| // This file was extracted from the TCG Published |
| // Trusted Platform Module Library |
| // Part 4: Supporting Routines |
| // Family "2.0" |
| // Level 00 Revision 01.16 |
| // October 30, 2014 |
| |
| #include <string.h> |
| |
| #include "OsslCryptoEngine.h" |
| #include "CpriHashData.c" |
| #if OPENSSL_VERSION_NUMBER < 0x10100000L |
| // |
| // Temporary aliasing of SM3 to SHA256 until SM3 is available |
| // |
| #define EVP_sm3 EVP_sha256 |
| |
| static void *OPENSSL_zalloc(size_t num) |
| { |
| void *ret = OPENSSL_malloc(num); |
| if (ret != NULL) |
| memset(ret, 0, num); |
| return ret; |
| } |
| |
| static EVP_MD_CTX *EVP_MD_CTX_new(void) |
| { |
| return OPENSSL_zalloc(sizeof(EVP_MD_CTX)); |
| } |
| |
| static void EVP_MD_CTX_free(EVP_MD_CTX *ctx) |
| { |
| EVP_MD_CTX_cleanup(ctx); |
| OPENSSL_free(ctx); |
| } |
| #endif |
| // |
| // |
| // Static Functions |
| // |
| // GetHashServer() |
| // |
| // This function returns the address of the hash server function |
| // |
| static EVP_MD * |
| GetHashServer( |
| TPM_ALG_ID hashAlg |
| ) |
| { |
| switch (hashAlg) |
| { |
| #ifdef TPM_ALG_SHA1 |
| case TPM_ALG_SHA1: |
| return (EVP_MD *)EVP_sha1(); |
| break; |
| #endif |
| #ifdef TPM_ALG_SHA256 |
| case TPM_ALG_SHA256: |
| return (EVP_MD *)EVP_sha256(); |
| break; |
| #endif |
| #ifdef TPM_ALG_SHA384 |
| case TPM_ALG_SHA384: |
| return (EVP_MD *)EVP_sha384(); |
| break; |
| #endif |
| #ifdef TPM_ALG_SHA512 |
| case TPM_ALG_SHA512: |
| return (EVP_MD *)EVP_sha512(); |
| break; |
| #endif |
| #ifdef TPM_ALG_SM3_256 |
| case TPM_ALG_SM3_256: |
| return (EVP_MD *)EVP_sm3(); // OpenSSL 1.1 introduced this function |
| break; |
| #endif |
| case TPM_ALG_NULL: |
| return NULL; |
| default: |
| FAIL(FATAL_ERROR_INTERNAL); |
| } |
| return NULL; // Never reached. |
| } |
| |
| // |
| // |
| // GetHashInfoPointer() |
| // |
| // This function returns a pointer to the hash info for the algorithm. If the algorithm is not supported, function |
| // returns a pointer to the data block associated with TPM_ALG_NULL. |
| // |
| static const HASH_INFO * |
| GetHashInfoPointer( |
| TPM_ALG_ID hashAlg |
| ) |
| { |
| UINT32 i, tableSize; |
| // Get the table size of g_hashData |
| tableSize = sizeof(g_hashData) / sizeof(g_hashData[0]); |
| for(i = 0; i < tableSize - 1; i++) |
| { |
| if(g_hashData[i].alg == hashAlg) |
| return &g_hashData[i]; |
| } |
| return &g_hashData[tableSize-1]; |
| } |
| // |
| // |
| // Hash Functions |
| // |
| // _cpri__HashStartup() |
| // |
| // Function that is called to initialize the hash service. In this implementation, this function does nothing but |
| // it is called by the CryptUtilStartup() function and must be present. |
| // |
| LIB_EXPORT BOOL |
| _cpri__HashStartup( |
| void |
| ) |
| { |
| return TRUE; |
| } |
| // |
| // |
| // _cpri__GetHashAlgByIndex() |
| // |
| // This function is used to iterate through the hashes. TPM_ALG_NULL is returned for all indexes that are |
| // not valid hashes. If the TPM implements 3 hashes, then an index value of 0 will return the first |
| // implemented hash and and index of 2 will return the last. All other index values will return |
| // TPM_ALG_NULL. |
| // |
| // |
| // |
| // |
| // Return Value Meaning |
| // |
| // TPM_ALG_xxx() a hash algorithm |
