From: David Howells <dhowells@redhat.com>
To: jmorris@namei.org
Cc: Denis Kenzior <denkenz@gmail.com>,
Marcel Holtmann <marcel@holtmann.org>,
Marcel Holtmann <marcel@holtmann.org>,
dhowells@redhat.com, denkenz@gmail.com, keyrings@vger.kernel.org,
linux-security-module@vger.kernel.org,
linux-kernel@vger.kernel.org
Subject: [PATCH 19/22] KEYS: asym_tpm: Implement the decrypt operation [ver #2]
Date: Tue, 09 Oct 2018 17:49:13 +0100 [thread overview]
Message-ID: <153910375354.12141.9875684406553552274.stgit@warthog.procyon.org.uk> (raw)
In-Reply-To: <153910360263.12141.6032694262361399627.stgit@warthog.procyon.org.uk>
From: Denis Kenzior <denkenz@gmail.com>
This patch implements the pkey_decrypt operation using the private key
blob. The blob is first loaded into the TPM via tpm_loadkey2. Once the
handle is obtained, tpm_unbind operation is used to decrypt the data on
the TPM and the result is returned. The key loaded by tpm_loadkey2 is
then evicted via tpm_flushspecific operation.
This patch assumes that the SRK authorization is a well known 20-byte of
zeros and the same holds for the key authorization of the provided key.
Signed-off-by: Denis Kenzior <denkenz@gmail.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Tested-by: Marcel Holtmann <marcel@holtmann.org>
Reviewed-by: Marcel Holtmann <marcel@holtmann.org>
---
crypto/asymmetric_keys/asym_tpm.c | 58 ++++++++++++++++++++++++++++++++++++-
1 file changed, 57 insertions(+), 1 deletion(-)
diff --git a/crypto/asymmetric_keys/asym_tpm.c b/crypto/asymmetric_keys/asym_tpm.c
index e893b5212222..6f5d5cf98910 100644
--- a/crypto/asymmetric_keys/asym_tpm.c
+++ b/crypto/asymmetric_keys/asym_tpm.c
@@ -341,7 +341,8 @@ static int tpm_key_query(const struct kernel_pkey_params *params,
info->max_enc_size = len;
info->max_dec_size = tk->key_len / 8;
- info->supported_ops = KEYCTL_SUPPORTS_ENCRYPT;
+ info->supported_ops = KEYCTL_SUPPORTS_ENCRYPT |
+ KEYCTL_SUPPORTS_DECRYPT;
ret = 0;
error_free_tfm:
@@ -410,6 +411,58 @@ static int tpm_key_encrypt(struct tpm_key *tk,
return ret;
}
+/*
+ * Decryption operation is performed with the private key in the TPM.
+ */
+static int tpm_key_decrypt(struct tpm_key *tk,
+ struct kernel_pkey_params *params,
+ const void *in, void *out)
+{
+ struct tpm_buf *tb;
+ uint32_t keyhandle;
+ uint8_t srkauth[SHA1_DIGEST_SIZE];
+ uint8_t keyauth[SHA1_DIGEST_SIZE];
+ int r;
+
+ pr_devel("==>%s()\n", __func__);
+
+ if (params->hash_algo)
+ return -ENOPKG;
+
+ if (strcmp(params->encoding, "pkcs1"))
+ return -ENOPKG;
+
+ tb = kzalloc(sizeof(*tb), GFP_KERNEL);
+ if (!tb)
+ return -ENOMEM;
+
+ /* TODO: Handle a non-all zero SRK authorization */
+ memset(srkauth, 0, sizeof(srkauth));
+
+ r = tpm_loadkey2(tb, SRKHANDLE, srkauth,
+ tk->blob, tk->blob_len, &keyhandle);
+ if (r < 0) {
+ pr_devel("loadkey2 failed (%d)\n", r);
+ goto error;
+ }
+
+ /* TODO: Handle a non-all zero key authorization */
+ memset(keyauth, 0, sizeof(keyauth));
+
+ r = tpm_unbind(tb, keyhandle, keyauth,
+ in, params->in_len, out, params->out_len);
+ if (r < 0)
+ pr_devel("tpm_unbind failed (%d)\n", r);
+
+ if (tpm_flushspecific(tb, keyhandle) < 0)
+ pr_devel("flushspecific failed (%d)\n", r);
+
+error:
+ kzfree(tb);
+ pr_devel("<==%s() = %d\n", __func__, r);
+ return r;
+}
+
/*
* Do encryption, decryption and signing ops.
