stefanberger / libtpms / #2040

// SPDX-License-Identifier: BSD-2-Clause

//** Introduction

// This file contains the code to perform the various self-test functions.

//

// NOTE: In this implementation, large local variables are made static to minimize

// stack usage, which is critical for stack-constrained platforms.

//** Includes and Defines

#include "Tpm.h"

#define SELF_TEST_DATA

#if ENABLE_SELF_TESTS

// These includes pull in the data structures. They contain data definitions for the

// various tests.

#  include "SelfTest.h"

#  include "SymmetricTest.h"

#  include "RsaTestData.h"

#  include "EccTestData.h"

#  include "HashTestData.h"

#  include "KdfTestData.h"

#  define TEST_DEFAULT_TEST_HASH(vector)        \

      if(TEST_BIT(DEFAULT_TEST_HASH, g_toTest)) \

          TestHash(DEFAULT_TEST_HASH, vector);

// Make sure that the algorithm has been tested

#  define CLEAR_BOTH(alg)               \

      {                                 \

          CLEAR_BIT(alg, *toTest);      \

          if(toTest != &g_toTest)       \

              CLEAR_BIT(alg, g_toTest); \

      }

#  define SET_BOTH(alg)               \

      {                               \

          SET_BIT(alg, *toTest);      \

          if(toTest != &g_toTest)     \

              SET_BIT(alg, g_toTest); \

      }

#  define TEST_BOTH(alg)                                                         \

      ((toTest != &g_toTest) ? TEST_BIT(alg, *toTest) || TEST_BIT(alg, g_toTest) \

                             : TEST_BIT(alg, *toTest))

// Can only cancel if doing a list.

#  define CHECK_CANCELED                             \

      if(_plat__IsCanceled() && toTest != &g_toTest) \

          return TPM_RC_CANCELED;

//** Hash Tests

//*** Description

// The hash test does a known-value HMAC using the specified hash algorithm.

//*** TestHash()

// The hash test function.

{

    //    TPM2B_TYPE(HMAC_BLOCK, DEFAULT_TEST_HASH_BLOCK_SIZE);

#  define HASH_CASE_FOR_TEST(HASH, hash)     \

      case ALG_##HASH##_VALUE:               \

          testDigest = &c_##HASH##_digest.b; \

          break;

    {

    }

    // Clear the to-test bits

    // If there is an algorithm without test vectors, then assume that things are OK.

        return TPM_RC_SUCCESS;

    // Set the HMAC key to twice the digest size

                      (BYTE*)c_hashTestData.t.buffer);

    return TPM_RC_SUCCESS;

}

// libtpms added begin

#if SMAC_IMPLEMENTED && ALG_CMAC

static TPM_RC

         ALGORITHM_VECTOR    *toTest LIBTPMS_ATTR_UNUSED

         )

{

    // initializing this statically seems impossible with gcc...

        {

                                      TPM_ALG_CMAC, CMACTests[i].key);

            }

        }

}

#endif

// libtpms added end

//** Symmetric Test Functions

//*** MakeIv()

// Internal function to make the appropriate IV depending on the mode.

                     UINT32     size,  // IN: block size of the algorithm

                     BYTE*      iv     // OUT: IV to fill in

)

{

        return 0;

    {

        // The test uses an IV that has 0xff in the last byte

    }

    else

    {

    }

    return size;

}

//*** TestSymmetricAlgorithm()

// Function to test a specific algorithm, key size, and mode.

                                   TPM_ALG_ID                   mode   //

)

{

    // libtpms added begin

        return;

    /* Skip test cases whose algorithms or keysizes are runtime-disabled */

                                             TPM_ECC_NONE,

                                             g_RuntimeProfile.stateFormatLevel))

        return;

    // libtpms added end

    //

    // Get the appropriate IV

    // Encrypt known data

                          &iv,

                          mode,

    // Check that it matches the expected value

    // Reinitialize the iv for decryption

                          &iv,

                          mode,

    // Make sure that it matches what we started with

}

//*** AllSymsAreDone()

// Checks if both symmetric algorithms have been tested. This is put here

// so that addition of a symmetric algorithm will be relatively easy to handle.

//

//  Return Type: BOOL

//      TRUE(1)         all symmetric algorithms tested

//      FALSE(0)        not all symmetric algorithms tested

{

}

//*** AllModesAreDone()

// Checks if all the modes have been tested.

//

//  Return Type: BOOL

//      TRUE(1)         all modes tested

//      FALSE(0)        all modes not tested

{

            return FALSE;

    return TRUE;

}

//*** TestSymmetric()

// If 'alg' is a symmetric block cipher, then all of the modes that are selected are

// tested. If 'alg' is a mode, then all algorithms of that mode are tested.

