4 files changed, 475 insertions, 0 deletions
diff --git a/src/tpm/tpm.h b/src/tpm/tpm.h
new file mode 100644
index 0000000..7531ae2
--- /dev/null
+++ b/src/tpm/tpm.h
@@ -0,0 +1,33 @@
+// Copyright 2026 Osmium Sorcerer
+// SPDX-License-Identifier: MIT
+
+#ifndef SOF_AO2CLIENT_TPM_TPM_H
+#define SOF_AO2CLIENT_TPM_TPM_H
+
+#include <stdint.h>
+#include <stddef.h>
+
+typedef enum {
+    STKB_SUCCESS,
+    STKB_ERROR,
+    STKB_TPM_UNAVAILABLE,
+    STKB_BAD_PIN,
+    STKB_AUTH_FAILURE,
+    STKB_LOCKOUT,
+} stkb_rc;
+
+typedef struct {
+    const uint8_t *pin;
+    size_t pin_len;
+    const wchar_t *key_name;
+} stkb_user_input;
+
+stkb_rc tpm2_init(void);
+
+stkb_rc tpm2_keygen(uint8_t *out_pub, uint8_t *out_buffer, size_t buffer_size,
+                    size_t *written, stkb_user_input input);
+
+stkb_rc tpm2_compute_ss(uint8_t *ss, const uint8_t *blob, size_t blob_len,
+                        const uint8_t *pk, stkb_user_input input);
+
+#endif /* SOF_AO2CLIENT_TPM_TPM_H */
diff --git a/src/tpm/tpm_cng.c b/src/tpm/tpm_cng.c
new file mode 100644
index 0000000..1f764c7
--- /dev/null
+++ b/src/tpm/tpm_cng.c
@@ -0,0 +1,170 @@
+// Copyright 2026 Osmium Sorcerer
+// SPDX-License-Identifier: MIT
+
+#define WIN32_LEAN_AND_MEAN
+#include <windows.h>
+#include <ncrypt.h>
+#include <rpc.h>
+
+#include "tpm.h"
+
+// Global handle for the Windows API.
+static NCRYPT_PROV_HANDLE provider;
+
+// 9 characters for prefix, 36 for random UUID, and don't forget that null terminator.
+// Note: this is count of wchar_t, not size.
+static const size_t keyname_len = 46;
+
+stkb_rc tpm2_init(void)
+{
+    // "Microsoft Platform Crypto Provider" is the TPM.
+    if (NCryptOpenStorageProvider(&provider, MS_PLATFORM_CRYPTO_PROVIDER, 0) != ERROR_SUCCESS)
+        return STKB_TPM_UNAVAILABLE;
+    if (NCryptIsAlgSupported(provider, BCRYPT_ECDH_P256_ALGORITHM, 0) != ERROR_SUCCESS)
+        return STKB_TPM_UNAVAILABLE;
+    return STKB_SUCCESS;
+}
+
+
+static int generate_keyname(wchar_t *out)
+{
+    // UUID seems like the way on Windows.
+    UUID id;
+    RPC_WSTR wstr = NULL;
+
+    if (UuidCreate(&id) != RPC_S_OK)
+        return 0;
+
+    if (UuidToStringW(&id, &wstr) != RPC_S_OK)
+        return 0;
+
+    wcscpy(out, L"SoF_Auth_");
+    wcscpy(out + 9, wstr);
+
+    RpcStringFreeW(&wstr);
+
+    return 1;
+}
+
+stkb_rc tpm2_keygen(uint8_t *out_pub, uint8_t *out_blob, size_t buffer_size, size_t *offset,
+                stkb_user_input input)
+{
+    NCRYPT_KEY_HANDLE key_handle = 0;
+    // Windows heavily abstracts the TPM and prevents you from acquiring the encrypted private structure. Instead, you
+    // have to use wide null-terminated strings as canonical key identifiers and refer to them by these names later.
+    // Yes, not even opaque byte arrays despite it handling "BLOBs."
