Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add Cipher Engine for Symmetric Encryption #76

Closed
wants to merge 71 commits into from
Closed

Add Cipher Engine for Symmetric Encryption #76

wants to merge 71 commits into from

Conversation

GaelGuegan
Copy link

Description

Adding Symmetric Encryption through new file : tpm2-tss-engine-ciphers.c. (Issue #70)

This is done by handling structure EVP_CIPHER_meth_new.

How to use ?

> Create a persistent sym key
> openssl enc -aes-256-cbc -e -engine tpm2tss -in data.txt -out enc_data -K 81000001 -iv 0123456789012345
> openssl enc -aes-256-cbc -d -engine tpm2tss -in enc_data -out dec_data.txt -K 81000001 -iv 0123456789012345

See the shell script to test it : ciphers.sh.

Problems

For now, it is only working with persistent handle.

Still have a problem with long string :

  • KO : openssl App (openssl enc). It call the cipher function several time, and the end of the string is wrong.
  • OK : openssl API (EVP_EncryptUpdate). Works fine.

Still wondering if we can use a different encryption mode than the one associated with the key ( issue here). For me, only the mode associated with the key works.

flihp and others added 30 commits February 18, 2019 09:43
@flihp
README.md: Fix name of ken generation utility in examples.
b665d5d 
This seems to have been renamed but the history was probably squashed.

Signed-off-by: Philip Tricca <[email protected]>
Signed-off-by: GaelGuegan <[email protected]>
LOADKEY Function: Add management of persistent handle
122faa1 
Signed-off-by: GaelGuegan <[email protected]>
Add TEST for RSA sign persistent handle
1cd20f1 
Add KEY_TYPE enum to know if the key passed is a handle or a blob.

The engine can now crypt and decrypt with RSA through persistant handle.

Signed-off-by: GaelGuegan <[email protected]>
Signed-off-by: GaelGuegan <[email protected]>
Add package dependencies : libcurl & libtool
01d1931 
Signed-off-by: GaelGuegan <[email protected]>
Engine naming: Symlink new to old.
a58d861 
Previously, engines were prefix by lib*.
Now, engines are not prefixed anymore.
We symlink non-prefix to prefixed on install to accomodate both.
Note we also have to create the engine-dir before that.

Fixes: #6

Signed-off-by: Andreas Fuchs <[email protected]>
Signed-off-by: GaelGuegan <[email protected]>
File travis.yml: Changed libcurl3 to libcurl3-dev
4401e04 
Signed-off-by: GaelGuegan <[email protected]>
File travis.yml: Changed libcurl3-dev to libcurl4-openssl-dev
fac0339 
Signed-off-by: GaelGuegan <[email protected]>
File travis.yml: Changed libgcrypt20-dev to libgcrypt-dev
b6b1b88 
Signed-off-by: GaelGuegan <[email protected]>
@safayetahmedatge
configure.ac: Makefile.am: allow build without pandoc
188f3b9 
Allow the engine to be built even if pandoc is missing. Only create
man pages if pandoc is available. This roughly follows the same
pattern as tpm2-tools.

Signed-off-by: Safayet Ahmed <[email protected]>
Signed-off-by: GaelGuegan <[email protected]>
@elwerene
Fix examples in Readme
bd8d6cc 
Signed-off-by: René Rössler <[email protected]>
Signed-off-by: GaelGuegan <[email protected]>
Removed dead code
4e41fdf 
Signed-off-by: Andreas Fuchs <[email protected]>
Signed-off-by: GaelGuegan <[email protected]>
Make enginesdir variable
a818560 
enginesdir is now pulled from pkg-config instead of hard coded.
Also added a --with-enginesdir option for overriding.

Signed-off-by: Andreas Fuchs <[email protected]>
Signed-off-by: GaelGuegan <[email protected]>
@dwmw2
Cope with default RSA exponent being stored in public key
7efd246 
Signed-off-by: David Woodhouse <[email protected]>
Signed-off-by: GaelGuegan <[email protected]>
@dwmw2
Add TPMA_OBJECT_NODA flag when generating EC primary
5d52f73 
Since this is used as part of the ECDH exchange for creating the key,
it's important to be consistent across implementations otherwise the
generated key ends up being different.

