[tpm2] Re: Why is validation structure required for ESAPI sign() in tpm2-pytss?
Roberts, William C <william.c.roberts at intel.com> Wed, 14 Sep 2022 14:18:38 +0000
| Newsgroups | dev.linux.lists.tpm2 |
|---|---|
| Message-ID | <SN6PR11MB34374863685AD5B75EFC1B6EB8469@SN6PR11MB3437.namprd11.prod.outlook.com> |
I'm assuming that 0x81000001 is not a standard Storage Root Key (SRK)? A standard SRK follows the attributes described in B3.3 of [1] with The modifications described in [2] with the sign bit set to 0, so sign wouldn't work because of the attribute. Now in the case of a restricted key (attribute restricted=1), a validation parameter is required. The validation ticket Comes from TPM2_Digest commands which proves the TPM created that digest. Restricted keys must use the validation ticket produced by a TPM hash command. Non-restricted keys can use the NULL validation ticket which, per the spec [4] 20.2.2: "If keyHandle is not a restricted signing key, then this may be a NULL Ticket with tag = TPM_ST_CHECKHASH." And is shown in [3]. [1] https://trustedcomputinggroup.org/wp-content/uploads/TCG_IWG_EKCredentialProfile_v2p4_r3.pdf [2] https://trustedcomputinggroup.org/wp-content/uploads/TCG-TPM-v2.0-Provisioning-Guidance-Published-v1r1.pdf [3] https://github.com/tpm2-software/tpm2-pytss/blob/master/test/test_esapi.py#L3313 [4] https://trustedcomputinggroup.org/wp-content/uploads/TCG_TPM2_r1p59_Part3_Commands_pub.pdf From: Gadacz, Henry <henry.gadacz(a)sit.fraunhofer.de> Sent: Wednesday, September 14, 2022 6:30 AM To: tpm2(a)lists.01.org Subject: [tpm2] Why is validation structure required for ESAPI sign() in tpm2-pytss? Hello everyone, thank you all very much for your answers and replies on my previous question. I have another one :D Why is validation structure required for ESAPI sign() in tpm2-pytss? In the tpm2-tools tpm2_sign has the optional parameter -t for passing a validation structure. When I try to use the ESAPI sign() method from tpm2-pytss, it is required (giving "ESAPI.sign() missing 1 required positional argument: 'validation' " error when not setting it). But what should it be for data that was not generated by the TPM? Below you can see my try to somehow build a structure for the validation parameter, but it results in "tpm:parameter(3):invalid ticket" error. digest="To be signed" scheme = TPMT_SIG_SCHEME(scheme=TPM2_ALG.RSASSA) scheme.details.rsassa.hashAlg = TPM2_ALG.SHA256 validation = TPMT_TK_HASHCHECK(tag=TPM2_ST.HASHCHECK, hierarchy=TPM2_RH.OWNER, digest=[0]*len(digest)) esapi.sign(key_handle=esapi.tr_from_tpmpublic(TPM2_HANDLE(0x81000001)), digest=digest, in_scheme=scheme, validation=validation) Viele Grüße / Best Regards, Henry
attachment.htm
(text/html, 5.9 KB)
<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:70.85pt 70.85pt 56.7pt 70.85pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">I’m assuming that 0x81000001 is not a standard Storage Root Key (SRK)? A standard SRK follows the attributes described in B3.3 of [1] with<o:p></o:p></p>
<p class="MsoNormal">The modifications described in [2] with the sign bit set to 0, so sign wouldn’t work because of the attribute.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Now in the case of a restricted key (attribute restricted=1), a validation parameter is required. The validation ticket<o:p></o:p></p>
<p class="MsoNormal">Comes from TPM2_Digest commands which proves the TPM created that digest.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Restricted keys must use the validation ticket produced by a TPM hash command.<o:p></o:p></p>
<p class="MsoNormal">Non-restricted keys can use the NULL validation ticket which, per the spec [4] 20.2.2:<o:p></o:p></p>
<p class="MsoNormal">“If keyHandle is not a restricted signing key, then this may be a NULL Ticket with tag = TPM_ST_CHECKHASH.”<o:p></o:p></p>
<p class="MsoNormal">And is shown in [3].<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">[1] <a href="https://trustedcomputinggroup.org/wp-content/uploads/TCG_IWG_EKCredentialProfile_v2p4_r3.pdf">
https://trustedcomputinggroup.org/wp-content/uploads/TCG_IWG_EKCredentialProfile_v2p4_r3.pdf</a><o:p></o:p></p>
<p class="MsoNormal">[2] <a href="https://trustedcomputinggroup.org/wp-content/uploads/TCG-TPM-v2.0-Provisioning-Guidance-Published-v1r1.pdf">
https://trustedcomputinggroup.org/wp-content/uploads/TCG-TPM-v2.0-Provisioning-Guidance-Published-v1r1.pdf</a><o:p></o:p></p>
<p class="MsoNormal">[3] <a href="https://github.com/tpm2-software/tpm2-pytss/blob/master/test/test_esapi.py#L3313">
https://github.com/tpm2-software/tpm2-pytss/blob/master/test/test_esapi.py#L3313</a><o:p></o:p></p>
<p class="MsoNormal">[4] <a href="https://trustedcomputinggroup.org/wp-content/uploads/TCG_TPM2_r1p59_Part3_Commands_pub.pdf">
https://trustedcomputinggroup.org/wp-content/uploads/TCG_TPM2_r1p59_Part3_Commands_pub.pdf</a><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div style="border:none;border-left:solid blue 1.5pt;padding:0in 0in 0in 4.0pt">
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b>From:</b> Gadacz, Henry <[email protected]> <br>
<b>Sent:</b> Wednesday, September 14, 2022 6:30 AM<br>
<b>To:</b> [email protected]<br>
<b>Subject:</b> [tpm2] Why is validation structure required for ESAPI sign() in tpm2-pytss?<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span lang="DE">Hello everyone, <o:p></o:p></span></p>
<p class="MsoNormal"><span lang="DE"><o:p> </o:p></span></p>
<p class="MsoNormal">thank you all very much for your answers and replies on my previous question.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I have another one :D <o:p></o:p></p>
<p class="MsoNormal">Why is validation structure required for ESAPI sign() in tpm2-pytss?<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">In the tpm2-tools tpm2_sign has the optional parameter -t for passing a validation structure. When I try to use the ESAPI sign() method from tpm2-pytss, it is required (giving “ESAPI.sign() missing 1 required positional argument: 'validation'
“ error when not setting it).<o:p></o:p></p>
<p class="MsoNormal">But what should it be for data that was not generated by the TPM? Below you can see my try to somehow build a structure for the validation parameter, but it results in “tpm:parameter(3):invalid ticket” error.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">digest="To be signed"<o:p></o:p></p>
<p class="MsoNormal">scheme = TPMT_SIG_SCHEME(scheme=TPM2_ALG.RSASSA)<o:p></o:p></p>
<p class="MsoNormal">scheme.details.rsassa.hashAlg = TPM2_ALG.SHA256<o:p></o:p></p>
<p class="MsoNormal">validation = TPMT_TK_HASHCHECK(tag=TPM2_ST.HASHCHECK, hierarchy=TPM2_RH.OWNER, digest=[0]*len(digest))<o:p></o:p></p>
<p class="MsoNormal">esapi.sign(key_handle=esapi.tr_from_tpmpublic(TPM2_HANDLE(0x81000001)), digest=digest, in_scheme=scheme, validation=validation)<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Viele Grüße / Best Regards,<o:p></o:p></p>
<p class="MsoNormal">Henry<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</body>
</html>