asym_tpm.c 22 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957
  1. // SPDX-License-Identifier: GPL-2.0
  2. #define pr_fmt(fmt) "ASYM-TPM: "fmt
  3. #include <linux/slab.h>
  4. #include <linux/module.h>
  5. #include <linux/export.h>
  6. #include <linux/kernel.h>
  7. #include <linux/seq_file.h>
  8. #include <linux/scatterlist.h>
  9. #include <linux/tpm.h>
  10. #include <linux/tpm_command.h>
  11. #include <crypto/akcipher.h>
  12. #include <crypto/hash.h>
  13. #include <crypto/sha.h>
  14. #include <asm/unaligned.h>
  15. #include <keys/asymmetric-subtype.h>
  16. #include <keys/trusted_tpm.h>
  17. #include <crypto/asym_tpm_subtype.h>
  18. #include <crypto/public_key.h>
  19. #define TPM_ORD_FLUSHSPECIFIC 186
  20. #define TPM_ORD_LOADKEY2 65
  21. #define TPM_ORD_UNBIND 30
  22. #define TPM_ORD_SIGN 60
  23. #define TPM_RT_KEY 0x00000001
  24. /*
  25. * Load a TPM key from the blob provided by userspace
  26. */
  27. static int tpm_loadkey2(struct tpm_buf *tb,
  28. uint32_t keyhandle, unsigned char *keyauth,
  29. const unsigned char *keyblob, int keybloblen,
  30. uint32_t *newhandle)
  31. {
  32. unsigned char nonceodd[TPM_NONCE_SIZE];
  33. unsigned char enonce[TPM_NONCE_SIZE];
  34. unsigned char authdata[SHA1_DIGEST_SIZE];
  35. uint32_t authhandle = 0;
  36. unsigned char cont = 0;
  37. uint32_t ordinal;
  38. int ret;
  39. ordinal = htonl(TPM_ORD_LOADKEY2);
  40. /* session for loading the key */
  41. ret = oiap(tb, &authhandle, enonce);
  42. if (ret < 0) {
  43. pr_info("oiap failed (%d)\n", ret);
  44. return ret;
  45. }
  46. /* generate odd nonce */
  47. ret = tpm_get_random(NULL, nonceodd, TPM_NONCE_SIZE);
  48. if (ret < 0) {
  49. pr_info("tpm_get_random failed (%d)\n", ret);
  50. return ret;
  51. }
  52. /* calculate authorization HMAC value */
  53. ret = TSS_authhmac(authdata, keyauth, SHA1_DIGEST_SIZE, enonce,
  54. nonceodd, cont, sizeof(uint32_t), &ordinal,
  55. keybloblen, keyblob, 0, 0);
  56. if (ret < 0)
  57. return ret;
  58. /* build the request buffer */
  59. tpm_buf_reset(tb, TPM_TAG_RQU_AUTH1_COMMAND, TPM_ORD_LOADKEY2);
  60. tpm_buf_append_u32(tb, keyhandle);
  61. tpm_buf_append(tb, keyblob, keybloblen);
  62. tpm_buf_append_u32(tb, authhandle);
  63. tpm_buf_append(tb, nonceodd, TPM_NONCE_SIZE);
  64. tpm_buf_append_u8(tb, cont);
  65. tpm_buf_append(tb, authdata, SHA1_DIGEST_SIZE);
  66. ret = trusted_tpm_send(tb->data, MAX_BUF_SIZE);
  67. if (ret < 0) {
  68. pr_info("authhmac failed (%d)\n", ret);
  69. return ret;
  70. }
  71. ret = TSS_checkhmac1(tb->data, ordinal, nonceodd, keyauth,
  72. SHA1_DIGEST_SIZE, 0, 0);
  73. if (ret < 0) {
  74. pr_info("TSS_checkhmac1 failed (%d)\n", ret);
  75. return ret;
  76. }
  77. *newhandle = LOAD32(tb->data, TPM_DATA_OFFSET);
  78. return 0;
  79. }
  80. /*
  81. * Execute the FlushSpecific TPM command
  82. */
  83. static int tpm_flushspecific(struct tpm_buf *tb, uint32_t handle)
  84. {
  85. tpm_buf_reset(tb, TPM_TAG_RQU_COMMAND, TPM_ORD_FLUSHSPECIFIC);
  86. tpm_buf_append_u32(tb, handle);
  87. tpm_buf_append_u32(tb, TPM_RT_KEY);
  88. return trusted_tpm_send(tb->data, MAX_BUF_SIZE);
  89. }
  90. /*
  91. * Decrypt a blob provided by userspace using a specific key handle.
