tpm-key_attestation 0.12.1 → 0.13.0

Sign up to get free protection for your applications and to get access to all the features.
Files changed (16) hide show
  1. checksums.yaml +4 -4
  2. data/.github/workflows/build.yml +25 -5
  3. data/Appraisals +4 -0
  4. data/CHANGELOG.md +7 -0
  5. data/Gemfile +1 -1
  6. data/Gemfile.lock +30 -28
  7. data/gemfiles/openssl_2_1.gemfile +1 -1
  8. data/gemfiles/openssl_2_2.gemfile +1 -1
  9. data/gemfiles/openssl_3_0.gemfile +1 -1
  10. data/gemfiles/openssl_3_1.gemfile +1 -1
  11. data/gemfiles/openssl_3_2.gemfile +12 -0
  12. data/lib/tpm/certify_validator.rb +7 -11
  13. data/lib/tpm/key_attestation/version.rb +1 -1
  14. data/lib/tpm/t_public.rb +8 -3
  15. data/lib/tpm/tpms_ecc_point.rb +12 -0
  16. metadata +4 -2
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA256:
3
- metadata.gz: ae6c28ee251d9123abbdaa6c18ab7d424accaf1bb44cbe0e350ccb2bdf8c79ca
4
- data.tar.gz: f172c0436c2dedeab2e8300396ddc515428912f6c73f5688d905723844625320
3
+ metadata.gz: c9e6f949c61e23e0614e570ac3eaeb2d1649d72af8681612cabe4df72b11c76b
4
+ data.tar.gz: d72f892493994557c4afb2547a9cfd78f9e75bd6a01b2d9026ad50028dc09c89
5
5
  SHA512:
6
- metadata.gz: aa78d70ea5a12c5768a0c24d90ae3f6137260ae8b45d14e23c716519b07a3dade2f76735c0a18b39dc1244f09e2ecd47019554395fb03c45d98a88bc454affd0
7
- data.tar.gz: fc501bb669b8ac188a89ce63fe3052b27b22b9e29069a4ca58e4b3538d5b14fd8ae23dccfe1de89027eeb74943750c00b21f460151872b26fdc51ec6f3c45979
6
+ metadata.gz: be7db9415c8e0e3dc8182f3a5c5483ed410e70e2096552efc65426b92209df500057f34440006a16fa39a39121b47bd49987073a3588f029ed74267d38651d6d
7
+ data.tar.gz: a4aef2663a09171e1388db3ab116c5526766363e50beb5ac7b991988d2796c69527647ff9b49fa1863a9ff364ef4c5085cb5449abddc77d4e16347addd53bfe5
data/.github/workflows/build.yml CHANGED
@@ -22,8 +22,9 @@ jobs:
22
22
  os:
23
23
  - ubuntu-20.04
24
24
  - windows-latest
25
- - macos-12
25
+ - macos-13
26
26
  ruby:
27
+ - '3.3'
27
28
  - '3.2'
28
29
  - '3.1'
29
30
  - '3.0'
@@ -36,6 +37,7 @@ jobs:
36
37
  - openssl_2_1
37
38
  - openssl_3_0
38
39
  - openssl_3_1
40
+ - openssl_3_2
39
41
  exclude:
40
42
  - ruby: '2.4'
41
43
  gemfile: openssl_3_0
@@ -45,24 +47,42 @@ jobs:
45
47
  gemfile: openssl_3_1
46
48
  - ruby: '2.5'
47
49
  gemfile: openssl_3_1
50
+ - ruby: '2.4'
51
+ gemfile: openssl_3_2
52
+ - ruby: '2.5'
53
+ gemfile: openssl_3_2
54
+ - ruby: '2.6'
55
+ gemfile: openssl_3_2
48
56
  - ruby: '3.1'
49
57
  gemfile: openssl_2_2
50
- os: macos-12
58
+ os: macos-13
51
59
  - ruby: '3.1'
52
60
  gemfile: openssl_2_1
53
- os: macos-12
61
+ os: macos-13
54
62
  - ruby: '3.2'
55
63
  gemfile: openssl_2_2
56
- os: macos-12
64
+ os: macos-13
57
65
  - ruby: '3.2'
58
66
  gemfile: openssl_2_1
59
- os: macos-12
67
+ os: macos-13
60
68
  - ruby: '3.2'
61
69
  gemfile: openssl_2_2
62
70
  os: windows-latest
63
71
  - ruby: '3.2'
64
72
  gemfile: openssl_2_1
65
73
  os: windows-latest
74
+ - ruby: '3.3'
75
+ gemfile: openssl_2_2
76
+ os: macos-13
77
+ - ruby: '3.3'
78
+ gemfile: openssl_2_1
79
+ os: macos-13
80
+ - ruby: '3.3'
81
+ gemfile: openssl_2_2
82
+ os: windows-latest
83
+ - ruby: '3.3'
84
+ gemfile: openssl_2_1
85
+ os: windows-latest
66
86
  env:
67
87
  BUNDLE_GEMFILE: gemfiles/${{ matrix.gemfile }}.gemfile
68
88
  steps:
data/Appraisals CHANGED
@@ -15,3 +15,7 @@ end
15
15
  appraise "openssl_3_1" do
16
16
  gem "openssl", "~> 3.1.0"
17
17
  end
18
+
19
+ appraise "openssl_3_2" do
20
+ gem "openssl", "~> 3.2.0"
21
+ end
data/CHANGELOG.md CHANGED
@@ -1,5 +1,11 @@
1
1
  # Changelog
2
2
 
