From 05db351e119beb53ffc0046509a022ae9c471f15 Mon Sep 17 00:00:00 2001 From: Osmium Sorcerer Date: Wed, 23 Sep 2026 21:31:36 +0000 Subject: Introduce hardware auth keys backed by TPM Hardware keys are created and managed exclusively in the protected environment of the Trusted Platform Module (TPM 2.0), a separate, secure processor isolated from the rest of the system. Keyring provides them as an alternative to established software keys for challenge-response authentication. Software keys, while far more secure than naive passwords, have their limitations. They're stored in a keyring file in an encrypted form and can be extracted and copied. As a result, it's possible to perform unlimited attempts to decrypt them offline. To mitigate such attacks, a memory-hard key derivation function must be used to derive the decryption key, and the passhprase itself must still be sufficiently strong because a small search space will definitely be exhausted. A side effect of this is a massive latency spike and potentially disruptive peak memory usage. Hardware keys, by design, are non-exportable. Total system compromise won't lead to key exfiltration due to TPM having no such functionality, and TPM's tamper resistance makes extraction of secrets infeasible even with physical access to the machine (if the TPM is genuine). PIN that is used to protect hardware keys is validated by the TPM itself, which also locks itself out after too many failed attempts. This lockout cannot be overridden without either issuing a lockout clear command with authorization value or resetting the TPM outright, erasing all keys stored in it. Because of this, low-entropy secrets (such as six-digit PIN) can provide sufficient security. Their only limitation is the flipside of their strength: because they're non-exportable, you can't back them up and move them between devices. Once created, a hardware key is bound to the machine, unlike software keys which are usable everywhere as long as you have keyring.cbor. Hardware keys require TPM 2.0 and an API to communicate with it. Implementations are provided for: - Windows via Cryptography API: Next Generation (CNG) with Microsoft Platform Crypto Provider. - Unix systems with TPM2 Software Stack (TSS2). Windows scopes keys to a Windows user, so you likely won't be able to move them across users or installations within the same machine. The keys will remain on the system with "SoF_Auth_" prefix and a UUID so you can locate them in your key registry. They'll additionally have the name you set at key creation. Unix might require additoinal user permissions to access the TPM. For example, adding a user to the `tss` group on Linux. The platform input differs. Windows can take a user-friendly key name to display, which is a good feature considering weird requirement of Windows that key names (actual identifiers) must be unique strings, for which I use UUIDs. Unix has no concept of key names or identifiers, but it has to provide PIN to the TPM directly. Windows uses its own PIN prompt from Windows Security UI that's disconnected from the application. This is somewhat awkward because it's modeless. Also, a ridiciulous quirk of Windows CNG API makes it so key handle creation returns the same `NTE_INVALID_HANDLE` error no matter what kind of error it was. In particular, it's impossible to differentiate between the operation failing due to the TPM lockout, or the user voluntarily closing the dialog. The user will always see "hardware locked out" error message. Brilliant API design. The PIN is implemented as a direct authorization value for keys, so it might be vulnerable to the bus sniffing attack if the PIN is traveling in clear between CPU and TPM. Though, a hypothetical adversary who's sitting with a logic analyzer hooked up to your motherboard as you type the PIN will realistically have easier means to log your keystrokes. TPM is capable of remote attestation to prove its authenticity, but I chose to avoid it to protect users' privacy (there's anonymous attestation, but it's not always practical because it requires special CAs) and avoid significant implementation complexity on the server that the attestation entails, such as parsing and validating certificate chains. Because of the unfortunate reality, TPMs overwhelmingly have no support for X25519 (the key exchange algorithm used in software keys). It was added in a recent revision, but it's yet to be implemented, and only on the newest machines. You can't upgrade the TPM hardware, so we have to compromise. Instead, elliptic curve Diffie-Hellman over P-256 curve has been selected, which is also the default curve used in WebAuthn (passkey) protocol. It's