tpm-key_attestation 0.3.0 → 0.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: fbe3cdf38d6460a938f807e18343011b5b1222fd0a3451c40ca0675ea30e74b1
-  data.tar.gz: 7bad2c9779bc3c15cb591ca6ca7a54ac0c608727166056360c31d77bc5cc23fd
+  metadata.gz: aa6a84bd8d758948be4dbb8ee8719205c70f049b841027f496c6f5c5c25362b0
+  data.tar.gz: ca4acf429c5ea3a819c34c8f5ae3053053efa81f1209c4f3152480096562ac1e
 SHA512:
-  metadata.gz: 0ffae87bcd8326dcbaaad92e9d487843461ae07d67dc20b0934d1130de00b8c167553c072e8674a41214f330952b9b6bb39ada04d2f6aad2bf62c3748c056e14
-  data.tar.gz: 2f650b3bd139b0db1c41eccbc99cd59f9a4af01454b94b31672cfad58c253c5c4cfc36ffccabc561b651d0b1a7789dc94420c8b680245cd1215053328ca2ce18
+  metadata.gz: 7a0a2dea4c9669fc3a7fdb01d1515987fc61974209414b3d3ec30875f799b0c2111ea40cc6f75f86ff2d95ec7975110905b9a36c27b88f0e09dd4ef2f7c90287
+  data.tar.gz: 0717bc921eba45a9eda3d347f6b70b45c2dfbfc231eba53e2dfddd2ba1f1b22d5fe3fce60ec6f7d79c035813a755e82830c07c64f7750b6e41ede257c3460430

data/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## [v0.4.0] - 2020-01-20
+
+### Added
+
+- Suport verification of RSA-PSS key attestations
+
 ## [v0.3.0] - 2020-01-20
 
 ### Added
@@ -19,6 +25,7 @@
 - `TPM::EKCertificate` wrapper
 - `TPM::SAttest` wrapper
 
+[v0.4.0]: https://github.com/cedarcode/tpm-key_attestation/compare/v0.3.0...v0.4.0/
 [v0.3.0]: https://github.com/cedarcode/tpm-key_attestation/compare/v0.2.0...v0.3.0/
 [v0.2.0]: https://github.com/cedarcode/tpm-key_attestation/compare/v0.1.0...v0.2.0/
 [v0.1.0]: https://github.com/cedarcode/tpm-key_attestation/compare/57c926ef7e83830cee8d111fdc5ccaf99ab2e861...v0.1.0/

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    tpm-key_attestation (0.2.0)
+    tpm-key_attestation (0.4.0)
       bindata (~> 2.4)
 
 GEM

data/README.md

@@ -30,8 +30,8 @@ key_attestation =
     signature,
     certified_object,
     signing_key,
-    hash_function,
-    quilifying_data
+    quilifying_data,
+    algorithm: "RS256" # Supported values: "RS256", "PS256", "ES256" (default "RS256")
   )
 
 if key_attestation.valid?

data/lib/tpm/certify_validator.rb

@@ -6,17 +6,18 @@ require "tpm/s_attest"
 
 module TPM
   class CertifyValidator
-    attr_reader :info, :signature, :nonce, :object
+    attr_reader :info, :signature, :nonce, :object, :algorithm
 
-    def initialize(info, signature, nonce, object)
+    def initialize(info, signature, nonce, object, algorithm: "RS256")
       @info = info
       @signature = signature
       @nonce = nonce
       @object = object
+      @algorithm = algorithm
     end
 
-    def valid?(signing_key, hash_function)
-      valid_info? && valid_signature?(signing_key, hash_function)
+    def valid?(signing_key)
+      valid_info? && valid_signature?(signing_key)
     end
 
     private
@@ -28,12 +29,24 @@ module TPM
         attest.attested.name.buffer == TPM::PublicArea.new(object).name
     end
 
-    def valid_signature?(signing_key, hash_function)
-      signing_key.verify(hash_function, signature, info)
+    def valid_signature?(signing_key)
+      if rsa_pss?
+        signing_key.verify_pss(hash_function, signature, info, salt_length: :auto, mgf1_hash: hash_function)
+      else
+        signing_key.verify(hash_function, signature, info)
+      end
     end
 
     def attest
       @attest ||= TPM::SAttest.deserialize(info)
     end
+
+    def hash_function
+      "SHA#{algorithm[2..-1]}"
+    end
+
+    def rsa_pss?
+      algorithm.start_with?("PS")
+    end
   end
 end

data/lib/tpm/key_attestation.rb

@@ -7,15 +7,15 @@ module TPM
   class KeyAttestation
     class Error < StandardError; end
 
-    attr_reader :certify_info, :signature, :certified_object, :signing_key, :hash_function, :qualifying_data
+    attr_reader :certify_info, :signature, :certified_object, :signing_key, :algorithm, :qualifying_data
 
-    def initialize(certify_info, signature, certified_object, signing_key, hash_function, qualifying_data)
+    def initialize(certify_info, signature, certified_object, signing_key, qualifying_data, algorithm: "RS256")
       @certify_info = certify_info
       @signature = signature
 
       @certified_object = certified_object
       @signing_key = signing_key
-      @hash_function = hash_function
+      @algorithm = algorithm
       @qualifying_data = qualifying_data
     end
 
@@ -26,7 +26,7 @@ module TPM
     end
 
     def valid?
-      certify_validator.valid?(signing_key, hash_function)
+      certify_validator.valid?(signing_key)
     end
 
     private
@@ -37,7 +37,8 @@ module TPM
           certify_info,
           signature,
           qualifying_data,
-          certified_object
+          certified_object,
+          algorithm: algorithm
         )
     end
 

data/lib/tpm/key_attestation/version.rb

@@ -2,6 +2,6 @@
 
 module TPM
   class KeyAttestation
-    VERSION = "0.3.0"
+    VERSION = "0.4.0"
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: tpm-key_attestation
 version: !ruby/object:Gem::Version
-  version: 0.3.0
+  version: 0.4.0
 platform: ruby
 authors:
 - Gonzalo