stefanberger / libtpms / #2002

/********************************************************************************/

/*                                                                                */

/*                          Code to perform the various self-test functions.        */

/*                             Written by Ken Goldman                                */

/*                       IBM Thomas J. Watson Research Center                        */

/*                                                                                */

/*  Licenses and Notices                                                        */

/*                                                                                */

/*  1. Copyright Licenses:                                                        */

/*                                                                                */

/*  - Trusted Computing Group (TCG) grants to the user of the source code in        */

/*    this specification (the "Source Code") a worldwide, irrevocable,                 */

/*    nonexclusive, royalty free, copyright license to reproduce, create         */

/*    derivative works, distribute, display and perform the Source Code and        */

/*    derivative works thereof, and to grant others the rights granted herein.        */

/*                                                                                */

/*  - The TCG grants to the user of the other parts of the specification         */

/*    (other than the Source Code) the rights to reproduce, distribute,         */

/*    display, and perform the specification solely for the purpose of                 */

/*    developing products based on such documents.                                */

/*                                                                                */

/*  2. Source Code Distribution Conditions:                                        */

/*                                                                                */

/*  - Redistributions of Source Code must retain the above copyright licenses,         */

/*    this list of conditions and the following disclaimers.                        */

/*                                                                                */

/*  - Redistributions in binary form must reproduce the above copyright         */

/*    licenses, this list of conditions        and the following disclaimers in the         */

/*    documentation and/or other materials provided with the distribution.        */

/*                                                                                */

/*  3. Disclaimers:                                                                */

/*                                                                                */

/*  - THE COPYRIGHT LICENSES SET FORTH ABOVE DO NOT REPRESENT ANY FORM OF        */

/*  LICENSE OR WAIVER, EXPRESS OR IMPLIED, BY ESTOPPEL OR OTHERWISE, WITH        */

/*  RESPECT TO PATENT RIGHTS HELD BY TCG MEMBERS (OR OTHER THIRD PARTIES)        */

/*  THAT MAY BE NECESSARY TO IMPLEMENT THIS SPECIFICATION OR OTHERWISE.                */

/*  Contact TCG Administration (admin@trustedcomputinggroup.org) for                 */

/*  information on specification licensing rights available through TCG         */

/*  membership agreements.                                                        */

/*                                                                                */

/*  - THIS SPECIFICATION IS PROVIDED "AS IS" WITH NO EXPRESS OR IMPLIED         */

/*    WARRANTIES WHATSOEVER, INCLUDING ANY WARRANTY OF MERCHANTABILITY OR         */

/*    FITNESS FOR A PARTICULAR PURPOSE, ACCURACY, COMPLETENESS, OR                 */

/*    NONINFRINGEMENT OF INTELLECTUAL PROPERTY RIGHTS, OR ANY WARRANTY                 */

/*    OTHERWISE ARISING OUT OF ANY PROPOSAL, SPECIFICATION OR SAMPLE.                */

/*                                                                                */

/*  - Without limitation, TCG and its members and licensors disclaim all         */

/*    liability, including liability for infringement of any proprietary         */

/*    rights, relating to use of information in this specification and to the        */

/*    implementation of this specification, and TCG disclaims all liability for        */

/*    cost of procurement of substitute goods or services, lost profits, loss         */

/*    of use, loss of data or any incidental, consequential, direct, indirect,         */

/*    or special damages, whether under contract, tort, warranty or otherwise,         */

/*    arising in any way out of use or reliance upon this specification or any         */

/*    information herein.                                                        */

/*                                                                                */

/*  (c) Copyright IBM Corp. and others, 2016 - 2024                                */

/*                                                                                */

/********************************************************************************/

//** Introduction

// This file contains the code to perform the various self-test functions.

//

// NOTE: In this implementation, large local variables are made static to minimize

// stack usage, which is critical for stack-constrained platforms.

//** Includes and Defines

#include "Tpm.h"

#define SELF_TEST_DATA

#if ENABLE_SELF_TESTS

// These includes pull in the data structures. They contain data definitions for the

// various tests.

