diff --git a/tss-esapi/src/abstraction/transient/key_attestation.rs b/tss-esapi/src/abstraction/transient/key_attestation.rs index dd5cfd45..c70e9491 100644 --- a/tss-esapi/src/abstraction/transient/key_attestation.rs +++ b/tss-esapi/src/abstraction/transient/key_attestation.rs @@ -10,36 +10,23 @@ use crate::{ session_handles::{AuthSession, PolicySession}, }, structures::{EncryptedSecret, IDObject, SymmetricDefinition}, - tss2_esys::{TPM2B_PUBLIC, TPMT_PUBLIC}, + tss2_esys::{Tss2_MU_TPM2B_PUBLIC_Marshal, TPM2B_PUBLIC}, utils::PublicKey, - Result, + Error, Result, }; -use std::convert::{TryFrom, TryInto}; +use log::error; +use std::convert::TryFrom; #[derive(Debug)] /// Wrapper for the parameters needed by MakeCredential pub struct MakeCredParams { /// TPM name of the object - name: Vec, + pub name: Vec, /// Encoding of the public parameters of the object whose name /// will be included in the credential computations - public: Vec, + pub public: Vec, /// Public part of the key used to protect the credential - attesting_key_pub: PublicKey, -} - -impl MakeCredParams { - pub fn name(&self) -> &[u8] { - &self.name - } - - pub fn public(&self) -> &[u8] { - &self.public - } - - pub fn attesting_key_pub(&self) -> &PublicKey { - &self.attesting_key_pub - } + pub attesting_key_pub: PublicKey, } impl TransientKeyContext { @@ -68,29 +55,29 @@ impl TransientKeyContext { self.context.flush_context(object_handle.into())?; let public = TPM2B_PUBLIC::from(object_public); - let public = unsafe { - std::mem::transmute::()]>( - public.publicArea, + let mut pub_buf = [0u8; std::mem::size_of::()]; + let mut offset = 0; + let result = unsafe { + Tss2_MU_TPM2B_PUBLIC_Marshal( + &public, + &mut pub_buf as *mut u8, + pub_buf.len() as u64, + &mut offset, ) }; - let attesting_key_pub = match key { - None => { - let key_handle = - ek::create_ek_object(&mut self.context, AsymmetricAlgorithm::Rsa, None)?; - let (attesting_key_pub, _, _) = - self.context.read_public(key_handle).or_else(|e| { - self.context.flush_context(key_handle.into())?; - Err(e) - })?; - self.context.flush_context(key_handle.into())?; + let result = Error::from_tss_rc(result); + if !result.is_success() { + error!("Error in marshalling TPM2B"); + return Err(result); + } - attesting_key_pub.try_into()? - } + let attesting_key_pub = match key { + None => get_ek_object_public(&mut self.context)?, Some(key) => key.material.public, }; Ok(MakeCredParams { name: object_name.value().to_vec(), - public: public.to_vec(), + public: pub_buf.to_vec(), attesting_key_pub, }) } @@ -203,3 +190,14 @@ impl TransientKeyContext { )) } } + +fn get_ek_object_public(context: &mut crate::Context) -> Result { + let key_handle = ek::create_ek_object(context, AsymmetricAlgorithm::Rsa, None)?; + let (attesting_key_pub, _, _) = context.read_public(key_handle).or_else(|e| { + context.flush_context(key_handle.into())?; + Err(e) + })?; + context.flush_context(key_handle.into())?; + + PublicKey::try_from(attesting_key_pub) +} diff --git a/tss-esapi/src/abstraction/transient/mod.rs b/tss-esapi/src/abstraction/transient/mod.rs index fe11e173..0e8071db 100644 --- a/tss-esapi/src/abstraction/transient/mod.rs +++ b/tss-esapi/src/abstraction/transient/mod.rs @@ -42,6 +42,8 @@ use zeroize::Zeroize; mod key_attestation; +pub use key_attestation::MakeCredParams; + /// Parameters for the kinds of keys supported by the context #[derive(Debug, Clone, Copy)] pub enum KeyParams { diff --git a/tss-esapi/tests/integration_tests/abstraction_tests/transient_key_context_tests.rs b/tss-esapi/tests/integration_tests/abstraction_tests/transient_key_context_tests.rs index 887926bb..67244d05 100644 --- a/tss-esapi/tests/integration_tests/abstraction_tests/transient_key_context_tests.rs +++ b/tss-esapi/tests/integration_tests/abstraction_tests/transient_key_context_tests.rs @@ -644,7 +644,7 @@ fn activate_credential() { name_hashing_algorithm, auth_policy, parameters, - unique: if let PublicKey::Rsa(val) = make_cred_params.attesting_key_pub().clone() { + unique: if let PublicKey::Rsa(val) = make_cred_params.attesting_key_pub { PublicKeyRsa::try_from(val).unwrap() } else { panic!("Wrong public key type"); @@ -664,7 +664,7 @@ fn activate_credential() { .make_credential( pub_handle, credential.clone().try_into().unwrap(), - make_cred_params.name().to_vec().try_into().unwrap(), + make_cred_params.name.try_into().unwrap(), ) .unwrap();