ubiquitous, supported by every single TPM 2.0, and secure if reasonably implemented. Keys don't take up limited nonvolatile memory of the TPM. Every reference to TPM objects necessary to perform authentication is stored on disk, and keys and contexts are recreated on every operation and cleared from memory afterwards. For the client public key format, I *only* use compressed P-256 points (1-byte parity of y coordinate followed by a full 32-byte x coordinate) for robustness. Their designated identification byte is 0x33, and they start with the letter M when base64url-encoded. --- CMakeLists.txt | 12 ++ src/keyring.cpp | 318 +++++++++++++++++++++++++++++++++++++++++------------ src/keyring.h | 27 ++++- src/tpm/tpm.h | 33 ++++++ src/tpm/tpm_cng.c | 170 ++++++++++++++++++++++++++++ src/tpm/tpm_stub.c | 28 +++++ src/tpm/tpm_tss.c | 244 ++++++++++++++++++++++++++++++++++++++++ 7 files changed, 757 insertions(+), 75 deletions(-) create mode 100644 src/tpm/tpm.h create mode 100644 src/tpm/tpm_cng.c create mode 100644 src/tpm/tpm_stub.c create mode 100644 src/tpm/tpm_tss.c diff --git a/CMakeLists.txt b/CMakeLists.txt index b3786d9..f9143be 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -126,8 +126,20 @@ qt_add_executable(Attorney_Online src/auth_flow.cpp src/saved_auth.h src/saved_auth.cpp + src/tpm/tpm.h ) +if(WIN32) + target_sources(Attorney_Online PRIVATE src/tpm/tpm_cng.c) + target_link_libraries(Attorney_Online PRIVATE ncrypt rpcrt4) +elseif(UNIX AND NOT APPLE) + target_sources(Attorney_Online PRIVATE src/tpm/tpm_tss.c) + target_link_libraries(Attorney_Online PRIVATE tss2-esys tss2-mu) + target_compile_definitions(Attorney_Online PRIVATE SOF_AO_HARDWARE_KEY_REQUIRES_PIN_UI) +else() + target_sources(Attorney_Online PRIVATE src/tpm/tpm_stub.c) +endif() + if(CMAKE_BUILD_TYPE STREQUAL "Dev") target_compile_definitions(Attorney_Online PRIVATE NETWORK_DEBUG) target_compile_options(Attorney_Online PRIVATE -O0 -Wall -Wextra -pedantic) diff --git a/src/keyring.cpp b/src/keyring.cpp index eb71e53..324aec2 100644 --- a/src/keyring.cpp +++ b/src/keyring.cpp @@ -16,6 +16,10 @@ #include "file_functions.h" #include "keyring.h" +extern "C" { +#include "tpm/tpm.h" +} + // Encrypted secret key serialized format version. // // Version 1: Secret key encrypted with ChaCha20-Poly1305 using password-based @@ -45,6 +49,10 @@ static constexpr quint8 all_zero_nonce[crypto_aead_chacha20poly1305_NPUBBYTES] = // authentication mechanism. static const auto domain_sep = QByteArrayLiteral("Einsof-Auth-DHCR"); +// Internal state, set by tpm2_init if TPM check and self-test succeed, and we +// can use hardware keys. +static int tpm_available = 0; + static QString get_keyring_path() { return QDir(get_app_path()).filePath("keyring.cbor"); @@ -67,10 +75,73 @@ int keyring_initialize() index.close(); } + if (tpm2_init() == STKB_SUCCESS) + { + tpm_available = 1; + } + + return 0; +} + +// Expose a way to query status without making the internal state variable +// global. +// Yes, this is stupid. +int keyring_hardware_available() +{ + return tpm_available; +} + +// Prepare the key CBOR entry and atomically insert it into the keyring. +// To ensure durability, file locking and atomic overwrite are used as +// provided by Qt. Frankly, I don't see the keyring being prone to corruption +// as there's no concurrent access, save for a contrived edge case of a user +// generating/deleting keys simultaneously from two client instances. It's +// done regardless for a good measure. +static int insert_into_keyring(quint8 tag, QStringView name, const QByteArray &pub, const QByteArray &sec) +{ + QCborMap entry; + entry.insert(0, QCborValue(tag)); + entry.insert(1, QCborValue(name)); + entry.insert(2, QCborValue(pub)); + entry.insert(3, QCborValue(sec)); + QFile index_file(get_keyring_path()); + QLockFile index_lock(QDir(get_app_path()).filePath("keyring.lock")); + if (!index_lock.lock()) + { + return 1; + } + if (!index_file.open(QIODevice::ReadOnly)) + { + return 1; + } + QCborStreamReader idx_in(&index_file); + QCborValue index = QCborValue::fromCbor(idx_in); + index_file.close(); + if (!index.isMap()) + { + index = QCborMap(); + } + QCborMap index_map = index.toMap(); + // Key fingerprint is used as its unique identifier. + QByteArray fingerprint; + fingerprint.append(tag); + fingerprint.append(pub); + uchar fpr_hash[crypto_generichash_BYTES]; + crypto_generichash(fpr_hash, sizeof(fpr_hash), (const uchar *)fingerprint.constData(), fingerprint.size(), nullptr, 0); + index_map.insert(QCborValue(QByteArray((const char *)fpr_hash, (qsizetype)sizeof(fpr_hash))), QCborValue(entry)); + QSaveFile index_file_w(get_keyring_path()); + if (!index_file_w.open(QIODevice::WriteOnly)) + { + return 1; + } + index_file_w.write(QCborValue(index_map).toCbor()); + index_file_w.commit(); + index_lock.unlock(); return 0; } -int generate_key(QStringView name, const QByteArray &password) +// Software X25519 keys protected by a passphrase. +int generate_software_key(QStringView name, const QByteArray &password) { // If we let users specify arbitrary parameters, additional constraints must // be enforced: min/max opslimit, type of memlimit (uint32_t vs size_t). @@ -127,94 +198,73 @@ int generate_key(QStringView name, const QByteArray &password) } sodium_munlock(wrap_key, sizeof(wrap_key)); sodium_munlock(secret_key, sizeof(secret_key)); - QByteArray public_key_array((const char *)public_key, (qsizetype)sizeof(public_key)); - quint8 tag = cert_x25519_tag; - - // Key fingerprint is used as its unique identifier. - QByteArray fingerprint; - fingerprint.append(tag); - fingerprint.append(public_key_array); - uchar fpr_hash[crypto_generichash_BYTES]; - crypto_generichash(fpr_hash, sizeof(fpr_hash), (const uchar *)fingerprint.constData(), fingerprint.size(), nullptr, 0); + QByteArray public_key_array((const char *)public_key, (qsizetype)sizeof(public_key)); QByteArray encrypted_secret(packed_header); encrypted_secret.append((const char *)payload, sizeof(payload)); - // Prepare the key CBOR entry and atomically insert it into the keyring. - // To ensure durability, file locking and atomic overwrite are used as - // provided by Qt. Frankly, I don't see the keyring being prone to corruption - // as there's no concurrent access, save for a contrived edge case of a user - // generating/deleting keys simultaneously from two client instances. It's - // done regardless for a good measure. - QCborMap entry; - entry.insert(0, QCborValue(tag)); - entry.insert(1, QCborValue(name)); - entry.insert(2, QCborValue(public_key_array)); - entry.insert(3, QCborValue(encrypted_secret)); - QFile index_file(get_keyring_path()); - QLockFile index_lock(QDir(get_app_path()).filePath("keyring.lock")); - if (!index_lock.lock()) + if (insert_into_keyring(cert_x25519_tag, name, public_key_array, encrypted_secret)) { - return 9; + return 5; } - if (!index_file.open(QIODevice::ReadOnly)) - { - return 6; - } - QCborStreamReader idx_in(&index_file); - QCborValue index = QCborValue::fromCbor(idx_in); - index_file.close(); - if (!index.isMap()) - { - index = QCborMap(); - } - QCborMap index_map = index.toMap(); - index_map.insert(QCborValue(QByteArray((const char *)fpr_hash, (qsizetype)sizeof(fpr_hash))), QCborValue(entry)); - QSaveFile index_file_w(get_keyring_path()); - if (!index_file_w.open(QIODevice::WriteOnly)) - { - return 8; - } - index_file_w.write(QCborValue(index_map).toCbor()); - index_file_w.commit(); - index_lock.unlock(); return 0; } -// Look up the key_id in the keyring, unlock it with supplied password using -// parameters from its header, perform a Diffie-Hellman key exchange with the -// server's ephemeral key to derive a shared secret, and hash it along with -// additional data to prove your authenticity to the server. -ResponseResult unlock_and_auth(QByteArrayView key_id, QByteArrayView password, QByteArrayView ephemeral_key, QByteArrayView username, AuthResponse &out) +static constexpr quint8 cert_hwkey_p256_tag = 0x33; + +static std::wstring optional_hardware_key_name(QStringView name) { - if (password.size() < crypto_pwhash_PASSWD_MIN || password.size() > crypto_pwhash_PASSWD_MAX) - { - return ResponseResult::invalid_password; - } +#ifdef SOF_AO_HARDWARE_KEY_REQUIRES_PIN_UI + (void)name; + return std::wstring(); +#else + return name.toString().toStdWString(); +#endif +} - QFile index_file(get_keyring_path()); - if (!index_file.open(QIODevice::ReadOnly)) - { - return ResponseResult::inaccessible_keyring; +// Hardware P-256 keys (because most TPMs can only do P-256, unfortunately); +// the TPM verifies the PIN. +int generate_hardware_key(QStringView name, const QByteArray &pin) +{ + // Compressed P-256 public key. + uint8_t pub[33]; + // Protected secret blobs differ by size depending on the platform (and in + // case of TSS2 implementation, size is unspecified). Prepare a sufficient + // buffer to write to, the actual output size will be in `sec_written`. + uint8_t sec[512]; + size_t sec_written = 0; + std::wstring optional_name_wstr = optional_hardware_key_name(name); + stkb_user_input input = { + .pin = (const uint8_t *)pin.constData(), + .pin_len = (size_t)pin.size(), + .key_name = optional_name_wstr.c_str(), + }; + stkb_rc rc = tpm2_keygen(pub, sec, sizeof(sec), &sec_written, input); + switch (rc) { + case STKB_SUCCESS: + break; + default: + return rc; } - QCborStreamReader