vtpm deep quote in locality 0

PATCH Applied Emil Condrea 2 participants 5 messages Apr 15, 2015 – Apr 16, 2015

Share & tools

Emil Condrea

author

2015-04-15 18:00 UTC #0 lore raw

v3 cover vtpm deep quote in locality 0

Changes from v2:
- removed useless whitespace
- fixed compiling issues for tpm emulator
Changes from v1, suggested by Daniel:
- flags parameter is now mandatory
- updated documentation about externData calculation
- constant size for externData structure, perform SHA1 on empty string
if requested parameter is NULL
- return error if invalid bit is set in flags
- added VTPM_QUOTE_FLAGS_GROUP_PUBKEY flag

Right now, deep quote functionality is enabled just when vtpm manager is started with locality=2. This requirement is enforced by the current implementation which uses PCRs that can be reset in locality 2: 20,21,22,23.

Since some TPM chips do not enable access to other locality than 0 this patch enables the deep quote functionality for vtpm manager started with locality=0.

The patches are based on a suggestion given by Daniel De Graaf in another thread on the list:
- Add a field to the request - extraInfoFlags
- Compute externData = SHA1 (
extraInfoFlags
requestData
[SHA1 (
[SHA1 (UUIDs if requested)]
[SHA1 (vTPM measurements if requested)]
[SHA1 (vTPM group update policy if requested)]
[SHA1 (vTPM group public key if requested)]
) if flags !=0 ]
)
- Perform deep quotes using the above externData value instead of the value
provided by the vTPM.

Embedding additional data in externData is equivalently secure as extending it into PCRs.

This change also has the benefit of increasing the flexibility of the request. It is simple to define additional flags and add data to the hash if needed.

Emil Condrea (2):
vtpm: deep quote flags
vtpmmgr: execute deep quote in locality 0

 stubdom/Makefile                    |   1 +
 stubdom/vtpm-deepquote-anyloc.patch | 127 ++++++++++++++++++++++++++++++++++++
 stubdom/vtpm/vtpm_cmd.c             |  13 ++--
 stubdom/vtpmmgr/marshal.h           |   1 +
 stubdom/vtpmmgr/mgmt_authority.c    |  91 +++++++++++++++++++++++---
 stubdom/vtpmmgr/mgmt_authority.h    |   2 +-
 stubdom/vtpmmgr/vtpm_cmd_handler.c  |   7 +-
 stubdom/vtpmmgr/vtpm_manager.h      |  27 +++++++-
 8 files changed, 250 insertions(+), 19 deletions(-)
 create mode 100644 stubdom/vtpm-deepquote-anyloc.patch

Signature · 1 line

2.1.0

Emil Condrea

author

2015-04-15 18:00 UTC #1 lore raw

PATCH v3 1/2 vtpm: deep quote flags

Currently, the flags are not interpreted by vTPM. They are just packed and sent to vtpmmgr.

Signed-off-by Emil Condrea <[email protected]>

Acked-by Daniel De Graaf <[email protected]>

---
 stubdom/Makefile                    |   1 +
 stubdom/vtpm-deepquote-anyloc.patch | 127 ++++++++++++++++++++++++++++++++++++
 stubdom/vtpm/vtpm_cmd.c             |  13 ++--
 3 files changed, 135 insertions(+), 6 deletions(-)
 create mode 100644 stubdom/vtpm-deepquote-anyloc.patch

stubdom/Makefile +1 -0

index 8fb885a..c135334 100644
@@ -211,6 +211,7 @@ tpm_emulator-$(XEN_TARGET_ARCH): tpm_emulator-$(TPMEMU_VERSION).tar.gz
 	patch -d $@ -p1 < vtpm-locality.patch
 	patch -d $@ -p1 < vtpm-parent-sign-ek.patch
 	patch -d $@ -p1 < vtpm-deepquote.patch
+	patch -d $@ -p1 < vtpm-deepquote-anyloc.patch
 	patch -d $@ -p1 < vtpm-cmake-Wextra.patch
 	mkdir $@/build
 	cd $@/build; CC=${CC} $(CMAKE) .. -DCMAKE_C_FLAGS:STRING="-std=c99 -DTPM_NO_EXTERN $(TARGET_CPPFLAGS) $(TARGET_CFLAGS) -Wno-declaration-after-statement"

