tpm-key_attestation 0.12.1 → 0.14.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (16) hide show
  1. checksums.yaml +4 -4
  2. data/.github/workflows/build.yml +25 -5
  3. data/Appraisals +4 -0
  4. data/CHANGELOG.md +16 -0
  5. data/Gemfile +1 -1
  6. data/Gemfile.lock +30 -28
  7. data/gemfiles/openssl_2_1.gemfile +1 -1
  8. data/gemfiles/openssl_2_2.gemfile +1 -1
  9. data/gemfiles/openssl_3_0.gemfile +1 -1
  10. data/gemfiles/openssl_3_1.gemfile +1 -1
  11. data/gemfiles/openssl_3_2.gemfile +12 -0
  12. data/lib/tpm/certify_validator.rb +7 -11
  13. data/lib/tpm/key_attestation/version.rb +1 -1
  14. data/lib/tpm/t_public.rb +10 -3
  15. data/lib/tpm/tpms_ecc_point.rb +12 -0
  16. metadata +4 -2
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA256:
3
- metadata.gz: ae6c28ee251d9123abbdaa6c18ab7d424accaf1bb44cbe0e350ccb2bdf8c79ca
4
- data.tar.gz: f172c0436c2dedeab2e8300396ddc515428912f6c73f5688d905723844625320
3
+ metadata.gz: 0a92767d4ddd0efcb039e6c5453f77036bb03ff7bd47a0a0aedf831f12e2645c
4
+ data.tar.gz: 287110f2d3c8e3945d4eced73103371d40e9d5ca3a00f50a99c209b0df1efa6a
5
5
  SHA512:
6
- metadata.gz: aa78d70ea5a12c5768a0c24d90ae3f6137260ae8b45d14e23c716519b07a3dade2f76735c0a18b39dc1244f09e2ecd47019554395fb03c45d98a88bc454affd0
7
- data.tar.gz: fc501bb669b8ac188a89ce63fe3052b27b22b9e29069a4ca58e4b3538d5b14fd8ae23dccfe1de89027eeb74943750c00b21f460151872b26fdc51ec6f3c45979
6
+ metadata.gz: e1c2d352b315b796655a0ede9c11383547a902c803f8815354f934090c5a3d683d32426f8fd537f1a76f6eb6784ea5688065bb6008da52e204bb0c6ac9dc5c9f
7
+ data.tar.gz: 19d3dbb264e6720af1731296aed09549a080119f2af1ee5174ca5ae07c9102b8669ce597bd7df5b7932efbf0c7ac21272e6ed6a033ace8158e5d7d64a3b460fe
data/.github/workflows/build.yml CHANGED
@@ -22,8 +22,9 @@ jobs:
22
22
  os:
23
23
  - ubuntu-20.04
24
24
  - windows-latest
25
- - macos-12
25
+ - macos-13
26
26
  ruby:
27
+ - '3.3'
27
28
  - '3.2'
28
29
  - '3.1'
29
30
  - '3.0'
@@ -36,6 +37,7 @@ jobs:
36
37
  - openssl_2_1
37
38
  - openssl_3_0
38
39
  - openssl_3_1
40
+ - openssl_3_2
39
41
  exclude:
40
42
  - ruby: '2.4'
41
43
  gemfile: openssl_3_0
@@ -45,24 +47,42 @@ jobs:
45
47
  gemfile: openssl_3_1
46
48
  - ruby: '2.5'
47
49
  gemfile: openssl_3_1
50
+ - ruby: '2.4'
51
+ gemfile: openssl_3_2
52
+ - ruby: '2.5'
53
+ gemfile: openssl_3_2
54
+ - ruby: '2.6'
55
+ gemfile: openssl_3_2
48
56
  - ruby: '3.1'
49
57
  gemfile: openssl_2_2
50
- os: macos-12
58
+ os: macos-13
51
59
  - ruby: '3.1'
52
60
  gemfile: openssl_2_1
53
- os: macos-12
61
+ os: macos-13
54
62
  - ruby: '3.2'
55
63
  gemfile: openssl_2_2
56
- os: macos-12
64
+ os: macos-13
57
65
  - ruby: '3.2'
58
66
  gemfile: openssl_2_1
59
- os: macos-12
67
+ os: macos-13
60
68
  - ruby: '3.2'
61
69
  gemfile: openssl_2_2
62
70
  os: windows-latest
63
71
  - ruby: '3.2'
64
72
  gemfile: openssl_2_1
65
73
  os: windows-latest
74
+ - ruby: '3.3'
75
+ gemfile: openssl_2_2
76
+ os: macos-13
77
+ - ruby: '3.3'
78
+ gemfile: openssl_2_1
79
+ os: macos-13
80
+ - ruby: '3.3'
81
+ gemfile: openssl_2_2
82
+ os: windows-latest
83
+ - ruby: '3.3'
84
+ gemfile: openssl_2_1
85
+ os: windows-latest
66
86
  env:
67
87
  BUNDLE_GEMFILE: gemfiles/${{ matrix.gemfile }}.gemfile
68
88
  steps:
data/Appraisals CHANGED
@@ -15,3 +15,7 @@ end
15
15
  appraise "openssl_3_1" do
16
16
  gem "openssl", "~> 3.1.0"
17
17
  end
18
+
19
+ appraise "openssl_3_2" do
20
+ gem "openssl", "~> 3.2.0"
21
+ end
data/CHANGELOG.md CHANGED
@@ -1,5 +1,19 @@
1
1
  # Changelog
2
2
 