+    wchar_t keyname[keyname_len];
+    if (sizeof(keyname) > buffer_size)
+        return STKB_ERROR;
+    if (!generate_keyname(keyname))
+        return STKB_ERROR;
+
+    // One might think, when NULL is passed instead of a key name, the key will not actually be persistent. But it
+    // becomes impossible to export the key to be loaded later, even in an encrypted form (while NCryptExportKey
+    // documents NCRYPT_OPAQUETRANSPORT_BLOB, explicitly saying "Opaque BLOBs are not transferable and must be imported
+    // by using the same CSP," and NCRYPT_PROTECTED_KEY_BLOB, confusingly, also doesn't export an opaque fixed-TPM
+    // restricted key blob. So we are forced to use a unique (potentially user-facing) name as an internal specifier.
+    if (NCryptCreatePersistedKey(provider, &key_handle, BCRYPT_ECDH_P256_ALGORITHM, keyname, 0, 0) != ERROR_SUCCESS)
+        return STKB_ERROR;
+
+    // Leave PINs unused, let the platform handle the input dialog.
+    NCRYPT_UI_POLICY ui_policy = {
+        .dwVersion = 1,
+        .dwFlags = NCRYPT_UI_FORCE_HIGH_PROTECTION_FLAG,
+        .pszFriendlyName = input.key_name,
+        .pszDescription = L"SoF authentication key",
+    };
+    stkb_rc ret = STKB_ERROR;
+    if (NCryptSetProperty(key_handle, NCRYPT_UI_POLICY_PROPERTY, (PBYTE)&ui_policy, sizeof(ui_policy), 0) != ERROR_SUCCESS)
+        goto exit;
+
+    // If the TPM is locked out, of all functions, FinalizeKey fails by returning NTE_INVALID_HANDLE.
+    // The other way it can happen (memory corruption aside) is if the user cancels the key creation
+    // dialog. You can't differentiate the two.
+    if (NCryptFinalizeKey(key_handle, 0) != ERROR_SUCCESS) {
+        ret = STKB_LOCKOUT;
+        goto exit;
+    }
+
+    BCRYPT_ECCKEY_BLOB ecc_blob = { 0 };
+    BYTE pub_buffer[sizeof(ecc_blob) + 32 * 2];
+    DWORD pub_buffer_off = 0;
+    if (NCryptExportKey(key_handle, 0, BCRYPT_ECCPUBLIC_BLOB, NULL, pub_buffer, sizeof(pub_buffer), &pub_buffer_off,
+                        0) != ERROR_SUCCESS)
+        goto exit;
+    memcpy(&ecc_blob, pub_buffer, sizeof(ecc_blob));
+    // Check sanity of the exported public key.
+    if (ecc_blob.dwMagic != BCRYPT_ECDH_PUBLIC_P256_MAGIC || ecc_blob.cbKey != 32)
+        goto exit;
+    // The x and y _should_ follow the blob (which is the beginning of the buffer) contiguously, each of cbKey (32)
+    // bytes.
+    memcpy(out_pub + 1, pub_buffer + sizeof(ecc_blob), 32);
+    // Encode parity of the last byte of y (both coordinates are big-endian).
+    if (pub_buffer[sizeof(ecc_blob) + 32 + 31] & 1)
+        out_pub[0] = 0x03;
+    else
+        out_pub[0] = 0x02;
+
+    memcpy(out_blob, keyname, sizeof(keyname));
+    *offset = sizeof(keyname);
+
+    ret = STKB_SUCCESS;
+
+exit:
+    NCryptFreeObject(key_handle);
+    return ret;
+}
+
+stkb_rc tpm2_compute_ss(uint8_t *ss, const uint8_t *blob, size_t blob_len, const uint8_t *pk, stkb_user_input input)
+{
+    (void)input;
+    // Because wchar_t is 16-byte-aligned, we can't cast a byte array, we have to do this redundant copy.
