| #!/bin/bash |
| # |
| |
| ################################################################################# |
| # # |
| # TPM2 regression test # |
| # Written by Ken Goldman # |
| # IBM Thomas J. Watson Research Center # |
| # # |
| # (c) Copyright IBM Corporation 2015 - 2020 # |
| # # |
| # All rights reserved. # |
| # # |
| # Redistribution and use in source and binary forms, with or without # |
| # modification, are permitted provided that the following conditions are # |
| # met: # |
| # # |
| # Redistributions of source code must retain the above copyright notice, # |
| # this list of conditions and the following disclaimer. # |
| # # |
| # Redistributions in binary form must reproduce the above copyright # |
| # notice, this list of conditions and the following disclaimer in the # |
| # documentation and/or other materials provided with the distribution. # |
| # # |
| # Neither the names of the IBM Corporation nor the names of its # |
| # contributors may be used to endorse or promote products derived from # |
| # this software without specific prior written permission. # |
| # # |
| # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS # |
| # "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT # |
| # LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR # |
| # A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT # |
| # HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, # |
| # SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT # |
| # LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, # |
| # DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY # |
| # THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT # |
| # (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE # |
| # OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. # |
| # # |
| ################################################################################# |
| |
| # primary key 80000000 |
| # storage key 80000001 |
| # signing key 80000002 |
| # policy session 03000000 |
| # e5 87 c1 1a b5 0f 9d 87 30 f7 21 e3 fe a4 2b 46 |
| # c0 45 5b 24 6f 96 ae e8 5d 18 eb 3b e6 4d 66 6a |
| |
| echo "" |
| echo "Make and Activate Credential" |
| echo "" |
| |
| echo "Use a random number as the credential input" |
| ${PREFIX}getrandom -by 32 -of tmpcredin.bin > run.out |
| checkSuccess $? |
| |
| echo "Load the storage key under the primary key, 80000001" |
| ${PREFIX}load -hp 80000000 -ipr storersa2048priv.bin -ipu storersa2048pub.bin -pwdp sto > run.out |
| checkSuccess $? |
| |
| echo "Create a restricted signing key under the primary key" |
| ${PREFIX}create -hp 80000000 -sir -kt f -kt p -opr tmprpriv.bin -opu tmprpub.bin -pwdp sto -pwdk sig -pol policies/policyccactivate.bin > run.out |
| checkSuccess $? |
| |
| echo "Load the signing key under the primary key, 80000002" |
| ${PREFIX}load -hp 80000000 -ipr tmprpriv.bin -ipu tmprpub.bin -pwdp sto > run.out |
| checkSuccess $? |
| |
| echo "Encrypt the credential using makecredential" |
| ${PREFIX}makecredential -ha 80000001 -icred tmpcredin.bin -in h80000002.bin -ocred tmpcredenc.bin -os tmpsecret.bin > run.out |
| checkSuccess $? |
| |