3
+ ## [v0.13.0] - 2025-01-21
4
+
5
+ - Use public key from AIK cert for signature algorithm initalization [@santiagorodriguez96]
6
+ - Support algorithm being ECC and pubArea's scheme parameter being TPM_ALG_NULL [@santiagorodriguez96]
7
+ - Allow TPM:TPublic to handle ECC keys in pubArea correctly [@santiagorodriguez96]
8
+
3
9
  ## [v0.12.1] - 2024-08-05
4
10
 
5
11
  - Fix loading trusted certificates on Windows. #20 & #21 [@johnnyshields], [@salmanasiddiqui]
@@ -79,6 +85,7 @@ replacement of `JOSE` format `algorithm` string
79
85
  - `TPM::EKCertificate` wrapper
80
86
  - `TPM::SAttest` wrapper
81
87
 
88
+ [v0.13.0]: https://github.com/cedarcode/tpm-key_attestation/compare/v0.12.1...v0.13.0/
82
89
  [v0.12.0]: https://github.com/cedarcode/tpm-key_attestation/compare/v0.11.0...v0.12.0/
83
90
  [v0.11.0]: https://github.com/cedarcode/tpm-key_attestation/compare/v0.10.0...v0.11.0/
84
91
  [v0.10.0]: https://github.com/cedarcode/tpm-key_attestation/compare/v0.9.0...v0.10.0/
data/Gemfile CHANGED
@@ -5,7 +5,7 @@ source "https://rubygems.org"
5
5
  # Specify your gem's dependencies in tpm-key_attestation.gemspec
6
6
  gemspec
7
7
 
