|
| 1 | +/* da_check.c |
| 2 | + * |
| 3 | + * Copyright (C) 2006-2026 wolfSSL Inc. |
| 4 | + * |
| 5 | + * This file is part of wolfTPM. |
| 6 | + * |
| 7 | + * wolfTPM is free software; you can redistribute it and/or modify |
| 8 | + * it under the terms of the GNU General Public License as published by |
| 9 | + * the Free Software Foundation; either version 3 of the License, or |
| 10 | + * (at your option) any later version. |
| 11 | + * |
| 12 | + * wolfTPM is distributed in the hope that it will be useful, |
| 13 | + * but WITHOUT ANY WARRANTY; without even the implied warranty of |
| 14 | + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
| 15 | + * GNU General Public License for more details. |
| 16 | + * |
| 17 | + * You should have received a copy of the GNU General Public License |
| 18 | + * along with this program; if not, write to the Free Software |
| 19 | + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA |
| 20 | + */ |
| 21 | + |
| 22 | +/* Exercises Dictionary Attack (DA) vs noDA behavior end to end: signing with a |
| 23 | + * DA-protected (non-noDA) key rides through the TPM_RC_RETRY the TPM returns |
| 24 | + * while it persists the daUsed flag on first auth use, and a noDA key never |
| 25 | + * trips lockout. With -lockout it also drives the lockout/recovery path. */ |
| 26 | + |
| 27 | +#ifdef HAVE_CONFIG_H |
| 28 | + #include <config.h> |
| 29 | +#endif |
| 30 | + |
| 31 | +#include <wolftpm/tpm2_wrap.h> |
| 32 | +#include <examples/management/management.h> |
| 33 | +#include <hal/tpm_io.h> |
| 34 | +#include <examples/tpm_test.h> |
| 35 | + |
| 36 | +#include <stdio.h> |
| 37 | + |
| 38 | +#if !defined(WOLFTPM2_NO_WRAPPER) && defined(HAVE_ECC) |
| 39 | + |
| 40 | +/* Sign a digest, resubmitting on TPM_RC_RETRY. A real TPM (and fwTPM built |
| 41 | + * with FWTPM_DA_USED_RETRY) returns RETRY once while it persists daUsed on the |
| 42 | + * first DA-protected auth use. The wolfTPM client does not auto-resubmit, so |
| 43 | + * callers must resend the identical command, as this loop does. */ |
| 44 | +static int DaSignWithRetry(WOLFTPM2_DEV* dev, WOLFTPM2_KEY* key, |
| 45 | + const byte* digest, int digestSz, byte* sig, int sigCap) |
| 46 | +{ |
| 47 | + int rc; |
| 48 | + int sigSz; |
| 49 | + int retries = 0; |
| 50 | + |
| 51 | + do { |
| 52 | + sigSz = sigCap; |
| 53 | + rc = wolfTPM2_SignHash(dev, key, digest, digestSz, sig, &sigSz); |
| 54 | + if (rc == TPM_RC_RETRY) { |
| 55 | + printf(" TPM_RC_RETRY (daUsed persist) - resubmitting\n"); |
| 56 | + } |
| 57 | + } while (rc == TPM_RC_RETRY && ++retries < 10); |
| 58 | + |
| 59 | + return rc; |
| 60 | +} |
| 61 | + |
| 62 | + |
| 63 | +int TPM2_DA_Check_Example(void* userCtx, int argc, char *argv[]) |
| 64 | +{ |
| 65 | + int rc; |
| 66 | + int i; |
| 67 | + int sigSz; |
| 68 | + int locked = 0; |
| 69 | + int doLockout = 0; |
| 70 | + WOLFTPM2_DEV dev; |
| 71 | + WOLFTPM2_KEY srk; |
| 72 | + WOLFTPM2_KEY daKey; /* DA-protected: noDA clear */ |
| 73 | + WOLFTPM2_KEY noDaKey; /* noDA set */ |
| 74 | + TPMT_PUBLIC publicTemplate; |
