Skip to content

Commit

Permalink
tpm2: rename base version to generation
Browse files Browse the repository at this point in the history
  • Loading branch information
@sespiros
sespiros committed Feb 28, 2024
1 parent e290c7d commit 4facbee
Show file tree
Hide file tree
Showing 5 changed files with 28 additions and 28 deletions.
16 changes: 8 additions & 8 deletions tpm2/keydata_v3.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -35,13 +35,13 @@ import (
)

type additionalData_v3 struct {
BaseVersion uint32
KDFAlg tpm2.HashAlgorithmId
AuthMode secboot.AuthMode
Generation uint32
KDFAlg tpm2.HashAlgorithmId
AuthMode secboot.AuthMode
}

func (d additionalData_v3) Marshal(w io.Writer) error {
_, err := mu.MarshalToWriter(w, uint32(3), d.BaseVersion, d.KDFAlg, d.AuthMode)
_, err := mu.MarshalToWriter(w, uint32(3), d.Generation, d.KDFAlg, d.AuthMode)
return err
}

Expand Down Expand Up @@ -165,16 +165,16 @@ func (d *keyData_v3) Policy() keyDataPolicy {
return d.PolicyData
}

func (d *keyData_v3) Decrypt(key, payload []byte, baseVersion uint32, kdfAlg tpm2.HashAlgorithmId, authMode secboot.AuthMode) ([]byte, error) {
func (d *keyData_v3) Decrypt(key, payload []byte, generation uint32, kdfAlg tpm2.HashAlgorithmId, authMode secboot.AuthMode) ([]byte, error) {
// We only support AES-256-GCM with a 12-byte nonce, so we expect 44 bytes here
if len(key) != 32+12 {
return nil, errors.New("invalid symmetric key size")
}

aad, err := mu.MarshalToBytes(&additionalData_v3{
BaseVersion: baseVersion,
KDFAlg: kdfAlg,
AuthMode: authMode,
Generation: generation,
KDFAlg: kdfAlg,
AuthMode: authMode,
})
if err != nil {
return nil, xerrors.Errorf("cannot create AAD: %w", err)
Expand Down
6 changes: 3 additions & 3 deletions tpm2/platform.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -39,10 +39,10 @@ const platformName = "tpm2"
type platformKeyDataHandler struct{}

func (h *platformKeyDataHandler) recoverKeysCommon(data *secboot.PlatformKeyData, encryptedPayload, authKey []byte) ([]byte, error) {
if data.Version < 0 || int64(data.Version) > math.MaxUint32 {
if data.Generation < 0 || int64(data.Generation) > math.MaxUint32 {
return nil, &secboot.PlatformHandlerError{
Type: secboot.PlatformHandlerErrorInvalidData,
Err: fmt.Errorf("invalid base key data version: %d", data.Version)}
Err: fmt.Errorf("invalid key data generation: %d", data.Generation)}
}

kdfAlg, err := hashAlgorithmIdFromCryptoHash(data.KDFAlg)
Expand Down Expand Up @@ -102,7 +102,7 @@ func (h *platformKeyDataHandler) recoverKeysCommon(data *secboot.PlatformKeyData
return nil, xerrors.Errorf("cannot unseal key: %w", err)
}

payload, err := k.data.Decrypt(symKey, encryptedPayload, uint32(data.Version), kdfAlg, data.AuthMode)
payload, err := k.data.Decrypt(symKey, encryptedPayload, uint32(data.Generation), kdfAlg, data.AuthMode)
if err != nil {
return nil, &secboot.PlatformHandlerError{
Type: secboot.PlatformHandlerErrorInvalidData,
Expand Down
22 changes: 11 additions & 11 deletions tpm2/platform_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -197,7 +197,7 @@ func (s *platformSuite) testRecoverKeys(c *C, params *ProtectKeyParams) {
c.Check(k.UnmarshalPlatformHandle(&platformHandle), IsNil)

platformKeyData := &secboot.PlatformKeyData{
Version: k.Version(),
Generation: k.Generation(),
EncodedHandle: platformHandle,
KDFAlg: crypto.Hash(crypto.SHA256),
AuthMode: k.AuthMode(),
Expand Down Expand Up @@ -253,7 +253,7 @@ func (s *platformSuite) testRecoverKeysNoValidSRK(c *C, prepareSrk func()) {

var handler PlatformKeyDataHandler
payload, err := handler.RecoverKeys(&secboot.PlatformKeyData{
Version: k.Version(),
Generation: k.Generation(),
EncodedHandle: platformHandle,
KDFAlg: crypto.Hash(crypto.SHA256)},
s.lastEncryptedPayload)
Expand Down Expand Up @@ -307,7 +307,7 @@ func (s *platformSuite) testRecoverKeysImportable(c *C, params *ProtectKeyParams

var handler PlatformKeyDataHandler
payload, err := handler.RecoverKeys(&secboot.PlatformKeyData{
Version: k.Version(),
Generation: k.Generation(),
EncodedHandle: platformHandle,
KDFAlg: crypto.Hash(crypto.SHA256)},
s.lastEncryptedPayload)
Expand Down Expand Up @@ -356,7 +356,7 @@ func (s *platformSuite) TestRecoverKeysNoTPMConnection(c *C) {