  92. * The handle is a well known handle or previously loaded by e.g. LoadKey2
  93. */
  94. static int tpm_unbind(struct tpm_buf *tb,
  95. uint32_t keyhandle, unsigned char *keyauth,
  96. const unsigned char *blob, uint32_t bloblen,
  97. void *out, uint32_t outlen)
  98. {
  99. unsigned char nonceodd[TPM_NONCE_SIZE];
  100. unsigned char enonce[TPM_NONCE_SIZE];
  101. unsigned char authdata[SHA1_DIGEST_SIZE];
  102. uint32_t authhandle = 0;
  103. unsigned char cont = 0;
  104. uint32_t ordinal;
  105. uint32_t datalen;
  106. int ret;
  107. ordinal = htonl(TPM_ORD_UNBIND);
  108. datalen = htonl(bloblen);
  109. /* session for loading the key */
  110. ret = oiap(tb, &authhandle, enonce);
  111. if (ret < 0) {
  112. pr_info("oiap failed (%d)\n", ret);
  113. return ret;
  114. }
  115. /* generate odd nonce */
  116. ret = tpm_get_random(NULL, nonceodd, TPM_NONCE_SIZE);
  117. if (ret < 0) {
  118. pr_info("tpm_get_random failed (%d)\n", ret);
  119. return ret;
  120. }
  121. /* calculate authorization HMAC value */
  122. ret = TSS_authhmac(authdata, keyauth, SHA1_DIGEST_SIZE, enonce,
  123. nonceodd, cont, sizeof(uint32_t), &ordinal,
  124. sizeof(uint32_t), &datalen,
  125. bloblen, blob, 0, 0);
  126. if (ret < 0)
  127. return ret;
  128. /* build the request buffer */
  129. tpm_buf_reset(tb, TPM_TAG_RQU_AUTH1_COMMAND, TPM_ORD_UNBIND);
  130. tpm_buf_append_u32(tb, keyhandle);
  131. tpm_buf_append_u32(tb, bloblen);
  132. tpm_buf_append(tb, blob, bloblen);
  133. tpm_buf_append_u32(tb, authhandle);
  134. tpm_buf_append(tb, nonceodd, TPM_NONCE_SIZE);
  135. tpm_buf_append_u8(tb, cont);
  136. tpm_buf_append(tb, authdata, SHA1_DIGEST_SIZE);
  137. ret = trusted_tpm_send(tb->data, MAX_BUF_SIZE);
  138. if (ret < 0) {
  139. pr_info("authhmac failed (%d)\n", ret);
  140. return ret;
  141. }
  142. datalen = LOAD32(tb->data, TPM_DATA_OFFSET);
  143. ret = TSS_checkhmac1(tb->data, ordinal, nonceodd,
  144. keyauth, SHA1_DIGEST_SIZE,
  145. sizeof(uint32_t), TPM_DATA_OFFSET,
  146. datalen, TPM_DATA_OFFSET + sizeof(uint32_t),
  147. 0, 0);
  148. if (ret < 0) {
  149. pr_info("TSS_checkhmac1 failed (%d)\n", ret);
  150. return ret;
  151. }
  152. memcpy(out, tb->data + TPM_DATA_OFFSET + sizeof(uint32_t),
  153. min(outlen, datalen));
  154. return datalen;
  155. }
  156. /*
  157. * Sign a blob provided by userspace (that has had the hash function applied)
  158. * using a specific key handle. The handle is assumed to have been previously
  159. * loaded by e.g. LoadKey2.
  160. *
  161. * Note that the key signature scheme of the used key should be set to
  162. * TPM_SS_RSASSAPKCS1v15_DER. This allows the hashed input to be of any size
  163. * up to key_length_in_bytes - 11 and not be limited to size 20 like the
  164. * TPM_SS_RSASSAPKCS1v15_SHA1 signature scheme.
  165. */
  166. static int tpm_sign(struct tpm_buf *tb,
  167. uint32_t keyhandle, unsigned char *keyauth,
  168. const unsigned char *blob, uint32_t bloblen,
  169. void *out, uint32_t outlen)
  170. {
  171. unsigned char nonceodd[TPM_NONCE_SIZE];
  172. unsigned char enonce[TPM_NONCE_SIZE];
  173. unsigned char authdata[SHA1_DIGEST_SIZE];
  174. uint32_t authhandle = 0;
  175. unsigned char cont = 0;
  176. uint32_t ordinal;
  177. uint32_t datalen;
  178. int ret;
  179. ordinal = htonl(TPM_ORD_SIGN);
  180. datalen = htonl(bloblen);
  181. /* session for loading the key */
  182. ret = oiap(tb, &authhandle, enonce);
  183. if (ret < 0) {
  184. pr_info("oiap failed (%d)\n", ret);
  185. return ret;
  186. }
  187. /* generate odd nonce */
  188. ret = tpm_get_random(NULL, nonceodd, TPM_NONCE_SIZE);
  189. if (ret < 0) {
  190. pr_info("tpm_get_random failed (%d)\n", ret);
  191. return ret;
  192. }
  193. /* calculate authorization HMAC value */
  194. ret = TSS_authhmac(authdata, keyauth, SHA1_DIGEST_SIZE, enonce,
  195. nonceodd, cont, sizeof(uint32_t), &ordinal,
  196. sizeof(uint32_t), &datalen,
  197. bloblen, blob, 0, 0);
  198. if (ret < 0)
  199. return ret;
  200. /* build the request buffer */
  201. tpm_buf_reset(tb, TPM_TAG_RQU_AUTH1_COMMAND, TPM_ORD_SIGN);
  202. tpm_buf_append_u32(tb, keyhandle);
  203. tpm_buf_append_u32(tb, bloblen);
  204. tpm_buf_append(tb, blob, bloblen);
  205. tpm_buf_append_u32(tb, authhandle);
  206. tpm_buf_append(tb, nonceodd, TPM_NONCE_SIZE);
  207. tpm_buf_append_u8(tb, cont);
  208. tpm_buf_append(tb, authdata, SHA1_DIGEST_SIZE);
  209. ret = trusted_tpm_send(tb->data, MAX_BUF_SIZE);
  210. if (ret < 0) {
  211. pr_info("authhmac failed (%d)\n", ret);
  212. return ret;
  213. }
  214. datalen = LOAD32(tb->data, TPM_DATA_OFFSET);
  215. ret = TSS_checkhmac1(tb->data, ordinal, nonceodd,
  216. keyauth, SHA1_DIGEST_SIZE,
  217. sizeof(uint32_t), TPM_DATA_OFFSET,
  218. datalen, TPM_DATA_OFFSET + sizeof(uint32_t),
  219. 0, 0);
  220. if (ret < 0) {
  221. pr_info("TSS_checkhmac1 failed (%d)\n", ret);
  222. return ret;
  223. }
  224. memcpy(out, tb->data + TPM_DATA_OFFSET + sizeof(uint32_t),
  225. min(datalen, outlen));
  226. return datalen;
  227. }
  228. /* Room to fit two u32 zeros for algo id and parameters length. */
  229. #define SETKEY_PARAMS_SIZE (sizeof(u32) * 2)
  230. /*
  231. * Maximum buffer size for the BER/DER encoded public key. The public key
  232. * is of the form SEQUENCE { INTEGER n, INTEGER e } where n is a maximum 2048
  233. * bit key and e is usually 65537
  234. * The encoding overhead is:
  235. * - max 4 bytes for SEQUENCE
  236. * - max 4 bytes for INTEGER n type/length
  237. * - 257 bytes of n
  238. * - max 2 bytes for INTEGER e type/length
  239. * - 3 bytes of e
  240. * - 4+4 of zeros for set_pub_key parameters (SETKEY_PARAMS_SIZE)
  241. */
  242. #define PUB_KEY_BUF_SIZE (4 + 4 + 257 + 2 + 3 + SETKEY_PARAMS_SIZE)
  243. /*
  244. * Provide a part of a description of the key for /proc/keys.