| // TPM_ALG_NULL this can be used as a stop value |
| // |
| LIB_EXPORT TPM_ALG_ID |
| _cpri__GetHashAlgByIndex( |
| UINT32 index // IN: the index |
| ) |
| { |
| if(index >= HASH_COUNT) |
| return TPM_ALG_NULL; |
| return g_hashData[index].alg; |
| } |
| // |
| // |
| // _cpri__GetHashBlockSize() |
| // |
| // Returns the size of the block used for the hash |
| // |
| // Return Value Meaning |
| // |
| // <0 the algorithm is not a supported hash |
| // >= the digest size (0 for TPM_ALG_NULL) |
| // |
| LIB_EXPORT UINT16 |
| _cpri__GetHashBlockSize( |
| TPM_ALG_ID hashAlg // IN: hash algorithm to look up |
| ) |
| { |
| return GetHashInfoPointer(hashAlg)->blockSize; |
| } |
| // |
| // |
| // _cpri__GetHashDER |
| // |
| // This function returns a pointer to the DER string for the algorithm and indicates its size. |
| // |
| LIB_EXPORT UINT16 |
| _cpri__GetHashDER( |
| TPM_ALG_ID hashAlg, // IN: the algorithm to look up |
| const BYTE **p |
| ) |
| { |
| const HASH_INFO *q; |
| q = GetHashInfoPointer(hashAlg); |
| *p = &q->der[0]; |
| return q->derSize; |
| } |
| // |
| // |
| // _cpri__GetDigestSize() |
| // |
| // Gets the digest size of the algorithm. The algorithm is required to be supported. |
| // |
| // Return Value Meaning |
| // |
| // =0 the digest size for TPM_ALG_NULL |
| // >0 the digest size of a hash algorithm |
| // |
| LIB_EXPORT UINT16 |
| _cpri__GetDigestSize( |
| TPM_ALG_ID hashAlg // IN: hash algorithm to look up |
| ) |
| { |
| return GetHashInfoPointer(hashAlg)->digestSize; |
| } |
| // |
| // |
| // _cpri__GetContextAlg() |
| // |
| // This function returns the algorithm associated with a hash context |
| // |
| LIB_EXPORT TPM_ALG_ID |
| _cpri__GetContextAlg( |
| CPRI_HASH_STATE *hashState // IN: the hash context |
| ) |
| { |
| return hashState->hashAlg; |
| } |
| // |
| // |
| // _cpri__CopyHashState |
| // |
| // This function is used to clone a CPRI_HASH_STATE. The return value is the size of the state. |
| // |
| LIB_EXPORT UINT16 |
| _cpri__CopyHashState ( |
| CPRI_HASH_STATE *out, // OUT: destination of the state |
| CPRI_HASH_STATE *in // IN: source of the state |
| ) |
| { |
| EVP_MD_CTX *in_ctx = *(EVP_MD_CTX **)&in->state; |
| EVP_MD_CTX *out_ctx; |
| pAssert(sizeof(out->state) >= sizeof(EVP_MD_CTX *)); |
| if((out_ctx = EVP_MD_CTX_new()) == NULL) |
| FAIL(FATAL_ERROR_INTERNAL); |
| if(!EVP_MD_CTX_copy_ex(out_ctx, in_ctx)) |
| { |
| EVP_MD_CTX_free(out_ctx); |
| return 0; |
| } |
| *(EVP_MD_CTX**)&out->state = out_ctx; |
| out->hashAlg = in->hashAlg; |
| return sizeof(EVP_MD_CTX *); |
| } |
| |
| // |
| // |
| // _cpri__StartHash() |
| // |
| // Functions starts a hash stack Start a hash stack and returns the digest size. As a side effect, the value of |
| // stateSize in hashState is updated to indicate the number of bytes of state that were saved. This function |
| // calls GetHashServer() and that function will put the TPM into failure mode if the hash algorithm is not |
| // supported. |
| // |
| // Return Value Meaning |
| // |
| // 0 hash is TPM_ALG_NULL |
| // >0 digest size |
| LIB_EXPORT UINT16 |
| _cpri__StartHash( |
| TPM_ALG_ID hashAlg, // IN: hash algorithm |
| BOOL sequence, // IN: TRUE if the state should be saved |
| CPRI_HASH_STATE *hashState // OUT: the state of hash stack. |