var handler PlatformKeyDataHandler
_, err = handler.RecoverKeys(&secboot.PlatformKeyData{
Version: k.Version(),
Generation: k.Generation(),
EncodedHandle: platformHandle,
KDFAlg: crypto.Hash(crypto.SHA256)},
s.lastEncryptedPayload)
Expand All @@ -381,7 +381,7 @@ func (s *platformSuite) testRecoverKeysUnsealErrorHandling(c *C, prepare func(*s

var handler PlatformKeyDataHandler
_, err = handler.RecoverKeys(&secboot.PlatformKeyData{
Version: k.Version(),
Generation: k.Generation(),
AuthMode: secboot.AuthModeNone,
Role: "",
KDFAlg: crypto.Hash(crypto.SHA256),
Expand Down Expand Up @@ -502,7 +502,7 @@ func (s *platformSuite) TestRecoverKeysWithAuthKey(c *C) {
c.Check(k.UnmarshalPlatformHandle(&platformHandle), IsNil)

platformKeyData := &secboot.PlatformKeyData{
Version: k.Version(),
Generation: k.Generation(),
EncodedHandle: platformHandle,
KDFAlg: crypto.Hash(crypto.SHA256),
AuthMode: k.AuthMode(),
Expand All @@ -513,7 +513,7 @@ func (s *platformSuite) TestRecoverKeysWithAuthKey(c *C) {
c.Check(err, IsNil)

newPlatformKeyData := &secboot.PlatformKeyData{
Version: k.Version(),
Generation: k.Generation(),
EncodedHandle: newHandle,
KDFAlg: crypto.Hash(crypto.SHA256),
AuthMode: k.AuthMode(),
Expand Down Expand Up @@ -579,7 +579,7 @@ func (s *platformSuite) TestRecoverKeysWithIncorrectAuthKey(c *C) {
c.Check(k.UnmarshalPlatformHandle(&platformHandle), IsNil)

platformKeyData := &secboot.PlatformKeyData{
Version: k.Version(),
Generation: k.Generation(),
EncodedHandle: platformHandle,
KDFAlg: crypto.Hash(crypto.SHA256),
AuthMode: k.AuthMode(),
Expand All @@ -590,7 +590,7 @@ func (s *platformSuite) TestRecoverKeysWithIncorrectAuthKey(c *C) {
c.Check(err, IsNil)

newPlatformKeyData := &secboot.PlatformKeyData{
Version: k.Version(),
Generation: k.Generation(),
EncodedHandle: newHandle,
KDFAlg: crypto.Hash(crypto.SHA256),
// AuthMode: k.AuthMode(),
Expand Down Expand Up @@ -651,7 +651,7 @@ func (s *platformSuite) TestChangeAuthKeyWithIncorrectAuthKey(c *C) {
c.Check(k.UnmarshalPlatformHandle(&platformHandle), IsNil)

platformKeyData := &secboot.PlatformKeyData{
Version: k.Version(),
Generation: k.Generation(),
EncodedHandle: platformHandle,
KDFAlg: crypto.Hash(crypto.SHA256),
AuthMode: k.AuthMode(),
Expand All @@ -662,7 +662,7 @@ func (s *platformSuite) TestChangeAuthKeyWithIncorrectAuthKey(c *C) {
c.Check(err, IsNil)

newPlatformKeyData := &secboot.PlatformKeyData{
Version: k.Version(),
Generation: k.Generation(),
EncodedHandle: newHandle,
KDFAlg: crypto.Hash(crypto.SHA256),
AuthMode: k.AuthMode(),
Expand Down
6 changes: 3 additions & 3 deletions tpm2/seal.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -187,9 +187,9 @@ func makeSealedKeyData(tpm *tpm2.TPMContext, params *makeSealedKeyDataParams, se
}

aad, err := mu.MarshalToBytes(&additionalData_v3{
BaseVersion: uint32(secboot.KeyDataVersion),
KDFAlg: tpm2.HashAlgorithmSHA256,
AuthMode: params.AuthMode,
Generation: uint32(secboot.KeyDataGeneration),
KDFAlg: tpm2.HashAlgorithmSHA256,
AuthMode: params.AuthMode,
})
if err != nil {
return nil, nil, nil, xerrors.Errorf("cannot create AAD: %w", err)
Expand Down
6 changes: 3 additions & 3 deletions tpm2/seal_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -619,9 +619,9 @@ func (s *sealSuiteNoTPM) testMakeSealedKeyData(c *C, data *testMakeSealedKeyData
c.Assert(err, IsNil)

aad, err := mu.MarshalToBytes(&AdditionalData_v3{
BaseVersion: uint32(kd.Version()),
KDFAlg: tpm2.HashAlgorithmSHA256,
AuthMode: kd.AuthMode(),
Generation: uint32(kd.Generation()),
KDFAlg: tpm2.HashAlgorithmSHA256,
AuthMode: kd.AuthMode(),
})

aead, err := cipher.NewGCM(b)
Expand Down

0 comments on commit 4facbee

Please sign in to comment.