  245. */
  246. static void asym_tpm_describe(const struct key *asymmetric_key,
  247. struct seq_file *m)
  248. {
  249. struct tpm_key *tk = asymmetric_key->payload.data[asym_crypto];
  250. if (!tk)
  251. return;
  252. seq_printf(m, "TPM1.2/Blob");
  253. }
  254. static void asym_tpm_destroy(void *payload0, void *payload3)
  255. {
  256. struct tpm_key *tk = payload0;
  257. if (!tk)
  258. return;
  259. kfree(tk->blob);
  260. tk->blob_len = 0;
  261. kfree(tk);
  262. }
  263. /* How many bytes will it take to encode the length */
  264. static inline uint32_t definite_length(uint32_t len)
  265. {
  266. if (len <= 127)
  267. return 1;
  268. if (len <= 255)
  269. return 2;
  270. return 3;
  271. }
  272. static inline uint8_t *encode_tag_length(uint8_t *buf, uint8_t tag,
  273. uint32_t len)
  274. {
  275. *buf++ = tag;
  276. if (len <= 127) {
  277. buf[0] = len;
  278. return buf + 1;
  279. }
  280. if (len <= 255) {
  281. buf[0] = 0x81;
  282. buf[1] = len;
  283. return buf + 2;
  284. }
  285. buf[0] = 0x82;
  286. put_unaligned_be16(len, buf + 1);
  287. return buf + 3;
  288. }
  289. static uint32_t derive_pub_key(const void *pub_key, uint32_t len, uint8_t *buf)
  290. {
  291. uint8_t *cur = buf;
  292. uint32_t n_len = definite_length(len) + 1 + len + 1;
  293. uint32_t e_len = definite_length(3) + 1 + 3;
  294. uint8_t e[3] = { 0x01, 0x00, 0x01 };
  295. /* SEQUENCE */
  296. cur = encode_tag_length(cur, 0x30, n_len + e_len);
  297. /* INTEGER n */
  298. cur = encode_tag_length(cur, 0x02, len + 1);
  299. cur[0] = 0x00;
  300. memcpy(cur + 1, pub_key, len);
  301. cur += len + 1;
  302. cur = encode_tag_length(cur, 0x02, sizeof(e));
  303. memcpy(cur, e, sizeof(e));
  304. cur += sizeof(e);
  305. /* Zero parameters to satisfy set_pub_key ABI. */
  306. memzero_explicit(cur, SETKEY_PARAMS_SIZE);
  307. return cur - buf;
  308. }
  309. /*
  310. * Determine the crypto algorithm name.
  311. */
  312. static int determine_akcipher(const char *encoding, const char *hash_algo,
  313. char alg_name[CRYPTO_MAX_ALG_NAME])
  314. {
  315. if (strcmp(encoding, "pkcs1") == 0) {
  316. if (!hash_algo) {
  317. strcpy(alg_name, "pkcs1pad(rsa)");
  318. return 0;
  319. }
  320. if (snprintf(alg_name, CRYPTO_MAX_ALG_NAME, "pkcs1pad(rsa,%s)",
  321. hash_algo) >= CRYPTO_MAX_ALG_NAME)
  322. return -EINVAL;
  323. return 0;
  324. }
  325. if (strcmp(encoding, "raw") == 0) {
  326. strcpy(alg_name, "rsa");
  327. return 0;
  328. }
  329. return -ENOPKG;
  330. }
  331. /*
  332. * Query information about a key.
  333. */
  334. static int tpm_key_query(const struct kernel_pkey_params *params,
  335. struct kernel_pkey_query *info)
  336. {
  337. struct tpm_key *tk = params->key->payload.data[asym_crypto];
  338. int ret;
  339. char alg_name[CRYPTO_MAX_ALG_NAME];
  340. struct crypto_akcipher *tfm;
  341. uint8_t der_pub_key[PUB_KEY_BUF_SIZE];
  342. uint32_t der_pub_key_len;
  343. int len;
  344. /* TPM only works on private keys, public keys still done in software */
  345. ret = determine_akcipher(params->encoding, params->hash_algo, alg_name);
  346. if (ret < 0)
  347. return ret;
  348. tfm = crypto_alloc_akcipher(alg_name, 0, 0);
  349. if (IS_ERR(tfm))
  350. return PTR_ERR(tfm);
  351. der_pub_key_len = derive_pub_key(tk->pub_key, tk->pub_key_len,
  352. der_pub_key);
  353. ret = crypto_akcipher_set_pub_key(tfm, der_pub_key, der_pub_key_len);
  354. if (ret < 0)
  355. goto error_free_tfm;
  356. len = crypto_akcipher_maxsize(tfm);
  357. info->key_size = tk->key_len;
  358. info->max_data_size = tk->key_len / 8;
  359. info->max_sig_size = len;