| ) |
| { |
| EVP_MD_CTX *context = *(EVP_MD_CTX **)&hashState->state; |
| EVP_MD *evpmdAlgorithm = NULL; |
| pAssert(sizeof(hashState->state) >= sizeof(EVP_MD_CTX *)); |
| evpmdAlgorithm = GetHashServer(hashAlg); |
| if(evpmdAlgorithm == NULL) |
| return 0; |
| if((context = EVP_MD_CTX_new()) == NULL) |
| FAIL(FATAL_ERROR_INTERNAL); |
| *(EVP_MD_CTX**)&hashState->state = context; |
| hashState->hashAlg = hashAlg; |
| if(EVP_DigestInit_ex(context, evpmdAlgorithm, NULL) != 1) |
| FAIL(FATAL_ERROR_INTERNAL); |
| return (CRYPT_RESULT)EVP_MD_CTX_size(context); |
| } |
| // |
| // |
| // _cpri__UpdateHash() |
| // |
| // Add data to a hash or HMAC stack. |
| // |
| LIB_EXPORT void |
| _cpri__UpdateHash( |
| CPRI_HASH_STATE *hashState, // IN: the hash context information |
| UINT32 dataSize, // IN: the size of data to be added to the |
| // digest |
| BYTE *data // IN: data to be hashed |
| ) |
| { |
| EVP_MD_CTX *context = *(EVP_MD_CTX **)&hashState->state; |
| // If there is no context, return |
| if(context == NULL) |
| return; |
| if(EVP_DigestUpdate(context, data, dataSize) != 1) |
| FAIL(FATAL_ERROR_INTERNAL); |
| return; |
| } |
| // |
| // |
| // _cpri__CompleteHash() |
| // |
| // Complete a hash or HMAC computation. This function will place the smaller of digestSize or the size of |
| // the digest in dOut. The number of bytes in the placed in the buffer is returned. If there is a failure, the |
| // returned value is <= 0. |
| // |
| // Return Value Meaning |
| // |
| // 0 no data returned |
| // >0 the number of bytes in the digest |
| // |
| LIB_EXPORT UINT16 |
| _cpri__CompleteHash( |
| CPRI_HASH_STATE *hashState, // IN: the state of hash stack |
| UINT32 dOutSize, // IN: size of digest buffer |
| BYTE *dOut // OUT: hash digest |
| ) |
| { |
| EVP_MD_CTX *context = *(EVP_MD_CTX **)&hashState->state; |
| UINT16 retVal; |
| int hLen; |
| BYTE temp[EVP_MAX_MD_SIZE]; |
| BYTE *rBuffer = dOut; |
| if(context == NULL) |
| return 0; |
| hLen = EVP_MD_CTX_size(context); |
| if((unsigned)hLen > dOutSize) |
| rBuffer = temp; |
| if(EVP_DigestFinal_ex(context, rBuffer, NULL) == 1) |
| { |
| if(rBuffer != dOut) |
| { |
| if(dOut != NULL) |
| { |
| memcpy(dOut, temp, dOutSize); |
| } |
| retVal = (UINT16)dOutSize; |
| } |
| else |
| { |
| retVal = (UINT16)hLen; |
| } |
| } |
| else |
| { |
| retVal = 0; // Indicate that no data is returned |
| } |
| |
| EVP_MD_CTX_free(context); |
| *(EVP_MD_CTX **)&hashState->state = NULL; |
| return retVal; |
| } |
| // |
| // |
| // _cpri__ImportExportHashState() |
| // |
| // This function is used to import or export the hash state. This function would be called to export state when |
| // a sequence object was being prepared for export |
| // |
| LIB_EXPORT void |
| _cpri__ImportExportHashState( |
| CPRI_HASH_STATE *osslFmt, // IN/OUT: the hash state formated for use |
| // by openSSL |
| EXPORT_HASH_STATE *externalFmt, // IN/OUT: the exported hash state |
| IMPORT_EXPORT direction // |
| ) |
| { |
| UNREFERENCED_PARAMETER(direction); |
| UNREFERENCED_PARAMETER(externalFmt); |
| UNREFERENCED_PARAMETER(osslFmt); |
| return; |
| #if 0 |
| if(direction == IMPORT_STATE) |
| { |
| // don't have the import export functions yet so just copy |
| _cpri__CopyHashState(osslFmt, (CPRI_HASH_STATE *)externalFmt); |