8
- gem "appraisal", "~> 2.2.0"
8
+ gem "appraisal", "~> 2.5.0"
9
9
  gem "byebug", "~> 11.0"
10
10
  gem "rake", "~> 13.0"
11
11
  gem "rspec", "~> 3.0"
data/Gemfile.lock CHANGED
@@ -1,7 +1,7 @@
1
1
  PATH
2
2
  remote: .
3
3
  specs:
4
- tpm-key_attestation (0.11.0)
4
+ tpm-key_attestation (0.12.1)
5
5
  bindata (~> 2.4)
6
6
  openssl (> 2.0)
7
7
  openssl-signature_algorithm (~> 1.0)
@@ -9,37 +9,39 @@ PATH
9
9
  GEM
10
10
  remote: https://rubygems.org/
11
11
  specs:
12
- appraisal (2.2.0)
12
+ appraisal (2.5.0)
13
13
  bundler
14
14
  rake
15
15
  thor (>= 0.14.0)
16
16
  ast (2.4.2)
17
- bindata (2.4.14)
17
+ bindata (2.5.0)
18
18
  byebug (11.1.3)
19
- diff-lcs (1.4.4)
20
- jaro_winkler (1.5.4)
21
- openssl (3.1.0)
22
- openssl-signature_algorithm (1.2.1)
23
- openssl (> 2.0, < 3.1)
24
- parallel (1.20.1)
25
- parser (3.0.0.0)
19
+ diff-lcs (1.5.1)
20
+ jaro_winkler (1.5.6)
21
+ openssl (3.2.0)
22
+ openssl-signature_algorithm (1.3.0)
23
+ openssl (> 2.0)
24
+ parallel (1.26.3)
25
+ parser (3.3.6.0)
26
26
  ast (~> 2.4.1)
27
- rainbow (3.0.0)
28
- rake (13.0.3)
29
- rexml (3.2.4)
30
- rspec (3.10.0)
31
- rspec-core (~> 3.10.0)
32
- rspec-expectations (~> 3.10.0)
33
- rspec-mocks (~> 3.10.0)
34
- rspec-core (3.10.1)
35
- rspec-support (~> 3.10.0)
36
- rspec-expectations (3.10.1)
27
+ racc
28
+ racc (1.8.1)
29
+ rainbow (3.1.1)
30
+ rake (13.2.1)
31
+ rexml (3.3.9)
32
+ rspec (3.13.0)
33
+ rspec-core (~> 3.13.0)
34
+ rspec-expectations (~> 3.13.0)
35
+ rspec-mocks (~> 3.13.0)
36
+ rspec-core (3.13.2)
37
+ rspec-support (~> 3.13.0)
38
+ rspec-expectations (3.13.3)
37
39
  diff-lcs (>= 1.2.0, < 2.0)
38
- rspec-support (~> 3.10.0)
39
- rspec-mocks (3.10.2)
40
+ rspec-support (~> 3.13.0)
41
+ rspec-mocks (3.13.2)
40
42
  diff-lcs (>= 1.2.0, < 2.0)
41
- rspec-support (~> 3.10.0)
42
- rspec-support (3.10.2)
43
+ rspec-support (~> 3.13.0)
44
+ rspec-support (3.13.2)
43
45
  rubocop (0.80.1)
44
46
  jaro_winkler (~> 1.5.1)
45
47
  parallel (~> 1.10)
@@ -48,15 +50,15 @@ GEM
48
50
  rexml
49
51
  ruby-progressbar (~> 1.7)
50
52
  unicode-display_width (>= 1.4.0, < 1.7)
51
- ruby-progressbar (1.11.0)
52
- thor (1.1.0)
53
+ ruby-progressbar (1.13.0)
54
+ thor (1.3.2)
53
55
  unicode-display_width (1.6.1)
54
56
 
55
57
  PLATFORMS
56
58
  ruby
57
59
 
58
60
  DEPENDENCIES
59
- appraisal (~> 2.2.0)
61
+ appraisal (~> 2.5.0)
60
62
  byebug (~> 11.0)
61
63
  rake (~> 13.0)
62
64
  rspec (~> 3.0)
@@ -64,4 +66,4 @@ DEPENDENCIES
64
66
  tpm-key_attestation!
65
67
 
66
68
  BUNDLED WITH
67
- 2.2.8
69
+ 2.5.23
data/gemfiles/openssl_2_1.gemfile CHANGED
@@ -2,7 +2,7 @@
2
2
 