Signed-off-by: David Woodhouse <[email protected]>
Signed-off-by: GaelGuegan <[email protected]>
@dwmw2
Switch to TSS2 PRIVATE KEY PEM format
82cba92 
Signed-off-by: David Woodhouse <[email protected]>
Signed-off-by: GaelGuegan <[email protected]>
@dwmw2
Fix double free of BIO on parse failure
9af5876 
Signed-off-by: David Woodhouse <[email protected]>
Signed-off-by: GaelGuegan <[email protected]>
Prompt for a password only when define
828fb5e 
Signed-off-by: GaelGuegan <[email protected]>
Checked if Key has flag UserWithAuth before to prompt a password
3f00f4e 
Signed-off-by: GaelGuegan <[email protected]>
Revert "Add package dependencies : libcurl & libtool"
38f7725 
This reverts commit 1034edd.

Signed-off-by: GaelGuegan <[email protected]>
Signed-off-by: GaelGuegan <[email protected]>
@sachingole
Self signed certificate generations steps added in README.md
4fb0986 
Signed-off-by: Sachin Gole <[email protected]>
Signed-off-by: GaelGuegan <[email protected]>
CI: Add tpm2-tools to travis
9bf7914 
Add tpm2-tools to travis for integration tests.
Had to add manually compiled libcurl along the way, due to
a conflict between libgcrypt20 and libcurl Ubuntu packages.

Signed-off-by: Andreas Fuchs <[email protected]>
Signed-off-by: GaelGuegan <[email protected]>
LOADKEY Function: Add management of persistent handle
659867e 
The engine can now crypt and decrypt with RSA through persistant handle.

Add TEST for RSA sign persistent handle
Add KEY_TYPE enum to know if the key passed is a handle or a blob.

Signed-off-by: GaelGuegan <[email protected]>
Co-authored-by: Andreas Fuchs <[email protected]>
Signed-off-by: Andreas Fuchs <[email protected]>
Signed-off-by: GaelGuegan <[email protected]>
Refactored persistent key handling
4587bd5 
Moved the persistent key handling from RSA parts of
the engine to the common area, also to enable ECDSA
with persistent keys.

Signed-off-by: Andreas Fuchs <[email protected]>
Signed-off-by: GaelGuegan <[email protected]>
Add option for password-less operations
a55e1c2 
Signed-off-by: Andreas Fuchs <[email protected]>
Signed-off-by: GaelGuegan <[email protected]>
@jhachenbergerSIT
doc: Add example output to README
b17a72f 
The README does not provide any example output for the random number
generation call. Unfortunately, the actual output of the call includes 4
warnings, which makes it easy to miss the succesfull generation of
a random number. An example output might improve this situation and help
the user to recognize the successful call as such.

Signed-off-by: Julien Hachenberger <[email protected]>
Signed-off-by: GaelGuegan <[email protected]>
@jhachenbergerSIT
doc: Add missing build steps for tpm2-tss
712ef00 
The build steps for the tpm2-tss dependency are incomplete (they miss
the two calls: ./bootstrap and ./configure, see [1])

[1] https://github.com/tpm2-software/tpm2-tss/blob/master/INSTALL.md

Signed-off-by: Julien Hachenberger <[email protected]>
Signed-off-by: GaelGuegan <[email protected]>
@diabonas
Terminate ERR_STRING_DATA arrays correctly
06da448 
Fixes #42

Signed-off-by: Jonas Witschel <[email protected]>
Signed-off-by: GaelGuegan <[email protected]>
@dwmw2
Switch to final assigned OIDs for key types
22095af 
Turns out I was right to be paranoid about chasing up the informally
assigned OIDs we were using. Those have been designated as non-leaf nodes
now, and we have new ones.

Signed-off-by: David Woodhouse <[email protected]>
Signed-off-by: GaelGuegan <[email protected]>
@diabonas
tests: Add .libs to LD_LIBRARY_PATH
79046f6 
This is necessary for the tests to pass with OpenSSL 1.1, where
setting OPENSSL_ENGINES is not enough because the built library is
called libtpm2tss.so instead of tpm2tss.so.

