tpm-key_attestation 0.9.0 → 0.10.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0f495569765faf3eaf8bcd9ff004405e278d720d12253ec01f98175f9dce3e4c
-  data.tar.gz: 26105eb6528b31ddec9a800cdeddea4eee311e25fdfc1c99cee2345b43e58bd9
+  metadata.gz: 28d7fefca9a69f2a4be0c8124bfb2721767c9c891768607473827c11df7aeaa3
+  data.tar.gz: 4739a10cab12236ee54f4bfacd2a182bc2c48622c5feaffd800317d1ff49228d
 SHA512:
-  metadata.gz: 3501ffabdfea8bc28803a2036f0e83d2e16eb7cdcd21a937f9112ffd7ecfdb91ff37290fd97b5d8de50eab22f3ddf109899b7f715c90b4ef667a0aed04156c4b
-  data.tar.gz: 26698f67fad4bcb5788d5f01ab536057b3fa3c0bd2db5338aa495dda45435bf528e101ae91e4afddd3f94b8389456544677a9964871df9f7997b79274ca41f38
+  metadata.gz: b29f8eff516b2f8a8f78583b264586e9eec7c3ad31f8a351517e4b0552a39ef68be0274e83289189395a00e64aac171131252bd24c76fcd964e33a76acab436a
+  data.tar.gz: 69a191891d4a12c8afd4b2acd07ec9c5728506fb33e94cd34e102de1d851acbcfd7694befb6daa01981ab0e2cfaf120a9ddcae4b2d1337eb0e9a74bee485bedd

data/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## [v0.10.0] - 2020-07-09
+
+### Added
+
+- Support ECDSA with NIST P384 and P521 curves
+
 ## [v0.9.0] - 2020-05-31
 
 ### Fixed
@@ -61,6 +67,7 @@ replacement of `JOSE` format `algorithm` string
 - `TPM::EKCertificate` wrapper
 - `TPM::SAttest` wrapper
 
+[v0.10.0]: https://github.com/cedarcode/tpm-key_attestation/compare/v0.9.0...v0.10.0/
 [v0.9.0]: https://github.com/cedarcode/tpm-key_attestation/compare/v0.8.0...v0.9.0/
 [v0.8.0]: https://github.com/cedarcode/tpm-key_attestation/compare/v0.7.0...v0.8.0/
 [v0.7.0]: https://github.com/cedarcode/tpm-key_attestation/compare/v0.6.0...v0.7.0/

data/Gemfile.lock

@@ -1,9 +1,9 @@
 PATH
   remote: .
   specs:
-    tpm-key_attestation (0.9.0)
+    tpm-key_attestation (0.10.0)
       bindata (~> 2.4)
-      openssl-signature_algorithm (~> 0.4.0)
+      openssl-signature_algorithm (~> 1.0)
 
 GEM
   remote: https://rubygems.org/
@@ -12,15 +12,15 @@ GEM
       bundler
       rake
       thor (>= 0.14.0)
-    ast (2.4.0)
+    ast (2.4.1)
     bindata (2.4.7)
     byebug (11.1.3)
-    diff-lcs (1.3)
+    diff-lcs (1.4.4)
     jaro_winkler (1.5.4)
-    openssl-signature_algorithm (0.4.0)
-    parallel (1.19.1)
-    parser (2.7.1.3)
-      ast (~> 2.4.0)
+    openssl-signature_algorithm (1.0.0)
+    parallel (1.19.2)
+    parser (2.7.1.4)
+      ast (~> 2.4.1)
     rainbow (3.0.0)
     rake (13.0.1)
     rexml (3.2.4)

data/lib/tpm/certify_validator.rb

@@ -6,7 +6,7 @@ require "tpm/s_attest"
 
 module TPM
   class CertifyValidator
-    attr_reader :info, :signature, :nonce, :object, :signature_algorithm, :hash_algorithm
+    attr_reader :info, :signature, :nonce, :public_area, :signature_algorithm, :hash_algorithm
 
     TPM_SIGNATURE_ALG_TO_OPENSSL = {
       ALG_RSASSA => OpenSSL::SignatureAlgorithm::RSAPKCS1,
@@ -16,14 +16,16 @@ module TPM
 
     TPM_HASH_ALG_TO_OPENSSL = {
       ALG_SHA1 => "SHA1",
-      ALG_SHA256 => "SHA256"
+      ALG_SHA256 => "SHA256",
+      ALG_SHA384 => "SHA384",
+      ALG_SHA512 => "SHA512"
     }.freeze
 