#  include "SelfTest.h"

#  include "SymmetricTest.h"

#  include "RsaTestData.h"

#  include "EccTestData.h"

#  include "HashTestData.h"

#  include "KdfTestData.h"

#  define TEST_DEFAULT_TEST_HASH(vector)              \

    if(TEST_BIT(DEFAULT_TEST_HASH, g_toTest))              \

        TestHash(DEFAULT_TEST_HASH, vector);

// Make sure that the algorithm has been tested

#  define CLEAR_BOTH(alg)                  \

    {                                          \

        CLEAR_BIT(alg, *toTest);          \

        if(toTest != &g_toTest)                          \

            CLEAR_BIT(alg, g_toTest);                  \

    }

#  define SET_BOTH(alg)                        \

    {                                        \

        SET_BIT(alg, *toTest);                \

        if(toTest != &g_toTest)                        \

            SET_BIT(alg, g_toTest);                \

    }

#  define TEST_BOTH(alg)                                                \

    ((toTest != &g_toTest) ? TEST_BIT(alg, *toTest) || TEST_BIT(alg, g_toTest) \

     : TEST_BIT(alg, *toTest))

// Can only cancel if doing a list.

#  define CHECK_CANCELED                                   \

    if(_plat__IsCanceled() && toTest != &g_toTest)           \

        return TPM_RC_CANCELED;

//** Hash Tests

//*** Description

// The hash test does a known-value HMAC using the specified hash algorithm.

//*** TestHash()

// The hash test function.

{

    //    TPM2B_TYPE(HMAC_BLOCK, DEFAULT_TEST_HASH_BLOCK_SIZE);

#  define HASH_CASE_FOR_TEST(HASH, hash)                 \

    case ALG_##HASH##_VALUE:                                 \

      testDigest = &c_##HASH##_digest.b;                 \

      break;

        {

        }

    // Clear the to-test bits

    // If there is an algorithm without test vectors, then assume that things are OK.

        return TPM_RC_SUCCESS;

    // Set the HMAC key to twice the digest size

                      (BYTE*)c_hashTestData.t.buffer);

    return TPM_RC_SUCCESS;

}

// libtpms added begin

#if SMAC_IMPLEMENTED && ALG_CMAC

static TPM_RC

         ALGORITHM_VECTOR    *toTest LIBTPMS_ATTR_UNUSED

         )

{

    // initializing this statically seems impossible with gcc...

        {

                                      TPM_ALG_CMAC, CMACTests[i].key);

            }

        }

}

#endif

// libtpms added end

//** Symmetric Test Functions

//*** MakeIv()

// Internal function to make the appropriate IV depending on the mode.

                     UINT32     size,  // IN: block size of the algorithm

                     BYTE*      iv     // OUT: IV to fill in

                     )

{

        return 0;

        {

            // The test uses an IV that has 0xff in the last byte

        }

    else

        {

        }

    return size;

}

//*** TestSymmetricAlgorithm()

// Function to test a specific algorithm, key size, and mode.

                                   TPM_ALG_ID                   mode   //

                                   )

{

    // libtpms added begin

        return;

    /* Skip test cases whose algorithms or keysizes are runtime-disabled */

                                             TPM_ECC_NONE,

                                             g_RuntimeProfile.stateFormatLevel))

        return;

    // libtpms added end

    //

    // Get the appropriate IV

    // Encrypt known data

                          &iv,

                          mode,

    // Check that it matches the expected value

    // Reinitialize the iv for decryption

                          &iv,

                          mode,

    // Make sure that it matches what we started with

}

//*** AllSymsAreDone()

// Checks if both symmetric algorithms have been tested. This is put here

// so that addition of a symmetric algorithm will be relatively easy to handle.

//

//  Return Type: BOOL

//      TRUE(1)         all symmetric algorithms tested

//      FALSE(0)        not all symmetric algorithms tested

{

}

//*** AllModesAreDone()

// Checks if all the modes have been tested.

//

//  Return Type: BOOL

//      TRUE(1)         all modes tested

//      FALSE(0)        all modes not tested

{

            return FALSE;

    return TRUE;

}

//*** TestSymmetric()

// If 'alg' is a symmetric block cipher, then all of the modes that are selected are

// tested. If 'alg' is a mode, then all algorithms of that mode are tested.

{

    //

        return TPM_RC_SUCCESS;

        {

            // Will test the algorithm for all modes and key sizes

            // A test this algorithm for all modes

                {

                        {

                                {

                                }

                        }

                }

            // if all the symmetric tests are done

                {

                    // all symmetric algorithms tested so no modes should be set

                }

        }

    else if(SYM_MODE_FIRST <= alg && alg <= SYM_MODE_LAST)

        {

            // Test this mode for all key sizes and algorithms

                {

                    // The mode testing only comes into play when doing self tests

                    // by command. When doing self tests by command, the block ciphers are

                    // tested first. That means that all of their modes would have been

                    // tested for all key sizes. If there is no block cipher left to

                    // test, then clear this mode bit.

