| /********************************************************************************/ |
| /* */ |
| /* IWG EK Index Parsing Utilities */ |
| /* Written by Ken Goldman */ |
| /* IBM Thomas J. Watson Research Center */ |
| /* */ |
| /* (c) Copyright IBM Corporation 2016 - 2019. */ |
| /* */ |
| /* All rights reserved. */ |
| /* */ |
| /* Redistribution and use in source and binary forms, with or without */ |
| /* modification, are permitted provided that the following conditions are */ |
| /* met: */ |
| /* */ |
| /* Redistributions of source code must retain the above copyright notice, */ |
| /* this list of conditions and the following disclaimer. */ |
| /* */ |
| /* Redistributions in binary form must reproduce the above copyright */ |
| /* notice, this list of conditions and the following disclaimer in the */ |
| /* documentation and/or other materials provided with the distribution. */ |
| /* */ |
| /* Neither the names of the IBM Corporation nor the names of its */ |
| /* contributors may be used to endorse or promote products derived from */ |
| /* this software without specific prior written permission. */ |
| /* */ |
| /* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS */ |
| /* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT */ |
| /* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR */ |
| /* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT */ |
| /* HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, */ |
| /* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT */ |
| /* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, */ |
| /* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY */ |
| /* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT */ |
| /* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE */ |
| /* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ |
| /********************************************************************************/ |
| |
| #ifndef EKUTILS_H |
| #define EKUTILS_H |
| |
| /* Windows 10 crypto API clashes with openssl */ |
| #ifdef TPM_WINDOWS |
| #ifndef WIN32_LEAN_AND_MEAN |
| #define WIN32_LEAN_AND_MEAN |
| #endif |
| #endif |
| |
| #ifndef TPM_TSS_NO_OPENSSL |
| #include <openssl/x509.h> |
| #include <openssl/x509v3.h> |
| #include <openssl/bn.h> |
| #endif /* TPM_TSS_NO_OPENSSL */ |
| |
| #include <ibmtss/tss.h> |
| |
| /* legacy TCG IWG NV indexes */ |
| |
| #define EK_CERT_RSA_INDEX 0x01c00002 |
| #define EK_NONCE_RSA_INDEX 0x01c00003 |
| #define EK_TEMPLATE_RSA_INDEX 0x01c00004 |
| |
| #define EK_CERT_EC_INDEX 0x01c0000a |
| #define EK_NONCE_EC_INDEX 0x01c0000b |
| #define EK_TEMPLATE_EC_INDEX 0x01c0000c |
| |
| #define MAX_ROOTS 100 /* 100 should be more than enough */ |
| |
| #ifdef __cplusplus |
| extern "C" { |
| #endif |
| |
| /* |
| crypto library independent functions |
| */ |
| |
| TPM_RC readNvBufferMax(TSS_CONTEXT *tssContext, |
| uint32_t *nvBufferMax); |
| TPM_RC getIndexSize(TSS_CONTEXT *tssContext, |
| uint16_t *dataSize, |
| TPMI_RH_NV_INDEX nvIndex); |
| TPM_RC getIndexData(TSS_CONTEXT *tssContext, |
| unsigned char **buffer, |
| TPMI_RH_NV_INDEX nvIndex, |
| uint16_t dataSize); |
| TPM_RC getIndexContents(TSS_CONTEXT *tssContext, |
| unsigned char **buffer, |
| uint16_t *bufferSize, |
| TPMI_RH_NV_INDEX nvIndex); |
| void getRsaTemplate(TPMT_PUBLIC *tpmtPublic); |
| void getEccTemplate(TPMT_PUBLIC *tpmtPublic); |
| TPM_RC getRootCertificateFilenames(char *rootFilename[], |
| unsigned int *rootFileCount, |
| const char *listFilename, |
| int print); |
| TPM_RC processEKNonce(TSS_CONTEXT *tssContext, |
| unsigned char **nonce, |
| uint16_t *nonceSize, |
| TPMI_RH_NV_INDEX ekNonceIndex, |
| int print); |
| TPM_RC processEKTemplate(TSS_CONTEXT *tssContext, |
| TPMT_PUBLIC *tpmtPublic, |
| TPMI_RH_NV_INDEX ekTemplateIndex, |
| int print); |
| TPM_RC convertDerToX509(void **x509Certificate, |
| uint16_t readLength, |
| const unsigned char *readBuffer); |
| TPM_RC convertX509PemToDer(uint32_t *certLength, |
| unsigned char **certificate, |
| const char *pemCertificateFilename); |
| TPM_RC convertX509ToPem(const char *pemFilename, |
| void *x509); |
| void x509FreeStructure(void *x509); |
| void x509PrintStructure(void *x509); |