idx_in(&index_file); - QCborValue index = QCborValue::fromCbor(idx_in); - index_file.close(); - QCborMap tmp_map = index.toMap().value(QCborValue(QByteArray(key_id))).toMap(); - QCborValue val = tmp_map.value(3); - if (!val.isByteArray()) + QByteArray public_array((const char *)pub, (qsizetype)sizeof(pub)); + QByteArray protected_array((const char *)sec, (qsizetype)sec_written); + if (insert_into_keyring(cert_hwkey_p256_tag, name, public_array, protected_array)) + return 1; + return 0; +} + +static ResponseResult compute_with_software_key(quint8 *shared_secret, const QByteArray &encrypted_secret, QByteArrayView password, QByteArrayView ephemeral_key) +{ + if (password.size() < crypto_pwhash_PASSWD_MIN || password.size() > crypto_pwhash_PASSWD_MAX) { - return ResponseResult::corrupted_entry; + return ResponseResult::invalid_password; } - QByteArray encrypted_secret = val.toByteArray(); - val = tmp_map.value(2); - if (!val.isByteArray()) + if (ephemeral_key.size() != crypto_kx_PUBLICKEYBYTES) { - return ResponseResult::corrupted_entry; + return ResponseResult::incompatible_arguments; } - QByteArray public_key = val.toByteArray(); // After retrieving the key from the keyring, the process is the same as // in key generation, but in the opposite direction. @@ -264,7 +314,6 @@ ResponseResult unlock_and_auth(QByteArrayView key_id, QByteArrayView password, Q // Now we've unlocked the key, and ready to perform DH with the server's // ephemeral key to prove ourselves. - quint8 shared_secret[crypto_scalarmult_BYTES]; if (crypto_scalarmult(shared_secret, secret_key, (const uchar *)ephemeral_key.constData())) { // We ended up with the point at infinity, something stupid must've @@ -274,6 +323,126 @@ ResponseResult unlock_and_auth(QByteArrayView key_id, QByteArrayView password, Q } sodium_munlock(secret_key, sizeof(secret_key)); + return ResponseResult::success; +} + +static ResponseResult compute_with_hardware_key(quint8 *shared_secret, const QByteArray &blob, QByteArrayView pin, QByteArrayView ephemeral_key) +{ + if (ephemeral_key.size() != 64) + { + return ResponseResult::incompatible_arguments; + } + stkb_user_input input = { + .pin = (const uint8_t *)pin.constData(), + .pin_len = (size_t)pin.size(), + .key_name = nullptr, + }; + stkb_rc rc = tpm2_compute_ss(shared_secret, (const uint8_t *)blob.constData(), (size_t)blob.size(), (const uint8_t *)ephemeral_key.constData(), input); + switch (rc) { + case STKB_SUCCESS: + return ResponseResult::success; + case STKB_ERROR: + return ResponseResult::hardware_fault; + case STKB_BAD_PIN: + case STKB_AUTH_FAILURE: + return ResponseResult::invalid_pin; + case STKB_LOCKOUT: + return ResponseResult::hardware_lockout; + case STKB_TPM_UNAVAILABLE: + default: + return ResponseResult::inaccessible_keyring; + } +} + +KeyringKey acquire_keyring_key(QByteArrayView key_id) +{ + struct KeyringKey key; + QFile index_file(get_keyring_path()); + if (!index_file.open(QIODevice::ReadOnly)) + { + return key; + } + QCborStreamReader idx_in(&index_file); + QCborValue index = QCborValue::fromCbor(idx_in); + index_file.close(); + QCborMap tmp_map = index.toMap().value(QCborValue(QByteArray(key_id))).toMap(); + + QCborValue val = tmp_map.value(2); + if (!val.isByteArray()) + { + return key; + } + key.public_key = val.toByteArray(); + + val = tmp_map.value(3); + if (!val.isByteArray()) + { + return key; + } + key.protected_secret = val.toByteArray(); + + val = tmp_map.value(0); + if (!val.isInteger()) + { + return key; + } + qint64 raw_tag = val.toInteger(); + if (raw_tag < 0 || raw_tag > 255) + { + return key; + } + quint8 tag = (quint8)raw_tag; + switch (tag) { + case cert_x25519_tag: + key.type = KeyringStorageType::software; + break; + case cert_hwkey_p256_tag: + key.type = KeyringStorageType::hardware; + break; + default: + break; + } + + val = tmp_map.value(1); + if (!val.isString()) + { + return key; + } + key.name = val.toString(); + + + key.id = QByteArray(key_id); + + return key; +} + +// Look up the key_id in the keyring, unlock it with supplied password using +// parameters from its header, perform a Diffie-Hellman key exchange with the +// server's ephemeral key to derive a shared secret, and hash it along with +// additional data to prove your authenticity to the server. +ResponseResult unlock_and_auth(const KeyringKey &key, QByteArrayView input, QByteArrayView ephemeral_key, QByteArrayView username, AuthResponse &out) +{ + uint8_t shared_secret[32]; + sodium_mlock(shared_secret, sizeof(shared_secret)); + + ResponseResult result; + switch (key.type) { + case KeyringStorageType::software: + result = compute_with_software_key(shared_secret, key.protected_secret, input, ephemeral_key); + break; + case