3
+ ## [v0.14.0] - 2025-02-06
4
+
5
+ - Handle incompatibility between `parameters` and `unique` in `TPublic`. [@nicolastemciuc], [@santiagorodriguez96]
6
+
7
+ ## [v0.13.1] - 2025-01-22
8
+
9
+ - Fix build [@nicolastemciuc]
10
+
11
+ ## [v0.13.0] - 2025-01-21
12
+
13
+ - Use public key from AIK cert for signature algorithm initalization [@santiagorodriguez96]
14
+ - Support algorithm being ECC and pubArea's scheme parameter being TPM_ALG_NULL [@santiagorodriguez96]
15
+ - Allow TPM:TPublic to handle ECC keys in pubArea correctly [@santiagorodriguez96]
16
+
3
17
  ## [v0.12.1] - 2024-08-05
4
18
 
5
19
  - Fix loading trusted certificates on Windows. #20 & #21 [@johnnyshields], [@salmanasiddiqui]
@@ -79,6 +93,8 @@ replacement of `JOSE` format `algorithm` string
79
93
  - `TPM::EKCertificate` wrapper
80
94
  - `TPM::SAttest` wrapper
81
95
 
96
+ [v0.13.1]: https://github.com/cedarcode/tpm-key_attestation/compare/v0.13.0...v0.13.1/
97
+ [v0.13.0]: https://github.com/cedarcode/tpm-key_attestation/compare/v0.12.1...v0.13.0/
82
98
  [v0.12.0]: https://github.com/cedarcode/tpm-key_attestation/compare/v0.11.0...v0.12.0/
83
99
  [v0.11.0]: https://github.com/cedarcode/tpm-key_attestation/compare/v0.10.0...v0.11.0/
84
100
  [v0.10.0]: https://github.com/cedarcode/tpm-key_attestation/compare/v0.9.0...v0.10.0/
data/Gemfile CHANGED
@@ -5,7 +5,7 @@ source "https://rubygems.org"
5
5
  # Specify your gem's dependencies in tpm-key_attestation.gemspec
6
6
  gemspec
7
7
 