3
3
  source "https://rubygems.org"
4
4
 
5
- gem "appraisal", "~> 2.2.0"
5
+ gem "appraisal", "~> 2.5.0"
6
6
  gem "byebug", "~> 11.0"
7
7
  gem "rake", "~> 13.0"
8
8
  gem "rspec", "~> 3.0"
data/gemfiles/openssl_2_2.gemfile CHANGED
@@ -2,7 +2,7 @@
2
2
 
3
3
  source "https://rubygems.org"
4
4
 
5
- gem "appraisal", "~> 2.2.0"
5
+ gem "appraisal", "~> 2.5.0"
6
6
  gem "byebug", "~> 11.0"
7
7
  gem "rake", "~> 13.0"
8
8
  gem "rspec", "~> 3.0"
data/gemfiles/openssl_3_0.gemfile CHANGED
@@ -2,7 +2,7 @@
2
2
 
3
3
  source "https://rubygems.org"
4
4
 
5
- gem "appraisal", "~> 2.2.0"
5
+ gem "appraisal", "~> 2.5.0"
6
6
  gem "byebug", "~> 11.0"
7
7
  gem "rake", "~> 13.0"
8
8
  gem "rspec", "~> 3.0"
data/gemfiles/openssl_3_1.gemfile CHANGED
@@ -2,7 +2,7 @@
2
2
 
3
3
  source "https://rubygems.org"
4
4
 
5
- gem "appraisal", "~> 2.2.0"
5
+ gem "appraisal", "~> 2.5.0"
6
6
  gem "byebug", "~> 11.0"
7
7
  gem "rake", "~> 13.0"
8
8
  gem "rspec", "~> 3.0"
data/gemfiles/openssl_3_2.gemfile ADDED
@@ -0,0 +1,12 @@
1
+ # This file was generated by Appraisal
2
+
3
+ source "https://rubygems.org"
4
+
5
+ gem "appraisal", "~> 2.5.0"
6
+ gem "byebug", "~> 11.0"
7
+ gem "rake", "~> 13.0"
8
+ gem "rspec", "~> 3.0"
9
+ gem "rubocop", "~> 0.80.1"
10
+ gem "openssl", "~> 3.2.0"
11
+
12
+ gemspec path: "../"
data/lib/tpm/certify_validator.rb CHANGED
@@ -44,7 +44,13 @@ module TPM
44
44
  end
45
45
 
46
46
  def valid_signature?(verify_key)
47
- openssl_signature_algorithm = openssl_signature_algorithm_class.new(**openssl_signature_algorithm_parameters)
47
+ parameters = { hash_function: openssl_hash_function }
48
+
49
+ if verify_key.is_a?(OpenSSL::PKey::EC) || verify_key.is_a?(OpenSSL::PKey::EC::Point)
50
+ parameters[:curve] = verify_key.group.curve_name
51
+ end
52
+
53
+ openssl_signature_algorithm = openssl_signature_algorithm_class.new(**parameters)
48
54
  openssl_signature_algorithm.verify_key = verify_key
49
55
  openssl_signature_algorithm.verify(signature, info)
50
56
  rescue OpenSSL::SignatureAlgorithm::Error
@@ -55,16 +61,6 @@ module TPM
55
61
  @attest ||= TPM::SAttest.deserialize(info)
56
62
  end
57
63
 
58
- def openssl_signature_algorithm_parameters
59
- parameters = { hash_function: openssl_hash_function }
60
-
61
- if public_area.ecc?
62
- parameters[:curve] = public_area.openssl_curve_name
63
- end
64
-
65
- parameters
66
- end
67
-
68
64
  def openssl_hash_function
69
65
  TPM_HASH_ALG_TO_OPENSSL[hash_algorithm] || raise("Unsupported hash algorithm #{hash_algorithm}")
70
66
  end
data/lib/tpm/key_attestation/version.rb CHANGED
@@ -2,6 +2,6 @@
2
2
 
