Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

TPM2: Basic bindings in FFI & Python #4361

Merged
merged 3 commits into from
Oct 11, 2024
Merged

TPM2: Basic bindings in FFI & Python #4361

merged 3 commits into from
Oct 11, 2024

Conversation

reneme
Copy link
Collaborator

@reneme reneme commented Oct 9, 2024

Exposes basic TPM 2.0 functionality via the FFI and the Python bindings.

Currently, this allows creating a TPM context object, enabling the usage of the Botan-based crypto backend, setting up an unauthenticated session for parameter encryption and instantiating a TPM-based RNG object.

Additional functionality (particularly to interface with TPM-hosted key material) may be added later.

Here's an example how the above would look in Python:

import botan3 as b

ctx = b.TPM2Context()
if ctx.supports_botan_crypto_backend():
    tpm2_ctx.enable_botan_crypto_backend(botan.RandomNumberGenerator("user"))
session = b.TPM2UnauthenticatedSession(ctx)

rng = b.RandomNumberGenerator("tpm2", tpm2_context=ctx, tpm2_sessions=session)

print("Randomness from TPM:", rng.get(32))

@reneme reneme added the enhancement Enhancement or new feature label Oct 9, 2024
@reneme reneme added this to the Botan 3.6.0 milestone Oct 9, 2024
@reneme reneme self-assigned this Oct 9, 2024
@reneme reneme force-pushed the feature/tpm2_rng_in_python branch 4 times, most recently from ffeac51 to 1818e54 Compare October 9, 2024 16:05
@coveralls
Copy link

coveralls commented Oct 9, 2024 •
edited
Loading

Coverage Status

coverage: 90.975% (-0.02%) from 90.994%
when pulling 4cb6970 on Rohde-Schwarz:feature/tpm2_rng_in_python
into c2a759b on randombit:master.

reneme
reneme commented Oct 9, 2024
View reviewed changes
src/lib/ffi/ffi.h Show resolved Hide resolved
src/lib/ffi/ffi_tpm2.cpp Show resolved Hide resolved
@reneme reneme force-pushed the feature/tpm2_rng_in_python branch 2 times, most recently from 83bacd0 to 4c884de Compare October 9, 2024 16:43
randombit
randombit reviewed Oct 10, 2024
View reviewed changes
src/python/botan3.py
@@ -20,11 +21,13 @@

from ctypes import CDLL, CFUNCTYPE, POINTER, byref, create_string_buffer, \
c_void_p, c_size_t, c_uint8, c_uint32, c_uint64, c_int, c_uint, c_char, c_char_p, addressof
from typing import Callable
Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This introduces a hard dependency on at least Python 3.5. Which seems fine - that version was released in 2015 - but I realize we currently do not have any specific documentation regarding what our minimum supported Python version is.

Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

#4365

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No strong need to introduce this. We could remove the type annotation for the sake of caution.

randombit
randombit approved these changes Oct 10, 2024
View reviewed changes
Copy link
Owner

@randombit randombit left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

One tiny nit in the Python

src/python/botan3.py
sessions = TPM2Session.session_bundle_(kwargs.get("tpm2_sessions", None))
_DLL.botan_tpm2_rng_init(byref(self.__obj), ctx.handle_(), *sessions)
else:
_DLL.botan_rng_init(byref(self.__obj), _ctype_str(rng_type))
Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should check here that kwargs is otherwise empty

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Used kwargs.pop() and validated that kwargs is empty after reading all relevant arguments. Also added a test for that.

atreiber94
atreiber94 approved these changes Oct 10, 2024
View reviewed changes
Copy link
Collaborator

@atreiber94 atreiber94 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

reneme
reneme commented Oct 11, 2024
View reviewed changes
src/python/botan3.py

from sys import platform
from time import strptime, mktime, time as system_time
from binascii import hexlify
from datetime import datetime
from collections.abc import Iterable
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For completeness: this adds a dependency to Python 3.3, if I interpret the documentation correctly. Python 3.9 seems to have added additional functionality to also interpret [] as Iterable, which is vaguely relevant for the use case in this pull request.

@reneme
CI: prepare for TPM2-based python tests
579e2b6
@reneme
Basic support for TPM 2.0 in the FFI
109d000 
This merely exposes enough functionality to establish an RNG backed
by the TPM. Explicitly enabling the usage of Botan's crypto primitives
for the communication with the TPM is also included.
@reneme
Basic TPM 2.0 bindings in botan3.py
4cb6970 
Enough to set up a TPM context, enable Botan's crypto backend and
instantiate a TPM-backed RNG with parameter encryption via an
unauthenticated Session object.
@reneme
Copy link
Collaborator Author

reneme commented Oct 11, 2024

Thanks for the reviews. I addressed Jack's suggestion and rebased to master (after #4325 caused a merge conflict).

@reneme reneme requested a review from randombit October 11, 2024 12:23
randombit
randombit approved these changes Oct 11, 2024
View reviewed changes
Copy link
Owner

@randombit randombit left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👍

@reneme reneme merged commit 4c29200 into randombit:master Oct 11, 2024
38 checks passed
@reneme reneme deleted the feature/tpm2_rng_in_python branch October 11, 2024 15:22
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@randombit randombit randombit approved these changes

@atreiber94 atreiber94 atreiber94 approved these changes

Assignees

@reneme reneme

Labels
enhancement Enhancement or new feature
Projects
None yet
Milestone
Botan 3.6.0
Development

Successfully merging this pull request may close these issues.
4 participants
@reneme @coveralls @randombit @atreiber94