{

    //

        return TPM_RC_SUCCESS;

    {

        // Will test the algorithm for all modes and key sizes

        // A test this algorithm for all modes

        {

            {

                {

                }

            }

        }

        // if all the symmetric tests are done

        {

            // all symmetric algorithms tested so no modes should be set

        }

    }

    else if(SYM_MODE_FIRST <= alg && alg <= SYM_MODE_LAST)

    {

        // Test this mode for all key sizes and algorithms

        {

            // The mode testing only comes into play when doing self tests

            // by command. When doing self tests by command, the block ciphers are

            // tested first. That means that all of their modes would have been

            // tested for all key sizes. If there is no block cipher left to

            // test, then clear this mode bit.

            {

            }

            else

            {

                {

                }

                // have tested this mode for all algorithms

            }

        }

        {

        }

    }

    else

    return TPM_RC_SUCCESS;

}

//** RSA Tests

#  if ALG_RSA

//*** Introduction

// The tests are for public key only operations and for private key operations.

// Signature verification and encryption are public key operations. They are tested

// by using a KVT. For signature verification, this means that a known good

// signature is checked by CryptRsaValidateSignature(). If it fails, then the

// TPM enters failure mode. For encryption, the TPM encrypts known values using

// the selected scheme and checks that the returned value matches the expected

// value.

//

// For private key operations, a full scheme check is used. For a signing key, a

// known key is used to sign a known message. Then that signature is verified.

// since the signature may involve use of random values, the signature will be

// different each time and we can't always check that the signature matches a

// known value. The same technique is used for decryption (RSADP/RSAEP).

//

// When an operation uses the public key and the verification has not been

// tested, the TPM will do a KVT.

//

// The test for the signing algorithm is built into the call for the algorithm

//*** RsaKeyInitialize()

// The test key is defined by a public modulus and a private prime. The TPM's RSA

// code computes the second prime and the private exponent.

{

                 (P2B)&c_rsaPublicModulus,

                 sizeof(c_rsaPublicModulus));

                 (P2B)&c_rsaPrivatePrime,

                 sizeof(testObject->sensitive.sensitive.rsa.t.buffer));

    // Use the default exponent

//*** TestRsaEncryptDecrypt()

// These tests are for a public key encryption that uses a random value.

                                    ALGORITHM_VECTOR* toTest   //

)

{

    //

    // Don't need to initialize much of the test object

    {

                                                 RUNTIME_ATTRIBUTE_NO_UNPADDED_ENCRYPTION))

            return TPM_RC_SUCCESS;        // don't test NULL with RSA        // libtpms added end

        // This is an encryption scheme using the private key without any encoding.

               &testOutput, &testInput.b, &testObject, &rsaScheme, NULL, NULL))

               &testOutput.b, &testInput.b, &testObject, &rsaScheme, NULL))

    }

    else

    {

        // TPM_ALG_RSAES:

        // This is an decryption scheme using padding according to

        // PKCS#1v2.1, 7.2. This padding uses random bits. To test a public

        // key encryption that uses random data, encrypt a value and then

        // decrypt the value and see that we get the encrypted data back.

        // The hash is not used by this encryption so it can be TMP_ALG_NULL

        // TPM_ALG_OAEP:

        // This is also an decryption scheme and it also uses a

        // pseudo-random

        // value. However, this also uses a hash algorithm. So, we may need

        // to test that algorithm before use.

        {

        }

        {

            kvtValue  = &c_RsaesKvt;

            testLabel = NULL;

        }

        else

        // Only use a digest-size portion of the test value

        // See if the encryption works

               &testOutput, &testInput.b, &testObject, &rsaScheme, testLabel, NULL))

        // see if we can decrypt this value and get the original data back

               &testOutput.b, &testInput.b, &testObject, &rsaScheme, testLabel))

        // See if the results compare

               testOutput.t.buffer, c_RsaTestValue, DEFAULT_TEST_DIGEST_SIZE))

        // Now check that the decryption works on a known value

               &testOutput.b, &testInput.b, &testObject, &rsaScheme, testLabel))

               testOutput.t.buffer, c_RsaTestValue, DEFAULT_TEST_DIGEST_SIZE))

    }

    return result;

}

//*** TestRsaSignAndVerify()

// This function does the testing of the RSA sign and verification functions. This

// test does a KVT.

{

    // Do a sign and signature verification.