-    def initialize(info, signature, nonce, object, signature_algorithm: ALG_RSASSA, hash_algorithm: ALG_SHA256)
+    def initialize(info, signature, nonce, public_area, signature_algorithm: ALG_RSASSA, hash_algorithm: ALG_SHA256)
       @info = info
       @signature = signature
       @nonce = nonce
-      @object = object
+      @public_area = public_area
       @signature_algorithm = signature_algorithm
       @hash_algorithm = hash_algorithm
     end
@@ -38,30 +40,38 @@ module TPM
       attest.attested_type == TPM::ST_ATTEST_CERTIFY &&
         attest.extra_data.buffer == nonce &&
         attest.magic == TPM::GENERATED_VALUE &&
-        attest.attested.name.valid_for?(object)
+        attest.attested.name.valid_for?(public_area.name)
     end
 
     def valid_signature?(verify_key)
-      openssl_signature_algorithm = openssl_signature_algorithm_class.new(openssl_hash_function[3..-1])
+      openssl_signature_algorithm = openssl_signature_algorithm_class.new(**openssl_signature_algorithm_parameters)
       openssl_signature_algorithm.verify_key = verify_key
-
-      begin
-        openssl_signature_algorithm.verify(signature, info)
-      rescue OpenSSL::SignatureAlgorithm::Error
-        false
-      end
+      openssl_signature_algorithm.verify(signature, info)
+    rescue OpenSSL::SignatureAlgorithm::Error
+      false
     end
 
     def attest
       @attest ||= TPM::SAttest.deserialize(info)
     end
 
+    def openssl_signature_algorithm_parameters
+      parameters = { hash_function: openssl_hash_function }
+
+      if public_area.ecc?
+        parameters[:curve] = public_area.openssl_curve_name
+      end
+
+      parameters
+    end
+
     def openssl_hash_function
       TPM_HASH_ALG_TO_OPENSSL[hash_algorithm] || raise("Unsupported hash algorithm #{hash_algorithm}")
     end
 
     def openssl_signature_algorithm_class
-      TPM_SIGNATURE_ALG_TO_OPENSSL[signature_algorithm] || raise("Unsupported signature algorithm #{algorithm}")
+      TPM_SIGNATURE_ALG_TO_OPENSSL[signature_algorithm] ||
+        raise("Unsupported signature algorithm #{signature_algorithm}")
     end
   end
 end

data/lib/tpm/constants.rb

@@ -11,6 +11,8 @@ module TPM
   ALG_RSA = 0x0001
   ALG_SHA1 = 0x0004
   ALG_SHA256 = 0x000B
+  ALG_SHA384 = 0x000C
+  ALG_SHA512 = 0x000D
   ALG_NULL = 0x0010
   ALG_RSASSA = 0x0014
   ALG_RSAPSS = 0x0016
@@ -19,6 +21,8 @@ module TPM
 
   # ECC curves
   ECC_NIST_P256 = 0x0003
+  ECC_NIST_P384 = 0x0004
+  ECC_NIST_P521 = 0x0005
 
   # https://trustedcomputinggroup.org/resource/vendor-id-registry/ section 2 "TPM Capabilities Vendor ID (CAP_VID)"
   VENDOR_IDS = {

data/lib/tpm/key_attestation.rb

@@ -2,9 +2,11 @@
 
 require "openssl"
 require "tpm/key_attestation/version"
+
 require "tpm/aik_certificate"
 require "tpm/certify_validator"
 require "tpm/constants"
+require "tpm/public_area"
 
 module TPM
   class KeyAttestation
@@ -71,7 +73,7 @@ module TPM
           certify_info,
           signature,
           qualifying_data,
-          certified_key,
+          public_area,
           signature_algorithm: signature_algorithm,
           hash_algorithm: hash_algorithm
         )

data/lib/tpm/key_attestation/version.rb

@@ -2,6 +2,6 @@
 
 module TPM
   class KeyAttestation
-    VERSION = "0.9.0"
+    VERSION = "0.10.0"
   end
 end

data/lib/tpm/public_area.rb

@@ -24,6 +24,14 @@ module TPM
       t_public.key
     end
 
+    def ecc?
+      t_public.ecc?
+    end
+
+    def openssl_curve_name
+      t_public.openssl_curve_name
+    end
+
     private
 