stubdom/vtpm-deepquote-anyloc.patch new file +127 -0

127 lines not on this page · raw message

stubdom/vtpm/vtpm_cmd.c +7 -6

index 6fda456..eec37df 100644
@@ -218,7 +218,8 @@ egress:
 }
 
 extern struct tpmfront_dev* tpmfront_dev;
-TPM_RESULT VTPM_GetParentQuote(TPM_NONCE *data, TPM_PCR_SELECTION *sel, UINT32 *sigSize, BYTE **sig)
+TPM_RESULT VTPM_GetParentQuote(TPM_NONCE *data, TPM_PCR_SELECTION *sel,
+                               UINT32 extraInfoFlags, UINT32 *quote_blob_size, BYTE **quote_blob)
 {
    TPM_RESULT status = TPM_SUCCESS;
    uint8_t* bptr, *resp;

@@ -231,11 +232,12 @@ TPM_RESULT VTPM_GetParentQuote(TPM_NONCE *data, TPM_PCR_SELECTION *sel, UINT32 *
    TPM_COMMAND_CODE ord = VTPM_ORD_GET_QUOTE;
 
    /*Create the command*/
-   len = size = VTPM_COMMAND_HEADER_SIZE + 25;
+   len = size = VTPM_COMMAND_HEADER_SIZE + 20 + sizeof_TPM_PCR_SELECTION((*sel)) + 4;
    bptr = cmdbuf = malloc(size);
    TRYFAILGOTO(pack_header(&bptr, &len, tag, size, ord));
    TRYFAILGOTO(tpm_marshal_TPM_NONCE(&bptr, &len, data));
    TRYFAILGOTO(tpm_marshal_TPM_PCR_SELECTION(&bptr, &len, sel));
+   TRYFAILGOTO(tpm_marshal_TPM_DEEP_QUOTE_INFO(&bptr, &len, extraInfoFlags));
 
    /* Send the command to vtpm_manager */
    info("Requesting Quote from backend");

@@ -248,11 +250,10 @@ TPM_RESULT VTPM_GetParentQuote(TPM_NONCE *data, TPM_PCR_SELECTION *sel, UINT32 *
 
    /* Check return code */
    CHECKSTATUSGOTO(ord, "VTPM_GetParentQuote()");
-
    /* Copy out the value */
-   *sigSize = len;
-   *sig = tpm_malloc(*sigSize);
-   TRYFAILGOTOMSG(tpm_unmarshal_BYTE_ARRAY(&bptr, &len, *sig, *sigSize), ERR_MALFORMED);
+   *quote_blob_size = len;
+   *quote_blob = tpm_malloc(*quote_blob_size);
+   TRYFAILGOTOMSG(tpm_unmarshal_BYTE_ARRAY(&bptr, &len, *quote_blob, *quote_blob_size), ERR_MALFORMED);
 
    goto egress;
 abort_egress:

Signature · 1 line

2.1.0

Emil Condrea

author

2015-04-15 18:00 UTC #2 lore raw

PATCH v3 2/2 vtpmmgr: execute deep quote in locality 0

In reply to Emil Condrea

Enables deep quote execution for vtpmmgr which can not be started using locality 2. Flags are used to request additional data to be present when executing quote. They are interpreted as a bitmask of:
* VTPM_QUOTE_FLAGS_HASH_UUID
* VTPM_QUOTE_FLAGS_VTPM_MEASUREMENTS
* VTPM_QUOTE_FLAGS_GROUP_INFO
* VTPM_QUOTE_FLAGS_GROUP_PUBKEY

The externData param for TPM_Quote is calculated as:
externData = SHA1 (
extraInfoFlags
requestData
[SHA1 (
[SHA1 (UUIDs if requested)]
[SHA1 (vTPM measurements if requested)] [SHA1 (vTPM group update policy if requested)] [SHA1 (vTPM group public key if requested)]
) if flags !=0 ]
)

The response param pcrValues is an array containing requested hashes used for externData calculation : UUIDs, vTPM measurements, vTPM group update policy, group public key. At the end of these hashes the PCR values are appended.