| echo "Start a policy session" |
| ${PREFIX}startauthsession -se p > run.out |
| checkSuccess $? |
| |
| echo "Policy command code - activatecredential" |
| ${PREFIX}policycommandcode -ha 03000000 -cc 00000147 > run.out |
| checkSuccess $? |
| |
| echo "Activate credential" |
| ${PREFIX}activatecredential -ha 80000002 -hk 80000001 -icred tmpcredenc.bin -is tmpsecret.bin -pwdk sto -ocred tmpcreddec.bin -se0 03000000 0 > run.out |
| checkSuccess $? |
| |
| echo "Check the decrypted result" |
| diff tmpcredin.bin tmpcreddec.bin > run.out |
| checkSuccess $? |
| |
| echo "Flush the storage key" |
| ${PREFIX}flushcontext -ha 80000001 > run.out |
| checkSuccess $? |
| |
| echo "Flush the signing key" |
| ${PREFIX}flushcontext -ha 80000002 > run.out |
| checkSuccess $? |
| |
| echo "" |
| echo "EK Certificate" |
| echo "" |
| |
| # The mbedtls port does not support EC certificate creation yet */ |
| |
| if [ ${CRYPTOLIBRARY} == "openssl" ]; then |
| |
| echo "Set platform hierarchy auth" |
| ${PREFIX}hierarchychangeauth -hi p -pwdn ppp > run.out |
| checkSuccess $? |
| |
| for ALG in "rsa" "ecc" |
| do |
| |
| echo "Create an ${ALG} EK certificate" |
| ${PREFIX}createekcert -alg ${ALG} -cakey cakey.pem -capwd rrrr -pwdp ppp -of tmp.der > run.out |
| checkSuccess $? |
| |
| echo "Read the ${ALG} EK certificate" |
| ${PREFIX}createek -alg ${ALG} -ce > run.out |
| checkSuccess $? |
| |
| echo "Read the ${ALG} template - should fail" |
| ${PREFIX}createek -alg ${ALG} -te > run.out |
| checkFailure $? |
| |
| echo "Read the ${ALG} nonce - should fail" |
| ${PREFIX}createek -alg ${ALG} -no > run.out |
| checkFailure $? |
| |
| echo "CreatePrimary and validate the ${ALG} EK against the EK certificate" |
| ${PREFIX}createek -alg ${ALG} -cp > run.out |
| checkSuccess $? |
| |
| echo "Validate the ${ALG} EK certificate against the root" |
| ${PREFIX}createek -alg ${ALG} -root certificates/rootcerts.txt > run.out |
| checkSuccess $? |
| |
| done |
| |
| echo "Clear platform hierarchy auth" |
| ${PREFIX}hierarchychangeauth -hi p -pwda ppp > run.out |
| checkSuccess $? |
| |
| # openssl vs mbedtls |
| fi |
| |
| echo "" |
| echo "EK Policies using optional policy in NV" |
| echo "" |
| |
| # Section B.8.2 Computing PolicyA - the standard IWG PolicySecret with endorsement auth |
| # policyiwgek.txt |
| # 000001514000000B |
| # (blank line for policyRef) |
| # |
| # policymaker -if policies/policyiwgek.txt -ns -halg sha256 -of policies/policyiwgeksha256.bin |
| # policymaker -if policies/policyiwgek.txt -ns -halg sha384 -of policies/policyiwgeksha384.bin |
| # policymaker -if policies/policyiwgek.txt -ns -halg sha512 -of policies/policyiwgeksha512.bin |
| |
| # 837197674484b3f81a90cc8d46a5d724fd52d76e06520b64f2a1da1b331469aa |
| # 8bbf2266537c171cb56e403c4dc1d4b64f432611dc386e6f532050c3278c930e143e8bb1133824ccb431053871c6db53 |
| # 1e3b76502c8a1425aa0b7b3fc646a1b0fae063b03b5368f9c4cddecaff0891dd682bac1a85d4d832b781ea451915de5fc5bf0dc4a1917cd42fa041e3f998e0ee |
| |
| # Section B.8.3 Computing Policy Index Names - attributes 220F1008 |
| |
| # For test, put PolicySecret + platform auth in NV Index. This is NOT the IWG standard, just for test. |