*/
@@ -424,6 +477,9 @@ static int tpm_key_eds_op(struct kernel_pkey_params *params,
case kernel_pkey_encrypt:
ret = tpm_key_encrypt(tk, params, in, out);
break;
+ case kernel_pkey_decrypt:
+ ret = tpm_key_decrypt(tk, params, in, out);
+ break;
default:
BUG();
}
next prev parent reply other threads:[~2018-10-09 16:49 UTC|newest]
Thread overview: 24+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-10-09 16:46 [PATCH 00/22] KEYS: Support TPM-wrapped key and crypto ops [ver #2] David Howells
2018-10-09 16:46 ` [PATCH 01/22] KEYS: Provide key type operations for asymmetric key " David Howells
2018-10-09 16:46 ` [PATCH 02/22] KEYS: Provide keyctls to drive the new key type ops for asymmetric keys " David Howells
2018-10-09 16:47 ` [PATCH 03/22] KEYS: Provide missing asymmetric key subops for new key type ops " David Howells
2018-10-09 16:47 ` [PATCH 04/22] KEYS: Make the X.509 and PKCS7 parsers supply the sig encoding type " David Howells
2018-10-09 16:47 ` [PATCH 05/22] KEYS: Provide software public key query function " David Howells
2018-10-09 16:47 ` [PATCH 06/22] KEYS: Allow the public_key struct to hold a private key " David Howells
2018-10-09 16:47 ` [PATCH 07/22] KEYS: Implement encrypt, decrypt and sign for software asymmetric " David Howells
2018-10-09 16:47 ` [PATCH 08/22] KEYS: Implement PKCS#8 RSA Private Key parser " David Howells
2018-10-09 16:47 ` [PATCH 09/22] crypto: rsa-pkcs1pad: Allow hash to be optional " David Howells
2018-10-09 16:48 ` [PATCH 10/22] KEYS: asym_tpm: add skeleton for asym_tpm " David Howells
2018-10-09 16:48 ` [PATCH 11/22] KEYS: asym_tpm: extract key size & public key " David Howells
2018-10-09 16:48 ` [PATCH 12/22] KEYS: Add parser for TPM-based keys " David Howells
2018-10-09 16:48 ` [PATCH 13/22] KEYS: asym_tpm: Implement pkey_query " David Howells
2018-10-09 16:48 ` [PATCH 14/22] KEYS: asym_tpm: Implement encryption operation " David Howells
2018-10-09 16:48 ` [PATCH 15/22] KEYS: trusted: Expose common functionality " David Howells
2018-10-09 16:48 ` [PATCH 16/22] KEYS: Move trusted.h to include/keys " David Howells
2018-10-09 16:48 ` [PATCH 17/22] KEYS: asym_tpm: Add loadkey2 and flushspecific " David Howells
2018-10-09 16:49 ` [PATCH 18/22] KEYS: asym_tpm: Implement tpm_unbind " David Howells
2018-10-09 16:49 ` David Howells [this message]
2018-10-09 16:49 ` [PATCH 20/22] KEYS: asym_tpm: Implement signature verification " David Howells
2018-10-09 16:49 ` [PATCH 21/22] KEYS: asym_tpm: Implement tpm_sign " David Howells
2018-10-09 16:49 ` [PATCH 22/22] KEYS: asym_tpm: Add support for the sign operation " David Howells
2018-10-09 19:26 ` [PATCH 00/22] KEYS: Support TPM-wrapped key and crypto ops " James Morris
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=153910375354.12141.9875684406553552274.stgit@warthog.procyon.org.uk \
--to=dhowells@redhat.com \
--cc=denkenz@gmail.com \
--cc=jmorris@namei.org \
--cc=keyrings@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=marcel@holtmann.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).