Signed-off-by Emil Condrea <[email protected]>

Acked-by Daniel De Graaf <[email protected]>

---
 stubdom/vtpmmgr/marshal.h          |  1 +
 stubdom/vtpmmgr/mgmt_authority.c   | 91 ++++++++++++++++++++++++++++++++++----
 stubdom/vtpmmgr/mgmt_authority.h   |  2 +-
 stubdom/vtpmmgr/vtpm_cmd_handler.c |  7 ++-
 stubdom/vtpmmgr/vtpm_manager.h     | 27 ++++++++++-
 5 files changed, 115 insertions(+), 13 deletions(-)

stubdom/vtpmmgr/marshal.h +1 -0

index bcc7c46..d826f19 100644
@@ -195,6 +195,7 @@ inline int unpack3_UINT32(BYTE* ptr, UINT32* pos, UINT32 max, UINT32 *t)
 #define unpack3_TPM_PHYSICAL_PRESENCE(p, l, m, t) unpack3_UINT16(p, l, m, t)
 #define unpack3_TPM_KEY_FLAGS(p, l, m, t) unpack3_UINT32(p, l, m, t)
 #define unpack3_TPM_LOCALITY_SELECTION(p, l, m, t) unpack3_BYTE(p, l, m, t)
+#define unpack3_TPM_DEEP_QUOTE_INFO(p, l, m, t) unpack3_UINT32(p, l, m, t)
 
 #define sizeof_TPM_RESULT(t) sizeof_UINT32(t)
 #define sizeof_TPM_PCRINDEX(t) sizeof_UINT32(t)

stubdom/vtpmmgr/mgmt_authority.c +82 -9

130 lines not on this page · raw message

stubdom/vtpmmgr/mgmt_authority.h +1 -1

index 1e96c8a..cdd06aa 100644
@@ -5,7 +5,7 @@ struct mem_group *vtpm_new_group(const struct tpm_authdata *privCADigest);
 int group_do_activate(struct mem_group *group, void* blob, int blobSize,
 	void* resp, unsigned int *rlen);
 int vtpm_do_quote(struct mem_group *group, const uuid_t uuid,
-	const uint8_t* kern_hash, const struct tpm_authdata *data, TPM_PCR_SELECTION *sel,
+	const uint8_t* kern_hash, const struct tpm_authdata *data, TPM_PCR_SELECTION *sel, uint32_t extraInfoFlags,
 	void* pcr_out, uint32_t *pcr_size, void* sig_out);
 
 #endif

stubdom/vtpmmgr/vtpm_cmd_handler.c +5 -2

index 13ead93..2ac14fa 100644
@@ -282,9 +282,11 @@ static TPM_RESULT vtpmmgr_GetQuote(struct tpm_opaque *opq, tpmcmd_t* tpmcmd)
 	void *ibuf;
 	uint32_t pcr_size;
 	TPM_PCR_SELECTION sel;
+	uint32_t extra_info_flags;
 
 	UNPACK_IN(VPTR, &ibuf, 20, UNPACK_ALIAS);
 	UNPACK_IN(TPM_PCR_SELECTION, &sel, UNPACK_ALIAS);
+	UNPACK_IN(TPM_DEEP_QUOTE_INFO, &extra_info_flags);
 	UNPACK_DONE();
 
 	if (!opq->vtpm) {

@@ -297,7 +299,7 @@ static TPM_RESULT vtpmmgr_GetQuote(struct tpm_opaque *opq, tpmcmd_t* tpmcmd)
 		printk("%02x", ((uint8_t*)ibuf)[i]);
 	printk("\n");
 
-	status = vtpm_do_quote(opq->group, *opq->uuid, opq->kern_hash, ibuf, &sel, PACK_BUF + 256, &pcr_size, PACK_BUF);
+	status = vtpm_do_quote(opq->group, *opq->uuid, opq->kern_hash, ibuf, &sel, extra_info_flags, PACK_BUF + 256, &pcr_size, PACK_BUF);
 	if (status)
 		goto abort_egress;
 	tpmcmd->resp_len += 256 + pcr_size;