| } |
| else |
| { |
| _cpri__CopyHashState((CPRI_HASH_STATE *)externalFmt, osslFmt); |
| } |
| #endif |
| } |
| // |
| // |
| // |
| // _cpri__HashBlock() |
| // |
| // Start a hash, hash a single block, update digest and return the size of the results. |
| // The digestSize parameter can be smaller than the digest. If so, only the more significant bytes are |
| // returned. |
| // |
| // Return Value Meaning |
| // |
| // >= 0 number of bytes in digest (may be zero) |
| // |
| LIB_EXPORT UINT16 |
| _cpri__HashBlock( |
| TPM_ALG_ID hashAlg, // IN: The hash algorithm |
| UINT32 dataSize, // IN: size of buffer to hash |
| BYTE *data, // IN: the buffer to hash |
| UINT32 digestSize, // IN: size of the digest buffer |
| BYTE *digest // OUT: hash digest |
| ) |
| { |
| EVP_MD_CTX *hashContext; |
| EVP_MD *hashServer = NULL; |
| UINT16 retVal = 0; |
| BYTE b[EVP_MAX_MD_SIZE]; // temp buffer in case digestSize not |
| // a full digest |
| unsigned int dSize = _cpri__GetDigestSize(hashAlg); |
| // If there is no digest to compute return |
| if(dSize == 0) |
| return 0; |
| if ((hashContext = EVP_MD_CTX_new()) == NULL) |
| FAIL(FATAL_ERROR_INTERNAL); |
| hashServer = GetHashServer(hashAlg); // Find the hash server |
| // It is an error if the digest size is non-zero but there is no server |
| if( (hashServer == NULL) |
| || (EVP_DigestInit_ex(hashContext, hashServer, NULL) != 1) |
| || (EVP_DigestUpdate(hashContext, data, dataSize) != 1)) |
| FAIL(FATAL_ERROR_INTERNAL); |
| else |
| { |
| // If the size of the digest produced (dSize) is larger than the available |
| // buffer (digestSize), then put the digest in a temp buffer and only copy |
| // the most significant part into the available buffer. |
| if(dSize > digestSize) |
| { |
| if(EVP_DigestFinal_ex(hashContext, b, &dSize) != 1) |
| FAIL(FATAL_ERROR_INTERNAL); |
| memcpy(digest, b, digestSize); |
| retVal = (UINT16)digestSize; |
| } |
| else |
| { |
| if((EVP_DigestFinal_ex(hashContext, digest, &dSize)) != 1) |
| FAIL(FATAL_ERROR_INTERNAL); |
| retVal = (UINT16) dSize; |
| } |
| } |
| EVP_MD_CTX_free(hashContext); |
| return retVal; |
| } |
| // |
| // |
| // |
| // HMAC Functions |
| // |
| // _cpri__StartHMAC |
| // |
| // This function is used to start an HMAC using a temp hash context. The function does the initialization of |
| // the hash with the HMAC key XOR iPad and updates the HMAC key XOR oPad. |
| // The function returns the number of bytes in a digest produced by hashAlg. |
| // |
| // Return Value Meaning |
| // |
| // >= 0 number of bytes in digest produced by hashAlg (may be zero) |
| // |
| LIB_EXPORT UINT16 |
| _cpri__StartHMAC( |
| TPM_ALG_ID hashAlg, // IN: the algorithm to use |
| BOOL sequence, // IN: indicates if the state should be |
| // saved |
| CPRI_HASH_STATE *state, // IN/OUT: the state buffer |
| UINT16 keySize, // IN: the size of the HMAC key |
| BYTE *key, // IN: the HMAC key |
| TPM2B *oPadKey // OUT: the key prepared for the oPad round |
| ) |
| { |
| CPRI_HASH_STATE localState = {}; |
| UINT16 blockSize = _cpri__GetHashBlockSize(hashAlg); |
| UINT16 digestSize; |
| BYTE *pb; // temp pointer |
| UINT32 i; |
| |
| // If the key size is larger than the block size, then the hash of the key |
| // is used as the key |
| if(keySize > blockSize) |