  360. info->max_enc_size = len;
  361. info->max_dec_size = tk->key_len / 8;
  362. info->supported_ops = KEYCTL_SUPPORTS_ENCRYPT |
  363. KEYCTL_SUPPORTS_DECRYPT |
  364. KEYCTL_SUPPORTS_VERIFY |
  365. KEYCTL_SUPPORTS_SIGN;
  366. ret = 0;
  367. error_free_tfm:
  368. crypto_free_akcipher(tfm);
  369. pr_devel("<==%s() = %d\n", __func__, ret);
  370. return ret;
  371. }
  372. /*
  373. * Encryption operation is performed with the public key. Hence it is done
  374. * in software
  375. */
  376. static int tpm_key_encrypt(struct tpm_key *tk,
  377. struct kernel_pkey_params *params,
  378. const void *in, void *out)
  379. {
  380. char alg_name[CRYPTO_MAX_ALG_NAME];
  381. struct crypto_akcipher *tfm;
  382. struct akcipher_request *req;
  383. struct crypto_wait cwait;
  384. struct scatterlist in_sg, out_sg;
  385. uint8_t der_pub_key[PUB_KEY_BUF_SIZE];
  386. uint32_t der_pub_key_len;
  387. int ret;
  388. pr_devel("==>%s()\n", __func__);
  389. ret = determine_akcipher(params->encoding, params->hash_algo, alg_name);
  390. if (ret < 0)
  391. return ret;
  392. tfm = crypto_alloc_akcipher(alg_name, 0, 0);
  393. if (IS_ERR(tfm))
  394. return PTR_ERR(tfm);
  395. der_pub_key_len = derive_pub_key(tk->pub_key, tk->pub_key_len,
  396. der_pub_key);
  397. ret = crypto_akcipher_set_pub_key(tfm, der_pub_key, der_pub_key_len);
  398. if (ret < 0)
  399. goto error_free_tfm;
  400. ret = -ENOMEM;
  401. req = akcipher_request_alloc(tfm, GFP_KERNEL);
  402. if (!req)
  403. goto error_free_tfm;
  404. sg_init_one(&in_sg, in, params->in_len);
  405. sg_init_one(&out_sg, out, params->out_len);
  406. akcipher_request_set_crypt(req, &in_sg, &out_sg, params->in_len,
  407. params->out_len);
  408. crypto_init_wait(&cwait);
  409. akcipher_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG |
  410. CRYPTO_TFM_REQ_MAY_SLEEP,
  411. crypto_req_done, &cwait);
  412. ret = crypto_akcipher_encrypt(req);
  413. ret = crypto_wait_req(ret, &cwait);
  414. if (ret == 0)
  415. ret = req->dst_len;
  416. akcipher_request_free(req);
  417. error_free_tfm:
  418. crypto_free_akcipher(tfm);
  419. pr_devel("<==%s() = %d\n", __func__, ret);
  420. return ret;
  421. }
  422. /*
  423. * Decryption operation is performed with the private key in the TPM.
  424. */
  425. static int tpm_key_decrypt(struct tpm_key *tk,
  426. struct kernel_pkey_params *params,
  427. const void *in, void *out)
  428. {
  429. struct tpm_buf tb;
  430. uint32_t keyhandle;
  431. uint8_t srkauth[SHA1_DIGEST_SIZE];
  432. uint8_t keyauth[SHA1_DIGEST_SIZE];
  433. int r;
  434. pr_devel("==>%s()\n", __func__);
  435. if (params->hash_algo)
  436. return -ENOPKG;
  437. if (strcmp(params->encoding, "pkcs1"))
  438. return -ENOPKG;
  439. r = tpm_buf_init(&tb, 0, 0);
  440. if (r)
  441. return r;
  442. /* TODO: Handle a non-all zero SRK authorization */
  443. memset(srkauth, 0, sizeof(srkauth));
  444. r = tpm_loadkey2(&tb, SRKHANDLE, srkauth,
  445. tk->blob, tk->blob_len, &keyhandle);
  446. if (r < 0) {
  447. pr_devel("loadkey2 failed (%d)\n", r);
  448. goto error;
  449. }
  450. /* TODO: Handle a non-all zero key authorization */
  451. memset(keyauth, 0, sizeof(keyauth));
  452. r = tpm_unbind(&tb, keyhandle, keyauth,
  453. in, params->in_len, out, params->out_len);
  454. if (r < 0)
  455. pr_devel("tpm_unbind failed (%d)\n", r);
  456. if (tpm_flushspecific(&tb, keyhandle) < 0)
  457. pr_devel("flushspecific failed (%d)\n", r);
  458. error:
  459. tpm_buf_destroy(&tb);
  460. pr_devel("<==%s() = %d\n", __func__, r);
  461. return r;
  462. }
  463. /*
  464. * Hash algorithm OIDs plus ASN.1 DER wrappings [RFC4880 sec 5.2.2].