8
- gem "appraisal", "~> 2.2.0"
8
+ gem "appraisal", "~> 2.5.0"
9
9
  gem "byebug", "~> 11.0"
10
10
  gem "rake", "~> 13.0"
11
11
  gem "rspec", "~> 3.0"
data/Gemfile.lock CHANGED
@@ -1,7 +1,7 @@
1
1
  PATH
2
2
  remote: .
3
3
  specs:
4
- tpm-key_attestation (0.11.0)
4
+ tpm-key_attestation (0.14.0)
5
5
  bindata (~> 2.4)
6
6
  openssl (> 2.0)
7
7
  openssl-signature_algorithm (~> 1.0)
@@ -9,37 +9,39 @@ PATH
9
9
  GEM
10
10
  remote: https://rubygems.org/
11
11
  specs:
12
- appraisal (2.2.0)
12
+ appraisal (2.5.0)
13
13
  bundler
14
14
  rake
15
15
  thor (>= 0.14.0)
16
16
  ast (2.4.2)
17
- bindata (2.4.14)
17
+ bindata (2.5.0)
18
18
  byebug (11.1.3)
19
- diff-lcs (1.4.4)
20
- jaro_winkler (1.5.4)
21
- openssl (3.1.0)
22
- openssl-signature_algorithm (1.2.1)
23
- openssl (> 2.0, < 3.1)
24
- parallel (1.20.1)
25
- parser (3.0.0.0)
19
+ diff-lcs (1.5.1)
20
+ jaro_winkler (1.5.6)
21
+ openssl (3.2.0)
22
+ openssl-signature_algorithm (1.3.0)
23
+ openssl (> 2.0)
24
+ parallel (1.26.3)
25
+ parser (3.3.6.0)
26
26
  ast (~> 2.4.1)
27
- rainbow (3.0.0)
28
- rake (13.0.3)
29
- rexml (3.2.4)
30
- rspec (3.10.0)
31
- rspec-core (~> 3.10.0)
32
- rspec-expectations (~> 3.10.0)
33
- rspec-mocks (~> 3.10.0)
34
- rspec-core (3.10.1)
35
- rspec-support (~> 3.10.0)
36
- rspec-expectations (3.10.1)
27
+ racc
28
+ racc (1.8.1)
29
+ rainbow (3.1.1)
30
+ rake (13.2.1)
31
+ rexml (3.3.9)
32
+ rspec (3.13.0)
33
+ rspec-core (~> 3.13.0)
34
+ rspec-expectations (~> 3.13.0)
35
+ rspec-mocks (~> 3.13.0)
36
+ rspec-core (3.13.2)
37
+ rspec-support (~> 3.13.0)
38
+ rspec-expectations (3.13.3)
37
39
  diff-lcs (>= 1.2.0, < 2.0)
38
- rspec-support (~> 3.10.0)
39
- rspec-mocks (3.10.2)
40
+ rspec-support (~> 3.13.0)
41
+ rspec-mocks (3.13.2)
40
42
  diff-lcs (>= 1.2.0, < 2.0)
41
- rspec-support (~> 3.10.0)
42
- rspec-support (3.10.2)
43
+ rspec-support (~> 3.13.0)
44
+ rspec-support (3.13.2)
43
45
  rubocop (0.80.1)
44
46
  jaro_winkler (~> 1.5.1)
45
47
  parallel (~> 1.10)
@@ -48,15 +50,15 @@ GEM
48
50
  rexml
49
51
  ruby-progressbar (~> 1.7)
50
52
  unicode-display_width (>= 1.4.0, < 1.7)
51
- ruby-progressbar (1.11.0)
52
- thor (1.1.0)
53
+ ruby-progressbar (1.13.0)
54
+ thor (1.3.2)
53
55
  unicode-display_width (1.6.1)
54
56
 
55
57
  PLATFORMS
56
58
  ruby
57
59
 
58
60
  DEPENDENCIES
59
- appraisal (~> 2.2.0)
61
+ appraisal (~> 2.5.0)
60
62
  byebug (~> 11.0)
61
63
  rake (~> 13.0)
62
64
  rspec (~> 3.0)
@@ -64,4 +66,4 @@ DEPENDENCIES
64
66
  tpm-key_attestation!
65
67
 
66
68
  BUNDLED WITH
67
- 2.2.8
69
+ 2.5.23
data/gemfiles/openssl_2_1.gemfile CHANGED
@@ -2,7 +2,7 @@
2
2
 