| { |
| // large key so digest |
| if((digestSize = _cpri__StartHash(hashAlg, FALSE, &localState)) == 0) |
| return 0; |
| _cpri__UpdateHash(&localState, keySize, key); |
| _cpri__CompleteHash(&localState, digestSize, oPadKey->buffer); |
| oPadKey->size = digestSize; |
| } |
| else |
| { |
| // key size is ok |
| memcpy(oPadKey->buffer, key, keySize); |
| oPadKey->size = keySize; |
| } |
| // XOR the key with iPad (0x36) |
| pb = oPadKey->buffer; |
| for(i = oPadKey->size; i > 0; i--) |
| *pb++ ^= 0x36; |
| // if the keySize is smaller than a block, fill the rest with 0x36 |
| for(i = blockSize - oPadKey->size; i > 0; i--) |
| *pb++ = 0x36; |
| // Increase the oPadSize to a full block |
| oPadKey->size = blockSize; |
| // Start a new hash with the HMAC key |
| // This will go in the caller's state structure and may be a sequence or not |
| if((digestSize = _cpri__StartHash(hashAlg, sequence, state)) > 0) |
| { |
| _cpri__UpdateHash(state, oPadKey->size, oPadKey->buffer); |
| // XOR the key block with 0x5c ^ 0x36 |
| for(pb = oPadKey->buffer, i = blockSize; i > 0; i--) |
| *pb++ ^= (0x5c ^ 0x36); |
| } |
| return digestSize; |
| } |
| // |
| // |
| // _cpri_CompleteHMAC() |
| // |
| // This function is called to complete an HMAC. It will finish the current digest, and start a new digest. It will |
| // then add the oPadKey and the completed digest and return the results in dOut. It will not return more than |
| // dOutSize bytes. |
| // |
| // Return Value Meaning |
| // |
| // >= 0 number of bytes in dOut (may be zero) |
| // |
| LIB_EXPORT UINT16 |
| _cpri__CompleteHMAC( |
| CPRI_HASH_STATE *hashState, // IN: the state of hash stack |
| TPM2B *oPadKey, // IN: the HMAC key in oPad format |
| UINT32 dOutSize, // IN: size of digest buffer |
| BYTE *dOut // OUT: hash digest |
| ) |
| { |
| BYTE digest[MAX_DIGEST_SIZE]; |
| CPRI_HASH_STATE *state = (CPRI_HASH_STATE *)hashState; |
| CPRI_HASH_STATE localState = {}; |
| UINT16 digestSize = _cpri__GetDigestSize(state->hashAlg); |
| |
| _cpri__CompleteHash(hashState, digestSize, digest); |
| // Using the local hash state, do a hash with the oPad |
| if(_cpri__StartHash(state->hashAlg, FALSE, &localState) != digestSize) |
| return 0; |
| _cpri__UpdateHash(&localState, oPadKey->size, oPadKey->buffer); |
| _cpri__UpdateHash(&localState, digestSize, digest); |
| return _cpri__CompleteHash(&localState, dOutSize, dOut); |
| } |
| // |
| // |
| // Mask and Key Generation Functions |
| // |
| // _crypi_MGF1() |
| // |
| // This function performs MGF1 using the selected hash. MGF1 is T(n) = T(n-1) || H(seed || counter). This |
| // function returns the length of the mask produced which could be zero if the digest algorithm is not |
| // supported |
| // |
| // Return Value Meaning |
| // |
| // 0 hash algorithm not supported |
| // >0 should be the same as mSize |
| // |
| LIB_EXPORT CRYPT_RESULT |
| _cpri__MGF1( |
| UINT32 mSize, // IN: length of the mask to be produced |
| BYTE *mask, // OUT: buffer to receive the mask |
| TPM_ALG_ID hashAlg, // IN: hash to use |
| UINT32 sSize, // IN: size of the seed |
| BYTE *seed // IN: seed size |
| ) |
| { |
| EVP_MD_CTX *hashContext; |
| EVP_MD *hashServer = NULL; |
| CRYPT_RESULT retVal = 0; |
| BYTE b[MAX_DIGEST_SIZE]; // temp buffer in case mask is not an |