| |
| # for prepending the hash algorithm identifier to make the TPMT_HA structure |
| # printf "%b" '\x00\x0b' > policies/sha256.bin |
| # printf "%b" '\x00\x0c' > policies/sha384.bin |
| # printf "%b" '\x00\x0d' > policies/sha512.bin |
| |
| # policymaker -if policies/policysecretp.txt -halg sha256 -pr -of policies/policysecretpsha256.bin -pr |
| # policymaker -if policies/policysecretp.txt -halg sha384 -pr -of policies/policysecretpsha384.bin -pr |
| # policymaker -if policies/policysecretp.txt -halg sha512 -pr -of policies/policysecretpsha512.bin -pr |
| |
| # prepend the algorithm identifiers |
| # cat policies/sha256.bin policies/policysecretpsha256.bin >! policies/policysecretpsha256ha.bin |
| # cat policies/sha384.bin policies/policysecretpsha384.bin >! policies/policysecretpsha384ha.bin |
| # cat policies/sha512.bin policies/policysecretpsha512.bin >! policies/policysecretpsha512ha.bin |
| |
| # NV Index Name calculation |
| |
| HALG=(sha256 sha384 sha512) |
| IDX=(01c07f01 01c07f02 01c07f03) |
| SIZ=(34 50 66) |
| # algorithms from Algorithm Registry |
| HBIN=(000b 000c 000d) |
| # Name from Table 14: Policy Index Names |
| NVNAME=( |
| 000b0c9d717e9c3fe69fda41769450bb145957f8b3610e084dbf65591a5d11ecd83f |
| 000cdb62fca346612c976732ff4e8621fb4e858be82586486504f7d02e621f8d7d61ae32cfc60c4d120609ed6768afcf090c |
| 000d1c47c0bbcbd3cf7d7cae6987d31937c171015dde3b7f0d3c869bca1f7e8a223b9acfadb49b7c9cf14d450f41e9327de34d9291eece2c58ab1dc10e9059cce560 |
| ) |
| |
| for ((i = 0 ; i < 3; i++)) |
| do |
| |
| echo "Undefine optional ${HALG[i]} NV index ${IDX[i]}" |
| ${PREFIX}nvundefinespace -ha ${IDX[i]} -hi o > run.out |
| echo " INFO:" |
| |
| echo "Define optional ${HALG[i]} NV index ${IDX[i]} with PolicySecret for TPM_RH_ENDORSEMENT" |
| ${PREFIX}nvdefinespace -ha ${IDX[i]} -nalg ${HALG[i]} -hi o -pol policies/policyiwgek${HALG[i]}.bin -sz ${SIZ[i]} +at wa +at or +at ppr +at ar -at aw > run.out |
| checkSuccess $? |
| |
| echo "Start a ${HALG[i]} policy session" |
| ${PREFIX}startauthsession -se p -halg ${HALG[i]} > run.out |
| checkSuccess $? |
| |
| echo "Satisfy the policy" |
| ${PREFIX}policysecret -hs 03000000 -ha 4000000B > run.out |
| checkSuccess $? |
| |
| echo "Get the session digest for debug" |
| ${PREFIX}policygetdigest -ha 03000000 > run.out |
| checkSuccess $? |
| |
| echo "Write the ${HALG[i]} ${IDX[i]} index to set the written bit before reading the Name" |
| ${PREFIX}nvwrite -ha ${IDX[i]} -if policies/policysecretp${HALG[i]}ha.bin -se0 03000000 0 > run.out |
| checkSuccess $? |
| |
| echo "Read the ${HALG[i]} Name" |
| ${PREFIX}nvreadpublic -ha ${IDX[i]} -ns > run.out |
| checkSuccess $? |
| |
| echo "Verify the ${HALG[i]} Name" |
| ACTUAL=`grep ${HBIN[i]} run.out |grep -v nvreadpublic` |
| diff <(echo "${ACTUAL}" ) <(echo "${NVNAME[i]}" ) |
| checkSuccess $? |
| |
| done |
| |
| # B.8.4 Computing PolicyC - TPM_CC_PolicyAuthorizeNV || nvIndex->Name) |
| |
| # policyiwgekcsha256.txt |
| # 00000192000b0c9d717e9c3fe69fda41769450bb145957f8b3610e084dbf65591a5d11ecd83f |
| |
| # policyiwgekcsha384.txt |
| # 00000192000cdb62fca346612c976732ff4e8621fb4e858be82586486504f7d02e621f8d7d61ae32cfc60c4d120609ed6768afcf090c |