3
3
  source "https://rubygems.org"
4
4
 
5
- gem "appraisal", "~> 2.2.0"
5
+ gem "appraisal", "~> 2.5.0"
6
6
  gem "byebug", "~> 11.0"
7
7
  gem "rake", "~> 13.0"
8
8
  gem "rspec", "~> 3.0"
data/gemfiles/openssl_2_2.gemfile CHANGED
@@ -2,7 +2,7 @@
2
2
 
3
3
  source "https://rubygems.org"
4
4
 
5
- gem "appraisal", "~> 2.2.0"
5
+ gem "appraisal", "~> 2.5.0"
6
6
  gem "byebug", "~> 11.0"
7
7
  gem "rake", "~> 13.0"
8
8
  gem "rspec", "~> 3.0"
data/gemfiles/openssl_3_0.gemfile CHANGED
@@ -2,7 +2,7 @@
2
2
 
3
3
  source "https://rubygems.org"
4
4
 
5
- gem "appraisal", "~> 2.2.0"
5
+ gem "appraisal", "~> 2.5.0"
6
6
  gem "byebug", "~> 11.0"
7
7
  gem "rake", "~> 13.0"
8
8
  gem "rspec", "~> 3.0"
data/gemfiles/openssl_3_1.gemfile CHANGED
@@ -2,7 +2,7 @@
2
2
 
3
3
  source "https://rubygems.org"
4
4
 
5
- gem "appraisal", "~> 2.2.0"
5
+ gem "appraisal", "~> 2.5.0"
6
6
  gem "byebug", "~> 11.0"
7
7
  gem "rake", "~> 13.0"
8
8
  gem "rspec", "~> 3.0"
data/gemfiles/openssl_3_2.gemfile ADDED
@@ -0,0 +1,12 @@
1
+ # This file was generated by Appraisal
2
+
3
+ source "https://rubygems.org"
4
+
5
+ gem "appraisal", "~> 2.5.0"
6
+ gem "byebug", "~> 11.0"
7
+ gem "rake", "~> 13.0"
8
+ gem "rspec", "~> 3.0"
9
+ gem "rubocop", "~> 0.80.1"
10
+ gem "openssl", "~> 3.2.0"
11
+
12
+ gemspec path: "../"
data/lib/tpm/certify_validator.rb CHANGED
@@ -44,7 +44,13 @@ module TPM
44
44
  end
45
45
 
46
46
  def valid_signature?(verify_key)
47
- openssl_signature_algorithm = openssl_signature_algorithm_class.new(**openssl_signature_algorithm_parameters)
47
+ parameters = { hash_function: openssl_hash_function }
48
+
49
+ if verify_key.is_a?(OpenSSL::PKey::EC) || verify_key.is_a?(OpenSSL::PKey::EC::Point)
50
+ parameters[:curve] = verify_key.group.curve_name
51
+ end
52
+
53
+ openssl_signature_algorithm = openssl_signature_algorithm_class.new(**parameters)
48
54
  openssl_signature_algorithm.verify_key = verify_key
49
55
  openssl_signature_algorithm.verify(signature, info)
50
56
  rescue OpenSSL::SignatureAlgorithm::Error
@@ -55,16 +61,6 @@ module TPM
55
61
  @attest ||= TPM::SAttest.deserialize(info)
56
62
  end
57
63
 
58
- def openssl_signature_algorithm_parameters
59
- parameters = { hash_function: openssl_hash_function }
60
-
61
- if public_area.ecc?
62
- parameters[:curve] = public_area.openssl_curve_name
63
- end
64
-
65
- parameters
66
- end
67
-
68
64
  def openssl_hash_function
69
65
  TPM_HASH_ALG_TO_OPENSSL[hash_algorithm] || raise("Unsupported hash algorithm #{hash_algorithm}")
70
66
  end
data/lib/tpm/key_attestation/version.rb CHANGED
@@ -2,6 +2,6 @@
2
2
 