| // even multiple of a full digest |
| CRYPT_RESULT dSize = _cpri__GetDigestSize(hashAlg); |
| unsigned int digestSize = (UINT32)dSize; |
| UINT32 remaining; |
| UINT32 counter; |
| BYTE swappedCounter[4]; |
| // Parameter check |
| if(mSize > (1024*16)) // Semi-arbitrary maximum |
| FAIL(FATAL_ERROR_INTERNAL); |
| // If there is no digest to compute return |
| if(dSize <= 0) |
| return 0; |
| hashServer = GetHashServer(hashAlg); // Find the hash server |
| if(hashServer == NULL) |
| // If there is no server, then there is no digest |
| return 0; |
| if ((hashContext = EVP_MD_CTX_new()) == NULL) |
| FAIL(FATAL_ERROR_INTERNAL); |
| for(counter = 0, remaining = mSize; remaining > 0; counter++) |
| { |
| // Because the system may be either Endian... |
| UINT32_TO_BYTE_ARRAY(counter, swappedCounter); |
| // Start the hash and include the seed and counter |
| if( (EVP_DigestInit_ex(hashContext, hashServer, NULL) != 1) |
| || (EVP_DigestUpdate(hashContext, seed, sSize) != 1) |
| || (EVP_DigestUpdate(hashContext, swappedCounter, 4) != 1) |
| ) |
| FAIL(FATAL_ERROR_INTERNAL); |
| // Handling the completion depends on how much space remains in the mask |
| // buffer. If it can hold the entire digest, put it there. If not |
| // put the digest in a temp buffer and only copy the amount that |
| // will fit into the mask buffer. |
| if(remaining < (unsigned)dSize) |
| { |
| if(EVP_DigestFinal_ex(hashContext, b, &digestSize) != 1) |
| FAIL(FATAL_ERROR_INTERNAL); |
| memcpy(mask, b, remaining); |
| break; |
| } |
| else |
| { |
| if(EVP_DigestFinal_ex(hashContext, mask, &digestSize) != 1) |
| FAIL(FATAL_ERROR_INTERNAL); |
| remaining -= dSize; |
| mask = &mask[dSize]; |
| } |
| retVal = (CRYPT_RESULT)mSize; |
| } |
| EVP_MD_CTX_free(hashContext); |
| return retVal; |
| } |
| // |
| // |
| // _cpri_KDFa() |
| // |
| // This function performs the key generation according to Part 1 of the TPM specification. |
| // This function returns the number of bytes generated which may be zero. |
| // The key and keyStream pointers are not allowed to be NULL. The other pointer values may be NULL. |
| // The value of sizeInBits must be no larger than (2^18)-1 = 256K bits (32385 bytes). |
| // The once parameter is set to allow incremental generation of a large value. If this flag is TRUE, |
| // sizeInBits will be used in the HMAC computation but only one iteration of the KDF is performed. This |
| // would be used for XOR obfuscation so that the mask value can be generated in digest-sized chunks |
| // rather than having to be generated all at once in an arbitrarily large buffer and then XORed() into the |
| // result. If once is TRUE, then sizeInBits must be a multiple of 8. |
| // Any error in the processing of this command is considered fatal. |
| // |
| // Return Value Meaning |
| // |
| // 0 hash algorithm is not supported or is TPM_ALG_NULL |
| // >0 the number of bytes in the keyStream buffer |
| // |
| LIB_EXPORT UINT16 |
| _cpri__KDFa( |
| TPM_ALG_ID hashAlg, // IN: hash algorithm used in HMAC |
| TPM2B *key, // IN: HMAC key |
| const char *label, // IN: a 0-byte terminated label used in KDF |
| TPM2B *contextU, // IN: context U |
| TPM2B *contextV, // IN: context V |
| UINT32 sizeInBits, // IN: size of generated key in bit |