| |
| # policyiwgekcsha512.txt |
| # 00000192000d1c47c0bbcbd3cf7d7cae6987d31937c171015dde3b7f0d3c869bca1f7e8a223b9acfadb49b7c9cf14d450f41e9327de34d9291eece2c58ab1dc10e9059cce560 |
| |
| # policymaker -if policies/policyiwgekcsha256.txt -ns -halg sha256 -pr -of policies/policyiwgekcsha256.bin |
| # 3767e2edd43ff45a3a7e1eaefcef78643dca964632e7aad82c673a30d8633fde |
| |
| # policymaker -if policies/policyiwgekcsha384.txt -ns -halg sha384 -pr -of policies/policyiwgekcsha384.bin |
| # d6032ce61f2fb3c240eb3cf6a33237ef2b6a16f4293c22b455e261cffd217ad5b4947c2d73e63005eed2dc2b3593d165 |
| |
| # policymaker -if policies/policyiwgekcsha512.txt -ns -halg sha512 -pr -of policies/policyiwgekcsha512.bin |
| # 589ee1e146544716e8deafe6db247b01b81e9f9c7dd16b814aa159138749105fba5388dd1dea702f35240c184933121e2c61b8f50d3ef91393a49a38c3f73fc8 |
| |
| # B.8.5 Computing PolicyB - TPM_CC_PolicyOR || digests |
| |
| # policyiwgekbsha256.txt |
| # 00000171 |
| # 837197674484b3f81a90cc8d46a5d724fd52d76e06520b64f2a1da1b331469aa |
| # 3767e2edd43ff45a3a7e1eaefcef78643dca964632e7aad82c673a30d8633fde |
| # policymaker -if policies/policyiwgekbsha256.txt -halg sha256 -pr -of policies/policyiwgekbsha256.bin |
| # ca 3d 0a 99 a2 b9 39 06 f7 a3 34 24 14 ef cf b3 |
| # a3 85 d4 4c d1 fd 45 90 89 d1 9b 50 71 c0 b7 a0 |
| |
| # policyiwgekbsha384.txt |
| # 00000171 |
| # 8bbf2266537c171cb56e403c4dc1d4b64f432611dc386e6f532050c3278c930e143e8bb1133824ccb431053871c6db53 |
| # d6032ce61f2fb3c240eb3cf6a33237ef2b6a16f4293c22b455e261cffd217ad5b4947c2d73e63005eed2dc2b3593d165 |
| # policymaker -if policies/policyiwgekbsha384.txt -halg sha384 -pr -of policies/policyiwgekbsha384.bin |
| # b2 6e 7d 28 d1 1a 50 bc 53 d8 82 bc f5 fd 3a 1a |
| # 07 41 48 bb 35 d3 b4 e4 cb 1c 0a d9 bd e4 19 ca |
| # cb 47 ba 09 69 96 46 15 0f 9f c0 00 f3 f8 0e 12 |
| |
| # policyiwgekbsha512.txt |
| # 00000171 |
| # 1e3b76502c8a1425aa0b7b3fc646a1b0fae063b03b5368f9c4cddecaff0891dd682bac1a85d4d832b781ea451915de5fc5bf0dc4a1917cd42fa041e3f998e0ee |
| # 589ee1e146544716e8deafe6db247b01b81e9f9c7dd16b814aa159138749105fba5388dd1dea702f35240c184933121e2c61b8f50d3ef91393a49a38c3f73fc8 |
| # policymaker -if policies/policyiwgekbsha512.txt -halg sha512 -pr -of policies/policyiwgekbsha512.bin |
| # b8 22 1c a6 9e 85 50 a4 91 4d e3 fa a6 a1 8c 07 |
| # 2c c0 12 08 07 3a 92 8d 5d 66 d5 9e f7 9e 49 a4 |
| # 29 c4 1a 6b 26 95 71 d5 7e db 25 fb db 18 38 42 |
| # 56 08 b4 13 cd 61 6a 5f 6d b5 b6 07 1a f9 9b ea |
| |
| echo "" |
| echo "Test the EK policies" |
| echo "" |
| |
| # test message to be signed |
| echo -n "1234567890123456" > msg.bin |
| |
| # Change endorsement and platform hierarchy passwords for testing |
| |
| echo "Change endorsement hierarchy password" |
| ${PREFIX}hierarchychangeauth -hi e -pwdn eee |
| checkSuccess $? |
| |
| echo "Change platform hierarchy password" |
| ${PREFIX}hierarchychangeauth -hi p -pwdn ppp |
| checkSuccess $? |
| |
| for ((i = 0 ; i < 3; i++)) |
| do |
| |
| echo "Create an RSA primary key ${HALG[i]} 80000001" |
| ${PREFIX}createprimary -si -nalg ${HALG[i]} -pwdk kkk -pol policies/policyiwgekb${HALG[i]}.bin -rsa 2048 > run.out |
| checkSuccess $? |
| |
| echo "Start a policy session ${HALG[i]} 03000000" |
| ${PREFIX}startauthsession -se p -halg ${HALG[i]} > run.out |
| checkSuccess $? |
| |
| echo "Satisfy Policy A - Policy Secret with PWAP session and endorsement hierarchy auth" |
| ${PREFIX}policysecret -ha 4000000b -hs 03000000 -pwde eee > run.out |
| checkSuccess $? |
| |
| echo "Get the session digest for debug" |
| ${PREFIX}policygetdigest -ha 03000000 > run.out |
| checkSuccess $? |
| |
| echo "Policy OR ${HALG[i]}" |
| ${PREFIX}policyor -ha 03000000 -if policies/policyiwgek${HALG[i]}.bin -if policies/policyiwgekc${HALG[i]}.bin > run.out |
| checkSuccess $? |
| |
| echo "Get the ${HALG[i]} session digest for debug" |
| ${PREFIX}policygetdigest -ha 03000000 > run.out |
| checkSuccess $? |
| |
| echo "Sign a digest - policy A" |
| ${PREFIX}sign -hk 80000001 -if msg.bin -os sig.bin -se0 03000000 1 > run.out |
| checkSuccess $? |
| |
| echo "Policy restart ${HALG[i]} 03000000" |
| ${PREFIX}policyrestart -ha 03000000 > run.out |
| checkSuccess $? |
| |
| echo "Satisfy NV Index Policy - Policy Secret with PWAP session and platform hierarchy auth" |
| ${PREFIX}policysecret -ha 4000000c -hs 03000000 -pwde ppp > run.out |
| checkSuccess $? |
| |
| echo "Get the ${HALG[i]} session digest for debug" |
| ${PREFIX}policygetdigest -ha 03000000 > run.out |
| checkSuccess $? |
| |
| echo "Satisfy Policy C - Policy Authorize NV" |
| ${PREFIX}policyauthorizenv -ha ${IDX[i]} -hs 03000000 > run.out |
| checkSuccess $? |
| |
| echo "Get the ${HALG[i]} session digest for debug" |
| ${PREFIX}policygetdigest -ha 03000000 > run.out |
| checkSuccess $? |
| |
| echo "Policy OR ${HALG[i]}" |
| ${PREFIX}policyor -ha 03000000 -if policies/policyiwgek${HALG[i]}.bin -if policies/policyiwgekc${HALG[i]}.bin > run.out |
| checkSuccess $? |
| |
| echo "Get the ${HALG[i]} session digest for debug" |
| ${PREFIX}policygetdigest -ha 03000000 > run.out |
| checkSuccess $? |
| |
| echo "Sign a digest - policy A" |
| ${PREFIX}sign -hk 80000001 -if msg.bin -os sig.bin -se0 03000000 1 > run.out |
| checkSuccess $? |
| |
| echo "Flush the policy session ${HALG[i]} 03000000" |
| ${PREFIX}flushcontext -ha 03000000 > run.out |
| checkSuccess $? |
| |
| echo "Flush the primary key ${HALG[i]} 80000001" |
| ${PREFIX}flushcontext -ha 80000001 > run.out |
| checkSuccess $? |
| |
| done |
| |
| echo "" |
| echo "Cleanup" |
| echo "" |
| |
| echo "Reset endorsement hierarchy password" |
| ${PREFIX}hierarchychangeauth -hi e -pwda eee |
| checkSuccess $? |
| |
| echo "Reset platform hierarchy password" |
| ${PREFIX}hierarchychangeauth -hi p -pwda ppp |
| checkSuccess $? |
| |
| for ((i = 0 ; i < 3; i++)) |
| do |
| |
| echo "Undefine optional ${HALG[i]} NV index ${IDX[i]}" |
| ${PREFIX}nvundefinespace -ha ${IDX[i]} -hi o > run.out |
| checkSuccess $? |
| |
| done |
| |
| rm -f run.out |
| rm -f sig.bin |
| rm -f tmprpub.bin |
| rm -f tmprpriv.bin |
| rm -f tmpcredin.bin |
| rm -f tmpcredenc.bin |
| rm -f tmpcreddec.bin |
| rm -f tmpsecret.bin |
| rm -f tmp.der |
| |
| # ${PREFIX}getcapability -cap 1 -pr 80000000 |
| # ${PREFIX}getcapability -cap 1 -pr 02000000 |