                        {

                        }

                    else

                        {

                                {

                                }

                            // have tested this mode for all algorithms

                        }

                }

                {

                }

        }

    else

    return TPM_RC_SUCCESS;

}

//** RSA Tests

#  if ALG_RSA

//*** Introduction

// The tests are for public key only operations and for private key operations.

// Signature verification and encryption are public key operations. They are tested

// by using a KVT. For signature verification, this means that a known good

// signature is checked by CryptRsaValidateSignature(). If it fails, then the

// TPM enters failure mode. For encryption, the TPM encrypts known values using

// the selected scheme and checks that the returned value matches the expected

// value.

//

// For private key operations, a full scheme check is used. For a signing key, a

// known key is used to sign a known message. Then that signature is verified.

// since the signature may involve use of random values, the signature will be

// different each time and we can't always check that the signature matches a

// known value. The same technique is used for decryption (RSADP/RSAEP).

//

// When an operation uses the public key and the verification has not been

// tested, the TPM will do a KVT.

//

// The test for the signing algorithm is built into the call for the algorithm

//*** RsaKeyInitialize()

// The test key is defined by a public modulus and a private prime. The TPM's RSA

// code computes the second prime and the private exponent.

{

                 (P2B)&c_rsaPublicModulus,

                 sizeof(c_rsaPublicModulus));

                 (P2B)&c_rsaPrivatePrime,

                 sizeof(testObject->sensitive.sensitive.rsa.t.buffer));

    // Use the default exponent

//*** TestRsaEncryptDecrypt()

// These tests are for a public key encryption that uses a random value.

                                    ALGORITHM_VECTOR* toTest   //

                                    )

{

    //

    // Don't need to initialize much of the test object

        {

                                                     RUNTIME_ATTRIBUTE_NO_UNPADDED_ENCRYPTION))

                return TPM_RC_SUCCESS;        // don't test NULL with RSA        // libtpms added end

            // This is an encryption scheme using the private key without any encoding.

                                  &testOutput, &testInput.b, &testObject, &rsaScheme, NULL, NULL))

                                  &testOutput.b, &testInput.b, &testObject, &rsaScheme, NULL))

        }

    else

        {

            // TPM_ALG_RSAES:

            // This is an decryption scheme using padding according to

            // PKCS#1v2.1, 7.2. This padding uses random bits. To test a public

            // key encryption that uses random data, encrypt a value and then

            // decrypt the value and see that we get the encrypted data back.

            // The hash is not used by this encryption so it can be TMP_ALG_NULL

            // TPM_ALG_OAEP:

            // This is also an decryption scheme and it also uses a

            // pseudo-random

            // value. However, this also uses a hash algorithm. So, we may need

            // to test that algorithm before use.

                {

                }

                {

                    kvtValue  = &c_RsaesKvt;

                    testLabel = NULL;

                }

            else

            // Only use a digest-size portion of the test value

            // See if the encryption works

                                  &testOutput, &testInput.b, &testObject, &rsaScheme, testLabel, NULL))

            // see if we can decrypt this value and get the original data back

                                  &testOutput.b, &testInput.b, &testObject, &rsaScheme, testLabel))

            // See if the results compare

                               testOutput.t.buffer, c_RsaTestValue, DEFAULT_TEST_DIGEST_SIZE))

            // Now check that the decryption works on a known value

                                  &testOutput.b, &testInput.b, &testObject, &rsaScheme, testLabel))

                               testOutput.t.buffer, c_RsaTestValue, DEFAULT_TEST_DIGEST_SIZE))

        }

    return result;

}

//*** TestRsaSignAndVerify()

// This function does the testing of the RSA sign and verification functions. This

// test does a KVT.

{

    // Do a sign and signature verification.

    // RSASSA:

    // This is a signing scheme according to PKCS#1-v2.1 8.2. It does not

    // use random data so there is a KVT for the signing operation. On

    // first use of the scheme for signing, use the TPM's RSA key to

    // sign a portion of c_RsaTestData and compare the results to c_RsassaKvt. Then

    // decrypt the data to see that it matches the starting value. This verifies

    // the signature with a KVT

    // Clear the bits indicating that the function has not been checked. This is to

    // prevent looping

    // RSAPSS:

    // This is a signing scheme a according to PKCS#1-v2.2 8.1 it uses

    // random data in the signature so there is no KVT for the signing

    // operation. To test signing, the TPM will use the TPM's RSA key

    // to sign a portion of c_RsaTestValue and then it will verify the

    // signature. For verification, c_RsapssKvt is verified before the

    // user signature blob is verified. The worst case for testing of this

    // algorithm is two private and one public key operation.