Fixes #41

Signed-off-by: GaelGuegan <[email protected]>
Added CHANGELOG and CONTRIBUTING
15791c0 
Signed-off-by: Andreas Fuchs <[email protected]>
Signed-off-by: GaelGuegan <[email protected]>
safayetahmedatge and others added 27 commits February 18, 2019 09:44
@safayetahmedatge
tpm2tss_tpm2data_readtpm: use ESYS_AUXCONTEXT
1e50dc3 
Replaced local variable `ESYS_CONTEXT ectx;` with `ESYS_AUXCONTEXT eactx;` in
function `tpm2tss_tpm2data_readtpm` (tpm2-tss-engine-common.c).

Signed-off-by: Safayet Ahmed <[email protected]>
Signed-off-by: GaelGuegan <[email protected]>
@safayetahmedatge
tpm2-tss-engine-rand.c: use ESYS_AUXCONTEXT
6952efd 
Replaced local variable `ESYS_CONTEXT ectx;` with `ESYS_AUXCONTEXT eactx;` in
function `rand_bytes` (tpm2-tss-engine-rand.c).

Signed-off-by: Safayet Ahmed <[email protected]>
Signed-off-by: GaelGuegan <[email protected]>
@safayetahmedatge
tpm2-tss-engine-rsa.c: use ESYS_AUXCONTEXT
0190dbe 
Replaced local variable `ESYS_CONTEXT ectx;` with `ESYS_AUXCONTEXT eactx;`
across functions in tpm2-tss-engine-rsa.c.

Signed-off-by: Safayet Ahmed <[email protected]>
Signed-off-by: GaelGuegan <[email protected]>
@safayetahmedatge
tpm2-tss-engine-ecc.c: use ESYS_AUXCONTEXT
bae246e 
Replaced local variable `ESYS_CONTEXT ectx;` with `ESYS_AUXCONTEXT eactx;`
across functions in tpm2-tss-engine-ecc.c.

Signed-off-by: Safayet Ahmed <[email protected]>
Signed-off-by: GaelGuegan <[email protected]>
@safayetahmedatge
init_tpm_key: use ESYS_AUXCONTEXT as 1st argument
dc69d2a 
Change the first argument to `init_tpm_key` from `ESYS_CONTEXT **ctx` to
`ESYS_AUXCONTEXT *eactx_p`. Change function header and callers accordingly.

Signed-off-by: Safayet Ahmed <[email protected]>
Signed-off-by: GaelGuegan <[email protected]>
@safayetahmedatge
init_tpm_parent: use ESYS_AUXCONTEXT as 1st argument
2fb929c 
Change the first argument to `init_tpm_parent` from `ESYS_CONTEXT **ctx` to
`ESYS_AUXCONTEXT *eactx_p`. Change function header and callers accordingly.

Signed-off-by: Safayet Ahmed <[email protected]>
Signed-off-by: GaelGuegan <[email protected]>
@safayetahmedatge
Initialize/Finalize TCTI based on opts
6cd6f3d 
src/tpm2-tss-engine-tcti.c:
src/tpm2-tss-engine-common.h:
Makefile.am
    Added new file to implement and export the following functions:
        - tcti_set_opts
        - tcti_clear_opts
        - tcti_get_ctx
        - tcti_free_ctx

src/tpm2-tss-engine-err.(c/h):
    Added new "function codes" and "reason codes" for the code added in
    tpm2-tss-engine-tcti.c

src/tpm2-tss-engine.c:
    Directly set and clear the TCTI option string through calls to
    `tcti_set_opts` and `tcti_clear_opts`; no need to maintain a separate
    global variable to point to a copy allocated on the heap.

src/tpm2-tss-engine-common.c:
    Modified `esys_auxctx_init` and `esys_auxctx_free` to call `tcti_get_ctx`
    and `tcti_free_ctx`, to manage the TCTI context.

Signed-off-by: Safayet Ahmed <[email protected]>
Signed-off-by: GaelGuegan <[email protected]>
Add unit tests for some error cases
87000b6 
Adding a first unit test to some of the error cases and handling
in code. This also adds a dependency on cmocka.

Signed-off-by: Andreas Fuchs <[email protected]>
Signed-off-by: GaelGuegan <[email protected]>
Configure: Test for tpm2-tss >=2.2
112098f 
The previous workaround for tpm2-tss < 2.2 would work here, but
ESAPI would leak a session handle inside the TPM.
Thus, we now check for tss version during configure and active
the potentially harmful code only conditionally.
Not nice but probably the best option.

