tpm-key_attestation 0.5.0 → 0.6.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e5df735cc88867e6fb7c0cdb55698173cfdddec88630b3a69534ba15cd0d9c32
-  data.tar.gz: aef2b61ce9a23bd4bd27f9dda61e7719a7eb1914ce29321d3e6ab2c723ffcf16
+  metadata.gz: 6b370d3aabc86bde782bf8cf6a6507f85edf56a676875fd4511c30dd4ddff1da
+  data.tar.gz: 53ce92d16a1ab22b573236c0a859c8ebec4c6172679b22d957e6ebf3347d4531
 SHA512:
-  metadata.gz: 3ec2802f034dfceebd917044760337c4968cb0268b8de970fd977c0f5d5da5ffbaf3c7017b12c3d372d1973d2f4807d1051e90ed28ddb4a8bca52eb15510cf57
-  data.tar.gz: 2bba01a0fdcd9baee3af72c2442a388cccde52b31c3e22a2e25ee46cace1edb307d1246ecdb62e11251a3e41d0114318a973f5253bfb8516d940c27dbd134d80
+  metadata.gz: 407f2c3dadf408a90c536cb5723e52ebc28e12f89231b93c6915ba182b7773960c256c7a2d5cc087bb3af02bf14522518cdafc279783321e3f0812daafe7b405
+  data.tar.gz: '0787cf34b0c204ed54391766fceafdf28fb1fcc5a453887b0a8f671f13f6c4b89f9f562e6ec6b72e996b3668f4b797ec0a53acdee87174a8cb0ae97c6dbdf91f'

data/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [v0.6.0] - 2020-01-30
+
+### Changed
+
+- `TPM::KeyAttestation.new` now accepts `signature_algorithm` and `hash_algorithm` in TPM format in
+replacement of `JOSE` format `algorithm` string
+
 ## [v0.5.0] - 2020-01-23
 
 ### Added
@@ -31,6 +38,7 @@
 - `TPM::EKCertificate` wrapper
 - `TPM::SAttest` wrapper
 
+[v0.6.0]: https://github.com/cedarcode/tpm-key_attestation/compare/v0.5.0...v0.6.0/
 [v0.5.0]: https://github.com/cedarcode/tpm-key_attestation/compare/v0.4.0...v0.5.0/
 [v0.4.0]: https://github.com/cedarcode/tpm-key_attestation/compare/v0.3.0...v0.4.0/
 [v0.3.0]: https://github.com/cedarcode/tpm-key_attestation/compare/v0.2.0...v0.3.0/

data/Gemfile.lock

@@ -1,8 +1,9 @@
 PATH
   remote: .
   specs:
-    tpm-key_attestation (0.5.0)
+    tpm-key_attestation (0.6.0)
       bindata (~> 2.4)
+      openssl-signature_algorithm (~> 0.3.0)
 
 GEM
   remote: https://rubygems.org/
@@ -16,6 +17,7 @@ GEM
     byebug (11.1.0)
     diff-lcs (1.3)
     jaro_winkler (1.5.4)
+    openssl-signature_algorithm (0.3.0)
     parallel (1.19.1)
     parser (2.7.0.2)
       ast (~> 2.4.0)

data/README.md

@@ -31,7 +31,7 @@ key_attestation =
     certified_object,
     signing_key,
     quilifying_data,
-    algorithm: "RS256" # Supported values: "RS256", "PS256", "ES256" (default "RS256")
+    signature_algorithm: TPM::ALG_RSAPSS # Supported values: TPM::ALG_RSAPSS, TPM::ALG_RSASSA, TPM::ALG_ECDSA (default TPM::ALG_RSASSA)
   )
 
 if key_attestation.valid?

data/lib/tpm/certify_validator.rb

@@ -1,19 +1,32 @@
 # frozen_string_literal: true
 
+require "openssl/signature_algorithm"
 require "tpm/constants"
 require "tpm/public_area"
 require "tpm/s_attest"
 
 module TPM
   class CertifyValidator
-    attr_reader :info, :signature, :nonce, :object, :algorithm
+    attr_reader :info, :signature, :nonce, :object, :signature_algorithm, :hash_algorithm
 
-    def initialize(info, signature, nonce, object, algorithm: "RS256")
+    TPM_SIGNATURE_ALG_TO_OPENSSL = {
+      ALG_RSASSA => OpenSSL::SignatureAlgorithm::RSAPKCS1,
+      ALG_RSAPSS => OpenSSL::SignatureAlgorithm::RSAPSS,
+      ALG_ECDSA => OpenSSL::SignatureAlgorithm::ECDSA
+    }.freeze
+
+    TPM_HASH_ALG_TO_OPENSSL = {
+      ALG_SHA1 => "SHA1",
+      ALG_SHA256 => "SHA256"
+    }.freeze
+
+    def initialize(info, signature, nonce, object, signature_algorithm: ALG_RSASSA, hash_algorithm: ALG_SHA256)
       @info = info
       @signature = signature
       @nonce = nonce
       @object = object
-      @algorithm = algorithm
+      @signature_algorithm = signature_algorithm
+      @hash_algorithm = hash_algorithm
     end
 
     def valid?(signing_key)
@@ -29,11 +42,14 @@ module TPM
         attest.attested.name.buffer == TPM::PublicArea.new(object).name
     end
 