| 75 | + byte digest[TPM_SHA256_DIGEST_SIZE]; |
| 76 | + byte sig[256]; |
| 77 | + const byte keyAuth[] = { 'd', 'a', '-', 'a', 'u', 't', 'h' }; |
| 78 | + |
| 79 | + for (i = 1; i < argc; i++) { |
| 80 | + if (XSTRCMP(argv[i], "-lockout") == 0) { |
| 81 | + doLockout = 1; |
| 82 | + } |
| 83 | + } |
| 84 | + |
| 85 | + XMEMSET(&dev, 0, sizeof(dev)); |
| 86 | + XMEMSET(&srk, 0, sizeof(srk)); |
| 87 | + XMEMSET(&daKey, 0, sizeof(daKey)); |
| 88 | + XMEMSET(&noDaKey, 0, sizeof(noDaKey)); |
| 89 | + XMEMSET(digest, 0x11, sizeof(digest)); |
| 90 | + |
| 91 | + printf("TPM2 Dictionary Attack (DA / noDA) check\n"); |
| 92 | + |
| 93 | + rc = wolfTPM2_Init(&dev, TPM2_IoCb, userCtx); |
| 94 | + if (rc != TPM_RC_SUCCESS) { |
| 95 | + printf("wolfTPM2_Init failed 0x%x: %s\n", rc, wolfTPM2_GetRCString(rc)); |
| 96 | + return rc; |
| 97 | + } |
| 98 | + |
| 99 | + rc = wolfTPM2_CreateSRK(&dev, &srk, TPM_ALG_ECC, NULL, 0); |
| 100 | + if (rc != 0) goto exit; |
| 101 | + |
| 102 | + /* DA-protected ECC signing key (noDA deliberately omitted). */ |
| 103 | + rc = wolfTPM2_GetKeyTemplate_ECC(&publicTemplate, |
| 104 | + TPMA_OBJECT_fixedTPM | TPMA_OBJECT_fixedParent | |
| 105 | + TPMA_OBJECT_sensitiveDataOrigin | TPMA_OBJECT_userWithAuth | |
| 106 | + TPMA_OBJECT_sign, |
| 107 | + TPM_ECC_NIST_P256, TPM_ALG_ECDSA); |
| 108 | + if (rc != 0) goto exit; |
| 109 | + publicTemplate.nameAlg = TPM_ALG_SHA256; |
| 110 | + rc = wolfTPM2_CreateAndLoadKey(&dev, &daKey, &srk.handle, &publicTemplate, |
| 111 | + keyAuth, (int)sizeof(keyAuth)); |
| 112 | + if (rc != 0) goto exit; |
| 113 | + printf("Created DA-protected ECC signing key (noDA clear)\n"); |
| 114 | + |
| 115 | + /* First auth use of a DA-protected key may return TPM_RC_RETRY. */ |
| 116 | + rc = DaSignWithRetry(&dev, &daKey, digest, (int)sizeof(digest), |
| 117 | + sig, (int)sizeof(sig)); |
| 118 | + if (rc != 0) goto exit; |
| 119 | + printf("Signed with DA-protected key (rode through any RC_RETRY)\n"); |
| 120 | + |
| 121 | + if (doLockout) { |
| 122 | + wolfTPM2_SetAuthPassword(&dev, 0, NULL); |
| 123 | + rc = wolfTPM2_DictionaryAttackParameters(&dev, 3, 0, 0); |
| 124 | + if (rc != 0) goto exit; |
| 125 | + |
| 126 | + /* Bad auth until lockout. */ |
| 127 | + daKey.handle.auth.buffer[0] ^= 0xFF; |
| 128 | + for (i = 0; i < 8 && !locked; i++) { |
| 129 | + sigSz = (int)sizeof(sig); |
| 130 | + rc = wolfTPM2_SignHash(&dev, &daKey, digest, (int)sizeof(digest), |
| 131 | + sig, &sigSz); |
| 132 | + if (rc == TPM_RC_LOCKOUT) { |
| 133 | + locked = 1; |
| 134 | + } |
| 135 | + } |
| 136 | + daKey.handle.auth.buffer[0] ^= 0xFF; |
| 137 | + if (!locked) { |
| 138 | + printf("Expected lockout was not reached\n"); |
| 139 | + rc = TPM_RC_FAILURE; |
| 140 | + goto exit; |
| 141 | + } |
| 142 | + printf("Entered lockout after repeated bad auth\n"); |
| 143 | + |
| 144 | + wolfTPM2_SetAuthPassword(&dev, 0, NULL); |
| 145 | + rc = wolfTPM2_DictionaryAttackLockReset(&dev); |
| 146 | + if (rc != 0) goto exit; |
| 147 | + rc = DaSignWithRetry(&dev, &daKey, digest, (int)sizeof(digest), |
| 148 | + sig, (int)sizeof(sig)); |
