tpm

package
v0.3.3-rsa Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jun 9, 2023 License: Apache-2.0 Imports: 16 Imported by: 0

Documentation

Overview

Package tpm supports direct communication with a tpm device under Linux.

Index

Constants

View Source 
const (
	CapAlg      uint32 = 0x00000002
	CapProperty uint32 = 0x00000005
	CapFlag     uint32 = 0x00000004
	CapNVList   uint32 = 0x0000000D
	CapNVIndex  uint32 = 0x00000011
	CapHandle   uint32 = 0x00000014
	CapVersion  uint32 = 0x0000001A
)

Capability types.

View Source 
const (
	SubCapPropManufacturer uint32 = 0x00000103
	SubCapFlagPermanent    uint32 = 0x00000108
)

SubCapabilities

View Source 
const PCRSize int = 20

PCRSize gives the fixed size (20 bytes) of a PCR.

Variables

View Source 
var AlgMap = map[Algorithm]string{
	AlgRSA:    "RSA",
	AlgSHA:    "SHA1",
	AlgHMAC:   "HMAC",
	AlgAES128: "AER128",
	AlgMGF1:   "MFG1",
	AlgAES192: "AES192",
	AlgAES256: "AES256",
}

AlgMap Map of Algorithms to Strings for nicer output and comparisons, etc.

Functions

func ActivateIdentity 

func ActivateIdentity(rw io.ReadWriter, aikAuth []byte, ownerAuth []byte, aik tpmutil.Handle, asym, sym []byte) ([]byte, error)

ActivateIdentity asks the TPM to decrypt an EKPub encrypted symmetric session key which it uses to decrypt the symmetrically encrypted secret.

func AuthorizeMigrationKey 

func AuthorizeMigrationKey(rw io.ReadWriter, ownerAuth Digest, migrationKey crypto.PublicKey) ([]byte, error)

AuthorizeMigrationKey authorizes a given public key for use in migrating migratable keys. The scheme is REWRAP.

func CloseKey 

func CloseKey(rw io.ReadWriter, h tpmutil.Handle) error

CloseKey flushes the key associated with the tpmutil.Handle.

func CreateMigratableWrapKey 

func CreateMigratableWrapKey(rw io.ReadWriter, srkAuth []byte, usageAuth Digest, migrationAuth Digest, pcrs []int) ([]byte, []byte, error)

CreateMigratableWrapKey creates a new RSA key as in CreateWrapKey, but the key is migratable (with the given migration auth). Returns the loadable KeyBlob as well as just the encrypted private part, for migration.

func CreateMigrationBlob 

func CreateMigrationBlob(rw io.ReadWriter, srkAuth Digest, migrationAuth Digest, keyBlob []byte, migrationKeyBlob []byte) ([]byte, error)

CreateMigrationBlob performs a Rewrap migration of the given key blob.

func CreateWrapKey 

func CreateWrapKey(rw io.ReadWriter, srkAuth []byte, usageAuth Digest, migrationAuth Digest, pcrs []int) ([]byte, error)

CreateWrapKey creates a new RSA key for signatures inside the TPM. It is wrapped by the SRK (which is to say, the SRK is the parent key). The key can be bound to the specified PCR numbers so that it can only be used for signing if the PCR values of those registers match. The pcrs parameter can be nil in which case the key is not bound to any PCRs. The usageAuth parameter defines the auth key for using this new key. The migrationAuth parameter would be used for authorizing migration of the key (although this code currently disables migration).

func FetchPCRValues 

func FetchPCRValues(rw io.ReadWriter, pcrVals []int) ([]byte, error)

FetchPCRValues gets a given sequence of PCR values.

func ForceClear 

func ForceClear(rw io.ReadWriter) error

ForceClear is normally used by firmware but on some platforms vendors got it wrong and didn't call TPM_DisableForceClear. It removes forcefully the ownership of the TPM.

func GetCapabilityRaw 

func GetCapabilityRaw(rw io.ReadWriter, cap, subcap uint32) ([]byte, error)

GetCapabilityRaw reads the requested capability and sub-capability from the TPM and returns it as a []byte. Where possible, prefer the convenience functions above, which return higher-level structs for easier handling.

func GetKeys 

func GetKeys(rw io.ReadWriter) ([]tpmutil.Handle, error)

GetKeys gets the list of handles for currently-loaded TPM keys.

func GetManufacturer 

func GetManufacturer(rw io.ReadWriter) ([]byte, error)

GetManufacturer returns the manufacturer ID

func GetNVList 

func GetNVList(rw io.ReadWriter) ([]uint32, error)