@@ -529,6 +531,7 @@ static TPM_RESULT vtpmmgr_GroupRegister(tpmcmd_t* tpmcmd)
 	sha1_context ctx;
 	TPM_PCR_SELECTION sel;
 	void *dhkx1, *dhkx2, *gk, *sig;
+	uint32_t extra_info_flags = 0;
 
 	UNPACK_GROUP(group);
 	UNPACK_IN(VPTR, &dhkx1, 256, UNPACK_ALIAS);

@@ -567,7 +570,7 @@ static TPM_RESULT vtpmmgr_GroupRegister(tpmcmd_t* tpmcmd)
 	sha1_update(&ctx, dhkx2, 256 + 32);
 	sha1_finish(&ctx, digest.bits);
 
-	status = vtpm_do_quote(group, NULL, NULL, &digest, &sel, NULL, NULL, PACK_BUF);
+	status = vtpm_do_quote(group, NULL, NULL, &digest, &sel, extra_info_flags,NULL, NULL, PACK_BUF);
 	tpmcmd->resp_len += 256;
 
 	CMD_END;

stubdom/vtpmmgr/vtpm_manager.h +26 -1

index 156c2ce..2d2109d 100644
@@ -46,6 +46,12 @@
 // Header size
 #define VTPM_COMMAND_HEADER_SIZE ( 2 + 4 + 4)
 
+//************************ Command Params ***************************
+#define VTPM_QUOTE_FLAGS_HASH_UUID                  0x00000001
+#define VTPM_QUOTE_FLAGS_VTPM_MEASUREMENTS          0x00000002
+#define VTPM_QUOTE_FLAGS_GROUP_INFO                 0x00000004
+#define VTPM_QUOTE_FLAGS_GROUP_PUBKEY               0x00000008
+
 //************************ Command Codes ****************************
 #define VTPM_ORD_BASE       0x0000
 #define TPM_VENDOR_COMMAND  0x02000000 // TPM Main, part 2, section 17.

@@ -110,6 +116,23 @@
  * Get a hardware TPM quote for this vTPM.  The quote will use the AIK
  * associated with the group this vTPM was created in. Values specific to the
  * vTPM will be extended to certain resettable PCRs.
+ * Additional info can be included when creating the signature by using
+ * quoteSelect as PCR selection and by setting flags param. The externData
+ * param for TPM_Quote is calculated as:
+ * externData = SHA1 (
+ *       extraInfoFlags
+ *       requestData
+ *       [SHA1 (
+ *          [SHA1 (UUIDs if requested)]
+ *          [SHA1 (vTPM measurements if requested)]
+ *          [SHA1 (vTPM group update policy if requested)]
+ *          [SHA1 (vTPM group public key if requested)]
+ *       ) if flags !=0 ]
+ * )
+ * The response param pcrValues is an array containing requested hashes used
+ * for externData calculation : UUIDs, vTPM measurements, vTPM group update
+ * policy, group public key. At the end of these hashes the PCR values are
+ * appended.
  *
  * Input:
  *  TPM_TAG         tag          VTPM_TAG_REQ

@@ -117,12 +140,14 @@
  *  UINT32          ordinal      VTPM_ORD_GET_QUOTE
  *  TPM_NONCE       externData   Data to be quoted
  *  PCR_SELECTION   quoteSelect  PCR selection for quote.
+ *  UINT32          flags        Bit mask of VTPM_QUOTE_FLAGS_*
  * Output:
  *  TPM_TAG         tag          VTPM_TAG_RSP
  *  UINT32          paramSize    total size
  *  UINT32          status       return code
  *  BYTE[]          signature    256 bytes of signature data
- *  TPM_PCRVALUE[]  pcrValues    Values of PCRs selected by the request
+ *  TPM_PCRVALUE[]  pcrValues    Values of additional SHA1 hashes requested,
+ *                               concatenated with PCRs selected by the request
  */
 #define VTPM_ORD_GET_QUOTE        (VTPM_ORD_BASE + 4)