| 149 | + if (rc != 0) goto exit; |
| 150 | + printf("Recovered via DictionaryAttackLockReset; signing works\n"); |
| 151 | + } |
| 152 | + |
| 153 | + /* noDA contrast key. */ |
| 154 | + rc = wolfTPM2_GetKeyTemplate_ECC(&publicTemplate, |
| 155 | + TPMA_OBJECT_fixedTPM | TPMA_OBJECT_fixedParent | |
| 156 | + TPMA_OBJECT_sensitiveDataOrigin | TPMA_OBJECT_userWithAuth | |
| 157 | + TPMA_OBJECT_sign | TPMA_OBJECT_noDA, |
| 158 | + TPM_ECC_NIST_P256, TPM_ALG_ECDSA); |
| 159 | + if (rc != 0) goto exit; |
| 160 | + publicTemplate.nameAlg = TPM_ALG_SHA256; |
| 161 | + rc = wolfTPM2_CreateAndLoadKey(&dev, &noDaKey, &srk.handle, &publicTemplate, |
| 162 | + keyAuth, (int)sizeof(keyAuth)); |
| 163 | + if (rc != 0) goto exit; |
| 164 | + |
| 165 | + /* Repeated bad auth on a noDA key must never reach lockout. */ |
| 166 | + noDaKey.handle.auth.buffer[0] ^= 0xFF; |
| 167 | + for (i = 0; i < 8; i++) { |
| 168 | + sigSz = (int)sizeof(sig); |
| 169 | + rc = wolfTPM2_SignHash(&dev, &noDaKey, digest, (int)sizeof(digest), |
| 170 | + sig, &sigSz); |
| 171 | + if (rc == TPM_RC_LOCKOUT) { |
| 172 | + printf("noDA key unexpectedly hit lockout\n"); |
| 173 | + noDaKey.handle.auth.buffer[0] ^= 0xFF; |
| 174 | + rc = TPM_RC_FAILURE; |
| 175 | + goto exit; |
| 176 | + } |
| 177 | + } |
| 178 | + noDaKey.handle.auth.buffer[0] ^= 0xFF; |
| 179 | + |
| 180 | + /* A correct-auth noDA sign never returns RC_RETRY. */ |
| 181 | + sigSz = (int)sizeof(sig); |
| 182 | + rc = wolfTPM2_SignHash(&dev, &noDaKey, digest, (int)sizeof(digest), |
| 183 | + sig, &sigSz); |
| 184 | + if (rc == TPM_RC_RETRY) { |
| 185 | + printf("noDA key unexpectedly returned RC_RETRY\n"); |
| 186 | + rc = TPM_RC_FAILURE; |
| 187 | + goto exit; |
| 188 | + } |
| 189 | + if (rc != 0) goto exit; |
| 190 | + printf("noDA key: no lockout, no RC_RETRY (DA bypassed as expected)\n"); |
| 191 | + |
| 192 | + printf("DA check example complete\n"); |
| 193 | + |
| 194 | +exit: |
| 195 | + if (rc != 0) { |
| 196 | + printf("Failure 0x%x: %s\n", rc, wolfTPM2_GetRCString(rc)); |
| 197 | + } |
| 198 | + |
| 199 | + /* Best-effort: do not leave the TPM locked for subsequent examples. */ |
| 200 | + wolfTPM2_SetAuthPassword(&dev, 0, NULL); |
| 201 | + (void)wolfTPM2_DictionaryAttackLockReset(&dev); |
| 202 | + |
| 203 | + wolfTPM2_UnloadHandle(&dev, &noDaKey.handle); |
| 204 | + wolfTPM2_UnloadHandle(&dev, &daKey.handle); |
| 205 | + wolfTPM2_UnloadHandle(&dev, &srk.handle); |
| 206 | + wolfTPM2_Cleanup(&dev); |
| 207 | + return rc; |
| 208 | +} |
| 209 | +#endif /* !WOLFTPM2_NO_WRAPPER && HAVE_ECC */ |
| 210 | + |
| 211 | +#ifndef NO_MAIN_DRIVER |
| 212 | +int main(int argc, char *argv[]) |
| 213 | +{ |
| 214 | + int rc = NOT_COMPILED_IN; |
| 215 | + |
| 216 | +#if !defined(WOLFTPM2_NO_WRAPPER) && defined(HAVE_ECC) |
| 217 | + rc = TPM2_DA_Check_Example(NULL, argc, argv); |
| 218 | +#else |
| 219 | + printf("DA check tool requires the wrapper and ECC\n"); |
| 220 | + (void)argc; |
| 221 | + (void)argv; |
| 222 | +#endif |
| 223 | + |
| 224 | + return rc; |
| 225 | +} |
| 226 | +#endif |
0 commit comments