FAPI: Use a second session for parameter encryption.

For policy sessions the auth value is needed to generate the key for parameter encryption if the encryption is activated. To avoid the usage of the auth value for policy sessions a second session will be used to activate parameter encryption. Signed-off-by: Juergen Repp <juergen_repp@web.de>
tpm2-software · Aug 15, 2023 · e2c2b8e · e2c2b8e
1 parent 86949f7
commit e2c2b8e
Show file tree

Hide file tree

Showing 18 changed files with 103 additions and 49 deletions.
diff --git a/src/tss2-fapi/api/Fapi_ChangeAuth.c b/src/tss2-fapi/api/Fapi_ChangeAuth.c
@@ -352,7 +352,8 @@ Fapi_ChangeAuth_Finish(
                     command->handle,
                     context->loadKey.parent_handle,
                     auth_session,
-                    ESYS_TR_NONE, ESYS_TR_NONE,
+                    ENC_SESSION_IF_POLICY(auth_session),
+                    ESYS_TR_NONE,
                     &command->newAuthValue);
             goto_if_error(r, "Error: Sign", error_cleanup);
 
@@ -481,7 +482,7 @@ Fapi_ChangeAuth_Finish(
             r = Esys_NV_ChangeAuth_Async(context->esys,
                     command->object.public.handle,
                     auth_session,
-                    ESYS_TR_NONE,
+                    ENC_SESSION_IF_POLICY(auth_session),
                     ESYS_TR_NONE,
                     &command->newAuthValue);
             goto_if_error(r, "Error: NV_ChangeAuth", error_cleanup);

diff --git a/src/tss2-fapi/api/Fapi_CreateNv.c b/src/tss2-fapi/api/Fapi_CreateNv.c
@@ -421,7 +421,7 @@ Fapi_CreateNv_Finish(
             r = Esys_NV_DefineSpace_Async(context->esys,
                                           hierarchy->public.handle,
                                           auth_session,
-                                          ESYS_TR_NONE,
+                                          ENC_SESSION_IF_POLICY(auth_session),
                                           ESYS_TR_NONE,
                                           auth,
                                           publicInfo);

diff --git a/src/tss2-fapi/api/Fapi_Decrypt.c b/src/tss2-fapi/api/Fapi_Decrypt.c
@@ -315,7 +315,9 @@ Fapi_Decrypt_Finish(
             /* Decrypt the actual data. */
             r = Esys_RSA_Decrypt_Async(context->esys,
                                        context->cmd.Data_EncryptDecrypt.key_handle,
-                                       command->auth_session, ESYS_TR_NONE, ESYS_TR_NONE,
+                                       command->auth_session,
+                                       ENC_SESSION_IF_POLICY(command->auth_session),
+                                       ESYS_TR_NONE,
                                        aux_data,
                                        &command->profile->rsa_decrypt_scheme,
                                        &null_data);

diff --git a/src/tss2-fapi/api/Fapi_Delete.c b/src/tss2-fapi/api/Fapi_Delete.c
@@ -614,7 +614,7 @@ Fapi_Delete_Finish(
                                             command->auth_index,
                                             object->public.handle,
                                             auth_session,
-                                            ESYS_TR_NONE,
+                                            ENC_SESSION_IF_POLICY(auth_session),
                                             ESYS_TR_NONE);
             goto_if_error_reset_state(r, " Fapi_NV_UndefineSpace_Async", error_cleanup);
 
@@ -658,8 +658,9 @@ Fapi_Delete_Finish(
                     r = Esys_EvictControl_Async(context->esys, ESYS_TR_RH_OWNER,
                                                 object->public.handle,
                                                 auth_session,
-                                                ESYS_TR_NONE, ESYS_TR_NONE,
-                                            object->misc.key.persistent_handle);
+                                                ESYS_TR_NONE,
+                                                ESYS_TR_NONE,
+                                                object->misc.key.persistent_handle);
                     goto_if_error(r, "Evict Control", error_cleanup);
                     context->state = ENTITY_DELETE_NULL_AUTH_SENT_FOR_KEY;
                 }

diff --git a/src/tss2-fapi/api/Fapi_ExportKey.c b/src/tss2-fapi/api/Fapi_ExportKey.c
@@ -391,7 +391,8 @@ Fapi_ExportKey_Finish(
                                      command->key_object->public.handle,
                                      command->handle_ext_key,
                                      auth_session,
-                                     ESYS_TR_NONE, ESYS_TR_NONE,
+                                     ENC_SESSION_IF_POLICY(auth_session),
+                                     ESYS_TR_NONE,
                                      &encryptionKey, &symmetric);
             goto_if_error(r, "Duplicate", cleanup);
 

diff --git a/src/tss2-fapi/api/Fapi_Import.c b/src/tss2-fapi/api/Fapi_Import.c
@@ -427,7 +427,8 @@ Fapi_Import_Finish(
 
