Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1674725

Re: [Linux-ima-devel] [PATCH v3 0/6] Updated API for TPM 2.0 PCR extend

Show all headers | View raw

On Sat, 2017-06-24 at 11:03 +0200, Jarkko Sakkinen wrote:
> On Wed, Jun 21, 2017 at 04:29:35PM +0200, Roberto Sassu wrote:


> To move this forward and be more constructive here's how I see it
> should be done (along the lines, draft):
> 
> int tpm_pcr_extend(u32 chip_num, int pcr_idx, unsigned int alg,
> 		   const u8 *hash);
> 
> The paramater 'alg' is crypto ID as specified by crypto subsystem.

Based on Kenneth Goldman's input, the new IMA TPM-2.0 crypto hash
agile measurement list will contain the TPM crypto hash algorithm ids
(TPM crypto-ID). 

> TPM driver must have a precompiled table of mappings for crypto IDs
> and TPM algorithm IDs.

We could map the TPM crypto-IDs to the crypto subsystem IDs and then
map them back, but is that necessary?

> 
> In addition it must have dynamically acquired list of TPM alg IDs.
> For those algs that static mapping does not exist it must extend
> them like we do now everything else except SHA-1 (Naynas changes).

Padding/truncating an unknown bank using SHA1 is fine, but at some
point, as Roberto pointed out to me, TPM 2.0's might not support SHA-
1.  So for the record, we're hard coding the use of SHA1 for the
unknown algorithms whether or not the TPM supports SHA1.

> There's absolutely no need to pass digest size like you do BTW as it is
> defined by the standard.

For algorithms known to the crypto subsystem, that is fine, but for
the unknown TPM crypto algorithms, we would need to somehow query the
TPM for the digest sizes to create the mapping.

Mimi

> I also except that where ever this interleaves with trusted keys there
> won't be duplicate structures and code.
> 
> /Jarkko
> 

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH v3 0/6] Updated API for TPM 2.0 PCR extend Roberto Sassu <roberto.sassu@huawei.com> - 2017-06-21 16:40 +0200
  [PATCH v3 5/6] tpm: introduce tpm_get_pcr_banks_info() Roberto Sassu <roberto.sassu@huawei.com> - 2017-06-21 16:40 +0200
    Re: [PATCH v3 5/6] tpm: introduce tpm_get_pcr_banks_info() Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> - 2017-06-23 12:40 +0200
  [PATCH v3 6/6] tpm: pass multiple digests to tpm_pcr_extend() Roberto Sassu <roberto.sassu@huawei.com> - 2017-06-21 16:40 +0200
    Re: [tpmdd-devel] [PATCH v3 6/6] tpm: pass multiple digests to  tpm_pcr_extend() Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> - 2017-06-23 12:40 +0200
  [PATCH v3 1/6] tpm: use tpm_buf functions to perform a PCR read Roberto Sassu <roberto.sassu@huawei.com> - 2017-06-21 16:40 +0200
    Re: [tpmdd-devel] [PATCH v3 1/6] tpm: use tpm_buf functions to  perform a PCR read Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> - 2017-06-22 12:20 +0200
      Re: [tpmdd-devel] [PATCH v3 1/6] tpm: use tpm_buf functions to  perform a PCR read Roberto Sassu <roberto.sassu@huawei.com> - 2017-06-22 14:00 +0200
        Re: [tpmdd-devel] [PATCH v3 1/6] tpm: use tpm_buf functions to  perform a PCR read Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> - 2017-06-23 13:00 +0200
  [PATCH v3 4/6] tpm: replace TPM algorithms IDs with tpm_pcr_bank_info structs in tpm_chip Roberto Sassu <roberto.sassu@huawei.com> - 2017-06-21 16:40 +0200
    Re: [PATCH v3 4/6] tpm: replace TPM algorithms IDs with  tpm_pcr_bank_info structs in tpm_chip Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> - 2017-06-23 12:40 +0200
  [PATCH v3 3/6] tpm: introduce tpm_pcr_bank_info structure with digest_size from TPM Roberto Sassu <roberto.sassu@huawei.com> - 2017-06-21 16:40 +0200
    Re: [PATCH v3 3/6] tpm: introduce tpm_pcr_bank_info structure with  digest_size from TPM Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> - 2017-06-23 12:30 +0200
      Re: [PATCH v3 3/6] tpm: introduce tpm_pcr_bank_info structure with  digest_size from TPM Roberto Sassu <roberto.sassu@huawei.com> - 2017-06-23 13:30 +0200
    Re: [tpmdd-devel] [PATCH v3 3/6] tpm: introduce tpm_pcr_bank_info  structure with digest_size from TPM Mimi Zohar <zohar@linux.vnet.ibm.com> - 2017-06-27 17:30 +0200
  Re: [PATCH v3 0/6] Updated API for TPM 2.0 PCR extend Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> - 2017-06-24 11:10 +0200
    Re: [PATCH v3 0/6] Updated API for TPM 2.0 PCR extend Roberto Sassu <roberto.sassu@huawei.com> - 2017-06-26 09:00 +0200
    Re: [PATCH v3 0/6] Updated API for TPM 2.0 PCR extend Roberto Sassu <roberto.sassu@huawei.com> - 2017-06-26 09:30 +0200
      Re: [PATCH v3 0/6] Updated API for TPM 2.0 PCR extend Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> - 2017-06-28 20:00 +0200
    Re: [Linux-ima-devel] [PATCH v3 0/6] Updated API for TPM 2.0 PCR  extend Mimi Zohar <zohar@linux.vnet.ibm.com> - 2017-06-26 14:40 +0200
      Re: [Linux-ima-devel] [PATCH v3 0/6] Updated API for TPM 2.0 PCR  extend Roberto Sassu <roberto.sassu@huawei.com> - 2017-06-26 17:00 +0200
        Re: [Linux-ima-devel] [PATCH v3 0/6] Updated API for TPM 2.0 PCR  extend Mimi Zohar <zohar@linux.vnet.ibm.com> - 2017-06-26 19:20 +0200
      Re: [Linux-ima-devel] [PATCH v3 0/6] Updated API for TPM 2.0 PCR  extend Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> - 2017-06-28 20:00 +0200
        Re: [Linux-ima-devel] [PATCH v3 0/6] Updated API for TPM 2.0 PCR  extend Mimi Zohar <zohar@linux.vnet.ibm.com> - 2017-06-29 00:30 +0200

csiph-web