3
3
  module TPM
4
4
  class KeyAttestation
5
- VERSION = "0.12.1"
5
+ VERSION = "0.14.0"
6
6
  end
7
7
  end
data/lib/tpm/t_public.rb CHANGED
@@ -4,6 +4,7 @@ require "bindata"
4
4
  require "openssl"
5
5
  require "tpm/constants"
6
6
  require "tpm/sized_buffer"
7
+ require "tpm/tpms_ecc_point"
7
8
  require "tpm/t_public/s_ecc_parms"
8
9
  require "tpm/t_public/s_rsa_parms"
9
10
 
@@ -42,7 +43,7 @@ module TPM
42
43
  end
43
44
 
44
45
  choice :unique, selection: :alg_type do
45
- sized_buffer TPM::ALG_ECC
46
+ tpms_ecc_point TPM::ALG_ECC
46
47
  sized_buffer TPM::ALG_RSA
47
48
  end
48
49
 
@@ -75,9 +76,13 @@ module TPM
75
76
  private
76
77
 
77
78
  def ecc_key
78
- if parameters.scheme == TPM::ALG_ECDSA
79
+ case parameters.scheme
80
+ when TPM::ALG_ECDSA, TPM::ALG_NULL
79
81
  group = OpenSSL::PKey::EC::Group.new(openssl_curve_name)
80
- point = OpenSSL::PKey::EC::Point.new(group, bn(ECC_UNCOMPRESSED_POINT_INDICATOR + unique.buffer.value))
82
+ point = OpenSSL::PKey::EC::Point.new(
83
+ group,
84
+ bn(ECC_UNCOMPRESSED_POINT_INDICATOR + unique.x.buffer.value + unique.y.buffer.value)
85
+ )
81
86
 
82
87
  # RFC5480 SubjectPublicKeyInfo
83
88
  asn1 = OpenSSL::ASN1::Sequence(
@@ -94,6 +99,8 @@ module TPM
94
99
 
95
100
  OpenSSL::PKey::EC.new(asn1.to_der)
96
101
  end
102
+ rescue OpenSSL::PKey::EC::Point::Error
103
+ nil
97
104
  end
98
105
 
99
106
  def rsa_key
data/lib/tpm/tpms_ecc_point.rb ADDED
@@ -0,0 +1,12 @@
1
+ # frozen_string_literal: true
2
+
3
+ require "bindata"
4
+
5
+ module TPM
6
+ class TpmsEccPoint < BinData::Record
7
+ endian :big
8
+
9
+ sized_buffer :x
10
+ sized_buffer :y
11
+ end
12
+ end
metadata CHANGED
@@ -1,14 +1,14 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: tpm-key_attestation
3
3
  version: !ruby/object:Gem::Version
4
- version: 0.12.1
4
+ version: 0.14.0
5
5
  platform: ruby
6
6
  authors:
7
7
  - Gonzalo
8
8
  autorequire:
9
9
  bindir: exe
10
10
  cert_chain: []
11
- date: 2024-08-05 00:00:00.000000000 Z
11
+ date: 2025-02-06 00:00:00.000000000 Z
12
12
  dependencies:
13
13
  - !ruby/object:Gem::Dependency
14
14
  name: bindata
@@ -76,6 +76,7 @@ files:
76
76
  - gemfiles/openssl_2_2.gemfile
77
77
  - gemfiles/openssl_3_0.gemfile
78
78
  - gemfiles/openssl_3_1.gemfile
79
+ - gemfiles/openssl_3_2.gemfile
79
80
  - lib/tpm/aik_certificate.rb
80
81
  - lib/tpm/certificates/AMD/RootCA/AMD-fTPM-ECC-RootCA.crt
81
82
  - lib/tpm/certificates/AMD/RootCA/AMD-fTPM-RSA-RootCA.crt
@@ -115,6 +116,7 @@ files:
115
116
  - lib/tpm/t_public/s_ecc_parms.rb
116
117
  - lib/tpm/t_public/s_rsa_parms.rb
117
118
  - lib/tpm/tpm2b_name.rb
119
+ - lib/tpm/tpms_ecc_point.rb
118
120
  - lib/tpm/tpmt_ha.rb
119
121
  - tpm-key_attestation.gemspec
120
122
  homepage: https://github.com/cedarcode/tpm-key_attestation