    // The process is to sign known data. If RSASSA is being done, verify that the

    // signature matches the precomputed value. For both, use the signed value and

    // see that the verification says that it is a good signature. Then

    // if testing RSAPSS, do a verify of a known good signature. This ensures that

    // the validation function works.

    // For RSASSA, make sure the results is what we are looking for

        {

                               testSig.signature.rsassa.sig.t.buffer,

                               RSA_TEST_KEY_SIZE))

        }

    // See if the TPM will validate its own signatures

    // If this is RSAPSS, check the verification with known signature

    // Have to copy because  CrytpRsaValidateSignature() eats the signature

        {

                         (P2B)&c_RsapssKvt,

                         sizeof(testSig.signature.rsapss.sig.t.buffer));

        }

}

//*** TestRSA()

// Function uses the provided vector to indicate which tests to run. It will clear

// the vector after each test is run and also clear g_toTest

{

    //

        {

            // This is the RSAEP/RSADP function. If we are processing a list, don't

            // need to test these now because any other test will validate

            // RSAEP/RSADP. Can tell this is list of test by checking to see if

            // 'toTest' is pointing at g_toTest. If so, this is an isolated test

            // an need to go ahead and do the test;

                // Not running a list of tests or no other tests on the list

                // so run the test now

            // if not running the test now, leave the bit on, just in case things

            // get interrupted

            break;

          case TPM_ALG_RSAES:

          case TPM_ALG_RSASSA:

        }

}

#  endif  // ALG_RSA

//** ECC Tests

#  if ALG_ECC

//*** LoadEccParameter()

// This function is mostly for readability and type checking

                             const TPM2B_EC_TEST* from  // source

                             )

{

//*** LoadEccPoint()

                         const TPM2B_EC_TEST* x,      // source

                         const TPM2B_EC_TEST* y)

{

//*** TestECDH()

// This test does a KVT on a point multiply.

                       ALGORITHM_VECTOR* toTest  // IN/OUT: modified after test is run

                       )

{

    //

}

//*** TestEccSignAndVerify()

{

    // ECC signature verification testing uses a KVT.

        {

          case TPM_ALG_ECDSA:

            break;

          case TPM_ALG_ECSCHNORR:

                             &c_TestEcSchnorr_r);

                             &c_TestEcSchnorr_s);

            break;

          case TPM_ALG_SM2:

            // don't have a test for SM2

            return TPM_RC_SUCCESS;

        }

    // Have to copy the key. This is because the size used in the test vectors

    // is the size of the ECC parameter for the test key while the size of a point

    // is TPM dependent

                 &c_ecTestKey_ds.b,

                 sizeof(testObject.sensitive.sensitive.ecc.t.buffer));

                 &testObject.publicArea.unique.ecc, &c_ecTestKey_QsX, &c_ecTestKey_QsY);

                                    &testSig, &testObject, (TPM2B_DIGEST*)&c_ecTestValue.b))

        {

        }

    // Now sign and verify some data

                       &testSig, &testObject, (TPM2B_DIGEST*)&c_ecTestValue, &eccScheme, NULL))

                                    &testSig, &testObject, (TPM2B_DIGEST*)&c_ecTestValue))

    return TPM_RC_SUCCESS;

}

//*** TestKDFa()

{

    //

                              &c_kdfTestKeyIn.b,

                              &c_kdfTestLabel.b,

                              &c_kdfTestContextU.b,

                              &c_kdfTestContextV.b,

                              TEST_KDF_KEY_SIZE * 8,

                              keyOut.t.buffer,

                              &counter,

                              FALSE);

}

//*** TestEcc()

{

        {

          case TPM_ALG_ECDH:

            // If this is in a loop then see if another test is going to deal with

            // this.

            // If toTest is not a self-test list

               // or this is the only ECC test in the list

                {

                }

            break;

          case TPM_ALG_ECSCHNORR:

          case TPM_ALG_SM2:

        }

}

#  endif  // ALG_ECC

//*** TestAlgorithm()

// Dispatches to the correct test function for the algorithm or gets a list of

// testable algorithms.