| BYTE *keyStream, // OUT: key buffer |
| UINT32 *counterInOut, // IN/OUT: caller may provide the iteration |
| // counter for incremental operations to |
| // avoid large intermediate buffers. |
| BOOL once // IN: TRUE if only one iteration is performed |
| // FALSE if iteration count determined by |
| // "sizeInBits" |
| ) |
| { |
| UINT32 counter = 0; // counter value |
| INT32 lLen = 0; // length of the label |
| INT16 hLen; // length of the hash |
| INT16 bytes; // number of bytes to produce |
| BYTE *stream = keyStream; |
| BYTE marshaledUint32[4]; |
| CPRI_HASH_STATE hashState = {}; |
| TPM2B_MAX_HASH_BLOCK hmacKey; |
| pAssert(key != NULL && keyStream != NULL); |
| pAssert(once == FALSE || (sizeInBits & 7) == 0); |
| if(counterInOut != NULL) |
| counter = *counterInOut; |
| // Prepare label buffer. Calculate its size and keep the last 0 byte |
| if(label != NULL) |
| for(lLen = 0; label[lLen++] != 0; ); |
| // Get the hash size. If it is less than or 0, either the |
| // algorithm is not supported or the hash is TPM_ALG_NULL |
| // |
| // In either case the digest size is zero. This is the only return |
| // other than the one at the end. All other exits from this function |
| // are fatal errors. After we check that the algorithm is supported |
| // anything else that goes wrong is an implementation flaw. |
| if((hLen = (INT16) _cpri__GetDigestSize(hashAlg)) == 0) |
| return 0; |
| // If the size of the request is larger than the numbers will handle, |
| // it is a fatal error. |
| pAssert(((sizeInBits + 7)/ 8) <= INT16_MAX); |
| bytes = once ? hLen : (INT16)((sizeInBits + 7) / 8); |
| // Generate required bytes |
| for (; bytes > 0; stream = &stream[hLen], bytes = bytes - hLen) |
| { |
| if(bytes < hLen) |
| hLen = bytes; |
| counter++; |
| // Start HMAC |
| if(_cpri__StartHMAC(hashAlg, |
| FALSE, |
| &hashState, |
| key->size, |
| &key->buffer[0], |
| &hmacKey.b) <= 0) |
| FAIL(FATAL_ERROR_INTERNAL); |
| // Adding counter |
| UINT32_TO_BYTE_ARRAY(counter, marshaledUint32); |
| _cpri__UpdateHash(&hashState, sizeof(UINT32), marshaledUint32); |
| // Adding label |
| if(label != NULL) |
| _cpri__UpdateHash(&hashState, lLen, (BYTE *)label); |
| // Adding contextU |
| if(contextU != NULL) |
| _cpri__UpdateHash(&hashState, contextU->size, contextU->buffer); |
| // Adding contextV |
| if(contextV != NULL) |
| _cpri__UpdateHash(&hashState, contextV->size, contextV->buffer); |
| // Adding size in bits |
| UINT32_TO_BYTE_ARRAY(sizeInBits, marshaledUint32); |
| _cpri__UpdateHash(&hashState, sizeof(UINT32), marshaledUint32); |
| // Compute HMAC. At the start of each iteration, hLen is set |
| // to the smaller of hLen and bytes. This causes bytes to decrement |
| // exactly to zero to complete the loop |
| _cpri__CompleteHMAC(&hashState, &hmacKey.b, hLen, stream); |
| } |
| // Mask off bits if the required bits is not a multiple of byte size |
| if((sizeInBits % 8) != 0) |
| keyStream[0] &= ((1 << (sizeInBits % 8)) - 1); |
| if(counterInOut != NULL) |
| *counterInOut = counter; |
| return (CRYPT_RESULT)((sizeInBits + 7)/8); |
| } |
| // |
| // |
| // |
| // _cpri__KDFe() |
| // |
| // KDFe() as defined in TPM specification part 1. |
| // This function returns the number of bytes generated which may be zero. |