  465. */
  466. static const u8 digest_info_md5[] = {
  467. 0x30, 0x20, 0x30, 0x0c, 0x06, 0x08,
  468. 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x02, 0x05, /* OID */
  469. 0x05, 0x00, 0x04, 0x10
  470. };
  471. static const u8 digest_info_sha1[] = {
  472. 0x30, 0x21, 0x30, 0x09, 0x06, 0x05,
  473. 0x2b, 0x0e, 0x03, 0x02, 0x1a,
  474. 0x05, 0x00, 0x04, 0x14
  475. };
  476. static const u8 digest_info_rmd160[] = {
  477. 0x30, 0x21, 0x30, 0x09, 0x06, 0x05,
  478. 0x2b, 0x24, 0x03, 0x02, 0x01,
  479. 0x05, 0x00, 0x04, 0x14
  480. };
  481. static const u8 digest_info_sha224[] = {
  482. 0x30, 0x2d, 0x30, 0x0d, 0x06, 0x09,
  483. 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x04,
  484. 0x05, 0x00, 0x04, 0x1c
  485. };
  486. static const u8 digest_info_sha256[] = {
  487. 0x30, 0x31, 0x30, 0x0d, 0x06, 0x09,
  488. 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x01,
  489. 0x05, 0x00, 0x04, 0x20
  490. };
  491. static const u8 digest_info_sha384[] = {
  492. 0x30, 0x41, 0x30, 0x0d, 0x06, 0x09,
  493. 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x02,
  494. 0x05, 0x00, 0x04, 0x30
  495. };
  496. static const u8 digest_info_sha512[] = {
  497. 0x30, 0x51, 0x30, 0x0d, 0x06, 0x09,
  498. 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x03,
  499. 0x05, 0x00, 0x04, 0x40
  500. };
  501. static const struct asn1_template {
  502. const char *name;
  503. const u8 *data;
  504. size_t size;
  505. } asn1_templates[] = {
  506. #define _(X) { #X, digest_info_##X, sizeof(digest_info_##X) }
  507. _(md5),
  508. _(sha1),
  509. _(rmd160),
  510. _(sha256),
  511. _(sha384),
  512. _(sha512),
  513. _(sha224),
  514. { NULL }
  515. #undef _
  516. };
  517. static const struct asn1_template *lookup_asn1(const char *name)
  518. {
  519. const struct asn1_template *p;
  520. for (p = asn1_templates; p->name; p++)
  521. if (strcmp(name, p->name) == 0)
  522. return p;
  523. return NULL;
  524. }
  525. /*
  526. * Sign operation is performed with the private key in the TPM.
  527. */
  528. static int tpm_key_sign(struct tpm_key *tk,
  529. struct kernel_pkey_params *params,
  530. const void *in, void *out)
  531. {
  532. struct tpm_buf tb;
  533. uint32_t keyhandle;
  534. uint8_t srkauth[SHA1_DIGEST_SIZE];
  535. uint8_t keyauth[SHA1_DIGEST_SIZE];
  536. void *asn1_wrapped = NULL;
  537. uint32_t in_len = params->in_len;
  538. int r;
  539. pr_devel("==>%s()\n", __func__);
  540. if (strcmp(params->encoding, "pkcs1"))
  541. return -ENOPKG;
  542. if (params->hash_algo) {
  543. const struct asn1_template *asn1 =
  544. lookup_asn1(params->hash_algo);
  545. if (!asn1)
  546. return -ENOPKG;
  547. /* request enough space for the ASN.1 template + input hash */
  548. asn1_wrapped = kzalloc(in_len + asn1->size, GFP_KERNEL);
  549. if (!asn1_wrapped)
  550. return -ENOMEM;
  551. /* Copy ASN.1 template, then the input */
  552. memcpy(asn1_wrapped, asn1->data, asn1->size);
  553. memcpy(asn1_wrapped + asn1->size, in, in_len);
  554. in = asn1_wrapped;
  555. in_len += asn1->size;
  556. }
  557. if (in_len > tk->key_len / 8 - 11) {
  558. r = -EOVERFLOW;
  559. goto error_free_asn1_wrapped;
  560. }
  561. r = tpm_buf_init(&tb, 0, 0);
  562. if (r)
  563. goto error_free_asn1_wrapped;
  564. /* TODO: Handle a non-all zero SRK authorization */
  565. memset(srkauth, 0, sizeof(srkauth));
  566. r = tpm_loadkey2(&tb, SRKHANDLE, srkauth,
  567. tk->blob, tk->blob_len, &keyhandle);
  568. if (r < 0) {
  569. pr_devel("loadkey2 failed (%d)\n", r);
  570. goto error_free_tb;
  571. }
  572. /* TODO: Handle a non-all zero key authorization */
  573. memset(keyauth, 0, sizeof(keyauth));
  574. r = tpm_sign(&tb, keyhandle, keyauth, in, in_len, out, params->out_len);
  575. if (r < 0)
  576. pr_devel("tpm_sign failed (%d)\n", r);
  577. if (tpm_flushspecific(&tb, keyhandle) < 0)
  578. pr_devel("flushspecific failed (%d)\n", r);
  579. error_free_tb:
  580. tpm_buf_destroy(&tb);
  581. error_free_asn1_wrapped:
  582. kfree(asn1_wrapped);
  583. pr_devel("<==%s() = %d\n", __func__, r);
  584. return r;
  585. }
  586. /*
  587. * Do encryption, decryption and signing ops.