KeyringStorageType::hardware: + result = compute_with_hardware_key(shared_secret, key.protected_secret, input, ephemeral_key); + break; + default: + result = ResponseResult::corrupted_entry; + break; + } + if (result != ResponseResult::success) + { + sodium_munlock(shared_secret, sizeof(shared_secret)); + return result; + } + // The proof is a BLAKE2b-256 hash over the following: // 1. Domain-separating constant. // 2. Shared DH secret, serving as a proof of posession of the secret key @@ -297,11 +466,14 @@ ResponseResult unlock_and_auth(QByteArrayView key_id, QByteArrayView password, Q crypto_generichash_update(&state, (const uchar *)domain_sep.constData(), domain_sep.size()); crypto_generichash_update(&state, shared_secret, sizeof(shared_secret)); crypto_generichash_update(&state, (const uchar *)ephemeral_key.constData(), ephemeral_key.size()); - crypto_generichash_update(&state, (const uchar *)public_key.constData(), public_key.size()); + crypto_generichash_update(&state, (const uchar *)key.public_key.constData(), key.public_key.size()); crypto_generichash_update(&state, (const uchar *)username.constData(), username.size()); crypto_generichash_final(&state, proof, sizeof(proof)); out.response = QByteArray((const char *)proof, (qsizetype)sizeof(proof)); + + sodium_munlock(shared_secret, sizeof(shared_secret)); + return ResponseResult::success; } diff --git a/src/keyring.h b/src/keyring.h index 81d97fc..42cf992 100644 --- a/src/keyring.h +++ b/src/keyring.h @@ -42,9 +42,32 @@ enum class ResponseResult derivation_failed, decryption_failed, bad_curve_point, + hardware_fault, + invalid_pin, + hardware_lockout, + incompatible_arguments, +}; + +enum class KeyringStorageType +{ + invalid, + software, + hardware, +}; + +struct KeyringKey +{ + KeyringStorageType type = KeyringStorageType::invalid; + QByteArray id; + QByteArray public_key; + QByteArray protected_secret; + QString name; }; int keyring_initialize(void); -int generate_key(QStringView name, const QByteArray &password); +int keyring_hardware_available(void); +int generate_software_key(QStringView name, const QByteArray &password); +int generate_hardware_key(QStringView name, const QByteArray &pin); +KeyringKey acquire_keyring_key(QByteArrayView key_id); void delete_key(const QByteArray &key_id); -ResponseResult unlock_and_auth(QByteArrayView key_id, QByteArrayView password, QByteArrayView ephemeral_key, QByteArrayView username, AuthResponse &out); +ResponseResult unlock_and_auth(const KeyringKey &key, QByteArrayView password, QByteArrayView ephemeral_key, QByteArrayView username, AuthResponse &out); diff --git a/src/tpm/tpm.h b/src/tpm/tpm.h new file mode 100644 index 0000000..7531ae2 --- /dev/null +++ b/src/tpm/tpm.h @@ -0,0 +1,33 @@ +// Copyright 2026 Osmium Sorcerer +// SPDX-License-Identifier: MIT + +#ifndef SOF_AO2CLIENT_TPM_TPM_H +#define SOF_AO2CLIENT_TPM_TPM_H + +#include +#include + +typedef enum { + STKB_SUCCESS, + STKB_ERROR, + STKB_TPM_UNAVAILABLE, + STKB_BAD_PIN, + STKB_AUTH_FAILURE, + STKB_LOCKOUT, +} stkb_rc; + +typedef struct { + const uint8_t *pin; + size_t pin_len; + const wchar_t *key_name; +} stkb_user_input; + +stkb_rc tpm2_init(void); + +stkb_rc tpm2_keygen(uint8_t *out_pub, uint8_t *out_buffer, size_t buffer_size, + size_t *written, stkb_user_input input); + +stkb_rc tpm2_compute_ss(uint8_t *ss, const uint8_t *blob, size_t blob_len, + const uint8_t *pk, stkb_user_input input); + +#endif /* SOF_AO2CLIENT_TPM_TPM_H */ diff --git a/src/tpm/tpm_cng.c b/src/tpm/tpm_cng.c new file mode 100644 index 0000000..1f764c7 --- /dev/null +++ b/src/tpm/tpm_cng.c @@ -0,0 +1,170 @@ +// Copyright 2026 Osmium Sorcerer +// SPDX-License-Identifier: MIT + +#define WIN32_LEAN_AND_MEAN +#include +#include +#include + +#include "tpm.h" + +// Global handle for the Windows API. +static NCRYPT_PROV_HANDLE provider; + +// 9 characters for prefix, 36 for random UUID, and don't forget that null terminator. +// Note: this is count of wchar_t, not size. +static const size_t keyname_len = 46; + +stkb_rc tpm2_init(void) +{ + // "Microsoft Platform Crypto Provider" is the TPM. + if (NCryptOpenStorageProvider(&provider, MS_PLATFORM_CRYPTO_PROVIDER, 0) != ERROR_SUCCESS) + return STKB_TPM_UNAVAILABLE; + if (NCryptIsAlgSupported(provider, BCRYPT_ECDH_P256_ALGORITHM, 0) != ERROR_SUCCESS) + return STKB_TPM_UNAVAILABLE; + return STKB_SUCCESS; +} + + +static int generate_keyname(wchar_t *out) +{ + // UUID seems like the way on Windows. + UUID id; + RPC_WSTR wstr = NULL; + + if (UuidCreate(&id) != RPC_S_OK) + return 0; + + if (UuidToStringW(&id, &wstr) != RPC_S_OK) + return 0; + + wcscpy(out, L"SoF_Auth_"); + wcscpy(out + 