Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

ESAPI: Have Esys_TR_SetAuth() handle large passwords #1008

Closed
AndreasFuchsTPM opened this issue May 4, 2018 · 4 comments
Closed

ESAPI: Have Esys_TR_SetAuth() handle large passwords #1008

AndreasFuchsTPM opened this issue May 4, 2018 · 4 comments
Labels
enhancement
Milestone
Version 3.1

Comments

@AndreasFuchsTPM
Copy link
Member

Currently, Esys_TR_SetAuth() is restricted to authValues shorter or equal to the nameAlg digest size.
The TPM 2.0 library spec part 1 recommends hashing authVaules with the nameAlg if they exceed the nameAlg digest size, but to keep then in the plain if they are shorter.

The ESAPI should adopt this behavior. We shall implement this here and also propose it to TCG.
@AndreasFuchsTPM
Copy link
Member Author

This of course also has to touch Esys_Create, Esys_CreatePrimary, Esys_CreateLoaded, Esys_NV_DefineSpace

@tstruk
Copy link
Contributor

tstruk commented Jul 5, 2018

@AndreasFuchsSIT I don't get that. Since The TPM 2.0 spec recommends this, why do we need to propose it to TCG?

@AndreasFuchsTPM
Copy link
Member Author

@tstruk TPM2 spec recommends it. TSS spec does not contain it. We need to propose it as mandatory behaviour for the TSS spec.

@tstruk tstruk mentioned this issue Jul 13, 2020
Closed
@AndreasFuchsTPM AndreasFuchsTPM added this to the Version 3.1 milestone Jul 15, 2020
JuergenReppSIT added a commit to JuergenReppSIT/tpm2-tss that referenced this issue Nov 27, 2020
@JuergenReppSIT
ESYS: Enable large auth value for keys and NV objects (Addresses tpm2…
69ed996 
…-software#1008).

* The size of the auth value for keys and NV objects is restricted to the size
  of the name hash algorithm of these objects.  Esapi will use the
  hash of the user auth values as auth value for these object.
  The maximal size will be sizeof(TPMU_HA).
* Test cases for keys and NV objects with large auth values were added.

Signed-off-by: Juergen Repp <juergen.repp@sit.fraunhofer.de>
JuergenReppSIT added a commit to JuergenReppSIT/tpm2-tss that referenced this issue Nov 27, 2020
@JuergenReppSIT
ESYS: Enable large auth value for keys and NV objects (Addresses tpm2…
3a4b30c 
…-software#1008).

* The size of the auth value for keys and NV objects is restricted to the size
  of the name hash algorithm of these objects.  Esapi will use the
  hash of the user auth values as auth value for these object.
  The maximal size will be sizeof(TPMU_HA).
* Test cases for keys and NV objects with large auth values were added.

Signed-off-by: Juergen Repp <juergen.repp@sit.fraunhofer.de>
williamcroberts pushed a commit to williamcroberts/tpm2-tss that referenced this issue Feb 1, 2021
@JuergenReppSIT
ESYS: Enable large auth value for keys and NV objects (Addresses tpm2…
c1d7878 
…-software#1008).

* The size of the auth value for keys and NV objects is restricted to the size
  of the name hash algorithm of these objects.  Esapi will use the
  hash of the user auth values as auth value for these object.
  The maximal size will be sizeof(TPMU_HA).
* Test cases for keys and NV objects with large auth values were added.

Signed-off-by: Juergen Repp <juergen.repp@sit.fraunhofer.de>
JuergenReppSIT added a commit to JuergenReppSIT/tpm2-tss that referenced this issue Feb 2, 2021
@JuergenReppSIT
ESYS: Enable large auth value for keys and NV objects (Addresses tpm2…
0f626b5 
…-software#1008).

* The size of the auth value for keys and NV objects is restricted to the size
  of the name hash algorithm of these objects.  Esapi will use the
  hash of the user auth values as auth value for these object.
  The maximal size will be sizeof(TPMU_HA).
* Test cases for keys and NV objects with large auth values were added.

Signed-off-by: Juergen Repp <juergen.repp@sit.fraunhofer.de>
Signed-off-by: William Roberts <william.c.roberts@intel.com>
@williamcroberts
Copy link
Member

So does PR #1929 address all of this? What about hierarchy authorizations? Do sequence objects come through that API?

williamcroberts pushed a commit that referenced this issue Feb 2, 2021
@JuergenReppSIT
ESYS: Enable large auth value for keys and NV objects (Addresses #1008).
29f3f36 
* The size of the auth value for keys and NV objects is restricted to the size
  of the name hash algorithm of these objects.  Esapi will use the
  hash of the user auth values as auth value for these object.
  The maximal size will be sizeof(TPMU_HA).
* Test cases for keys and NV objects with large auth values were added.

Signed-off-by: Juergen Repp <juergen.repp@sit.fraunhofer.de>
Signed-off-by: William Roberts <william.c.roberts@intel.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
enhancement
Projects
None yet
Milestone
Version 3.1
Development

No branches or pull requests
3 participants
@tstruk @AndreasFuchsTPM @williamcroberts