3
3
  module TPM
4
4
  class KeyAttestation
5
- VERSION = "0.12.1"
5
+ VERSION = "0.13.0"
6
6
  end
7
7
  end
data/lib/tpm/t_public.rb CHANGED
@@ -4,6 +4,7 @@ require "bindata"
4
4
  require "openssl"
5
5
  require "tpm/constants"
6
6
  require "tpm/sized_buffer"
7
+ require "tpm/tpms_ecc_point"
7
8
  require "tpm/t_public/s_ecc_parms"
8
9
  require "tpm/t_public/s_rsa_parms"
9
10
 
@@ -42,7 +43,7 @@ module TPM
42
43
  end
43
44
 
44
45
  choice :unique, selection: :alg_type do
45
- sized_buffer TPM::ALG_ECC
46
+ tpms_ecc_point TPM::ALG_ECC
46
47
  sized_buffer TPM::ALG_RSA
47
48
  end
48
49
 
@@ -75,9 +76,13 @@ module TPM
75
76
  private
76
77
 
77
78
  def ecc_key
78
- if parameters.scheme == TPM::ALG_ECDSA
79
+ case parameters.scheme
80
+ when TPM::ALG_ECDSA, TPM::ALG_NULL
79
81
  group = OpenSSL::PKey::EC::Group.new(openssl_curve_name)
80
- point = OpenSSL::PKey::EC::Point.new(group, bn(ECC_UNCOMPRESSED_POINT_INDICATOR + unique.buffer.value))
82
+ point = OpenSSL::PKey::EC::Point.new(
83
+ group,
84
+ bn(ECC_UNCOMPRESSED_POINT_INDICATOR + unique.x.buffer.value + unique.y.buffer.value)
85
+ )
81
86
 
82
87
  # RFC5480 SubjectPublicKeyInfo
83
88
  asn1 = OpenSSL::ASN1::Sequence(
data/lib/tpm/tpms_ecc_point.rb ADDED
@@ -0,0 +1,12 @@
1
+ # frozen_string_literal: true
2
+
3
+ require "bindata"
4
+
5
+ module TPM
6
+ class TpmsEccPoint < BinData::Record
7
+ endian :big
8
+
9
+ sized_buffer :x
10
+ sized_buffer :y
11
+ end
12
+ end
metadata CHANGED
@@ -1,14 +1,14 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: tpm-key_attestation
3
3
  version: !ruby/object:Gem::Version
4
- version: 0.12.1
4
+ version: 0.13.0
5
5
  platform: ruby
6
6
  authors:
7
7
  - Gonzalo
8
8
  autorequire:
9
9
  bindir: exe
10
10
  cert_chain: []
11
- date: 2024-08-05 00:00:00.000000000 Z
11
+ date: 2025-01-22 00:00:00.000000000 Z
12
12
  dependencies:
13
13
  - !ruby/object:Gem::Dependency
14
14
  name: bindata
@@ -76,6 +76,7 @@ files:
76
76
  - gemfiles/openssl_2_2.gemfile
77
77
  - gemfiles/openssl_3_0.gemfile
78
78
  - gemfiles/openssl_3_1.gemfile
79
+ - gemfiles/openssl_3_2.gemfile
79
80
  - lib/tpm/aik_certificate.rb
80
81
  - lib/tpm/certificates/AMD/RootCA/AMD-fTPM-ECC-RootCA.crt
81
82
  - lib/tpm/certificates/AMD/RootCA/AMD-fTPM-RSA-RootCA.crt
@@ -115,6 +116,7 @@ files:
115
116
  - lib/tpm/t_public/s_ecc_parms.rb
116
117
  - lib/tpm/t_public/s_rsa_parms.rb
117
118
  - lib/tpm/tpm2b_name.rb
119
+ - lib/tpm/tpms_ecc_point.rb
118
120
  - lib/tpm/tpmt_ha.rb
119
121
  - tpm-key_attestation.gemspec
120
122
  homepage: https://github.com/cedarcode/tpm-key_attestation