Signed-off-by: Andreas Fuchs <[email protected]>
Signed-off-by: GaelGuegan <[email protected]>
@GaelGuegan
Initial commit symmectric encryption
33770b7 
Signed-off-by: GaelGuegan <[email protected]>
Signed-off-by: GaelGuegan <[email protected]>
Code style cleanup
10fc2a1 
Fix indentation and similar cosmetics in all c files.

Signed-off-by: Andreas Fuchs <[email protected]>
Signed-off-by: GaelGuegan <[email protected]>
Remove left-over debug statements
c238538 
Remove printf()s that were left over from
development work.

Signed-off-by: Andreas Fuchs <[email protected]>
Signed-off-by: GaelGuegan <[email protected]>
Doc: Add function documentation
2746af6 
Add missing documentation to
tpm2-tss-engine-common.c

Signed-off-by: Andreas Fuchs <[email protected]>
Signed-off-by: GaelGuegan <[email protected]>
@GaelGuegan
Added cipher structure : EVP_CIPHER tpm_aes256_cbc{}
c7bae08 
Signed-off-by: GaelGuegan <[email protected]>
Signed-off-by: GaelGuegan <[email protected]>
Remove Esys_Startup from code
ab58b4e 
Esys_Startup clutters the log with many errors.
A TPM should be assumed to be started up when used.
The test scripts will use tpm2-tools to start up the TPM in case
it wasn't.

Signed-off-by: Andreas Fuchs <[email protected]>
Signed-off-by: GaelGuegan <[email protected]>
@GaelGuegan
Corrected spelling comments
c291841 
Signed-off-by: GaelGuegan <[email protected]>
Signed-off-by: GaelGuegan <[email protected]>
@GaelGuegan
Starts implementation for persistent handle
87e1ace 
Signed-off-by: GaelGuegan <[email protected]>
Signed-off-by: GaelGuegan <[email protected]>
@GaelGuegan
Change configure.ac to disable -Werror
e7efe89 
Signed-off-by: GaelGuegan <[email protected]>
@GaelGuegan
Added EncryptDecrypt for persistent handle
ff209a7 
Disable -Werror

Signed-off-by: GaelGuegan <[email protected]>
Signed-off-by: GaelGuegan <[email protected]>
@GaelGuegan
Changed comments style
47dee44 
Removed compile tcti-sim

Signed-off-by: GaelGuegan <[email protected]>
Signed-off-by: GaelGuegan <[email protected]>
@GaelGuegan
Added Persistent Handle For OpenSSL APP CLI (enc)
35f70b7 
Signed-off-by: GaelGuegan <[email protected]>
Signed-off-by: GaelGuegan <[email protected]>
@GaelGuegan
Deleted .project
c26e2f0 
Signed-off-by: GaelGuegan <[email protected]>
Signed-off-by: GaelGuegan <[email protected]>
@GaelGuegan
Factorized some code
fff7b6e 
Signed-off-by: GaelGuegan <[email protected]>
Signed-off-by: GaelGuegan <[email protected]>
@GaelGuegan
Add test
91fa66d 
Signed-off-by: GaelGuegan <[email protected]>
Signed-off-by: GaelGuegan <[email protected]>
@GaelGuegan
Uncomment -Werror
2684d12 
Signed-off-by: GaelGuegan <[email protected]>
Signed-off-by: GaelGuegan <[email protected]>
@GaelGuegan
Undiff useless stuff
bbc3e15 
Signed-off-by: GaelGuegan <[email protected]>
Signed-off-by: GaelGuegan <[email protected]>
@GaelGuegan
Update configure.ac, my text editor was adding whitespaces
0f4c43d 
Signed-off-by: GaelGuegan <[email protected]>
Signed-off-by: GaelGuegan <[email protected]>
@GaelGuegan GaelGuegan closed this Feb 18, 2019
@AndreasFuchsTPM
Copy link
Member

@GaelGuegan Will you keep working on this feature ?
I'd highly appreciate it being added.

@GaelGuegan
Copy link
Author

@AndreasFuchsSIT Yes sorry I changed all the commits because I needed to change my signed-off commit email. I have redo a pull request

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
9 participants
@GaelGuegan @AndreasFuchsTPM @flihp @safayetahmedatge @elwerene @dwmw2 @sachingole @jhachenbergerSIT @diabonas