//

// If 'toTest' is not NULL, then the test decisions are based on the algorithm

// selections in 'toTest'. Otherwise, 'g_toTest' is used. When bits are clear in

// 'g_toTest' they will also be cleared 'toTest'.

//

// If there doesn't happen to be a test for the algorithm, its associated bit is

// quietly cleared.

//

// If 'alg' is zero (TPM_ALG_ERROR), then the toTest vector is cleared of any bits

// for which there is no test (i.e. no tests are actually run but the vector is

// cleared).

//

// Note: 'toTest' will only ever have bits set for implemented algorithms but 'alg'

// can be anything.

//

//  Return Type: TPM_RC

//      TPM_RC_CANCELED     test was canceled

LIB_EXPORT

TPM_RC

{

    // This is kind of strange. This function will either run a test of the selected

    // algorithm or just clear a bit if there is no test for the algorithm. So,

    // either this loop will be executed once for the selected algorithm or once for

    // each of the possible algorithms. If it is executed more than once ('alg' ==

    // ALG_ERROR), then no test will be run but bits will be cleared for

    // unimplemented algorithms. This was done this way so that there is only one

    // case statement with all of the algorithms. It was easier to have one case

    // statement than to have multiple ones to manage whenever an algorithm ID is

    // added.

        {

            // if 'alg' was TPM_ALG_ERROR, then we will be cycling through

            // values, some of which may not be implemented. If the bit in toTest

            // happens to be set, then we could either generated an assert, or just

            // silently CLEAR it. Decided to just clear.

                {

                }

            // Process whatever is left.

            // NOTE: since this switch will only be called if the algorithm is

            // implemented, it is not necessary to modify this list except to comment

            // out the algorithms for which there is no test

                {

                    // Symmetric block ciphers

#  if ALG_AES

// libtpms added begin

#  if SMAC_IMPLEMENTED && ALG_CMAC

                             break;

                    }

#  endif

// libtpms added end

#  endif

#  if ALG_SM4

                    // if SM4 is implemented, its test is like other block ciphers but there

                    // aren't any test vectors for it yet

                  case TPM_ALG_SM4: /* libtpms changed */

#  endif  // ALG_SM4

#  if ALG_CAMELLIA

                  /* fallthrough */

                  case TPM_ALG_CAMELLIA:  // libtpms activated

#  endif

#  if ALG_TDES

                  case TPM_ALG_TDES:      // libtpms added

#  endif

                    // Symmetric modes

#  if !ALG_CFB

#    error CFB is required in all TPM implementations

#  endif  // !ALG_CFB

                  case TPM_ALG_CFB:

                    break;

#  if ALG_CTR

#  endif  // ALG_CRT

#  if ALG_OFB

                  case TPM_ALG_OFB:

#  endif  // ALG_OFB

#  if ALG_CBC

                  case TPM_ALG_CBC:

#  endif  // ALG_CBC

#  if ALG_ECB

                  case TPM_ALG_ECB:

#  endif

                    else

                        // If doing the initialization of g_toTest vector, only need

                        // to test one of the modes for the symmetric algorithms. If

                        // initializing for a SelfTest(FULL_TEST), allow all the modes.

                    break;

#  if !ALG_HMAC

#    error HMAC is required in all TPM implementations

#  endif

                    // Clear the bit that indicates that HMAC is required because

                    // HMAC is used as the basic test for all hash algorithms.

                    // Testing HMAC means test the default hash

                    else

                        // If not testing, then indicate that the hash needs to be

                        // tested because this uses HMAC

                    break;

                    // Have to use two arguments for the macro even though only the first is used in the

                    // expansion.

#  define HASH_CASE_TEST(HASH, hash) case ALG_##HASH##_VALUE:

#  undef HASH_CASE_TEST

                    break;

                    // RSA-dependent

#  if ALG_RSA

                    else

                    break;

                  case TPM_ALG_RSAES:

                  case TPM_ALG_RSAPSS:

                  case TPM_ALG_OAEP:

                  case TPM_ALG_NULL:  // used or RSADP

                    break;

#  endif  // ALG_RSA

#  if ALG_KDF1_SP800_108

                    break;

#  endif  // ALG_KDF1_SP800_108

#  if ALG_ECC

                    // ECC dependent but no tests

                    //        case TPM_ALG_ECDAA:

                    //        case TPM_ALG_ECMQV:

                    //        case TPM_ALG_KDF1_SP800_56a:

                    //        case TPM_ALG_KDF2:

                    //        case TPM_ALG_MGF1:

                    else

                    break;