    // RSASSA:

    // This is a signing scheme according to PKCS#1-v2.1 8.2. It does not

    // use random data so there is a KVT for the signing operation. On

    // first use of the scheme for signing, use the TPM's RSA key to

    // sign a portion of c_RsaTestData and compare the results to c_RsassaKvt. Then

    // decrypt the data to see that it matches the starting value. This verifies

    // the signature with a KVT

    // Clear the bits indicating that the function has not been checked. This is to

    // prevent looping

    // RSAPSS:

    // This is a signing scheme a according to PKCS#1-v2.2 8.1 it uses

    // random data in the signature so there is no KVT for the signing

    // operation. To test signing, the TPM will use the TPM's RSA key

    // to sign a portion of c_RsaTestValue and then it will verify the

    // signature. For verification, c_RsapssKvt is verified before the

    // user signature blob is verified. The worst case for testing of this

    // algorithm is two private and one public key operation.

    // The process is to sign known data. If RSASSA is being done, verify that the

    // signature matches the precomputed value. For both, use the signed value and

    // see that the verification says that it is a good signature. Then

    // if testing RSAPSS, do a verify of a known good signature. This ensures that

    // the validation function works.

    // For RSASSA, make sure the results is what we are looking for

    {

                           testSig.signature.rsassa.sig.t.buffer,

                           RSA_TEST_KEY_SIZE))

    }

    // See if the TPM will validate its own signatures

    // If this is RSAPSS, check the verification with known signature

    // Have to copy because  CrytpRsaValidateSignature() eats the signature

    {

                     (P2B)&c_RsapssKvt,

                     sizeof(testSig.signature.rsapss.sig.t.buffer));

    }

}

//*** TestRSA()

// Function uses the provided vector to indicate which tests to run. It will clear

// the vector after each test is run and also clear g_toTest

{

    //

    {

            // This is the RSAEP/RSADP function. If we are processing a list, don't

            // need to test these now because any other test will validate

            // RSAEP/RSADP. Can tell this is list of test by checking to see if

            // 'toTest' is pointing at g_toTest. If so, this is an isolated test

            // an need to go ahead and do the test;

                // Not running a list of tests or no other tests on the list

                // so run the test now

            // if not running the test now, leave the bit on, just in case things

            // get interrupted

            break;

        case TPM_ALG_RSAES:

        case TPM_ALG_RSASSA:

    }

}

#  endif  // ALG_RSA

//** ECC Tests

#  if ALG_ECC

//*** LoadEccParameter()

// This function is mostly for readability and type checking

                             const TPM2B_EC_TEST* from  // source

)

{

//*** LoadEccPoint()

                         const TPM2B_EC_TEST* x,      // source

                         const TPM2B_EC_TEST* y)

{

//*** TestECDH()

// This test does a KVT on a point multiply.

                       ALGORITHM_VECTOR* toTest  // IN/OUT: modified after test is run

)

{

    //

}

//*** TestEccSignAndVerify()

{

    // ECC signature verification testing uses a KVT.

    {

        case TPM_ALG_ECDSA:

            break;

        case TPM_ALG_ECSCHNORR:

                             &c_TestEcSchnorr_r);

                             &c_TestEcSchnorr_s);

            break;

        case TPM_ALG_SM2:

            // don't have a test for SM2

            return TPM_RC_SUCCESS;

    }

    // Have to copy the key. This is because the size used in the test vectors

    // is the size of the ECC parameter for the test key while the size of a point

    // is TPM dependent

                 &c_ecTestKey_ds.b,

                 sizeof(testObject.sensitive.sensitive.ecc.t.buffer));

        &testObject.publicArea.unique.ecc, &c_ecTestKey_QsX, &c_ecTestKey_QsY);

           &testSig, &testObject, (TPM2B_DIGEST*)&c_ecTestValue.b))

    {

    }

    // Now sign and verify some data

           &testSig, &testObject, (TPM2B_DIGEST*)&c_ecTestValue, &eccScheme, NULL))

           &testSig, &testObject, (TPM2B_DIGEST*)&c_ecTestValue))

    return TPM_RC_SUCCESS;

}

//*** TestKDFa()

{

    //

                              &c_kdfTestKeyIn.b,

                              &c_kdfTestLabel.b,

                              &c_kdfTestContextU.b,

                              &c_kdfTestContextV.b,

                              TEST_KDF_KEY_SIZE * 8,

                              keyOut.t.buffer,

                              &counter,

                              FALSE);

}

//*** TestEcc()

{

    {

        case TPM_ALG_ECDH:

            // If this is in a loop then see if another test is going to deal with

            // this.

            // If toTest is not a self-test list

               // or this is the only ECC test in the list

            {

            }

            break;

        case TPM_ALG_ECSCHNORR:

        case TPM_ALG_SM2:

    }

}

#  endif  // ALG_ECC

//*** TestAlgorithm()

// Dispatches to the correct test function for the algorithm or gets a list of

// testable algorithms.

