1 // This file was extracted from the TCG Published
2 // Trusted Platform Module Library
3 // Part 3: Commands
4 // Family "2.0"
5 // Level 00 Revision 01.16
6 // October 30, 2014
7
8 #include "InternalRoutines.h"
9 #include "Sign_fp.h"
10 #include "Attest_spt_fp.h"
11 //
12 //
13 // Error Returns Meaning
14 //
15 // TPM_RC_BINDING The public and private portions of the key are not properly bound.
16 // TPM_RC_KEY signHandle does not reference a signing key;
17 // TPM_RC_SCHEME the scheme is not compatible with sign key type, or input scheme is
18 // not compatible with default scheme, or the chosen scheme is not a
19 // valid sign scheme
20 // TPM_RC_TICKET validation is not a valid ticket
21 // TPM_RC_VALUE the value to sign is larger than allowed for the type of keyHandle
22 //
23 TPM_RC
TPM2_Sign(Sign_In * in,Sign_Out * out)24 TPM2_Sign(
25 Sign_In *in, // IN: input parameter list
26 Sign_Out *out // OUT: output parameter list
27 )
28 {
29 TPM_RC result;
30 TPMT_TK_HASHCHECK ticket;
31 OBJECT *signKey;
32
33 // Input Validation
34 // Get sign key pointer
35 signKey = ObjectGet(in->keyHandle);
36
37 // pick a scheme for sign. If the input sign scheme is not compatible with
38 // the default scheme, return an error.
39 result = CryptSelectSignScheme(in->keyHandle, &in->inScheme);
40 if(result != TPM_RC_SUCCESS)
41 {
42 if(result == TPM_RC_KEY)
43 return TPM_RC_KEY + RC_Sign_keyHandle;
44 else
45 return RcSafeAddToResult(result, RC_Sign_inScheme);
46 }
47
48 // If validation is provided, or the key is restricted, check the ticket
49 if( in->validation.digest.t.size != 0
50 || signKey->publicArea.objectAttributes.restricted == SET)
51 {
52 // Compute and compare ticket
53 TicketComputeHashCheck(in->validation.hierarchy,
54 in->inScheme.details.any.hashAlg,
55 &in->digest, &ticket);
56
57 if(!Memory2BEqual(&in->validation.digest.b, &ticket.digest.b))
58 return TPM_RC_TICKET + RC_Sign_validation;
59 }
60 else
61 // If we don't have a ticket, at least verify that the provided 'digest'
62 // is the size of the scheme hashAlg digest.
63 // NOTE: this does not guarantee that the 'digest' is actually produced using
64 // the indicated hash algorithm, but at least it might be.
65 {
66 if(
67 #if defined(SUPPORT_PADDING_ONLY_RSASSA) && SUPPORT_PADDING_ONLY_RSASSA == YES
68 in->inScheme.details.any.hashAlg != TPM_ALG_NULL &&
69 #endif
70 in->digest.t.size
71 != CryptGetHashDigestSize(in->inScheme.details.any.hashAlg))
72 return TPM_RC_SIZE + RC_Sign_digest;
73 }
74
75 // Command Output
76 // Sign the hash. A TPM_RC_VALUE or TPM_RC_SCHEME
77 // error may be returned at this point
78 result = CryptSign(in->keyHandle, &in->inScheme, &in->digest, &out->signature);
79
80 return result;
81 }
82