+    wchar_t keyname[keyname_len];
+    if (blob_len != sizeof(keyname))
+        return STKB_ERROR;
+    memcpy(keyname, blob, sizeof(keyname));
+    stkb_rc ret = STKB_ERROR;
+    NCRYPT_KEY_HANDLE key_handle = 0;
+    NCRYPT_KEY_HANDLE pk_handle = 0;
+    NCRYPT_SECRET_HANDLE shared_point = 0;
+    if (NCryptOpenKey(provider, &key_handle, keyname, 0, 0) != ERROR_SUCCESS)
+        goto exit;
+    // The API expects us to do the same ceremony to import the key in its format instead of using it directly.
+    BCRYPT_ECCKEY_BLOB ecc_blob = {
+        .dwMagic = BCRYPT_ECDH_PUBLIC_P256_MAGIC,
+        .cbKey = 32,
+    };
+    BYTE pub_buffer[sizeof(ecc_blob) + 32 * 2];
+    memcpy(pub_buffer, &ecc_blob, sizeof(ecc_blob));
+    memcpy(pub_buffer + sizeof(ecc_blob), pk, 64);
+    if (NCryptImportKey(provider, 0, BCRYPT_ECCPUBLIC_BLOB, NULL, &pk_handle, pub_buffer, sizeof(pub_buffer), 0) != ERROR_SUCCESS)
+        goto exit;
+    // Here it can also fail due to cancelation of dialog, too many failed attempts, or a TPM lockout.
+    if (NCryptSecretAgreement(key_handle, pk_handle, &shared_point, 0) != ERROR_SUCCESS) {
+        ret = STKB_LOCKOUT;
+        goto exit;
+    }
+    // You cannot extract the x coordinate of the shared point either, you have to derive the key. Even if you want to
+    // directly use the secret. But fine, apparently RAW_SECRET is a cryptographic key derivation function, which is
+    // some unrecognized cryptographic genius. We'll use it to get our affine big-endian x coordinate, the canonical
+    // ECDH shared secret. If you specify the size to be 32, it will only output the x coordinate, after all, that's
+    // what a point is: 32 bytes of x, then 32 bytes of y, no padding, no leading bytes, no headers. Right?
+    BYTE secret[32];
+    DWORD written = 0;
+    if (NCryptDeriveKey(shared_point, BCRYPT_KDF_RAW_SECRET, NULL, secret, sizeof(secret), &written, 0) != ERROR_SUCCESS)
+        goto exit;
+    // Of course it wouldn't be that easy. Even if we guessed the behavior of this function with respect to the buffer
+    // size you pass to it, CNG API decides that it's a good idea to output point coordinates in little-endian order,
+    // opposite of how the standard defines it (and what every other implementation correctly does, including the
+    // Platform Crypto backend that CNG relies on, and CNG's own NCryptExportKey).
+    for (size_t i = 0; i < sizeof(secret); ++i)
+        ss[i] = secret[sizeof(secret) - 1 - i];
+
+    ret = STKB_SUCCESS;
+
+exit:
+    NCryptFreeObject(key_handle);
+    NCryptFreeObject(pk_handle);
+    NCryptFreeObject(shared_point);
+    return ret;
+}
diff --git a/src/tpm/tpm_stub.c b/src/tpm/tpm_stub.c
new file mode 100644
index 0000000..4e2d2c0
--- /dev/null
+++ b/src/tpm/tpm_stub.c
@@ -0,0 +1,28 @@
+#include "tpm.h"
+
+stkb_rc tpm2_init(void)
+{
+    return STKB_TPM_UNAVAILABLE;
+}
+
+stkb_rc tpm2_keygen(uint8_t *out_pub, uint8_t *out_buffer, size_t buffer_size,
+                    size_t *written, stkb_user_input input)
+{
+    (void)out_pub;
+    (void)out_buffer;
+    (void)buffer_size;
+    (void)written;
+    (void)input;
+    return STKB_TPM_UNAVAILABLE;
+}
+
+stkb_rc tpm2_compute_ss(uint8_t *ss, const uint8_t *blob, size_t blob_len,
+                        const uint8_t *pk, stkb_user_input input)
+{
+    (void)ss;
+    (void)blob;
+    (void)blob_len;
+    (void)pk;
+    (void)input;
+    return STKB_TPM_UNAVAILABLE;
+}
diff --git a/src/tpm/tpm_tss.c b/src/tpm/tpm_tss.c
new file mode 100644
index 0000000..880fa32
--- /dev/null
+++ b/src/tpm/tpm_tss.c
@@ -0,0 +1,244 @@
+// Copyright 2026 Osmium Sorcerer
+// SPDX-License-Identifier: MIT
+
+#include <string.h>
+
+#include <tss2/tss2_esys.h>
+#include <tss2/tss2_mu.h>
+
+#include "tpm.h"
+
+// Storage Key: asymmetric scheme is NULL, symmetric is defined and shall
+// use CFB mode. The key is restricted.