     def name_digest

data/lib/tpm/t_public.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require "bindata"
+require "openssl"
 require "tpm/constants"
 require "tpm/sized_buffer"
 require "tpm/t_public/s_ecc_parms"
@@ -10,8 +11,16 @@ module TPM
   # Section 12.2.4 in https://trustedcomputinggroup.org/wp-content/uploads/TPM-Rev-2.0-Part-2-Structures-01.38.pdf
   class TPublic < BinData::Record
     BYTE_LENGTH = 8
-    CURVE_TPM_TO_OPENSSL = { TPM::ECC_NIST_P256 => "prime256v1" }.freeze
+
+    CURVE_TPM_TO_OPENSSL = {
+      TPM::ECC_NIST_P256 => "prime256v1",
+      TPM::ECC_NIST_P384 => "secp384r1",
+      TPM::ECC_NIST_P521 => "secp521r1",
+    }.freeze
+
+    BN_BASE = 2
     RSA_KEY_DEFAULT_PUBLIC_EXPONENT = 2**16 + 1
+    ECC_UNCOMPRESSED_POINT_INDICATOR = "\x04"
 
     class << self
       alias_method :deserialize, :read
@@ -37,12 +46,19 @@ module TPM
       sized_buffer TPM::ALG_RSA
     end
 
+    def rsa?
+      alg_type == TPM::ALG_RSA
+    end
+
+    def ecc?
+      alg_type == TPM::ALG_ECC
+    end
+
     def key
       if parameters.symmetric == TPM::ALG_NULL
-        case alg_type
-        when TPM::ALG_ECC
+        if ecc?
           ecc_key
-        when TPM::ALG_RSA
+        elsif rsa?
           rsa_key
         else
           raise "Type #{alg_type} not supported"
@@ -50,21 +66,22 @@ module TPM
       end
     end
 
+    def openssl_curve_name
+      if ecc?
+        CURVE_TPM_TO_OPENSSL[parameters.curve_id] || raise("Unknown curve #{parameters.curve_id}")
+      end
+    end
+
     private
 
     def ecc_key
       if parameters.scheme == TPM::ALG_ECDSA
-        curve = CURVE_TPM_TO_OPENSSL[parameters.curve_id]
+        group = OpenSSL::PKey::EC::Group.new(openssl_curve_name)
 
-        if curve
-          group = OpenSSL::PKey::EC::Group.new(curve)
-          pkey = OpenSSL::PKey::EC.new(group)
-          public_key_bn = OpenSSL::BN.new("\x04" + unique.buffer.value, 2)
-          public_key_point = OpenSSL::PKey::EC::Point.new(group, public_key_bn)
-          pkey.public_key = public_key_point
+        key = OpenSSL::PKey::EC.new(group)
+        key.public_key = OpenSSL::PKey::EC::Point.new(group, bn(ECC_UNCOMPRESSED_POINT_INDICATOR + unique.buffer.value))
 
-          pkey
-        end
+        key
       end
     end
 
@@ -84,7 +101,7 @@ module TPM
 
     def bn(data)
       if data
-        OpenSSL::BN.new(data, 2)
+        OpenSSL::BN.new(data, BN_BASE)
       end
     end
   end

data/lib/tpm/tpm2b_name.rb

@@ -1,7 +1,6 @@
 # frozen_string_literal: true
 
 require "bindata"
-require "tpm/public_area"
 require "tpm/tpmt_ha"
 
 module TPM
@@ -11,8 +10,8 @@ module TPM
     uint16 :name_size, value: lambda { name.to_binary_s.size }
     tpmt_ha :name, read_length: :name_size
 
-    def valid_for?(object)
-      name.to_binary_s == TPM::PublicArea.new(object).name
+    def valid_for?(other_name)
+      name.to_binary_s == other_name
     end
   end
 end

data/tpm-key_attestation.gemspec

@@ -26,5 +26,5 @@ Gem::Specification.new do |spec|
   spec.require_paths = ["lib"]
 
   spec.add_dependency "bindata", "~> 2.4"
-  spec.add_dependency "openssl-signature_algorithm", "~> 0.4.0"
+  spec.add_dependency "openssl-signature_algorithm", "~> 1.0"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: tpm-key_attestation
 version: !ruby/object:Gem::Version
-  version: 0.9.0
+  version: 0.10.0
 platform: ruby
 authors:
 - Gonzalo
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2020-05-31 00:00:00.000000000 Z
+date: 2020-07-09 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bindata
@@ -30,14 +30,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.4.0
+        version: '1.0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.4.0
+        version: '1.0'
 description: 
 email: 
 executables: []
@@ -130,7 +130,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.1.3
+rubygems_version: 3.1.4
 signing_key: 
 specification_version: 4
 summary: TPM Key Attestation verifier