  588. */
  589. static int tpm_key_eds_op(struct kernel_pkey_params *params,
  590. const void *in, void *out)
  591. {
  592. struct tpm_key *tk = params->key->payload.data[asym_crypto];
  593. int ret = -EOPNOTSUPP;
  594. /* Perform the encryption calculation. */
  595. switch (params->op) {
  596. case kernel_pkey_encrypt:
  597. ret = tpm_key_encrypt(tk, params, in, out);
  598. break;
  599. case kernel_pkey_decrypt:
  600. ret = tpm_key_decrypt(tk, params, in, out);
  601. break;
  602. case kernel_pkey_sign:
  603. ret = tpm_key_sign(tk, params, in, out);
  604. break;
  605. default:
  606. BUG();
  607. }
  608. return ret;
  609. }
  610. /*
  611. * Verify a signature using a public key.
  612. */
  613. static int tpm_key_verify_signature(const struct key *key,
  614. const struct public_key_signature *sig)
  615. {
  616. const struct tpm_key *tk = key->payload.data[asym_crypto];
  617. struct crypto_wait cwait;
  618. struct crypto_akcipher *tfm;
  619. struct akcipher_request *req;
  620. struct scatterlist src_sg[2];
  621. char alg_name[CRYPTO_MAX_ALG_NAME];
  622. uint8_t der_pub_key[PUB_KEY_BUF_SIZE];
  623. uint32_t der_pub_key_len;
  624. int ret;
  625. pr_devel("==>%s()\n", __func__);
  626. BUG_ON(!tk);
  627. BUG_ON(!sig);
  628. BUG_ON(!sig->s);
  629. if (!sig->digest)
  630. return -ENOPKG;
  631. ret = determine_akcipher(sig->encoding, sig->hash_algo, alg_name);
  632. if (ret < 0)
  633. return ret;
  634. tfm = crypto_alloc_akcipher(alg_name, 0, 0);
  635. if (IS_ERR(tfm))
  636. return PTR_ERR(tfm);
  637. der_pub_key_len = derive_pub_key(tk->pub_key, tk->pub_key_len,
  638. der_pub_key);
  639. ret = crypto_akcipher_set_pub_key(tfm, der_pub_key, der_pub_key_len);
  640. if (ret < 0)
  641. goto error_free_tfm;
  642. ret = -ENOMEM;
  643. req = akcipher_request_alloc(tfm, GFP_KERNEL);
  644. if (!req)
  645. goto error_free_tfm;
  646. sg_init_table(src_sg, 2);
  647. sg_set_buf(&src_sg[0], sig->s, sig->s_size);
  648. sg_set_buf(&src_sg[1], sig->digest, sig->digest_size);
  649. akcipher_request_set_crypt(req, src_sg, NULL, sig->s_size,
  650. sig->digest_size);
  651. crypto_init_wait(&cwait);
  652. akcipher_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG |
  653. CRYPTO_TFM_REQ_MAY_SLEEP,
  654. crypto_req_done, &cwait);
  655. ret = crypto_wait_req(crypto_akcipher_verify(req), &cwait);
  656. akcipher_request_free(req);
  657. error_free_tfm:
  658. crypto_free_akcipher(tfm);
  659. pr_devel("<==%s() = %d\n", __func__, ret);
  660. if (WARN_ON_ONCE(ret > 0))
  661. ret = -EINVAL;
  662. return ret;
  663. }
  664. /*
  665. * Parse enough information out of TPM_KEY structure:
  666. * TPM_STRUCT_VER -> 4 bytes
  667. * TPM_KEY_USAGE -> 2 bytes
  668. * TPM_KEY_FLAGS -> 4 bytes
  669. * TPM_AUTH_DATA_USAGE -> 1 byte
  670. * TPM_KEY_PARMS -> variable
  671. * UINT32 PCRInfoSize -> 4 bytes
  672. * BYTE* -> PCRInfoSize bytes
  673. * TPM_STORE_PUBKEY
  674. * UINT32 encDataSize;
  675. * BYTE* -> encDataSize;
  676. *
  677. * TPM_KEY_PARMS:
  678. * TPM_ALGORITHM_ID -> 4 bytes
  679. * TPM_ENC_SCHEME -> 2 bytes
  680. * TPM_SIG_SCHEME -> 2 bytes
  681. * UINT32 parmSize -> 4 bytes
  682. * BYTE* -> variable
  683. */
  684. static int extract_key_parameters(struct tpm_key *tk)
  685. {
  686. const void *cur = tk->blob;