+static const TPM2B_PUBLIC primary_template = {
+    .publicArea = {
+        .type = TPM2_ALG_ECC,
+        .nameAlg = TPM2_ALG_SHA256,
+        .objectAttributes =
+            TPMA_OBJECT_FIXEDTPM |
+            TPMA_OBJECT_FIXEDPARENT |
+            TPMA_OBJECT_SENSITIVEDATAORIGIN |
+            TPMA_OBJECT_USERWITHAUTH |
+            TPMA_OBJECT_RESTRICTED |
+            TPMA_OBJECT_DECRYPT,
+        .parameters.eccDetail = {
+            .symmetric = {
+                .algorithm = TPM2_ALG_AES,
+                .keyBits.aes = 128,
+                .mode.aes = TPM2_ALG_CFB,
+            },
+            .scheme.scheme = TPM2_ALG_NULL,
+            .curveID = TPM2_ECC_NIST_P256,
+            .kdf.scheme = TPM2_ALG_NULL,
+        },
+    },
+};
+
+// Symmetric algorithm is NULL for a nonrestricted key. This is the template
+// for actual key exchange keys under the primary storage key, accessed with a
+// user authentication value.
+// There is TPM2_ALG_ECDH scheme, but it requires KDF.
+static const TPM2B_PUBLIC ecdh_key_template = {
+    .publicArea = {
+        .type = TPM2_ALG_ECC,
+        .nameAlg = TPM2_ALG_SHA256,
+        .objectAttributes =
+            TPMA_OBJECT_FIXEDTPM |
+            TPMA_OBJECT_FIXEDPARENT |
+            TPMA_OBJECT_SENSITIVEDATAORIGIN |
+            TPMA_OBJECT_USERWITHAUTH |
+            TPMA_OBJECT_DECRYPT,
+        .parameters.eccDetail = {
+            .symmetric.algorithm = TPM2_ALG_NULL,
+            .scheme.scheme = TPM2_ALG_NULL,
+            .curveID = TPM2_ECC_NIST_P256,
+            .kdf.scheme = TPM2_ALG_NULL,
+        },
+    },
+};
+
+static const TPM2B_SENSITIVE_CREATE empty_in_sensitive = { 0 };
+static const TPM2B_DATA             empty_outside_info = { 0 };
+static const TPML_PCR_SELECTION     empty_creation_pcr = { 0 };
+
+// Make sure TPM 2.0 is present and working correctly before using it.
+stkb_rc tpm2_init(void)
+{
+    int           ret = 0;
+    ESYS_CONTEXT *ctx;
+    if (Esys_Initialize(&ctx, NULL, NULL) != TSS2_RC_SUCCESS)
+        return STKB_TPM_UNAVAILABLE;
+    // Simple self-test. Tests only what's necessary instead of all internal
+    // functions and operations, doesn't disrupt the system.
