.c diff --git a/crypto/asymmetric_keys/Kconfig b/crypto/asymmetric_keys/Kconfig index e50bd9b3e27b..a93e13d5768f 100644 --- a/crypto/asymmetric_keys/Kconfig +++ b/crypto/asymmetric_keys/Kconfig @@ -15,6 +15,7 @@ config ASYMMETRIC_PUBLIC_KEY_SUBTYPE select MPILIB select CRYPTO_HASH_INFO select CRYPTO_AKCIPHER + select CRYPTO_RSA select CRYPTO_SIG select CRYPTO_HASH help @@ -23,6 +24,22 @@ config ASYMMETRIC_PUBLIC_KEY_SUBTYPE appropriate hash algorithms (such as SHA-1) must be available. ENOPKG will be reported if the requisite algorithm is unavailable. +config ASYMMETRIC_TPM2_KEY_SUBTYPE + tristate "Asymmetric TPM2 crypto algorithm subtype" + depends on TCG_TPM + select CRYPTO_SHA256 + select CRYPTO_HASH_INFO + select CRYPTO_TPM2_KEY + select ASN1 + select ASN1_ENCODER + help + This option provides support for asymmetric TPM2 key type handling. + Asymmetric operations such as sign and verify are delegated to the + TPM, and bound to the kernel crypto subsystem. Both RSA and ECDSA + keys are supported. + + ENOPKG will be reported if the requisite algorithm is unavailable. + config X509_CERTIFICATE_PARSER tristate "X.509 certificate parser" depends on ASYMMETRIC_PUBLIC_KEY_SUBTYPE diff --git a/crypto/asymmetric_keys/Makefile b/crypto/asymmetric_keys/Makefile index bc65d3b98dcb..c83b40d021ac 100644 --- a/crypto/asymmetric_keys/Makefile +++ b/crypto/asymmetric_keys/Makefile @@ -11,6 +11,7 @@ asymmetric_keys-y := \ signature.o obj-$(CONFIG_ASYMMETRIC_PUBLIC_KEY_SUBTYPE) += public_key.o +obj-$(CONFIG_ASYMMETRIC_TPM2_KEY_SUBTYPE) += tpm2_asymmetric.o # # X.509 Certificate handling diff --git a/crypto/asymmetric_keys/tpm2_asymmetric.c b/crypto/asymmetric_keys/tpm2_asymmetric.c new file mode 100644 index 000000000000..f6598e6fd283 --- /dev/null +++ b/crypto/asymmetric_keys/tpm2_asymmetric.c @@ -0,0 +1,1096 @@ +// SPDX-License-Identifier: GPL-2.0-or-later +/* + * An asymmetric TPM2 key subtype. + */ + +#include <crypto/hash_info.h> +#include <crypto/internal/ecc.h> +#include <crypto/public_key.h> +#include <crypto/tpm2_key.h> +#include <keys/asymmetric-parser.h> +#include <keys/asymmetric-subtype.h> +#include <linux/asn1_encoder.h> +#include <linux/keyctl.h> +#include <linux/module.h> +#include <linux/slab.h> +#include <linux/tpm.h> +#include <linux/unaligned.h> + +#undef pr_fmt +#define pr_fmt(fmt) "tpm2_asymmetric: "fmt + +/* TPM2 Structures 12.2.3.5: TPMS_RSA_PARMS */ +struct tpm2_asymmetric_rsa_parms { + __be16 symmetric; + __be16 scheme; + __be16 key_bits; + __be32 exponent; + __be16 modulus_size; +} __packed; + +/* TPM2 Structures 12.2.3.6: TPMS_ECC_PARMS */ +struct tpm2_asymmetric_ecc_parms { + __be16 symmetric; + __be16 scheme; + __be16 ecc; + __be16 kdf; +}; + +static const void *tpm2_asymmetric_parms(const struct tpm2_key *key) +{ + return &key->data[key->priv_len + 2 + sizeof(*key->desc)]; +} + +static u16 tpm2_asymmetric_rsa_mod_size(const struct tpm2_key *key) +{ + const struct tpm2_asymmetric_rsa_parms *p = tpm2_asymmetric_parms(key); + + return be16_to_cpu(p->modulus_size); +} + +static const u8 *tpm2_asymmetric_ecc_x(const struct tpm2_key *key) +{ + return tpm2_asymmetric_parms(key) + sizeof(struct tpm2_asymmetric_ecc_parms); +} + +static const u8 *tpm2_asymmetric_ecc_y(const struct tpm2_key *key) +{ + const u8 *x = tpm2_asymmetric_ecc_x(key); + u16 x_size = get_unaligned_be16(&x[0]); + + return &x[2 + x_size]; +} + +static unsigned int tpm2_asymmetric_ecc_key_bits(u16 ecc) +{ + switch (ecc) { + case TPM2_ECC_NIST_P256: + return 256; + case TPM2_ECC_NIST_P384: + return 384; + case TPM2_ECC_NIST_P521: + return 521; + default: + return 0; + } +} + +static int tpm2_asymmetric_hash_lookup(const char *hash_algo, + int *hash_id, int *tpm_hash) +{ + int id, alg; + + if (!hash_algo) + return -EINVAL; + + id = match_string(hash_algo_name, HASH_ALGO__LAST, hash_algo); + if (id < 0) + return -ENOPKG; + + alg = tpm2_find_hash_alg(id); + if (alg < 0) + return -ENOPKG; + + if (hash_id) + *hash_id = id; + + if (tpm_hash) + *tpm_hash = alg; + + return 0; +} + +static int tpm2_asymmetric_signature_scheme(const struct tpm2_key *key, + const char *encoding, + const char *hash_algo, + u16 *scheme, + int *tpm_hash) +{ + if (!encoding) + return -ENOPKG; + + switch (tpm2_key_type(key)) { + case TPM_ALG_RSA: + if (strcmp(encoding, "pkcs1") != 0) + return -ENOPKG; + *scheme = TPM_ALG_RSASSA; + break; + case TPM_ALG_ECC: + if (strcmp(encoding, "x962") != 0) + return -ENOPKG; + *scheme = TPM_ALG_ECDSA; + break; + default: + return -EOPNOTSUPP; + } + + return tpm2_asymmetric_hash_lookup(hash_algo, NULL, tpm_hash); +} + +/* + * Load a TPM2 key blob into the TPM. + * + * On success, @buf is initialized and the authorization session is kept open. + * On failure, @buf is destroyed and the authorization session is closed. + */ +static int tpm2_asymmetric_load(struct tpm_chip *chip, struct tpm2_key *key, + struct tpm_buf *buf, u32 *handle_out) +{ + int ret; + + ret = tpm2_start_auth_session(chip); + if (ret) + return ret; + + ret = tpm_buf_init(buf, TPM2_ST_SESSIONS, TPM2_CC_LOAD); + if (ret < 0) + goto err_auth; + + ret = tpm_buf_append_name(chip, buf, key->parent, NULL); + if (ret) + goto err_buf; + tpm_buf_append_hmac_session(chip, buf, TPM2_SA_CONTINUE_SESSION | + TPM2_SA_ENCRYPT, NULL, 0); + tpm_buf_append(buf, &key->data[0], key->priv_len + key->pub_len); + if (buf->flags & TPM_BUF_OVERFLOW) { + ret = -E2BIG; + goto err_buf; + } + ret = tpm_buf_fill_hmac_session(chip, buf); + if (ret) + goto err_buf; + ret = tpm_transmit_cmd(chip, buf, 4, "TPM2_CC_LOAD"); + ret = tpm_buf_check_hmac_response(chip, buf, ret); + if (ret) { + ret = -EIO; + goto err_buf; + } + + *handle_out = be32_to_cpup((__be32 *)&buf->data[TPM_HEADER_SIZE]); + return 0; + +err_buf: + tpm_buf_destroy(buf); + +err_auth: + tpm2_end_auth_session(chip); + return ret; +} + +static void tpm2_asymmetric_key_destroy(void *payload0, void *payload3) +{ + kfree(payload0); +} + +/* + * Encrypt using TPM2_RSA_Encrypt with RSAES (PKCS#1 v1.5) scheme. + */ +static int tpm2_asymmetric_rsa_encrypt(struct tpm_chip *chip, + struct tpm2_key *key, + struct kernel_pkey_params *params, + const void *in, void *out) +{ + u32 key_handle = 0; + struct tpm_buf buf; + u16 ciphertext_len; + u16 scheme; + u8 *pos; + int ret; + + if (!params->encoding) + return -EINVAL; + + if (strcmp(params->encoding, "pkcs1") == 0) + scheme = TPM_ALG_RSAES; + else if (strcmp(params->encoding, "raw") == 0) + scheme = TPM_ALG_NULL; + else + return -ENOPKG; + + ret = tpm_try_get_ops(chip); + if (ret) + return ret; + + ret = tpm2_asymmetric_load(chip, key, &buf, &key_handle); + if (ret) + goto err_ops; + + tpm2_end_auth_session(chip); + tpm_buf_destroy(&buf); + + ret = tpm_buf_init(&buf, TPM2_ST_NO_SESSIONS, TPM2_CC_RSA_ENCRYPT); + if (ret) + goto err_key; + + tpm_buf_append_u32(&buf, key_handle); + + tpm_buf_append_u16(&buf, params->in_len); + tpm_buf_append(&buf, in, params->in_len); + + tpm_buf_append_u16(&buf, scheme); + + tpm_buf_append_u16(&buf, 0); + + ret = tpm_transmit_cmd(chip, &buf, 4, "TPM2_RSA_Encrypt"); + if (ret) { + ret = -EIO; + goto err_buf; + } + + pos = buf.data + TPM_HEADER_SIZE; + ciphertext_len = be16_to_cpup((__be16 *)pos); + pos += 2; + if (pos + ciphertext_len > buf.data + buf.length) { + ret = -EIO; + goto err_buf; + } + + if (params->out_len < ciphertext_len) { + ret = -EMSGSIZE; + goto err_buf; + } + + memcpy(out, pos, ciphertext_len); + ret = ciphertext_len; + +err_buf: + tpm_buf_destroy(&buf); + +err_key: + tpm2_flush_context(chip, key_handle); + +err_ops: + tpm_put_ops(chip); + return ret; +} + +/* + * Convert a TPM2B_PUBLIC_KEY_RSA response into a raw RSA signature. + */ +static int tpm2_asymmetric_rsa_parse_signature(struct tpm_buf *buf, + off_t *offset, + struct kernel_pkey_params *params, + void *out) +{ + u16 sig_len; + + sig_len = tpm_buf_read_u16(buf, offset); + if (buf->flags & TPM_BUF_BOUNDARY_ERROR) + return -EIO; + if (*offset + sig_len > buf->length) + return -EIO; + if (sig_len > params->out_len) + return -EMSGSIZE; + + memcpy(out, &buf->data[*offset], sig_len); + return sig_len; +} + +/* + * Convert a TPMT_SIGNATURE ECDSA R/S response into DER SEQUENCE form. + */ +static int tpm2_asymmetric_ecc_parse_signature(struct tpm_buf *buf, off_t *offset, + struct kernel_pkey_params *params, + void *out) +{ + u8 der[2 * (2 + ECC_MAX_BYTES + 1)]; + u8 *encoded, *ptr; + const u8 *s; + u16 r_size; + u16 s_size; + + r_size = tpm_buf_read_u16(buf, offset); + if (buf->flags & TPM_BUF_BOUNDARY_ERROR) + return -EIO; + if (r_size == 0 || r_size > ECC_MAX_BYTES || + *offset + r_size + 2 > buf->length) + return -EIO; + + s_size = get_unaligned_be16(&buf->data[*offset + r_size]); + s = &buf->data[*offset + r_size + 2]; + if (s_size == 0 || s_size > ECC_MAX_BYTES || + *offset + r_size + 2 + s_size > buf->length) + return -EIO; + + ptr = der; + ptr = asn1_encode_integer_bytes(ptr, der + sizeof(der), + &buf->data[*offset], r_size); + ptr = asn1_encode_integer_bytes(ptr, der + sizeof(der), s, s_size); + if (IS_ERR(ptr)) + return PTR_ERR(ptr); + + encoded = asn1_encode_sequence(out, (u8 *)out + params->out_len, + der, ptr - der); + if (IS_ERR(encoded)) + return PTR_ERR(encoded) == -EINVAL ? -EMSGSIZE : PTR_ERR(encoded); + + return encoded - (u8 *)out; +} + +static int tpm2_asymmetric_parse_signature(struct tpm_buf *buf, + u16 scheme, int tpm_hash, + struct kernel_pkey_params *params, + void *out) +{ + off_t offset = TPM_HEADER_SIZE + 4; + u16 hash_alg; + u16 sig_alg; + + sig_alg = tpm_buf_read_u16(buf, &offset); + hash_alg = tpm_buf_read_u16(buf, &offset); + if (buf->flags & TPM_BUF_BOUNDARY_ERROR) + return -EIO; + if (sig_alg != scheme || hash_alg != tpm_hash) + return -EIO; + + switch (scheme) { + case TPM_ALG_RSASSA: + return tpm2_asymmetric_rsa_parse_signature(buf, &offset, params, out); + case TPM_ALG_ECDSA: + return tpm2_asymmetric_ecc_parse_signature(buf, &offset, params, out); + default: + return -EOPNOTSUPP; + } +} + +/* + * Sign a digest using TPM2_Sign. + */ +static int tpm2_asymmetric_sign(struct tpm_chip *chip, struct tpm2_key *key, + struct kernel_pkey_params *params, + const void *in, void *out) +{ + struct tpm_buf buf; + u32 key_handle = 0; + int tpm_hash; + u16 scheme; + int ret; + + ret = tpm2_asymmetric_signature_scheme(key, params->encoding, + params->hash_algo, &scheme, + &tpm_hash); + if (ret) + return ret; + + ret = tpm_try_get_ops(chip); + if (ret) + return ret; + + ret = tpm2_asymmetric_load(chip, key, &buf, &key_handle); + if (ret) + goto err_ops; + + tpm_buf_reset(&buf, TPM2_ST_SESSIONS, TPM2_CC_SIGN); + ret = tpm_buf_append_name(chip, &buf, key_handle, NULL); + if (ret) + goto err_key; + tpm_buf_append_hmac_session(chip, &buf, TPM2_SA_DECRYPT, NULL, 0); + + /* digest (TPM2B_DIGEST) */ + tpm_buf_append_u16(&buf, params->in_len); + tpm_buf_append(&buf, in, params->in_len); + + /* inScheme (TPMT_SIG_SCHEME) */ + tpm_buf_append_u16(&buf, scheme); + tpm_buf_append_u16(&buf, tpm_hash); + + /* validation (TPMT_TK_HASHCHECK): NULL ticket */ + tpm_buf_append_u16(&buf, TPM2_ST_HASHCHECK); + tpm_buf_append_u32(&buf, TPM2_RH_NULL); + tpm_buf_append_u16(&buf, 0); + + if (buf.flags & TPM_BUF_OVERFLOW) { + tpm2_end_auth_session(chip); + ret = -E2BIG; + goto err_key; + } + ret = tpm_buf_fill_hmac_session(chip, &buf); + if (ret) + goto err_key; + ret = tpm_transmit_cmd(chip, &buf, 4, "TPM2_Sign"); + ret = tpm_buf_check_hmac_response(chip, &buf, ret); + if (ret) { + ret = -EIO; + goto err_key; + } + + ret = tpm2_asymmetric_parse_signature(&buf, scheme, tpm_hash, params, out); + +err_key: + tpm2_flush_context(chip, key_handle); + tpm_buf_destroy(&buf); + +err_ops: + tpm_put_ops(chip); + return ret; +} + +/* + * Decrypt using TPM2_RSA_Decrypt with RSAES-PKCS1-v1_5 scheme. + */ +static int tpm2_asymmetric_rsa_decrypt(struct tpm_chip *chip, + struct tpm2_key *key, + struct kernel_pkey_params *params, + const void *in, void *out) +{ + u32 key_handle = 0; + struct tpm_buf buf; + u16 decrypted_len; + off_t offset; + int ret; + + if (!params->encoding || strcmp(params->encoding, "pkcs1") != 0) + return -ENOPKG; + + ret = tpm_try_get_ops(chip); + if (ret) + return ret; + + ret = tpm2_asymmetric_load(chip, key, &buf, &key_handle); + if (ret) + goto err_ops; + + tpm_buf_reset(&buf, TPM2_ST_SESSIONS, TPM2_CC_RSA_DECRYPT); + ret = tpm_buf_append_name(chip, &buf, key_handle, NULL); + if (ret) + goto err_key; + tpm_buf_append_hmac_session(chip, &buf, TPM2_SA_DECRYPT, NULL, 0); + tpm_buf_append_u16(&buf, params->in_len); + tpm_buf_append(&buf, in, params->in_len); + tpm_buf_append_u16(&buf, TPM_ALG_RSAES); + tpm_buf_append_u16(&buf, 0); + if (buf.flags & TPM_BUF_OVERFLOW) { + tpm2_end_auth_session(chip); + ret = -E2BIG; + goto err_key; + } + ret = tpm_buf_fill_hmac_session(chip, &buf); + if (ret) + goto err_key; + ret = tpm_transmit_cmd(chip, &buf, 4, "TPM2_RSA_DECRYPT"); + ret = tpm_buf_check_hmac_response(chip, &buf, ret); + if (ret) { + ret = -EIO; + goto err_key; + } + + offset = TPM_HEADER_SIZE + 4; + decrypted_len = tpm_buf_read_u16(&buf, &offset); + if (buf.flags & TPM_BUF_BOUNDARY_ERROR) { + ret = -EIO; + goto err_key; + } + if (offset + decrypted_len > buf.length) { + ret = -EIO; + goto err_key; + } + + if (params->out_len < decrypted_len) { + ret = -EMSGSIZE; + goto err_key; + } + + memcpy(out, &buf.data[offset], decrypted_len); + ret = decrypted_len; + +err_key: + tpm2_flush_context(chip, key_handle); + tpm_buf_destroy(&buf); + +err_ops: + tpm_put_ops(chip); + return ret; +} + +/* + * Verify an RSA signature using TPM2_VerifySignature with RSASSA scheme. + */ +static int tpm2_asymmetric_rsa_verify(const struct key *key, + const struct public_key_signature *sig) +{ + struct tpm2_key *tpm2_key = key->payload.data[asym_crypto]; + struct tpm_chip *chip; + struct tpm_buf buf; + u32 key_handle = 0; + int tpm_hash; + int ret; + + if (!sig->m) + return -ENOPKG; + + if (!sig->encoding || strcmp(sig->encoding, "pkcs1") != 0) + return -ENOPKG; + + if (!sig->hash_algo) + return -EINVAL; + + chip = tpm_default_chip(); + + if (!chip) + return -ENODEV; + + ret = tpm2_asymmetric_hash_lookup(sig->hash_algo, NULL, &tpm_hash); + if (ret) + goto err_chip; + + ret = tpm_try_get_ops(chip); + if (ret) + goto err_chip; + + ret = tpm2_asymmetric_load(chip, tpm2_key, &buf, &key_handle); + if (ret) + goto err_ops; + + tpm2_end_auth_session(chip); + tpm_buf_destroy(&buf); + + ret = tpm_buf_init(&buf, TPM2_ST_NO_SESSIONS, + TPM2_CC_VERIFY_SIGNATURE); + if (ret) + goto err_key; + + tpm_buf_append_u32(&buf, key_handle); + + tpm_buf_append_u16(&buf, sig->m_size); + tpm_buf_append(&buf, sig->m, sig->m_size); + + tpm_buf_append_u16(&buf, TPM_ALG_RSASSA); + tpm_buf_append_u16(&buf, tpm_hash); + tpm_buf_append_u16(&buf, sig->s_size); + tpm_buf_append(&buf, sig->s, sig->s_size); + + ret = tpm_transmit_cmd(chip, &buf, 0, "TPM2_VerifySignature"); + if (ret) + ret = -EKEYREJECTED; + + tpm_buf_destroy(&buf); + +err_key: + tpm2_flush_context(chip, key_handle); + +err_ops: + tpm_put_ops(chip); + +err_chip: + put_device(&chip->dev); + return ret; +} + +static int tpm2_asymmetric_rsa_query(const struct kernel_pkey_params *params, + struct kernel_pkey_query *info) +{ + const struct tpm2_key *key = params->key->payload.data[asym_crypto]; + u16 max_data_size = TPM2_MAX_DIGEST_SIZE; + const u16 mod_size = tpm2_asymmetric_rsa_mod_size(key); + int hash_id, ret; + + if (!params->encoding) + return -EINVAL; + + memset(info, 0, sizeof(*info)); + info->key_size = mod_size * 8; + + if (strcmp(params->encoding, "pkcs1") == 0) { + if (params->hash_algo) { + ret = tpm2_asymmetric_hash_lookup(params->hash_algo, &hash_id, NULL); + if (ret) + return ret; + max_data_size = hash_digest_size[hash_id]; + } + + info->max_data_size = max_data_size; + info->max_sig_size = mod_size; + info->max_enc_size = mod_size; + info->max_dec_size = mod_size; + info->supported_ops = KEYCTL_SUPPORTS_SIGN | + KEYCTL_SUPPORTS_VERIFY | + KEYCTL_SUPPORTS_ENCRYPT | + KEYCTL_SUPPORTS_DECRYPT; + return 0; + } + + if (strcmp(params->encoding, "raw") == 0) { + info->max_data_size = mod_size; + info->max_enc_size = mod_size; + info->max_dec_size = mod_size; + info->supported_ops = KEYCTL_SUPPORTS_ENCRYPT; + return 0; + } + + return -ENOPKG; +} + +static int tpm2_asymmetric_rsa_validate(const struct tpm2_key *key) +{ + const struct tpm2_asymmetric_rsa_parms *p = tpm2_asymmetric_parms(key); + u16 key_bits; + u16 mod_size; + + if (tpm2_key_policy_size(key) != 0) + return -EBADMSG; + + if (key->pub_len < 2 + sizeof(*key->desc) + sizeof(*p)) + return -EBADMSG; + + if (be16_to_cpu(p->symmetric) != TPM_ALG_NULL) + return -EBADMSG; + + if (be16_to_cpu(p->scheme) != TPM_ALG_NULL) + return -EBADMSG; + + key_bits = be16_to_cpu(p->key_bits); + if (key_bits != 2048 && key_bits != 3072 && key_bits != 4096) + return -EBADMSG; + + if (be32_to_cpu(p->exponent) != 0x00000000 && + be32_to_cpu(p->exponent) != 0x00010001) + return -EBADMSG; + + mod_size = tpm2_asymmetric_rsa_mod_size(key); + if (mod_size != key_bits / 8) + return -EBADMSG; + + if (key->pub_len < 2 + sizeof(*key->desc) + sizeof(*p) + mod_size) + return -EBADMSG; + + return 0; +} + +static unsigned int tpm2_asymmetric_der_len_size(unsigned int len) +{ + if (len < 128) + return 1; + if (len <= 255) + return 2; + return 3; +} + +/* + * Parse a DER-encoded ECDSA signature: SEQUENCE { INTEGER r, INTEGER s }. + * + * On success, @r/@r_len and @s/@s_len point into @der with leading zero + * pads stripped. + */ +static int tpm2_asymmetric_ecc_parse_der_signature(const u8 *der, u32 der_len, + const u8 **r, u16 *r_len, + const u8 **s, u16 *s_len) +{ + const u8 *end = der + der_len; + u32 seq_len, int_len; + const u8 *p = der; + + if (p >= end || *p++ != 0x30) + return -EBADMSG; + + if (p >= end) + return -EBADMSG; + if (*p < 0x80) { + seq_len = *p++; + } else if (*p == 0x81) { + if (++p >= end) + return -EBADMSG; + seq_len = *p++; + } else { + return -EBADMSG; + } + + if (p + seq_len > end) + return -EBADMSG; + end = p + seq_len; + + /* INTEGER r */ + if (p >= end || *p++ != 0x02) + return -EBADMSG; + if (p >= end) + return -EBADMSG; + int_len = *p++; + if (int_len == 0 || int_len >= 0x80 || p + int_len > end) + return -EBADMSG; + while (int_len > 1 && *p == 0x00) { + p++; + int_len--; + } + *r = p; + *r_len = int_len; + p += int_len; + + /* INTEGER s */ + if (p >= end || *p++ != 0x02) + return -EBADMSG; + if (p >= end) + return -EBADMSG; + int_len = *p++; + if (int_len == 0 || int_len >= 0x80 || p + int_len > end) + return -EBADMSG; + while (int_len > 1 && *p == 0x00) { + p++; + int_len--; + } + *s = p; + *s_len = int_len; + p += int_len; + + if (p != end) + return -EBADMSG; + + return 0; +} + +/* + * Verify an ECDSA signature using TPM2_VerifySignature. + * + * A DER-encoded signature is parsed into (r, s) components for the TPM command. + */ +static int tpm2_asymmetric_ecc_verify(const struct key *key, + const struct public_key_signature *sig) +{ + struct tpm2_key *tpm2_key = key->payload.data[asym_crypto]; + struct tpm_chip *chip; + const u8 *r, *s_data; + struct tpm_buf buf; + u32 key_handle = 0; + u16 r_len, s_len; + int tpm_hash; + int ret; + + if (!sig->m) + return -ENOPKG; + + if (!sig->encoding || strcmp(sig->encoding, "x962") != 0) + return -ENOPKG; + + if (!sig->hash_algo) + return -EINVAL; + + chip = tpm_default_chip(); + + if (!chip) + return -ENODEV; + + ret = tpm2_asymmetric_hash_lookup(sig->hash_algo, NULL, &tpm_hash); + if (ret) + goto err_chip; + + ret = tpm2_asymmetric_ecc_parse_der_signature(sig->s, sig->s_size, + &r, &r_len, &s_data, + &s_len); + if (ret) + goto err_chip; + + ret = tpm_try_get_ops(chip); + if (ret) + goto err_chip; + + ret = tpm2_asymmetric_load(chip, tpm2_key, &buf, &key_handle); + if (ret) + goto err_ops; + + tpm2_end_auth_session(chip); + tpm_buf_destroy(&buf); + + ret = tpm_buf_init(&buf, TPM2_ST_NO_SESSIONS, + TPM2_CC_VERIFY_SIGNATURE); + if (ret) + goto err_key; + + tpm_buf_append_u32(&buf, key_handle); + + /* digest (TPM2B_DIGEST) */ + tpm_buf_append_u16(&buf, sig->m_size); + tpm_buf_append(&buf, sig->m, sig->m_size); + + /* signature (TPMT_SIGNATURE): ECDSA with the given hash */ + tpm_buf_append_u16(&buf, TPM_ALG_ECDSA); + tpm_buf_append_u16(&buf, tpm_hash); + + /* signatureR (TPM2B_ECC_PARAMETER) */ + tpm_buf_append_u16(&buf, r_len); + tpm_buf_append(&buf, r, r_len); + + /* signatureS (TPM2B_ECC_PARAMETER) */ + tpm_buf_append_u16(&buf, s_len); + tpm_buf_append(&buf, s_data, s_len); + + ret = tpm_transmit_cmd(chip, &buf, 0, "TPM2_VerifySignature"); + if (ret) + ret = -EKEYREJECTED; + + tpm_buf_destroy(&buf); + +err_key: + tpm2_flush_context(chip, key_handle); + +err_ops: + tpm_put_ops(chip); + +err_chip: + put_device(&chip->dev); + return ret; +} + +static int tpm2_asymmetric_ecc_query(const struct kernel_pkey_params *params, + struct kernel_pkey_query *info) +{ + const struct tpm2_key *key = params->key->payload.data[asym_crypto]; + const struct tpm2_asymmetric_ecc_parms *p = tpm2_asymmetric_parms(key); + unsigned int int_len, seq_payload; + const u8 *x; + u16 ecc, n; + int ret; + + ecc = be16_to_cpu(p->ecc); + x = tpm2_asymmetric_ecc_x(key); + n = get_unaligned_be16(&x[0]); + int_len = n + 1; + + if (!params->encoding || strcmp(params->encoding, "x962") != 0) + return -ENOPKG; + + ret = tpm2_asymmetric_hash_lookup(params->hash_algo, NULL, NULL); + if (ret) + return ret; + + /* + * SEQUENCE { INTEGER (<=n+1 bytes), INTEGER (<=n+1 bytes) } + */ + seq_payload = 2 * (1 + tpm2_asymmetric_der_len_size(int_len) + int_len); + + memset(info, 0, sizeof(*info)); + info->key_size = tpm2_asymmetric_ecc_key_bits(ecc); + info->max_sig_size = 1 + tpm2_asymmetric_der_len_size(seq_payload) + seq_payload; + info->max_data_size = TPM2_MAX_DIGEST_SIZE; + info->supported_ops = KEYCTL_SUPPORTS_SIGN | KEYCTL_SUPPORTS_VERIFY; + + return 0; +} + +static int tpm2_asymmetric_ecc_validate(const struct tpm2_key *key) +{ + const struct tpm2_asymmetric_ecc_parms *p = tpm2_asymmetric_parms(key); + size_t min_len = 2 + sizeof(*key->desc) + sizeof(*p); + u16 x_size, y_size; + const u8 *x, *y; + + if (tpm2_key_policy_size(key) != 0) + return -EBADMSG; + + if (key->pub_len < min_len + 2) + return -EBADMSG; + + if (be16_to_cpu(p->symmetric) != TPM_ALG_NULL) + return -EBADMSG; + + if (be16_to_cpu(p->scheme) != TPM_ALG_NULL) + return -EBADMSG; + + if (be16_to_cpu(p->ecc) != TPM2_ECC_NIST_P256 && + be16_to_cpu(p->ecc) != TPM2_ECC_NIST_P384 && + be16_to_cpu(p->ecc) != TPM2_ECC_NIST_P521) + return -EBADMSG; + + if (be16_to_cpu(p->kdf) != TPM_ALG_NULL) + return -EBADMSG; + + x = tpm2_asymmetric_ecc_x(key); + x_size = get_unaligned_be16(&x[0]); + if (x_size > ECC_MAX_BYTES) + return -EBADMSG; + + if (key->pub_len < min_len + 2 + x_size + 2) + return -EBADMSG; + + y = tpm2_asymmetric_ecc_y(key); + y_size = get_unaligned_be16(&y[0]); + if (y_size > ECC_MAX_BYTES) + return -EBADMSG; + + if (key->pub_len < min_len + 2 + x_size + 2 + y_size) + return -EBADMSG; + + if (x_size != y_size) + return -EBADMSG; + + return 0; +} + +static const char *tpm2_asymmetric_ecc_name(const struct tpm2_key *key) +{ + const struct tpm2_asymmetric_ecc_parms *p; + + p = tpm2_asymmetric_parms(key); + + switch (be16_to_cpu(p->ecc)) { + case TPM2_ECC_NIST_P256: + return "ecdsa-nist-p256"; + case TPM2_ECC_NIST_P384: + return "ecdsa-nist-p384"; + case TPM2_ECC_NIST_P521: + return "ecdsa-nist-p521"; + default: + return "ecdsa"; + } +} + +static void tpm2_asymmetric_describe(const struct key *asymmetric_key, + struct seq_file *m) +{ + const struct tpm2_key *key; + + key = asymmetric_key->payload.data[asym_crypto]; + if (!key) + return; + + switch (tpm2_key_type(key)) { + case TPM_ALG_RSA: + seq_puts(m, "tpm2.rsa"); + break; + case TPM_ALG_ECC: + seq_printf(m, "tpm2.%s", tpm2_asymmetric_ecc_name(key)); + break; + default: + seq_puts(m, "tpm2.unknown"); + break; + } +} + +static int tpm2_asymmetric_query(const struct kernel_pkey_params *params, + struct kernel_pkey_query *info) +{ + struct tpm2_key *key = params->key->payload.data[asym_crypto]; + + switch (tpm2_key_type(key)) { + case TPM_ALG_RSA: + return tpm2_asymmetric_rsa_query(params, info); + case TPM_ALG_ECC: + return tpm2_asymmetric_ecc_query(params, info); + default: + return -EOPNOTSUPP; + } +} + +static int tpm2_asymmetric_eds_op(struct kernel_pkey_params *params, + const void *in, void *out) +{ + struct tpm2_key *key = params->key->payload.data[asym_crypto]; + struct tpm_chip *chip; + int ret; + + chip = tpm_default_chip(); + if (!chip) + return -ENODEV; + + switch (params->op) { + case kernel_pkey_encrypt: + if (tpm2_key_type(key) != TPM_ALG_RSA) { + ret = -EOPNOTSUPP; + break; + } + ret = tpm2_asymmetric_rsa_encrypt(chip, key, params, in, out); + break; + case kernel_pkey_decrypt: + if (tpm2_key_type(key) != TPM_ALG_RSA) { + ret = -EOPNOTSUPP; + break; + } + ret = tpm2_asymmetric_rsa_decrypt(chip, key, params, in, out); + break; + case kernel_pkey_sign: + ret = tpm2_asymmetric_sign(chip, key, params, in, out); + break; + default: + ret = -EOPNOTSUPP; + break; + } + + put_device(&chip->dev); + return ret; +} + +static int tpm2_asymmetric_verify_signature(const struct key *asymmetric_key, + const struct public_key_signature *sig) +{ + struct tpm2_key *key = asymmetric_key->payload.data[asym_crypto]; + + switch (tpm2_key_type(key)) { + case TPM_ALG_RSA: + return tpm2_asymmetric_rsa_verify(asymmetric_key, sig); + case TPM_ALG_ECC: + return tpm2_asymmetric_ecc_verify(asymmetric_key, sig); + default: + return -EOPNOTSUPP; + } +} + +static struct asymmetric_key_subtype tpm2_asymmetric_subtype = { + .owner = THIS_MODULE, + .name = "tpm2_asymmetric_key", + .name_len = sizeof("tpm2_asymmetric_key") - 1, + .describe = tpm2_asymmetric_describe, + .destroy = tpm2_asymmetric_key_destroy, + .query = tpm2_asymmetric_query, + .eds_op = tpm2_asymmetric_eds_op, + .verify_signature = tpm2_asymmetric_verify_signature, +}; + +static int tpm2_asymmetric_preparse(struct key_preparsed_payload *prep) +{ + struct tpm2_key *key __free(kfree) = NULL; + int ret; + + key = tpm2_key_decode(prep->data, prep->datalen); + if (IS_ERR(key)) { + ret = PTR_ERR(key); + key = NULL; + return ret; + } + + if (key->oid != OID_TPMLoadableKey) + return -EBADMSG; + + switch (tpm2_key_type(key)) { + case TPM_ALG_RSA: + ret = tpm2_asymmetric_rsa_validate(key); + break; + case TPM_ALG_ECC: + ret = tpm2_asymmetric_ecc_validate(key); + break; + default: + ret = -EBADMSG; + break; + } + + if (ret < 0) + return ret; + + __module_get(tpm2_asymmetric_subtype.owner); + + prep->payload.data[asym_subtype] = &tpm2_asymmetric_subtype; + prep->payload.data[asym_key_ids] = NULL; + prep->payload.data[asym_crypto] = no_free_ptr(key); + prep->payload.data[asym_auth] = NULL; + prep->quotalen = 100; + + return 0; +} + +static struct asymmetric_key_parser tpm2_asymmetric_parser = { + .owner = THIS_MODULE, + .name = "tpm2_asymmetric_parser", + .parse = tpm2_asymmetric_preparse, +}; + +static int __init tpm2_asymmetric_init(void) +{ + return register_asymmetric_key_parser(&tpm2_asymmetric_parser); +} + +static void __exit tpm2_asymmetric_exit(void) +{ + unregister_asymmetric_key_parser(&tpm2_asymmetric_parser); +} + +module_init(tpm2_asymmetric_init); +module_exit(tpm2_asymmetric_exit); + +MODULE_DESCRIPTION("Asymmetric TPM2 key"); +MODULE_LICENSE("GPL"); diff --git a/include/linux/tpm.h b/include/linux/tpm.h index 202da079d500..d4d5ddc0173a 100644 --- a/include/linux/tpm.h +++ b/include/linux/tpm.h @@ -45,6 +45,7 @@ enum tpm2_session_types { /* if you add a new hash to this, increment TPM_MAX_HASHES below */ enum tpm_algorithms { TPM_ALG_ERROR = 0x0000, + TPM_ALG_RSA = 0x0001, TPM_ALG_SHA1 = 0x0004, TPM_ALG_AES = 0x0006, TPM_ALG_KEYEDHASH = 0x0008, @@ -53,6 +54,9 @@ enum tpm_algorithms { TPM_ALG_SHA512 = 0x000D, TPM_ALG_NULL = 0x0010, TPM_ALG_SM3_256 = 0x0012, + TPM_ALG_RSASSA = 0x0014, + TPM_ALG_RSAES = 0x0015, + TPM_ALG_ECDSA = 0x0018, TPM_ALG_ECC = 0x0023, TPM_ALG_CFB = 0x0043, }; @@ -66,6 +70,8 @@ enum tpm_algorithms { enum tpm2_curves { TPM2_ECC_NONE = 0x0000, TPM2_ECC_NIST_P256 = 0x0003, + TPM2_ECC_NIST_P384 = 0x0004, + TPM2_ECC_NIST_P521 = 0x0005, }; struct tpm_digest { @@ -242,6 +248,7 @@ enum tpm2_structures { TPM2_ST_NO_SESSIONS = 0x8001, TPM2_ST_SESSIONS = 0x8002, TPM2_ST_CREATION = 0x8021, + TPM2_ST_HASHCHECK = 0x8024, }; /* Indicates from what layer of the software stack the error comes from */ @@ -276,12 +283,15 @@ enum tpm2_command_codes { TPM2_CC_NV_READ = 0x014E, TPM2_CC_CREATE = 0x0153, TPM2_CC_LOAD = 0x0157, + TPM2_CC_RSA_DECRYPT = 0x0159, TPM2_CC_SEQUENCE_UPDATE = 0x015C, + TPM2_CC_SIGN = 0x015D, TPM2_CC_UNSEAL = 0x015E, TPM2_CC_CONTEXT_LOAD = 0x0161, TPM2_CC_CONTEXT_SAVE = 0x0162, TPM2_CC_FLUSH_CONTEXT = 0x0165, TPM2_CC_READ_PUBLIC = 0x0173, + TPM2_CC_RSA_ENCRYPT = 0x0174, TPM2_CC_START_AUTH_SESS = 0x0176, TPM2_CC_VERIFY_SIGNATURE = 0x0177, TPM2_CC_GET_CAPABILITY = 0x017A, -- 2.47.3
