From patchwork Mon Apr 29 20:28:07 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: James Bottomley X-Patchwork-Id: 13647689 Received: from bedivere.hansenpartnership.com (bedivere.hansenpartnership.com [96.44.175.130]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E0FD815E5D5; Mon, 29 Apr 2024 20:31:05 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=96.44.175.130 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1714422667; cv=none; b=SkBAMd/RYAT58MKAakP1aN+i0rrMLzb/aD/YNR8SGJWs+dA6U0xOE3exWxME4TETCnrH9g7rOcELXoZjInsH8bMr80GdprhUnXcTI9+CTuOGRia+jX7kqtdvHZqDm5AFSabQbjJlTsl3I6nQD1T7Mi9sj5Rk0B1fRG5xzfqxSoY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1714422667; c=relaxed/simple; bh=Cko+6A+nnZkw5y/pYgGYflP0aP9gR/kov7SixeNqKaI=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=sT7+vE6717nH+L8upHrXGyMP2/svEuj3WKSLDzHq/piV6yduvNHPARnK4gsrcCM+43XONWiH5C9FmutggNbqxzm0V7obY4cW3Y4W0wCpfDMXZ2GSqIXm3M89PQ7qZqZt5ePieIzyZpdhk7SkyLvRL7Ri9K7dPn1YHS5Yw4lEum4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=HansenPartnership.com; spf=pass smtp.mailfrom=HansenPartnership.com; dkim=pass (1024-bit key) header.d=hansenpartnership.com header.i=@hansenpartnership.com header.b=o7sLPYx6; arc=none smtp.client-ip=96.44.175.130 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=HansenPartnership.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=HansenPartnership.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=hansenpartnership.com header.i=@hansenpartnership.com header.b="o7sLPYx6" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=hansenpartnership.com; s=20151216; t=1714422665; bh=Cko+6A+nnZkw5y/pYgGYflP0aP9gR/kov7SixeNqKaI=; h=From:To:Subject:Date:Message-Id:In-Reply-To:References:From; b=o7sLPYx6/yxOOlHm1izNCnGOuRa2DwlgWgkU4vxW9FZSQRigg3L7t6a3Op9Mz4M0a AvTDDeBghxm7WRZQUjIhbG0Vfw0Q4Ewsq/R+ygWyk26bOQ002KwQD79hhmpuV9Tkjx GKzt2K7iirj3nOXP3FCI9opPb0ZQ4lHBMfXlvNdI= Received: from localhost (localhost [127.0.0.1]) by bedivere.hansenpartnership.com (Postfix) with ESMTP id 8F2961281D87; Mon, 29 Apr 2024 16:31:05 -0400 (EDT) Received: from bedivere.hansenpartnership.com ([127.0.0.1]) by localhost (bedivere.hansenpartnership.com [127.0.0.1]) (amavis, port 10024) with ESMTP id CJvZj_ef_84z; Mon, 29 Apr 2024 16:31:05 -0400 (EDT) Received: from lingrow.int.hansenpartnership.com (unknown [153.66.160.227]) by bedivere.hansenpartnership.com (Postfix) with ESMTP id 051B912819F3; Mon, 29 Apr 2024 16:31:04 -0400 (EDT) From: James Bottomley To: linux-integrity@vger.kernel.org Cc: Jarkko Sakkinen , keyrings@vger.kernel.org, Ard Biesheuvel Subject: [PATCH v8 18/22] tpm: add session encryption protection to tpm2_get_random() Date: Mon, 29 Apr 2024 16:28:07 -0400 Message-Id: <20240429202811.13643-19-James.Bottomley@HansenPartnership.com> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20240429202811.13643-1-James.Bottomley@HansenPartnership.com> References: <20240429202811.13643-1-James.Bottomley@HansenPartnership.com> Precedence: bulk X-Mailing-List: keyrings@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 If some entity is snooping the TPM bus, they can see the random numbers we're extracting from the TPM and do prediction attacks against their consumers. Foil this attack by using response encryption to prevent the attacker from seeing the random sequence. Signed-off-by: James Bottomley Reviewed-by: Jarkko Sakkinen Reported-by: Nícolas F. R. A. Prado Signed-off-by: James Bottomley Acked-by: Ard Biesheuvel Reported-by: Nícolas F. R. A. Prado Acked-by: Ard Biesheuvel Signed-off-by: James Bottomley --- v7: add review --- drivers/char/tpm/tpm2-cmd.c | 21 +++++++++++++++++---- 1 file changed, 17 insertions(+), 4 deletions(-) diff --git a/drivers/char/tpm/tpm2-cmd.c b/drivers/char/tpm/tpm2-cmd.c index a53a843294ed..0cdf892ec2a7 100644 --- a/drivers/char/tpm/tpm2-cmd.c +++ b/drivers/char/tpm/tpm2-cmd.c @@ -292,25 +292,35 @@ int tpm2_get_random(struct tpm_chip *chip, u8 *dest, size_t max) if (!num_bytes || max > TPM_MAX_RNG_DATA) return -EINVAL; - err = tpm_buf_init(&buf, 0, 0); + err = tpm2_start_auth_session(chip); if (err) return err; + err = tpm_buf_init(&buf, 0, 0); + if (err) { + tpm2_end_auth_session(chip); + return err; + } + do { - tpm_buf_reset(&buf, TPM2_ST_NO_SESSIONS, TPM2_CC_GET_RANDOM); + tpm_buf_reset(&buf, TPM2_ST_SESSIONS, TPM2_CC_GET_RANDOM); + tpm_buf_append_hmac_session_opt(chip, &buf, TPM2_SA_ENCRYPT + | TPM2_SA_CONTINUE_SESSION, + NULL, 0); tpm_buf_append_u16(&buf, num_bytes); + tpm_buf_fill_hmac_session(chip, &buf); err = tpm_transmit_cmd(chip, &buf, offsetof(struct tpm2_get_random_out, buffer), "attempting get random"); + err = tpm_buf_check_hmac_response(chip, &buf, err); if (err) { if (err > 0) err = -EIO; goto out; } - out = (struct tpm2_get_random_out *) - &buf.data[TPM_HEADER_SIZE]; + out = (struct tpm2_get_random_out *)tpm_buf_parameters(&buf); recd = min_t(u32, be16_to_cpu(out->size), num_bytes); if (tpm_buf_length(&buf) < TPM_HEADER_SIZE + @@ -327,9 +337,12 @@ int tpm2_get_random(struct tpm_chip *chip, u8 *dest, size_t max) } while (retries-- && total < max); tpm_buf_destroy(&buf); + tpm2_end_auth_session(chip); + return total ? total : -EIO; out: tpm_buf_destroy(&buf); + tpm2_end_auth_session(chip); return err; }