+    ret = Esys_SelfTest(ctx, ESYS_TR_NONE, ESYS_TR_NONE, ESYS_TR_NONE, TPM2_NO);
+    Esys_Finalize(&ctx);
+    if (ret != TSS2_RC_SUCCESS)
+        return STKB_TPM_UNAVAILABLE;
+    return STKB_SUCCESS;
+}
+
+static TSS2_RC tpm2_setup_primary(ESYS_CONTEXT **ctx, ESYS_TR *primary_handle)
+{
+    TSS2_RC rc = Esys_Initialize(ctx, NULL, NULL);
+    if (rc != TSS2_RC_SUCCESS)
+        return rc;
+    rc = Esys_CreatePrimary(*ctx, ESYS_TR_RH_OWNER, ESYS_TR_PASSWORD,
+                            ESYS_TR_NONE, ESYS_TR_NONE, &empty_in_sensitive,
+                            &primary_template, &empty_outside_info,
+                            &empty_creation_pcr, primary_handle, NULL, NULL,
+                            NULL, NULL);
+    if (rc != TSS2_RC_SUCCESS)
+        Esys_Finalize(ctx);
+    return rc;
+}
+
+static stkb_rc decode_tpm_rc(TSS2_RC tpm_rc)
+{
+    // Check that the code is from the TPM itself rather than ESAPI, otherwise
+    // return a generic error as we're not interested in details.
+    if ((tpm_rc & TSS2_RC_LAYER_MASK) != TSS2_TPM_RC_LAYER)
+        return STKB_ERROR;
+
+    // Format-One return codes are composite and in particular have an added
+    // parameter value that is irrelevant to the nature of the error, clear it.
+    if (tpm_rc & TPM2_RC_FMT1)
+        tpm_rc &= ~TPM2_RC_N_MASK;
+
+    switch (tpm_rc) {
+    case TPM2_RC_BAD_AUTH:
+    case TPM2_RC_AUTH_FAIL:
+        return STKB_AUTH_FAILURE;
+    case TPM2_RC_LOCKOUT:
+        return STKB_LOCKOUT;
+    default:
+        return STKB_ERROR;
+    }
+}
+
+stkb_rc tpm2_keygen(uint8_t *out_pub, uint8_t *out_buffer, size_t buffer_size,
+                    size_t *written, stkb_user_input input)
+{
+    if (input.pin_len > TPM2_SHA256_DIGEST_SIZE)
+        return STKB_BAD_PIN;
+    TPM2B_SENSITIVE_CREATE in_sensitive = { 0 };
+    memcpy(in_sensitive.sensitive.userAuth.buffer, input.pin, input.pin_len);
+    in_sensitive.sensitive.userAuth.size = (UINT16)input.pin_len;
+    ESYS_CONTEXT *ctx;
+    ESYS_TR       primary_handle;
+    stkb_rc       ret = STKB_ERROR;
+    if (tpm2_setup_primary(&ctx, &primary_handle) != TSS2_RC_SUCCESS)
+        return ret;
+    TPM2B_PRIVATE *ecdh_priv = NULL;
+    TPM2B_PUBLIC  *ecdh_pub  = NULL;
+    TSS2_RC rc = Esys_Create(ctx, primary_handle, ESYS_TR_PASSWORD,
+                             ESYS_TR_NONE, ESYS_TR_NONE, &in_sensitive,
+                             &ecdh_key_template, &empty_outside_info,
+                             &empty_creation_pcr, &ecdh_priv, &ecdh_pub, NULL,
+                             NULL, NULL);
+    if (rc != TSS2_RC_SUCCESS) {
+        ret = decode_tpm_rc(rc);
+        goto exit;
+    }
+
+    // TPM 2.0 Library, Part 1, 44.5.3 Padding:
+    //
+    // > In ECC points returned by the TPM, the x and y values, if non-empty,
+    // > are required to be the size of their associated curve (e.g., 32 bytes
+    // > for NIST P-256).
+    if (ecdh_pub->publicArea.unique.ecc.x.size != 32 ||
+        ecdh_pub->publicArea.unique.ecc.y.size != 32)
+        goto exit;
+
+    // Compress the public key: knowing x, it's enough to only encode parity of
+    // y to fully reconstruct the point.
+    if (ecdh_pub->publicArea.unique.ecc.y.buffer[31] & 1)
+        out_pub[0] = 0x03;
+    else
+        out_pub[0] = 0x02;
+    memcpy(out_pub + 1, ecdh_pub->publicArea.unique.ecc.x.buffer, 32);
+
+    // Serialize both structures, we'll need them for Load.