9, wstr); + + RpcStringFreeW(&wstr); + + return 1; +} + +stkb_rc tpm2_keygen(uint8_t *out_pub, uint8_t *out_blob, size_t buffer_size, size_t *offset, + stkb_user_input input) +{ + NCRYPT_KEY_HANDLE key_handle = 0; + // Windows heavily abstracts the TPM and prevents you from acquiring the encrypted private structure. Instead, you + // have to use wide null-terminated strings as canonical key identifiers and refer to them by these names later. + // Yes, not even opaque byte arrays despite it handling "BLOBs." + wchar_t keyname[keyname_len]; + if (sizeof(keyname) > buffer_size) + return STKB_ERROR; + if (!generate_keyname(keyname)) + return STKB_ERROR; + + // One might think, when NULL is passed instead of a key name, the key will not actually be persistent. But it + // becomes impossible to export the key to be loaded later, even in an encrypted form (while NCryptExportKey + // documents NCRYPT_OPAQUETRANSPORT_BLOB, explicitly saying "Opaque BLOBs are not transferable and must be imported + // by using the same CSP," and NCRYPT_PROTECTED_KEY_BLOB, confusingly, also doesn't export an opaque fixed-TPM + // restricted key blob. So we are forced to use a unique (potentially user-facing) name as an internal specifier. + if (NCryptCreatePersistedKey(provider, &key_handle, BCRYPT_ECDH_P256_ALGORITHM, keyname, 0, 0) != ERROR_SUCCESS) + return STKB_ERROR; + + // Leave PINs unused, let the platform handle the input dialog. + NCRYPT_UI_POLICY ui_policy = { + .dwVersion = 1, + .dwFlags = NCRYPT_UI_FORCE_HIGH_PROTECTION_FLAG, + .pszFriendlyName = input.key_name, + .pszDescription = L"SoF authentication key", + }; + stkb_rc ret = STKB_ERROR; + if (NCryptSetProperty(key_handle, NCRYPT_UI_POLICY_PROPERTY, (PBYTE)&ui_policy, sizeof(ui_policy), 0) != ERROR_SUCCESS) + goto exit; + + // If the TPM is locked out, of all functions, FinalizeKey fails by returning NTE_INVALID_HANDLE. + // The other way it can happen (memory corruption aside) is if the user cancels the key creation + // dialog. You can't differentiate the two. + if (NCryptFinalizeKey(key_handle, 0) != ERROR_SUCCESS) { + ret = STKB_LOCKOUT; + goto exit; + } + + BCRYPT_ECCKEY_BLOB ecc_blob = { 0 }; + BYTE pub_buffer[sizeof(ecc_blob) + 32 * 2]; + DWORD pub_buffer_off = 0; + if (NCryptExportKey(key_handle, 0, BCRYPT_ECCPUBLIC_BLOB, NULL, pub_buffer, sizeof(pub_buffer), &pub_buffer_off, + 0) != ERROR_SUCCESS) + goto exit; + memcpy(&ecc_blob, pub_buffer, sizeof(ecc_blob)); + // Check sanity of the exported public key. + if (ecc_blob.dwMagic != BCRYPT_ECDH_PUBLIC_P256_MAGIC || ecc_blob.cbKey != 32) + goto exit; + // The x and y _should_ follow the blob (which is the beginning of the buffer) contiguously, each of cbKey (32) + // bytes. + memcpy(out_pub + 1, pub_buffer + sizeof(ecc_blob), 32); + // Encode parity of the last byte of y (both coordinates are big-endian). + if (pub_buffer[sizeof(ecc_blob) + 32 + 31] & 1) + out_pub[0] = 0x03; + else + out_pub[0] = 0x02; + + memcpy(out_blob, keyname, sizeof(keyname)); + *offset = sizeof(keyname); + + ret = STKB_SUCCESS; + +exit: + NCryptFreeObject(key_handle); + return ret; +} + +stkb_rc tpm2_compute_ss(uint8_t *ss, const uint8_t *blob, size_t blob_len, const uint8_t *pk, stkb_user_input input) +{ + (void)input; + // Because wchar_t is 16-byte-aligned, we can't cast a byte array, we have to do this redundant copy. + wchar_t keyname[keyname_len]; + if (blob_len != sizeof(keyname)) + return STKB_ERROR; + memcpy(keyname, blob, sizeof(keyname)); + stkb_rc ret = STKB_ERROR; + NCRYPT_KEY_HANDLE key_handle = 0; + NCRYPT_KEY_HANDLE pk_handle = 0; + NCRYPT_SECRET_HANDLE shared_point = 0; + if (NCryptOpenKey(provider, &key_handle, keyname, 0, 0) != ERROR_SUCCESS) + goto exit; + // The API expects us to do the same ceremony to import the key in its format instead of using it directly. + BCRYPT_ECCKEY_BLOB ecc_blob = { + .dwMagic = BCRYPT_ECDH_PUBLIC_P256_MAGIC, + .cbKey = 32, + }; + BYTE pub_buffer[sizeof(ecc_blob) + 32 * 2]; + memcpy(pub_buffer, &ecc_blob, sizeof(ecc_blob)); + memcpy(pub_buffer + sizeof(ecc_blob), pk, 64); + if (NCryptImportKey(provider, 0, BCRYPT_ECCPUBLIC_BLOB, NULL, &pk_handle, pub_buffer, sizeof(pub_buffer), 0) != ERROR_SUCCESS) + goto exit; + // Here it can also fail due to cancelation of dialog, too many failed attempts, or a TPM lockout. + if (NCryptSecretAgreement(key_handle, pk_handle, &shared_point, 0) != ERROR_SUCCESS) { + ret = STKB_LOCKOUT; + goto exit; + } + // You cannot extract the x coordinate of the shared point either, you have to derive the key. Even if you want to + // directly use the secret. But fine, apparently RAW_SECRET is a cryptographic key derivation function, which is + // some unrecognized cryptographic