| // The Z and keyStream pointers are not allowed to be NULL. The other pointer values may be NULL. The |
| // value of sizeInBits must be no larger than (2^18)-1 = 256K bits (32385 bytes). Any error in the processing |
| // of this command is considered fatal. |
| // |
| // Return Value Meaning |
| // |
| // 0 hash algorithm is not supported or is TPM_ALG_NULL |
| // >0 the number of bytes in the keyStream buffer |
| // |
| LIB_EXPORT UINT16 |
| _cpri__KDFe( |
| TPM_ALG_ID hashAlg, // IN: hash algorithm used in HMAC |
| TPM2B *Z, // IN: Z |
| const char *label, // IN: a 0 terminated label using in KDF |
| TPM2B *partyUInfo, // IN: PartyUInfo |
| TPM2B *partyVInfo, // IN: PartyVInfo |
| UINT32 sizeInBits, // IN: size of generated key in bit |
| BYTE *keyStream // OUT: key buffer |
| ) |
| { |
| UINT32 counter = 0; // counter value |
| UINT32 lSize = 0; |
| BYTE *stream = keyStream; |
| CPRI_HASH_STATE hashState = {}; |
| INT16 hLen = (INT16) _cpri__GetDigestSize(hashAlg); |
| INT16 bytes; // number of bytes to generate |
| BYTE marshaledUint32[4]; |
| pAssert( keyStream != NULL |
| && Z != NULL |
| && ((sizeInBits + 7) / 8) < INT16_MAX); |
| if(hLen == 0) |
| return 0; |
| bytes = (INT16)((sizeInBits + 7) / 8); |
| // Prepare label buffer. Calculate its size and keep the last 0 byte |
| if(label != NULL) |
| for(lSize = 0; label[lSize++] != 0;); |
| // Generate required bytes |
| //The inner loop of that KDF uses: |
| // Hashi := H(counter | Z | OtherInfo) (5) |
| // Where: |
| // Hashi the hash generated on the i-th iteration of the loop. |
| // H() an approved hash function |
| // counter a 32-bit counter that is initialized to 1 and incremented |
| // on each iteration |
| // Z the X coordinate of the product of a public ECC key and a |
| // different private ECC key. |
| // OtherInfo a collection of qualifying data for the KDF defined below. |
| // In this specification, OtherInfo will be constructed by: |
| // OtherInfo := Use | PartyUInfo | PartyVInfo |
| for (; bytes > 0; stream = &stream[hLen], bytes = bytes - hLen) |
| { |
| if(bytes < hLen) |
| hLen = bytes; |
| // |
| counter++; |
| // Start hash |
| if(_cpri__StartHash(hashAlg, FALSE, &hashState) == 0) |
| return 0; |
| // Add counter |
| UINT32_TO_BYTE_ARRAY(counter, marshaledUint32); |
| _cpri__UpdateHash(&hashState, sizeof(UINT32), marshaledUint32); |
| // Add Z |
| if(Z != NULL) |
| _cpri__UpdateHash(&hashState, Z->size, Z->buffer); |
| // Add label |
| if(label != NULL) |
| _cpri__UpdateHash(&hashState, lSize, (BYTE *)label); |
| else |
| // The SP800-108 specification requires a zero between the label |
| // and the context. |
| _cpri__UpdateHash(&hashState, 1, (BYTE *)""); |
| // Add PartyUInfo |
| if(partyUInfo != NULL) |
| _cpri__UpdateHash(&hashState, partyUInfo->size, partyUInfo->buffer); |
| // Add PartyVInfo |
| if(partyVInfo != NULL) |
| _cpri__UpdateHash(&hashState, partyVInfo->size, partyVInfo->buffer); |
| // Compute Hash. hLen was changed to be the smaller of bytes or hLen |
| // at the start of each iteration. |
| _cpri__CompleteHash(&hashState, hLen, stream); |
| } |
| // Mask off bits if the required bits is not a multiple of byte size |
| if((sizeInBits % 8) != 0) |
| keyStream[0] &= ((1 << (sizeInBits % 8)) - 1); |
| return (CRYPT_RESULT)((sizeInBits + 7) / 8); |
| } |