GetNVList returns a list of TPM_NV_INDEX values that are currently allocated NV storage through TPM_NV_DefineSpace.

func GetPubKey 

func GetPubKey(rw io.ReadWriter, keyHandle tpmutil.Handle, srkAuth []byte) ([]byte, error)

GetPubKey retrieves an opaque blob containing a public key corresponding to a handle from the TPM.

func GetRandom 

func GetRandom(rw io.ReadWriter, size uint32) ([]byte, error)

GetRandom gets random bytes from the TPM.

func LoadKey2 

func LoadKey2(rw io.ReadWriter, keyBlob []byte, srkAuth []byte) (tpmutil.Handle, error)

LoadKey2 loads a key blob (a serialized TPM_KEY or TPM_KEY12) into the TPM and returns a handle for this key.

func MakeIdentity 

func MakeIdentity(rw io.ReadWriter, srkAuth []byte, ownerAuth []byte, aikAuth []byte, pk crypto.PublicKey, label []byte) ([]byte, error)

MakeIdentity creates a new AIK with the given new auth value, and the given parameters for the privacy CA that will be used to attest to it. If both pk and label are nil, then the TPM_CHOSENID_HASH is set to all 0s as a special case. MakeIdentity returns a key blob for the newly-created key. The caller must be authorized to use the SRK, since the private part of the AIK is sealed against the SRK. TODO(tmroeder): currently, this code can only create 2048-bit RSA keys.

func NVDefineSpace 

func NVDefineSpace(rw io.ReadWriter, nvData NVDataPublic, ownAuth []byte) error

NVDefineSpace implements the reservation of NVRAM as specified in: TPM-Main-Part-3-Commands_v1.2_rev116_01032011, P. 212

func NVReadValue 

func NVReadValue(rw io.ReadWriter, index, offset, len uint32, ownAuth []byte) ([]byte, error)

NVReadValue returns the value from a given index, offset, and length in NVRAM. See TPM-Main-Part-2-TPM-Structures 19.1. If TPM isn't locked, no authentication is needed. This is for platform suppliers only. See TPM-Main-Part-3-Commands-20.4

func NVReadValueAuth 

func NVReadValueAuth(rw io.ReadWriter, index, offset, len uint32, auth []byte) ([]byte, error)

NVReadValueAuth returns the value from a given index, offset, and length in NVRAM. See TPM-Main-Part-2-TPM-Structures 19.1. If TPM is locked, authentication is mandatory. See TPM-Main-Part-3-Commands-20.5

func NVWriteValue 

func NVWriteValue(rw io.ReadWriter, index, offset uint32, data []byte, ownAuth []byte) error

NVWriteValue for writing to the NVRAM. Needs a index for a defined space in NVRAM. See TPM-Main-Part-3-Commands_v1.2_rev116_01032011, P216

func NVWriteValueAuth 

func NVWriteValueAuth(rw io.ReadWriter, index, offset uint32, data []byte, auth []byte) error

NVWriteValueAuth for authenticated writing to the NVRAM. Needs a index of a defined space in NVRAM. See TPM-Main-Part-2-TPM-Structures 19.1. If TPM is locked, authentification is mandatory. See TPM-Main-Part-3-Commands_v1.2_rev116_01032011, P216

func NewQuoteInfo 

func NewQuoteInfo(data []byte, pcrNums []int, pcrs []byte) ([]byte, error)

NewQuoteInfo computes a quoteInfo structure for a given pair of data and PCR values.

func OpenTPM 

func OpenTPM(path string) (io.ReadWriteCloser, error)

OpenTPM opens a channel to the TPM at the given path. If the file is a device, then it treats it like a normal TPM device, and if the file is a Unix domain socket, then it opens a connection to the socket.

func OwnerClear 

func OwnerClear(rw io.ReadWriter, ownerAuth Digest) error

OwnerClear uses owner auth to clear the TPM. After this operation, the TPM can change ownership.

func OwnerReadPubEK 

func OwnerReadPubEK(rw io.ReadWriter, ownerAuth Digest) ([]byte, error)

OwnerReadPubEK uses owner auth to get a blob representing the public part of the endorsement key.

func OwnerReadSRK 

func OwnerReadSRK(rw io.ReadWriter, ownerAuth Digest) ([]byte, error)

OwnerReadSRK uses owner auth to get a blob representing the SRK.

func PcrExtend 

func PcrExtend(rw io.ReadWriter, pcrIndex uint32, pcr pcrValue) ([]byte, error)

PcrExtend extends a value into the right PCR by index.