genius. We'll use it to get our affine big-endian x coordinate, the canonical + // ECDH shared secret. If you specify the size to be 32, it will only output the x coordinate, after all, that's + // what a point is: 32 bytes of x, then 32 bytes of y, no padding, no leading bytes, no headers. Right? + BYTE secret[32]; + DWORD written = 0; + if (NCryptDeriveKey(shared_point, BCRYPT_KDF_RAW_SECRET, NULL, secret, sizeof(secret), &written, 0) != ERROR_SUCCESS) + goto exit; + // Of course it wouldn't be that easy. Even if we guessed the behavior of this function with respect to the buffer + // size you pass to it, CNG API decides that it's a good idea to output point coordinates in little-endian order, + // opposite of how the standard defines it (and what every other implementation correctly does, including the + // Platform Crypto backend that CNG relies on, and CNG's own NCryptExportKey). + for (size_t i = 0; i < sizeof(secret); ++i) + ss[i] = secret[sizeof(secret) - 1 - i]; + + ret = STKB_SUCCESS; + +exit: + NCryptFreeObject(key_handle); + NCryptFreeObject(pk_handle); + NCryptFreeObject(shared_point); + return ret; +} diff --git a/src/tpm/tpm_stub.c b/src/tpm/tpm_stub.c new file mode 100644 index 0000000..4e2d2c0 --- /dev/null +++ b/src/tpm/tpm_stub.c @@ -0,0 +1,28 @@ +#include "tpm.h" + +stkb_rc tpm2_init(void) +{ + return STKB_TPM_UNAVAILABLE; +} + +stkb_rc tpm2_keygen(uint8_t *out_pub, uint8_t *out_buffer, size_t buffer_size, + size_t *written, stkb_user_input input) +{ + (void)out_pub; + (void)out_buffer; + (void)buffer_size; + (void)written; + (void)input; + return STKB_TPM_UNAVAILABLE; +} + +stkb_rc tpm2_compute_ss(uint8_t *ss, const uint8_t *blob, size_t blob_len, + const uint8_t *pk, stkb_user_input input) +{ + (void)ss; + (void)blob; + (void)blob_len; + (void)pk; + (void)input; + return STKB_TPM_UNAVAILABLE; +} diff --git a/src/tpm/tpm_tss.c b/src/tpm/tpm_tss.c new file mode 100644 index 0000000..880fa32 --- /dev/null +++ b/src/tpm/tpm_tss.c @@ -0,0 +1,244 @@ +// Copyright 2026 Osmium Sorcerer +// SPDX-License-Identifier: MIT + +#include + +#include +#include + +#include "tpm.h" + +// Storage Key: asymmetric scheme is NULL, symmetric is defined and shall +// use CFB mode. The key is restricted. +static const TPM2B_PUBLIC primary_template = { + .publicArea = { + .type = TPM2_ALG_ECC, + .nameAlg = TPM2_ALG_SHA256, + .objectAttributes = + TPMA_OBJECT_FIXEDTPM | + TPMA_OBJECT_FIXEDPARENT | + TPMA_OBJECT_SENSITIVEDATAORIGIN | + TPMA_OBJECT_USERWITHAUTH | + TPMA_OBJECT_RESTRICTED | + TPMA_OBJECT_DECRYPT, + .parameters.eccDetail = { + .symmetric = { + .algorithm = TPM2_ALG_AES, + .keyBits.aes = 128, + .mode.aes = TPM2_ALG_CFB, + }, + .scheme.scheme = TPM2_ALG_NULL, + .curveID = TPM2_ECC_NIST_P256, + .kdf.scheme = TPM2_ALG_NULL, + }, + }, +}; + +// Symmetric algorithm is NULL for a nonrestricted key. This is the template +// for actual key exchange keys under the primary storage key, accessed with a +// user authentication value. +// There is TPM2_ALG_ECDH scheme, but it requires KDF. +static const TPM2B_PUBLIC ecdh_key_template = { + .publicArea = { + .type = TPM2_ALG_ECC, + .nameAlg = TPM2_ALG_SHA256, + .objectAttributes = + TPMA_OBJECT_FIXEDTPM | + TPMA_OBJECT_FIXEDPARENT | + TPMA_OBJECT_SENSITIVEDATAORIGIN | + TPMA_OBJECT_USERWITHAUTH | + TPMA_OBJECT_DECRYPT, + .parameters.eccDetail = { + .symmetric.algorithm = TPM2_ALG_NULL, + .scheme.scheme = TPM2_ALG_NULL, + .curveID = TPM2_ECC_NIST_P256, + .kdf.scheme = TPM2_ALG_NULL, + }, + }, +}; + +static const TPM2B_SENSITIVE_CREATE empty_in_sensitive = { 0 }; +static const TPM2B_DATA empty_outside_info = { 0 }; +static const TPML_PCR_SELECTION empty_creation_pcr = { 0 }; + +// Make sure TPM 2.0 is present and working correctly before using it. +stkb_rc tpm2_init(void) +{ + int ret = 0; + ESYS_CONTEXT *ctx; + if (Esys_Initialize(&ctx, NULL, NULL) != TSS2_RC_SUCCESS) + return STKB_TPM_UNAVAILABLE; + // Simple self-test. Tests only what's necessary instead of all internal + // functions and operations, doesn't disrupt the system. + ret = Esys_SelfTest(ctx, ESYS_TR_NONE, ESYS_TR_NONE, ESYS_TR_NONE, TPM2_NO); + Esys_Finalize(&ctx); + if (ret != TSS2_RC_SUCCESS) + return STKB_TPM_UNAVAILABLE; + return STKB_SUCCESS; +} + +static TSS2_RC tpm2_setup_primary(ESYS_CONTEXT **ctx, ESYS_TR *primary_handle) +{ + TSS2_RC rc = Esys_Initialize(ctx, NULL, NULL); + if (rc != TSS2_RC_SUCCESS) + return rc; + rc = Esys_CreatePrimary(*ctx, ESYS_TR_RH_OWNER, ESYS_TR_PASSWORD, + ESYS_TR_NONE, ESYS_TR_NONE, &empty_in_sensitive, + &primary_template, &empty_outside_info, + &empty_creation_pcr, primary_handle, NULL, NULL, + NULL, NULL); + if (rc != TSS2_RC_SUCCESS) + Esys_Finalize(ctx); + return