-    def valid_signature?(signing_key)
-      if rsa_pss?
-        signing_key.verify_pss(hash_function, signature, info, salt_length: :auto, mgf1_hash: hash_function)
-      else
-        signing_key.verify(hash_function, signature, info)
+    def valid_signature?(verify_key)
+      openssl_signature_algorithm = openssl_signature_algorithm_class.new(openssl_hash_function[3..-1])
+      openssl_signature_algorithm.verify_key = verify_key
+
+      begin
+        openssl_signature_algorithm.verify(signature, info)
+      rescue OpenSSL::SignatureAlgorithm::Error
+        false
       end
     end
 
@@ -41,12 +57,12 @@ module TPM
       @attest ||= TPM::SAttest.deserialize(info)
     end
 
-    def hash_function
-      "SHA#{algorithm[2..-1]}"
+    def openssl_hash_function
+      TPM_HASH_ALG_TO_OPENSSL[hash_algorithm] || raise("Unsupported hash algorithm #{hash_algorithm}")
     end
 
-    def rsa_pss?
-      algorithm.start_with?("PS")
+    def openssl_signature_algorithm_class
+      TPM_SIGNATURE_ALG_TO_OPENSSL[signature_algorithm] || raise("Unsupported signature algorithm #{algorithm}")
     end
   end
 end

data/lib/tpm/ek_certificate.rb

@@ -72,7 +72,7 @@ module TPM
       model = name.assoc(OID_TCG_AT_TPM_MODEL).at(1)
       version = name.assoc(OID_TCG_AT_TPM_VERSION).at(1)
 
-      ::TPM::VENDOR_IDS[manufacturer] &&
+      TPM::VENDOR_IDS[manufacturer] &&
         !model.empty? &&
         !version.empty? &&
         (empty_subject? && extension.critical? || !empty_subject? && !extension.critical?)

data/lib/tpm/key_attestation.rb

@@ -2,20 +2,38 @@
 
 require "tpm/key_attestation/version"
 require "tpm/certify_validator"
+require "tpm/constants"
 
 module TPM
   class KeyAttestation
     class Error < StandardError; end
 
-    attr_reader :certify_info, :signature, :certified_object, :signing_key, :algorithm, :qualifying_data
+    attr_reader(
+      :certify_info,
+      :signature,
+      :certified_object,
+      :signing_key,
+      :signature_algorithm,
+      :hash_algorithm,
+      :qualifying_data
+    )
 
-    def initialize(certify_info, signature, certified_object, signing_key, qualifying_data, algorithm: "RS256")
+    def initialize(
+      certify_info,
+      signature,
+      certified_object,
+      signing_key,
+      qualifying_data,
+      signature_algorithm: ALG_RSASSA,
+      hash_algorithm: ALG_SHA256
+    )
       @certify_info = certify_info
       @signature = signature
 
       @certified_object = certified_object
       @signing_key = signing_key
-      @algorithm = algorithm
+      @signature_algorithm = signature_algorithm
+      @hash_algorithm = hash_algorithm
       @qualifying_data = qualifying_data
     end
 
@@ -38,7 +56,8 @@ module TPM
           signature,
           qualifying_data,
           certified_object,
-          algorithm: algorithm
+          signature_algorithm: signature_algorithm,
+          hash_algorithm: hash_algorithm
         )
     end
 

data/lib/tpm/key_attestation/version.rb

@@ -2,6 +2,6 @@
 
 module TPM
   class KeyAttestation
-    VERSION = "0.5.0"
+    VERSION = "0.6.0"
   end
 end

data/lib/tpm/t_public.rb

@@ -37,7 +37,7 @@ module TPM
     end
 
     def key
-      if parameters.symmetric == ::TPM::ALG_NULL
+      if parameters.symmetric == TPM::ALG_NULL
         case alg_type
         when TPM::ALG_ECC
           ecc_key

data/tpm-key_attestation.gemspec

@@ -26,4 +26,5 @@ Gem::Specification.new do |spec|
   spec.require_paths = ["lib"]
 
   spec.add_dependency "bindata", "~> 2.4"
+  spec.add_dependency "openssl-signature_algorithm", "~> 0.3.0"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: tpm-key_attestation
 version: !ruby/object:Gem::Version
-  version: 0.5.0
+  version: 0.6.0
 platform: ruby
 authors:
 - Gonzalo
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2020-01-23 00:00:00.000000000 Z
+date: 2020-01-30 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bindata
@@ -24,6 +24,20 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '2.4'
+- !ruby/object:Gem::Dependency
+  name: openssl-signature_algorithm
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 0.3.0
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 0.3.0
 description: 
 email: 
 executables: []