func PcrReset 

func PcrReset(rw io.ReadWriter, pcrs []int) error

PcrReset resets the given PCRs. Given typical locality restrictions, this can usually only be 16 or 23.

func Quote 

func Quote(rw io.ReadWriter, handle tpmutil.Handle, data []byte, pcrNums []int, aikAuth []byte) ([]byte, []byte, error)

Quote produces a TPM quote for the given data under the given PCRs. It uses AIK auth and a given AIK handle.

func Quote2 

func Quote2(rw io.ReadWriter, handle tpmutil.Handle, data []byte, pcrVals []int, addVersion byte, aikAuth []byte) ([]byte, error)

Quote2 performs a quote operation on the TPM for the given data, under the key associated with the handle and for the pcr values specified in the call.

func ReadEKCert 

func ReadEKCert(rw io.ReadWriter, ownAuth Digest) ([]byte, error)

ReadEKCert reads the EKCert from the NVRAM. The TCG PC Client specifies additional headers that are to be stored with the EKCert, we parse them here and return only the DER encoded certificate. TCG PC Client Specific Implementation Specification for Conventional BIOS 7.4.4 https://www.trustedcomputinggroup.org/wp-content/uploads/TCG_PCClientImplementation_1-21_1_00.pdf

func ReadPCR 

func ReadPCR(rw io.ReadWriter, pcrIndex uint32) ([]byte, error)

ReadPCR reads a PCR value from the TPM.

func ReadPubEK 

func ReadPubEK(rw io.ReadWriter) ([]byte, error)

ReadPubEK reads the public part of the endorsement key when no owner is established.

func Reseal 

func Reseal(rw io.ReadWriter, loc Locality, pcrs map[int][]byte, data []byte, srkAuth []byte) ([]byte, error)

Reseal takes a pre-calculated PCR map and locality in order to seal data with a srkAuth. This function is necessary for PCR pre-calculation and later sealing to provide a way of updating software which is part of a measured boot process.

func ResetLockValue 

func ResetLockValue(rw io.ReadWriter, ownerAuth Digest) error

ResetLockValue resets the dictionary-attack value in the TPM; this allows the TPM to start working again after authentication errors without waiting for the dictionary-attack defenses to time out. This requires owner authentication.

func Seal 

func Seal(rw io.ReadWriter, loc Locality, pcrs []int, data []byte, srkAuth []byte) ([]byte, error)

Seal encrypts data against a given locality and PCRs and returns the sealed data.

func Sign 

func Sign(rw io.ReadWriter, keyAuth []byte, keyHandle tpmutil.Handle, hash crypto.Hash, hashed []byte) ([]byte, error)

Sign will sign a digest using the supplied key handle. Uses PKCS1v15 signing, which means the hash OID is prefixed to the hash before it is signed. Therefore the hash used needs to be passed as the hash parameter to determine the right prefix.

func TakeOwnership 

func TakeOwnership(rw io.ReadWriter, newOwnerAuth Digest, newSRKAuth Digest, pubEK []byte) error

TakeOwnership takes over a TPM and inserts a new owner auth value and generates a new SRK, associating it with a new SRK auth value. This operation can only be performed if there isn't already an owner for the TPM. The pub EK blob can be acquired by calling ReadPubEK if there is no owner, or OwnerReadPubEK if there is.

func UnmarshalPubRSAPublicKey 

func UnmarshalPubRSAPublicKey(keyBlob []byte) (*rsa.PublicKey, error)

UnmarshalPubRSAPublicKey takes in a blob containing a serialized RSA TPM_PUBKEY and converts it to a crypto/rsa.PublicKey.

func UnmarshalRSAPublicKey 

func UnmarshalRSAPublicKey(keyBlob []byte) (*rsa.PublicKey, error)

UnmarshalRSAPublicKey takes in a blob containing a serialized RSA TPM_KEY and converts it to a crypto/rsa.PublicKey.

func Unseal 

func Unseal(rw io.ReadWriter, sealed []byte, srkAuth []byte) ([]byte, error)

Unseal decrypts data encrypted by the TPM.

func VerifyQuote 

func VerifyQuote(pk *rsa.PublicKey, data []byte, quote []byte, pcrNums []int, pcrs []byte) error

VerifyQuote verifies a quote against a given set of PCRs.