| TPM_RC processEKCertificate(TSS_CONTEXT *tssContext, |
| void **ekCertificate, |
| uint8_t **modulusBin, |
| int *modulusBytes, |
| TPMI_RH_NV_INDEX ekCertIndex, |
| int print); |
| TPM_RC getIndexX509Certificate(TSS_CONTEXT *tssContext, |
| void **certificate, |
| TPMI_RH_NV_INDEX nvIndex); |
| TPM_RC convertCertificatePubKey(uint8_t **modulusBin, |
| int *modulusBytes, |
| void *ekCertificate, |
| TPMI_RH_NV_INDEX ekCertIndex, |
| int print); |
| TPM_RC createCertificate(char **x509CertString, |
| char **pemCertString, |
| uint32_t *certLength, |
| unsigned char **certificate, |
| TPMT_PUBLIC *tpmtPublic, |
| const char *caKeyFileName, |
| size_t issuerEntriesSize, |
| char **issuerEntries, |
| size_t subjectEntriesSize, |
| char **subjectEntries, |
| const char *caKeyPassword); |
| TPM_RC processRoot(TSS_CONTEXT *tssContext, |
| TPMI_RH_NV_INDEX ekCertIndex, |
| const char *rootFilename[], |
| unsigned int rootFileCount, |
| int print); |
| TPM_RC verifyCertificate(void *x509Certificate, |
| const char *rootFilename[], |
| unsigned int rootFileCount, |
| int print); |
| TPM_RC processCreatePrimary(TSS_CONTEXT *tssContext, |
| TPM_HANDLE *keyHandle, |
| TPMI_RH_NV_INDEX ekCertIndex, |
| unsigned char *nonce, |
| uint16_t nonceSize, |
| TPMT_PUBLIC *tpmtPublicIn, |
| TPMT_PUBLIC *tpmtPublicOut, |
| unsigned int noFlush, |
| int print); |
| TPM_RC processValidatePrimary(uint8_t *publicKeyBin, |
| int publicKeyBytes, |
| TPMT_PUBLIC *tpmtPublic, |
| TPMI_RH_NV_INDEX ekCertIndex, |
| int print); |
| TPM_RC processPrimary(TSS_CONTEXT *tssContext, |
| TPM_HANDLE *keyHandle, |
| TPMI_RH_NV_INDEX ekCertIndex, |
| TPMI_RH_NV_INDEX ekNonceIndex, |
| TPMI_RH_NV_INDEX ekTemplateIndex, |
| unsigned int noFlush, |
| int print); |
| |
| /* |
| deprecated OpenSSL specific functions |
| */ |
| |
| #ifndef TPM_TSS_NO_OPENSSL |
| |
| |
| uint32_t getPubkeyFromDerCertFile(RSA **rsaPkey, |
| X509 **x509, |
| const char *derCertificateFileName); |
| uint32_t getPubKeyFromX509Cert(RSA **rsaPkey, |
| X509 *x509); |
| TPM_RC getCaStore(X509_STORE **caStore, |
| X509 *caCert[], |
| const char *rootFilename[], |
| unsigned int rootFileCount); |
| TPM_RC verifyKeyUsage(X509 *ekX509Certificate, |
| int pkeyType, |
| int print); |
| TPM_RC convertX509ToDer(uint32_t *certLength, |
| unsigned char **certificate, |
| X509 *x509Certificate); |
| #ifndef TPM_TSS_NOECC |
| TPM_RC convertX509ToEc(EC_KEY **ecKey, |
| X509 *x509); |
| #endif /* TPM_TSS_NOECC */ |
| TPM_RC convertX509ToDer(uint32_t *certLength, |
| unsigned char **certificate, |
| X509 *x509Certificate); |
| TPM_RC convertPemToX509(X509 **x509, |
| const char *pemCertificateFilename); |
| TPM_RC convertPemMemToX509(X509 **x509, |
| const char *pemCertificate); |
| TPM_RC convertX509ToPemMem(char **pemString, |
| X509 *x509); |
| TPM_RC convertX509ToString(char **x509String, |
| X509 *x509); |
| TPM_RC convertCertificatePubKey12(uint8_t **modulusBin, |
| int *modulusBytes, |
| X509 *ekCertificate); |
| |
| /* certificate key to nid mapping array */ |
| |
| TPM_RC startCertificate(X509 *x509Certificate, |
| uint16_t keyLength, |
| const unsigned char *keyBuffer, |
| size_t issuerEntriesSize, |
| char **issuerEntries, |
| size_t subjectEntriesSize, |
| char **subjectEntries); |
| |
| typedef struct tdCertificateName |
| { |
| const char *key; |
| int nid; |
| } CertificateName; |
| |
| TPM_RC calculateNid(void); |
| TPM_RC createX509Name(X509_NAME **x509Name, |
| size_t entriesSize, |
| char **entries); |
| TPM_RC addCertExtension(X509 *x509Certificate, int nid, const char *value); |
| TPM_RC addCertKeyRsa(X509 *x509Certificate, |
| const TPM2B_PUBLIC_KEY_RSA *tpm2bRsa); |
| #ifndef TPM_TSS_NOECC |
| TPM_RC addCertKeyEcc(X509 *x509Certificate, |
| const TPMS_ECC_POINT *tpmsEccPoint); |
| #endif /* TPM_TSS_NOECC */ |
| TPM_RC addCertSignatureRoot(X509 *x509Certificate, |
| const char *caKeyFileName, |
| const char *caKeyPassword); |
| TPM_RC TSS_RSAGetKey(const BIGNUM **n, |
| const BIGNUM **e, |
| const BIGNUM **d, |
| const BIGNUM **p, |
| const BIGNUM **q, |
| const RSA *rsaKey); |
| |
| int TSS_Pubkey_GetAlgorithm(EVP_PKEY *pkey); |
| |
| |
| #endif /* TPM_TSS_NO_OPENSSL */ |
| |
| #ifdef __cplusplus |
| } |
| #endif |
| |
| #endif |