+    size_t off = 0;
+    if (Tss2_MU_TPM2B_PRIVATE_Marshal(ecdh_priv, out_buffer, buffer_size, &off) !=
+        TSS2_RC_SUCCESS)
+        goto exit;
+    if (Tss2_MU_TPM2B_PUBLIC_Marshal(ecdh_pub, out_buffer, buffer_size - off,
+                                     &off) != TSS2_RC_SUCCESS)
+        goto exit;
+
+    *written = off;
+    ret     = STKB_SUCCESS;
+
+exit:
+    Esys_Free(ecdh_priv);
+    Esys_Free(ecdh_pub);
+    Esys_FlushContext(ctx, primary_handle);
+    Esys_Finalize(&ctx);
+    return ret;
+}
+
+// pk is an uncompressed 64-byte point (x || y) of the peer.
+stkb_rc tpm2_compute_ss(uint8_t *ss, const uint8_t *blob, size_t blob_len,
+                        const uint8_t *pk, stkb_user_input input)
+{
+    if (input.pin_len > TPM2_SHA256_DIGEST_SIZE)
+        return STKB_BAD_PIN;
+    TPM2B_AUTH auth_value = { 0 };
+    memcpy(auth_value.buffer, input.pin, input.pin_len);
+    auth_value.size = (UINT16)input.pin_len;
+
+    ESYS_CONTEXT *ctx;
+    ESYS_TR       primary_handle;
+    stkb_rc       ret = STKB_ERROR;
+    if (tpm2_setup_primary(&ctx, &primary_handle) != TSS2_RC_SUCCESS)
+        return ret;
+
+    ESYS_TR          ecdh_key_handle = ESYS_TR_NONE;
+    TPM2B_PRIVATE    ecdh_priv;
+    TPM2B_PUBLIC     ecdh_pub;
+    TPM2B_ECC_POINT *shared_point = NULL;
+    size_t           off          = 0;
+    if (Tss2_MU_TPM2B_PRIVATE_Unmarshal(blob, blob_len, &off, &ecdh_priv) !=
+        TSS2_RC_SUCCESS)
+        goto exit;
+    if (Tss2_MU_TPM2B_PUBLIC_Unmarshal(blob, blob_len, &off, &ecdh_pub) !=
+        TSS2_RC_SUCCESS)
+        goto exit;
+
+    TSS2_RC rc = Esys_Load(ctx, primary_handle, ESYS_TR_PASSWORD, ESYS_TR_NONE,
+                           ESYS_TR_NONE, &ecdh_priv, &ecdh_pub,
+                           &ecdh_key_handle);
+    if (rc != TSS2_RC_SUCCESS) {
+        ret = decode_tpm_rc(rc);
+        goto exit;
+    }
+
+    if (Esys_TR_SetAuth(ctx, ecdh_key_handle, &auth_value) != TSS2_RC_SUCCESS)
+        goto exit;
+
+    TPM2B_ECC_POINT in_point;
+    in_point.point.x.size = 32;
+    in_point.point.y.size = 32;
+    memcpy(in_point.point.x.buffer, pk, 32);
+    memcpy(in_point.point.y.buffer, pk + 32, 32);
+    rc = Esys_ECDH_ZGen(ctx, ecdh_key_handle, ESYS_TR_PASSWORD, ESYS_TR_NONE,
+                        ESYS_TR_NONE, &in_point, &shared_point);
+    if (rc != TSS2_RC_SUCCESS) {
+        ret = decode_tpm_rc(rc);
+        goto exit;
+    }
+
+    // Deliver the x coordinate of the shared point.
+    memcpy(ss, shared_point->point.x.buffer, 32);
+
+    ret = STKB_SUCCESS;
+
+exit:
+    Esys_Free(shared_point);
+    if (primary_handle != ESYS_TR_NONE)
+        Esys_FlushContext(ctx, primary_handle);
+    if (ecdh_key_handle != ESYS_TR_NONE)
+        Esys_FlushContext(ctx, ecdh_key_handle);
+    Esys_Finalize(&ctx);
+    return ret;
+}