  687. uint32_t len = tk->blob_len;
  688. const void *pub_key;
  689. uint32_t sz;
  690. uint32_t key_len;
  691. if (len < 11)
  692. return -EBADMSG;
  693. /* Ensure this is a legacy key */
  694. if (get_unaligned_be16(cur + 4) != 0x0015)
  695. return -EBADMSG;
  696. /* Skip to TPM_KEY_PARMS */
  697. cur += 11;
  698. len -= 11;
  699. if (len < 12)
  700. return -EBADMSG;
  701. /* Make sure this is an RSA key */
  702. if (get_unaligned_be32(cur) != 0x00000001)
  703. return -EBADMSG;
  704. /* Make sure this is TPM_ES_RSAESPKCSv15 encoding scheme */
  705. if (get_unaligned_be16(cur + 4) != 0x0002)
  706. return -EBADMSG;
  707. /* Make sure this is TPM_SS_RSASSAPKCS1v15_DER signature scheme */
  708. if (get_unaligned_be16(cur + 6) != 0x0003)
  709. return -EBADMSG;
  710. sz = get_unaligned_be32(cur + 8);
  711. if (len < sz + 12)
  712. return -EBADMSG;
  713. /* Move to TPM_RSA_KEY_PARMS */
  714. len -= 12;
  715. cur += 12;
  716. /* Grab the RSA key length */
  717. key_len = get_unaligned_be32(cur);
  718. switch (key_len) {
  719. case 512:
  720. case 1024:
  721. case 1536:
  722. case 2048:
  723. break;
  724. default:
  725. return -EINVAL;
  726. }
  727. /* Move just past TPM_KEY_PARMS */
  728. cur += sz;
  729. len -= sz;
  730. if (len < 4)
  731. return -EBADMSG;
  732. sz = get_unaligned_be32(cur);
  733. if (len < 4 + sz)
  734. return -EBADMSG;
  735. /* Move to TPM_STORE_PUBKEY */
  736. cur += 4 + sz;
  737. len -= 4 + sz;
  738. /* Grab the size of the public key, it should jive with the key size */
  739. sz = get_unaligned_be32(cur);
  740. if (sz > 256)
  741. return -EINVAL;
  742. pub_key = cur + 4;
  743. tk->key_len = key_len;
  744. tk->pub_key = pub_key;
  745. tk->pub_key_len = sz;
  746. return 0;
  747. }
  748. /* Given the blob, parse it and load it into the TPM */
  749. struct tpm_key *tpm_key_create(const void *blob, uint32_t blob_len)
  750. {
  751. int r;
  752. struct tpm_key *tk;
  753. r = tpm_is_tpm2(NULL);
  754. if (r < 0)
  755. goto error;
  756. /* We don't support TPM2 yet */
  757. if (r > 0) {
  758. r = -ENODEV;
  759. goto error;
  760. }
  761. r = -ENOMEM;
  762. tk = kzalloc(sizeof(struct tpm_key), GFP_KERNEL);
  763. if (!tk)
  764. goto error;
  765. tk->blob = kmemdup(blob, blob_len, GFP_KERNEL);
  766. if (!tk->blob)
  767. goto error_memdup;
  768. tk->blob_len = blob_len;
  769. r = extract_key_parameters(tk);
  770. if (r < 0)
  771. goto error_extract;
  772. return tk;
  773. error_extract:
  774. kfree(tk->blob);
  775. tk->blob_len = 0;
  776. error_memdup:
  777. kfree(tk);
  778. error:
  779. return ERR_PTR(r);
  780. }
  781. EXPORT_SYMBOL_GPL(tpm_key_create);
  782. /*
  783. * TPM-based asymmetric key subtype
  784. */
  785. struct asymmetric_key_subtype asym_tpm_subtype = {
  786. .owner = THIS_MODULE,
  787. .name = "asym_tpm",
  788. .name_len = sizeof("asym_tpm") - 1,
  789. .describe = asym_tpm_describe,
  790. .destroy = asym_tpm_destroy,
  791. .query = tpm_key_query,
  792. .eds_op = tpm_key_eds_op,
  793. .verify_signature = tpm_key_verify_signature,
  794. };
  795. EXPORT_SYMBOL_GPL(asym_tpm_subtype);
  796. MODULE_DESCRIPTION("TPM based asymmetric key subtype");
  797. MODULE_AUTHOR("Intel Corporation");
  798. MODULE_LICENSE("GPL v2");