1 /* Microsoft Reference Implementation for TPM 2.0
2 *
3 * The copyright in this software is being made available under the BSD License,
4 * included below. This software may be subject to other third party and
5 * contributor rights, including patent rights, and no such rights are granted
6 * under this license.
7 *
8 * Copyright (c) Microsoft Corporation
9 *
10 * All rights reserved.
11 *
12 * BSD License
13 *
14 * Redistribution and use in source and binary forms, with or without modification,
15 * are permitted provided that the following conditions are met:
16 *
17 * Redistributions of source code must retain the above copyright notice, this list
18 * of conditions and the following disclaimer.
19 *
20 * Redistributions in binary form must reproduce the above copyright notice, this
21 * list of conditions and the following disclaimer in the documentation and/or
22 * other materials provided with the distribution.
23 *
24 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS ""AS IS""
25 * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
26 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
27 * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR
28 * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
29 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
30 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
31 * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
32 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
33 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
34 */
35 #include "Tpm.h"
36 #include "Sign_fp.h"
37
38 #if CC_Sign // Conditional expansion of this file
39
40 #include "Attest_spt_fp.h"
41
42 /*(See part 3 specification)
43 // sign an externally provided hash using an asymmetric signing key
44 */
45 // Return Type: TPM_RC
46 // TPM_RC_BINDING The public and private portions of the key are not
47 // properly bound.
48 // TPM_RC_KEY 'signHandle' does not reference a signing key;
49 // TPM_RC_SCHEME the scheme is not compatible with sign key type,
50 // or input scheme is not compatible with default
51 // scheme, or the chosen scheme is not a valid
52 // sign scheme
53 // TPM_RC_TICKET 'validation' is not a valid ticket
54 // TPM_RC_VALUE the value to sign is larger than allowed for the
55 // type of 'keyHandle'
56
57 TPM_RC
TPM2_Sign(Sign_In * in,Sign_Out * out)58 TPM2_Sign(
59 Sign_In *in, // IN: input parameter list
60 Sign_Out *out // OUT: output parameter list
61 )
62 {
63 TPM_RC result;
64 TPMT_TK_HASHCHECK ticket;
65 OBJECT *signObject = HandleToObject(in->keyHandle);
66 //
67 // Input Validation
68 if(!IsSigningObject(signObject))
69 return TPM_RCS_KEY + RC_Sign_keyHandle;
70
71 // A key that will be used for x.509 signatures can't be used in TPM2_Sign().
72 if(IS_ATTRIBUTE(signObject->publicArea.objectAttributes, TPMA_OBJECT, x509sign))
73 return TPM_RCS_ATTRIBUTES + RC_Sign_keyHandle;
74
75 // pick a scheme for sign. If the input sign scheme is not compatible with
76 // the default scheme, return an error.
77 if(!CryptSelectSignScheme(signObject, &in->inScheme))
78 return TPM_RCS_SCHEME + RC_Sign_inScheme;
79
80 // If validation is provided, or the key is restricted, check the ticket
81 if(in->validation.digest.t.size != 0
82 || IS_ATTRIBUTE(signObject->publicArea.objectAttributes,
83 TPMA_OBJECT, restricted))
84 {
85 // Compute and compare ticket
86 TicketComputeHashCheck(in->validation.hierarchy,
87 in->inScheme.details.any.hashAlg,
88 &in->digest, &ticket);
89
90 if(!MemoryEqual2B(&in->validation.digest.b, &ticket.digest.b))
91 return TPM_RCS_TICKET + RC_Sign_validation;
92 }
93 else
94 // If we don't have a ticket, at least verify that the provided 'digest'
95 // is the size of the scheme hashAlg digest.
96 // NOTE: this does not guarantee that the 'digest' is actually produced using
97 // the indicated hash algorithm, but at least it might be.
98 {
99 if(in->digest.t.size
100 != CryptHashGetDigestSize(in->inScheme.details.any.hashAlg))
101 return TPM_RCS_SIZE + RC_Sign_digest;
102 }
103
104 // Command Output
105 // Sign the hash. A TPM_RC_VALUE or TPM_RC_SCHEME
106 // error may be returned at this point
107 result = CryptSign(signObject, &in->inScheme, &in->digest, &out->signature);
108
109 return result;
110 }
111
112 #endif // CC_Sign