             r = Esys_Load_Async(context->esys, context->loadKey.handle,
                                 auth_session,
-                                ESYS_TR_NONE, ESYS_TR_NONE,
+                                ENC_SESSION_IF_POLICY(auth_session),
+                                ESYS_TR_NONE,
                                 &private, &object->misc.key.public);
             goto_if_error(r, "Load async", error_cleanup);
             fallthrough;
@@ -534,7 +535,8 @@ Fapi_Import_Finish(
             r = Esys_Import_Async(context->esys,
                   command->parent_object->public.handle,
                   session,
-                  ESYS_TR_NONE, ESYS_TR_NONE,
+                  ENC_SESSION_IF_POLICY(session),
+                  ESYS_TR_NONE,
                   NULL, &keyTree->public,
                   &keyTree->duplicate,
                   &keyTree->encrypted_seed,

diff --git a/src/tss2-fapi/api/Fapi_NvExtend.c b/src/tss2-fapi/api/Fapi_NvExtend.c
@@ -349,7 +349,7 @@ Fapi_NvExtend_Finish(
                                  command->auth_index,
                                  nvIndex,
                                  auth_session,
-                                 ESYS_TR_NONE,
+                                 ENC_SESSION_IF_POLICY(auth_session),
                                  ESYS_TR_NONE,
                                  auxData);
         goto_if_error_reset_state(r, " Fapi_NvExtend_Async", error_cleanup);

diff --git a/src/tss2-fapi/api/Fapi_NvIncrement.c b/src/tss2-fapi/api/Fapi_NvIncrement.c
@@ -297,7 +297,8 @@ Fapi_NvIncrement_Finish(
         r = Esys_NV_Increment_Async(context->esys,  command->auth_index,
                                     nvIndex,
                                     auth_session,
-                                    ESYS_TR_NONE, ESYS_TR_NONE);
+                                    ENC_SESSION_IF_POLICY(auth_session),
+                                    ESYS_TR_NONE);
         goto_if_error_reset_state(r, " Fapi_NvIncrement_Async", error_cleanup);
 
         fallthrough;

diff --git a/src/tss2-fapi/api/Fapi_Provision.c b/src/tss2-fapi/api/Fapi_Provision.c
@@ -1022,7 +1022,9 @@ Fapi_Provision_Finish(FAPI_CONTEXT *context)
 
             /* Prepare the setting of the dictionary attack parameters. */
             r = Esys_DictionaryAttackParameters_Async(context->esys, ESYS_TR_RH_LOCKOUT,
-                       auth_session, ESYS_TR_NONE, ESYS_TR_NONE,
+                       auth_session,
+                       ENC_SESSION_IF_POLICY(auth_session),
+                       ESYS_TR_NONE,
                        defaultProfile->newMaxTries, defaultProfile->newRecoveryTime,
                        defaultProfile->lockoutRecovery);
             goto_if_error(r, "Error Esys_DictionaryAttackParameters",

diff --git a/src/tss2-fapi/api/Fapi_Quote.c b/src/tss2-fapi/api/Fapi_Quote.c
@@ -371,7 +371,9 @@ Fapi_Quote_Finish(
 
             /* Perform the Quote operation. */
             r = Esys_Quote_Async(context->esys, command->handle,
-                                 auth_session, ESYS_TR_NONE, ESYS_TR_NONE,
+                                 auth_session,
+                                 ENC_SESSION_IF_POLICY(auth_session),
+                                 ESYS_TR_NONE,
                                  &command->qualifyingData,
                                  &command->key_object->misc.key.signing_scheme,
                                  &command->pcr_selection);

diff --git a/src/tss2-fapi/api/Fapi_Unseal.c b/src/tss2-fapi/api/Fapi_Unseal.c
@@ -244,7 +244,8 @@ Fapi_Unseal_Finish(
             /* Perform the unseal operation with the TPM. */
             r = Esys_Unseal_Async(context->esys, command->object->public.handle,
                     auth_session,
-                    ESYS_TR_NONE, ESYS_TR_NONE);
+                    ENC_SESSION_IF_POLICY(auth_session),
+                    ESYS_TR_NONE);
             goto_if_error(r, "Error esys Unseal ", error_cleanup);
 
             fallthrough;

diff --git a/src/tss2-fapi/fapi_int.h b/src/tss2-fapi/fapi_int.h
@@ -127,6 +127,10 @@ typedef struct {
         goto label;  \
     }
 
+#define ENC_SESSION_IF_POLICY(auth_session)             \
+    (auth_session == ESYS_TR_PASSWORD || auth_session == ESYS_TR_NONE || \
+     auth_session == context->session2) ? ESYS_TR_NONE : context->session2
+
 /** The states for the FAPI's object authorization state*/
 enum IFAPI_GET_CERT_STATE {
     GET_CERT_INIT = 0,