Types

type Algorithm 

type Algorithm uint32

Algorithm type for more convenient handling. see Algorithm ID for possible values. 

const (
	AlgRSA Algorithm

	AlgSHA
	AlgHMAC
	AlgAES128
	AlgMGF1
	AlgAES192
	AlgAES256
	AlgXOR
)

Algorithm ID values.

func GetAlgs 

func GetAlgs(rw io.ReadWriter) ([]Algorithm, error)

GetAlgs returns a list of algorithms supported by the TPM device.

func (Algorithm) String 

func (a Algorithm) String() string

type CapVersionInfo 

type CapVersionInfo struct {
	Tag            tpmutil.Tag
	Version        capVersion
	SpecLevel      uint16
	ErrataRev      byte
	TPMVendorID    [4]byte
	VendorSpecific tpmutil.U16Bytes
}

CapVersionInfo implements TPM_CAP_VERSION_INFO from spec. Part 2 - Page 174

func GetCapVersionVal 

func GetCapVersionVal(rw io.ReadWriter) (*CapVersionInfo, error)

GetCapVersionVal returns the decoded contents of TPM_CAP_VERSION_INFO.

func (*CapVersionInfo) Decode 

func (c *CapVersionInfo) Decode(data []byte) error

Decode reads TPM_CAP_VERSION_INFO into CapVersionInfo.

type Digest 

type Digest [20]byte

A Digest is a 20-byte SHA1 value.

type KeyFlags 

type KeyFlags uint32

KeyFlags represents TPM_KEY_FLAGS.

type Locality 

type Locality byte

Locality type 

const (
	LocZero Locality = 1 << iota
	LocOne
	LocTwo
	LocThree
	LocFour
)

Values of locality Note: Localities are summable

func (Locality) String 

func (l Locality) String() string

// String returns a textual representation of the set of Localities

type MigrationScheme 

type MigrationScheme uint16

MigrationScheme represents TPM_MIGRATE_SCHEME.

type NVDataPublic 

type NVDataPublic struct {
	Tag          uint16
	NVIndex      uint32
	PCRInfoRead  pcrInfoShort
	PCRInfoWrite pcrInfoShort
	Permission   nvAttributes
	ReadSTClear  bool
	WriteSTClear bool
	WriteDefine  bool
	Size         uint32
}

NVDataPublic implements the structure of TPM_NV_DATA_PUBLIC as described in TPM-Main-Part-2-TPM-Structures_v1.2_rev116_01032011, P. 142

func GetNVIndex 

func GetNVIndex(rw io.ReadWriter, nvIndex uint32) (*NVDataPublic, error)

GetNVIndex returns the structure of NVDataPublic which contains information about the requested NV Index. See: TPM-Main-Part-2-TPM-Structures_v1.2_rev116_01032011, P.167

type Nonce 

type Nonce [20]byte

A Nonce is a 20-byte value.

type PermanentFlags 

type PermanentFlags struct {
	Tag                          uint16
	Disable                      bool
	Ownership                    bool
	Deactivated                  bool
	ReadPubEK                    bool
	DisableOwnerClear            bool
	AllowMaintenance             bool
	PhysicalPresenceLifetimeLock bool
	PhysicalPresenceHWEnable     bool
	PhysicalPresenceCMDEnable    bool
	CEKPUsed                     bool
	TPMPost                      bool
	TPMPostLock                  bool
	FIPS                         bool
	Operator                     bool
	EnableRevokeEK               bool
	NVLocked                     bool
	ReadSRKPub                   bool
	TPMEstablished               bool
	MaintenanceDone              bool
	DisableFullDALogicInfo       bool
}

PermanentFlags contains persistent TPM properties

func GetPermanentFlags 

func GetPermanentFlags(rw io.ReadWriter) (PermanentFlags, error)

GetPermanentFlags returns the TPM_PERMANENT_FLAGS structure.

type Permission 

type Permission uint32

Permission type 

const (
	NVPerPPWrite    Permission = 0x00000001
	NVPerOwnerWrite Permission = 0x00000002
	NVPerAuthWrite  Permission = 0x00000004
	NVPerWriteAll   Permission = 0x00000800
	// Warning: The Value 0x00001000 is
	// defined in the spec as
	// TPM_NV_PER_WRITEDEFINE, but it is
	// not included directly in this
	// code because it locks the given
	// NV Index permanently if used
	// incorrectly. This operation can't
	// be undone in any way. Do not use
	// this value unless you know what
	// you're doing!
	NVPerWriteSTClear Permission = 0x00002000
	NVPerGlobalLock   Permission = 0x00004000
	NVPerPPRead       Permission = 0x00008000
	NVPerOwnerRead    Permission = 0x00100000
	NVPerAuthRead     Permission = 0x00200000
	NVPerReadSTClear  Permission = 0x80000000
)

NV Permissions and Operations Note: Permissions are summable

func (Permission) String 

func (p Permission) String() string

String returns a textual representation of the set of permissions

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.