//

// If 'toTest' is not NULL, then the test decisions are based on the algorithm

// selections in 'toTest'. Otherwise, 'g_toTest' is used. When bits are clear in

// 'g_toTest' they will also be cleared 'toTest'.

//

// If there doesn't happen to be a test for the algorithm, its associated bit is

// quietly cleared.

//

// If 'alg' is zero (TPM_ALG_ERROR), then the toTest vector is cleared of any bits

// for which there is no test (i.e. no tests are actually run but the vector is

// cleared).

//

// Note: 'toTest' will only ever have bits set for implemented algorithms but 'alg'

// can be anything.

//

//  Return Type: TPM_RC

//      TPM_RC_CANCELED     test was canceled

LIB_EXPORT

TPM_RC

{

    // This is kind of strange. This function will either run a test of the selected

    // algorithm or just clear a bit if there is no test for the algorithm. So,

    // either this loop will be executed once for the selected algorithm or once for

    // each of the possible algorithms. If it is executed more than once ('alg' ==

    // ALG_ERROR), then no test will be run but bits will be cleared for

    // unimplemented algorithms. This was done this way so that there is only one

    // case statement with all of the algorithms. It was easier to have one case

    // statement than to have multiple ones to manage whenever an algorithm ID is

    // added.

    {

        // if 'alg' was TPM_ALG_ERROR, then we will be cycling through

        // values, some of which may not be implemented. If the bit in toTest

        // happens to be set, then we could either generated an assert, or just

        // silently CLEAR it. Decided to just clear.

        {

        }

        // Process whatever is left.

        // NOTE: since this switch will only be called if the algorithm is

        // implemented, it is not necessary to modify this list except to comment

        // out the algorithms for which there is no test

        {

            // Symmetric block ciphers

#  if ALG_AES

// libtpms added begin

#  if SMAC_IMPLEMENTED && ALG_CMAC

                {

                        break;

                }

#  endif

// libtpms added end

#  endif

#  if ALG_SM4

                // if SM4 is implemented, its test is like other block ciphers but there

                // aren't any test vectors for it yet

                //            case TPM_ALG_SM4:

#  endif  // ALG_SM4

#  if ALG_CAMELLIA

            /* fallthrough */

            case TPM_ALG_CAMELLIA:  // libtpms activated

#  endif

#  if ALG_TDES

            case TPM_ALG_TDES:      // libtpms added

#  endif

            // Symmetric modes

#  if !ALG_CFB

#    error CFB is required in all TPM implementations

#  endif  // !ALG_CFB

            case TPM_ALG_CFB:

                break;

#  if ALG_CTR

#  endif  // ALG_CRT

#  if ALG_OFB

            case TPM_ALG_OFB:

#  endif  // ALG_OFB

#  if ALG_CBC

            case TPM_ALG_CBC:

#  endif  // ALG_CBC

#  if ALG_ECB

            case TPM_ALG_ECB:

#  endif

                else

                    // If doing the initialization of g_toTest vector, only need

                    // to test one of the modes for the symmetric algorithms. If

                    // initializing for a SelfTest(FULL_TEST), allow all the modes.

                break;

#  if !ALG_HMAC

#    error HMAC is required in all TPM implementations

#  endif

                // Clear the bit that indicates that HMAC is required because

                // HMAC is used as the basic test for all hash algorithms.

                // Testing HMAC means test the default hash

                else

                    // If not testing, then indicate that the hash needs to be

                    // tested because this uses HMAC

                break;

// Have to use two arguments for the macro even though only the first is used in the

// expansion.

#  define HASH_CASE_TEST(HASH, hash) case ALG_##HASH##_VALUE:

#  undef HASH_CASE_TEST

                break;

                // RSA-dependent

#  if ALG_RSA

                else

                break;

            case TPM_ALG_RSAES:

            case TPM_ALG_RSAPSS:

            case TPM_ALG_OAEP:

            case TPM_ALG_NULL:  // used or RSADP

                break;

#  endif  // ALG_RSA

#  if ALG_KDF1_SP800_108

                break;

#  endif  // ALG_KDF1_SP800_108

#  if ALG_ECC

                // ECC dependent but no tests

                //        case TPM_ALG_ECDAA:

                //        case TPM_ALG_ECMQV:

                //        case TPM_ALG_KDF1_SP800_56a:

                //        case TPM_ALG_KDF2:

                //        case TPM_ALG_MGF1:

                else

                break;

            case TPM_ALG_ECDH:

            case TPM_ALG_ECSCHNORR:

                //            case TPM_ALG_SM2:

                break;

#  endif  // ALG_ECC

                break;

        }

            break;

    }

}

#endif  // SELF_TESTS