rc; +} + +static stkb_rc decode_tpm_rc(TSS2_RC tpm_rc) +{ + // Check that the code is from the TPM itself rather than ESAPI, otherwise + // return a generic error as we're not interested in details. + if ((tpm_rc & TSS2_RC_LAYER_MASK) != TSS2_TPM_RC_LAYER) + return STKB_ERROR; + + // Format-One return codes are composite and in particular have an added + // parameter value that is irrelevant to the nature of the error, clear it. + if (tpm_rc & TPM2_RC_FMT1) + tpm_rc &= ~TPM2_RC_N_MASK; + + switch (tpm_rc) { + case TPM2_RC_BAD_AUTH: + case TPM2_RC_AUTH_FAIL: + return STKB_AUTH_FAILURE; + case TPM2_RC_LOCKOUT: + return STKB_LOCKOUT; + default: + return STKB_ERROR; + } +} + +stkb_rc tpm2_keygen(uint8_t *out_pub, uint8_t *out_buffer, size_t buffer_size, + size_t *written, stkb_user_input input) +{ + if (input.pin_len > TPM2_SHA256_DIGEST_SIZE) + return STKB_BAD_PIN; + TPM2B_SENSITIVE_CREATE in_sensitive = { 0 }; + memcpy(in_sensitive.sensitive.userAuth.buffer, input.pin, input.pin_len); + in_sensitive.sensitive.userAuth.size = (UINT16)input.pin_len; + ESYS_CONTEXT *ctx; + ESYS_TR primary_handle; + stkb_rc ret = STKB_ERROR; + if (tpm2_setup_primary(&ctx, &primary_handle) != TSS2_RC_SUCCESS) + return ret; + TPM2B_PRIVATE *ecdh_priv = NULL; + TPM2B_PUBLIC *ecdh_pub = NULL; + TSS2_RC rc = Esys_Create(ctx, primary_handle, ESYS_TR_PASSWORD, + ESYS_TR_NONE, ESYS_TR_NONE, &in_sensitive, + &ecdh_key_template, &empty_outside_info, + &empty_creation_pcr, &ecdh_priv, &ecdh_pub, NULL, + NULL, NULL); + if (rc != TSS2_RC_SUCCESS) { + ret = decode_tpm_rc(rc); + goto exit; + } + + // TPM 2.0 Library, Part 1, 44.5.3 Padding: + // + // > In ECC points returned by the TPM, the x and y values, if non-empty, + // > are required to be the size of their associated curve (e.g., 32 bytes + // > for NIST P-256). + if (ecdh_pub->publicArea.unique.ecc.x.size != 32 || + ecdh_pub->publicArea.unique.ecc.y.size != 32) + goto exit; + + // Compress the public key: knowing x, it's enough to only encode parity of + // y to fully reconstruct the point. + if (ecdh_pub->publicArea.unique.ecc.y.buffer[31] & 1) + out_pub[0] = 0x03; + else + out_pub[0] = 0x02; + memcpy(out_pub + 1, ecdh_pub->publicArea.unique.ecc.x.buffer, 32); + + // Serialize both structures, we'll need them for Load. + size_t off = 0; + if (Tss2_MU_TPM2B_PRIVATE_Marshal(ecdh_priv, out_buffer, buffer_size, &off) != + TSS2_RC_SUCCESS) + goto exit; + if (Tss2_MU_TPM2B_PUBLIC_Marshal(ecdh_pub, out_buffer, buffer_size - off, + &off) != TSS2_RC_SUCCESS) + goto exit; + + *written = off; + ret = STKB_SUCCESS; + +exit: + Esys_Free(ecdh_priv); + Esys_Free(ecdh_pub); + Esys_FlushContext(ctx, primary_handle); + Esys_Finalize(&ctx); + return ret; +} + +// pk is an uncompressed 64-byte point (x || y) of the peer. +stkb_rc tpm2_compute_ss(uint8_t *ss, const uint8_t *blob, size_t blob_len, + const uint8_t *pk, stkb_user_input input) +{ + if (input.pin_len > TPM2_SHA256_DIGEST_SIZE) + return STKB_BAD_PIN; + TPM2B_AUTH auth_value = { 0 }; + memcpy(auth_value.buffer, input.pin, input.pin_len); + auth_value.size = (UINT16)input.pin_len; + + ESYS_CONTEXT *ctx; + ESYS_TR primary_handle; + stkb_rc ret = STKB_ERROR; + if (tpm2_setup_primary(&ctx, &primary_handle) != TSS2_RC_SUCCESS) + return ret; + + ESYS_TR ecdh_key_handle = ESYS_TR_NONE; + TPM2B_PRIVATE ecdh_priv; + TPM2B_PUBLIC ecdh_pub; + TPM2B_ECC_POINT *shared_point = NULL; + size_t off = 0; + if (Tss2_MU_TPM2B_PRIVATE_Unmarshal(blob, blob_len, &off, &ecdh_priv) != + TSS2_RC_SUCCESS) + goto exit; + if (Tss2_MU_TPM2B_PUBLIC_Unmarshal(blob, blob_len, &off, &ecdh_pub) != + TSS2_RC_SUCCESS) + goto exit; + + TSS2_RC rc = Esys_Load(ctx, primary_handle, ESYS_TR_PASSWORD, ESYS_TR_NONE, + ESYS_TR_NONE, &ecdh_priv, &ecdh_pub, + &ecdh_key_handle); + if (rc != TSS2_RC_SUCCESS) { + ret = decode_tpm_rc(rc); + goto exit; + } + + if (Esys_TR_SetAuth(ctx, ecdh_key_handle, &auth_value) != TSS2_RC_SUCCESS) + goto exit; + + TPM2B_ECC_POINT in_point; + in_point.point.x.size = 32; + in_point.point.y.size = 32; + memcpy(in_point.point.x.buffer, pk, 32); + memcpy(in_point.point.y.buffer, pk + 32, 32); + rc = Esys_ECDH_ZGen(ctx, ecdh_key_handle, ESYS_TR_PASSWORD, ESYS_TR_NONE, + ESYS_TR_NONE, &in_point, &shared_point); + if (rc != TSS2_RC_SUCCESS) { + ret = decode_tpm_rc(rc); + goto exit; + } + + // Deliver the x coordinate of the shared point. + memcpy(ss, shared_point->point.x.buffer, 32); + + ret = STKB_SUCCESS; + +exit: + Esys_Free(shared_point); + if (primary_handle != ESYS_TR_NONE) + Esys_FlushContext(ctx, primary_handle); + if (ecdh_key_handle != ESYS_TR_NONE) + Esys_FlushContext(ctx, ecdh_key_handle); + Esys_Finalize(&ctx); + return ret; +} -- cgit