denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

libtpmtss: Support of RSAPSS signature scheme

Browse Source
This commit is contained in:
Andreas Steffen
2018-07-19 12:40:42 +02:00
parent e74e920bbc
commit fd21c40b6c
5 changed files with 66 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libtpmtss/tpm_tss_tss2_v2.c
+30 -5
View File
@@ -742,10 +742,12 @@ METHOD(tpm_tss_t, quote, bool,
METHOD(tpm_tss_t, sign, bool,
private_tpm_tss_tss2_t *this, uint32_t hierarchy, uint32_t handle,
signature_scheme_t scheme, chunk_t data, chunk_t pin, chunk_t *signature)
signature_scheme_t scheme, void *params, chunk_t data, chunk_t pin,
chunk_t *signature)
{
key_type_t key_type;
hash_algorithm_t hash_alg;
rsa_pss_params_t *rsa_pss_params;
uint32_t rval;
TPM2_ALG_ID alg_id;
@@ -768,8 +770,17 @@ METHOD(tpm_tss_t, sign, bool,
memcpy(cmd->hmac.buffer, pin.ptr, cmd->hmac.size);
}
key_type = key_type_from_signature_scheme(scheme);
hash_alg = hasher_from_signature_scheme(scheme, NULL);
if (scheme == SIGN_RSA_EMSA_PSS)
{
key_type = KEY_RSA;
rsa_pss_params = (rsa_pss_params_t *)params;
hash_alg = rsa_pss_params->hash;
}
else
{
key_type = key_type_from_signature_scheme(scheme);
hash_alg = hasher_from_signature_scheme(scheme, NULL);
}
/* Check if hash algorithm is supported by TPM */
alg_id = hash_alg_to_tpm_alg_id(hash_alg);
@@ -788,8 +799,16 @@ METHOD(tpm_tss_t, sign, bool,
if (key_type == KEY_RSA && public.publicArea.type == TPM2_ALG_RSA)
{
sig_scheme.scheme = TPM2_ALG_RSASSA;
sig_scheme.details.rsassa.hashAlg = alg_id;
if (scheme == SIGN_RSA_EMSA_PSS)
{
sig_scheme.scheme = TPM2_ALG_RSAPSS;
sig_scheme.details.rsapss.hashAlg = alg_id;
}
else
{
sig_scheme.scheme = TPM2_ALG_RSASSA;
sig_scheme.details.rsassa.hashAlg = alg_id;
}
}
else if (key_type == KEY_ECDSA && public.publicArea.type == TPM2_ALG_ECC)
{
@@ -881,6 +900,12 @@ METHOD(tpm_tss_t, sign, bool,
sig.signature.rsassa.sig.buffer,
sig.signature.rsassa.sig.size));
break;
case SIGN_RSA_EMSA_PSS:
*signature = chunk_clone(
chunk_create(
sig.signature.rsapss.sig.buffer,
sig.signature.rsapss.sig.size));
break;
case SIGN_ECDSA_256:
case SIGN_ECDSA_384:
case SIGN_ECDSA_521: