Commit Graph

223 Commits

Author SHA1 Message Date
Brandon Weeks
be496f1149 Internal change
PiperOrigin-RevId: 394330027
2021-09-01 15:39:03 -07:00
Eric Chiang
a35bd36e42
attest: fix test build for MacOS (#241)
Windows still requires openssl due to tpm-tools simulator. Will try to
figure out that next.
2021-09-01 13:24:57 -07:00
Alex Wu
505680f536
Invert 'notspi' build tag to 'tspi' (#237)
This change allows users to specify TPM1.2 support rather than remove it.
go-attestation will build without needing Trousers/TSPI support.
The flip-side of this is that TPM1.2 does not just work; TPM1.2 users need to
include the `tspi` build tag.
2021-09-01 12:55:02 -07:00
Eric Chiang
7cf0af2beb
.github: add initial github action for CI (#239)
Goal is to switch current builder run internally by Google over to
GitHub Actions.
2021-09-01 11:15:26 -07:00
copybara-service[bot]
5410759ddc
Consider a nonce in NVRAM when computing the EK Template (Fixes #236). (#238)
PiperOrigin-RevId: 394112776

Co-authored-by: Tom D'Netto <jsonp@google.com>
2021-08-31 17:45:37 -07:00
Tom D
cc52e2d143
Handle EFI_ACTION events signalling DMA protection is disabled. (#235) 2021-08-23 14:03:58 -07:00
Timo Lindfors
7d128657ca Fix misleading comment 2021-08-10 12:18:55 -07:00
Timo Lindfors
e8c5dc4fd5 Fix minor spelling issues in comments 2021-08-10 12:18:55 -07:00
tracefinder
5df8a8e979
Add a build tag to turn off TPM12 support and avoid tspi dependency (#232)
* Add build tag to turn off TPM12 support and avoid tspi dependency

* Add notspi build flag related information in README.md
2021-07-30 12:26:45 -07:00
dependabot[bot]
9ff0d31d3c
Bump github.com/google/go-cmp from 0.5.5 to 0.5.6 (#221)
Bumps [github.com/google/go-cmp](https://github.com/google/go-cmp) from 0.5.5 to 0.5.6.
- [Release notes](https://github.com/google/go-cmp/releases)
- [Commits](https://github.com/google/go-cmp/compare/v0.5.5...v0.5.6)

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2021-07-02 11:17:17 -07:00
Eric Chiang
fa6830fc2f
update go-tspi dependency (#231)
This fixes go-attestation builds on 32 bit architectures.
2021-07-02 10:45:08 -07:00
Brandon Weeks
7ec6228f59 Rollback using certificatetransparency/x509 for the CI code
PiperOrigin-RevId: 380897258
2021-06-22 14:48:41 -07:00
copybara-service[bot]
bec58f2406
Internal change (#227)
PiperOrigin-RevId: 380891920

Co-authored-by: Brandon Weeks <bweeks@google.com>
2021-06-22 14:33:47 -07:00
Go-Attestation Team
20a9e4b381 Internal change
PiperOrigin-RevId: 380881515
2021-06-22 20:41:11 +00:00
Tom D
1b4849d2c3
Make possibly-missing WBCL values ternary-typed (#226) 2021-06-21 14:10:45 -07:00
Alex Wu
0a3c6e82bf
Ignore SBAT events in ParseUEFIVariableAuthority (#222)
As part of the Boothole fixes, shim has introduced an
SBAT feature https://github.com/rhboot/shim/blob/main/SBAT.md.
SBAT configuration is configured to log to PCR7 using
EV_EFI_VARIABLE_AUTHORITY.
493bd940e5/mok.c (L228-L247)

This causes issue with ParseUEFIVariableAuthority, as
it asssumes that an event with type EV_EFI_VARIABLE_AUTHORITY
can be parsed as EFI_SIGNATURE_DATA, per section 3.3.4.8
of the TCG PC Client Platform Firmware Profile Specification.
2021-06-03 14:28:24 -07:00
Paweł Szałachowski
c4760bd1c6
Validate the RSA-PSS salt length argument. (#219) 2021-05-21 15:28:56 -07:00
Paweł Szałachowski
0b7298fb18
Support RSA application keys (#218) 2021-05-20 11:15:09 -07:00
Paweł Szałachowski
7f6fec6b36
add ecdsa configuration options (#217)
Add configuration options for ECDSA key generation.
2021-05-19 11:32:54 -07:00
Tom D
ee5bb94c43
WIP processing image load events (#216) 2021-05-10 12:11:58 -07:00
Paweł Szałachowski
9b857465d0
Handle to interface{} in *windowsKey12.certify() (#214) 2021-04-23 16:13:10 -07:00
Paweł Szałachowski
6848928436
Add AK.Certify() and use CertifyEx() for certification (#210)
* replace CertifyCreation() by CertifyEx() to handle certification of objects for which we cannot extract CreationData
* add AK.Certify(handle) allowing to certify externally-created keys
2021-04-23 14:41:30 -07:00
Tom D
e24a847d44
Add initial docs for attest-tool (#213) 2021-04-15 12:14:18 -07:00
Brandon Weeks
b6c6a0c365
Parse TCG_PCClientPCREvent structures with an eventSize of 0 (#212) 2021-04-14 13:59:06 -07:00
Brandon Weeks
31ad4f57fd
Fix integer overflow in digest parsing (#211) 2021-04-13 15:57:16 -07:00
Dmitrii Okunev
b89180c3eb
bugfix(eventlog): Assume TPM1.2 events if NO_ACTION is too short (#208) 2021-04-13 10:46:15 -07:00
Tom D
1ceeedc8dc
win_events: Determine if the WBCL was for a cold boot (as opposed to a resume from hibernation) (#209) 2021-04-07 16:08:29 -07:00
Paweł Szałachowski
1bbba0bdfd
Minor fixes and additions (#207)
* replace ReadPublic() by DecodePublic() when creating and loading keys: the current implementation calls ReadPublic() even if public data is already accessible
* drop handle() from the ak interface: it is unnecessary
* add Blobs() to attest.Key: to allow agnostic key marshaling
2021-04-01 19:29:45 -07:00
Paweł Szałachowski
611c6598b2
testKeySign: small fix (#206) 2021-04-01 09:53:30 -07:00
Brandon Weeks
9fc6c7504a
Bump Go version to 1.16, update dependencies (#205) 2021-03-17 15:05:37 -07:00
Paweł Szałachowski
1379a4f766
Verify(): ensure that the hash function is available (#204) 2021-03-09 09:30:11 -08:00
Paweł Szałachowski
440d34a877
Support for application signing keys (#201) 2021-03-08 12:27:00 -08:00
dependabot[bot]
328912c0ae
Bump github.com/google/go-cmp from 0.5.4 to 0.5.5 (#203)
Bumps [github.com/google/go-cmp](https://github.com/google/go-cmp) from 0.5.4 to 0.5.5.
- [Release notes](https://github.com/google/go-cmp/releases)
- [Commits](https://github.com/google/go-cmp/compare/v0.5.4...v0.5.5)

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2021-03-08 11:09:05 -08:00
Paweł Szałachowski
d436f3c9c5
attestPCRs(): make sure that the return values are consistent (#199) 2021-01-12 16:21:21 -08:00
Eric Chiang
339bdb245a
attest: add bounds checks for slice indexes (#197)
Found manually looking through the code. The activate credential could
crash the client, the secureboot and challenge generation could crash
the server.
2020-12-30 19:33:55 +01:00
dependabot[bot]
0ee6160aab
Bump github.com/google/go-tpm-tools from 0.2.0 to 0.2.1 (#196)
Bumps [github.com/google/go-tpm-tools](https://github.com/google/go-tpm-tools) from 0.2.0 to 0.2.1.
- [Release notes](https://github.com/google/go-tpm-tools/releases)
- [Commits](https://github.com/google/go-tpm-tools/compare/v0.2.0...v0.2.1)

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2020-12-14 12:49:45 +01:00
dependabot[bot]
f98225cdc5
Bump github.com/google/go-tpm from 0.3.1 to 0.3.2 (#195)
Bumps [github.com/google/go-tpm](https://github.com/google/go-tpm) from 0.3.1 to 0.3.2.
- [Release notes](https://github.com/google/go-tpm/releases)
- [Commits](https://github.com/google/go-tpm/compare/v0.3.1...v0.3.2)

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2020-12-14 12:44:47 +01:00
Deepika Rajani
dfe63791df
Update tpm_windows.go (#194) 2020-12-14 12:37:04 +01:00
Deepika Rajani
2f809d0330
Deepikarajani24 patch 1 (#193)
* tbs.dll to not initialize on start up
so that it's not initialized when tpm support is not required

Changed author to my google.com user

* initialize tbs.dll and proc Tbsi_GetDeviceInfo during probeSystemTPMs

initialization is done in probeSystemTPMs as it's called before openTPM which requires support of the dll
changed author to my google.com user

* tbs.dll to load once

Changed the author to my google.com email

* Tbsi_GetDeviceInfo check to happen once
changed the author of the commit
2020-12-02 11:09:22 -08:00
dependabot[bot]
9632df6f12
Bump github.com/google/go-cmp from 0.5.3 to 0.5.4 (#191)
Bumps [github.com/google/go-cmp](https://github.com/google/go-cmp) from 0.5.3 to 0.5.4.
- [Release notes](https://github.com/google/go-cmp/releases)
- [Commits](https://github.com/google/go-cmp/compare/v0.5.3...v0.5.4)

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Tom D <40675700+twitchy-jsonp@users.noreply.github.com>
2020-11-30 12:27:08 -08:00
Eric Chiang
0efaf4b19f
attest: improve event log debugging (#190)
Event log verification is terrible and easy to mess up. Even if you
replay against the PCRs there are still values that can be tampered with
or reordered. PCRs also shouldn't be trusted unless they're attested to
have come from the correct TPM.

Given this, it seems advantageous to add some ability to consume raw
event logs, even if it's just for debugging.
2020-11-30 12:22:43 -08:00
Aditya Prakash
63c5188962
Export InvalidPCRs field in ReplayError (#189)
* Export InvalidPCRs field in ReplayError

In order to retrieve the Invalid PCRs which couldn't be replayed against the Event log, we need this field to be exported as this gives the exact and true information. Replay error events will give all the events, but doesn't give the exact PCR index which doesn't get replayed. 

Following is the test to extend PCR 7 and verify the PCRs 7,8,9 against the Event log. Output:
```
event log failed to verify: the following registers failed to replay: [7]
ReplayError Events:=[107]
Replay Error Events PCR indexes=[0 7 2 3 6 9 8 1 4 5]
```

* Add Comment to the exported field
2020-11-30 11:56:55 -08:00
Brandon Weeks
d90962df3c
Add InjectSimulatedTPMForTest function for testing (#187) 2020-11-19 07:43:19 +01:00
Brandon Weeks
6bd14729ac
Add RFC 4043 and GCP OIDs (#188)
Co-authored-by: Tom D <40675700+twitchy-jsonp@users.noreply.github.com>
2020-11-18 22:34:46 -08:00
Brandon Weeks
72a39f3597
Upgrade dependencies, enable Dependabot (#186)
Co-authored-by: Tom D <40675700+twitchy-jsonp@users.noreply.github.com>
2020-11-18 22:29:50 -08:00
Brandon Weeks
25f5b13c2c
Fix Go Vet string conversion warnings (#185)
https://golang.org/doc/go1.15#vet
2020-11-18 22:25:44 -08:00
Eric Chiang
b59ed18da9
Revert "README: add build dependencies to instructions (#68)" (#184)
This reverts commit 1b270852e6.
2020-11-18 09:45:30 -08:00
Eric Chiang
1b270852e6
README: add build dependencies to instructions (#68) 2020-11-18 09:24:10 -08:00
Matthew Garrett
3cc596e3c6 Add missing optional tags
Some fields have default values, which also means they should be treated
as optional. Fix up the tagging to handle that. The natural defaults
here will work, so no need to make them explicit.
2020-11-17 15:00:41 -08:00
Matthew Garrett
4ad1cc2bf5 Fix type for ComponentClassValue
This is an octet string (ie, an array of bytes) rather than a string.
Fix it to be []byte.
2020-11-12 16:31:41 -08:00