From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751749AbdE3NZr (ORCPT ); Tue, 30 May 2017 09:25:47 -0400 Received: from lhrrgout.huawei.com ([194.213.3.17]:27875 "EHLO lhrrgout.huawei.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751501AbdE3NZp (ORCPT ); Tue, 30 May 2017 09:25:45 -0400 Subject: Re: [Linux-ima-devel] [PATCH v2 3/5] tpm: pass multiple digests to tpm_pcr_extend() To: Mimi Zohar , References: <20170505142152.29795-1-roberto.sassu@huawei.com> <20170505142152.29795-4-roberto.sassu@huawei.com> <1496114943.3841.480.camel@linux.vnet.ibm.com> <97c6930e-8b4d-9578-e210-68987e4d7503@huawei.com> <1496143547.3841.517.camel@linux.vnet.ibm.com> CC: , , , From: Roberto Sassu Message-ID: <5e62a3ba-8d0d-d531-152b-73ce94955124@huawei.com> Date: Tue, 30 May 2017 15:25:20 +0200 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.7.1 MIME-Version: 1.0 In-Reply-To: <1496143547.3841.517.camel@linux.vnet.ibm.com> Content-Type: text/plain; charset="utf-8"; format=flowed Content-Transfer-Encoding: 7bit X-Originating-IP: [10.220.96.113] X-CFilter-Loop: Reflected X-Mirapoint-Virus-RAPID-Raw: score=unknown(0), refid=str=0001.0A020202.592D72C5.003D,ss=1,re=0.000,recu=0.000,reip=0.000,cl=1,cld=1,fgs=0, ip=0.0.0.0, so=2013-06-18 04:22:30, dmn=2013-03-21 17:37:32 X-Mirapoint-Loop-Id: 15fa287f13c1a1204fd7a20859b5812e Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 5/30/2017 1:25 PM, Mimi Zohar wrote: > On Tue, 2017-05-30 at 09:28 +0200, Roberto Sassu wrote: >> On 5/30/2017 5:29 AM, Mimi Zohar wrote: >>> On Fri, 2017-05-05 at 16:21 +0200, Roberto Sassu wrote: > > >>>> @@ -876,29 +925,46 @@ static int tpm1_pcr_extend(struct tpm_chip *chip, int pcr_idx, const u8 *hash, >>>> * isn't, protect against the chip disappearing, by incrementing >>>> * the module usage count. >>>> */ >>>> -int tpm_pcr_extend(u32 chip_num, int pcr_idx, const u8 *hash) >>>> +int tpm_pcr_extend(u32 chip_num, int pcr_idx, int count, >>>> + struct tpm2_digest *digests) >>>> { >>>> int rc; >>>> struct tpm_chip *chip; >>>> struct tpm2_digest digest_list[ARRAY_SIZE(chip->active_banks)]; >>>> - u32 count = 0; >>>> + struct tpm2_digest *digests_ptr = digests; >>>> + u32 filled_count = 0; >>>> + u8 *hash; >>>> int i; >>>> >>>> chip = tpm_chip_find_get(chip_num); >>>> if (chip == NULL) >>>> return -ENODEV; >>>> >>>> - if (chip->flags & TPM_CHIP_FLAG_TPM2) { >>>> + rc = tpm_pcr_check_input(chip, count, digests); >>>> + if (rc < 0) { >>>> + dev_dbg(&chip->dev, "%s: invalid arguments\n", __func__); >>>> + tpm_put_ops(chip); >>> >>> This rejects the TPM extend, if ANY of the algorithms are unknown. >>> Suppose that the standards were updated, TPM vendors add support for >>> the new algorithm, but the kernel has not been updated to reflect the >>> new algorithms supported. As the measurement hash already been added >>> to the IMA measurement list, verifying the measurement list against a >>> TPM quote will fail, not just for the unknown algorithm, but for all >>> algorithms. Something is very broken with this approach. >> >> The alternative is to extend remaining banks with a digest, >> for example the first passed by the caller. I will modify >> the patch, if everyone agrees on that. > > The solution you're proposing is similar to the original solution of > extending the TPM with a padded/truncated SHA1 hash, but this time it > might not be a padded/truncated SHA1 hash, but a different algorithm. > So the attestation server will then need to know which hash algorithm > was used to extend each of the TPM banks - a padded/truncated digest > value or the real digest value. The convention would be that the first digest in the event log is truncated/padded, to extend banks for which no digest is provided. This convention would apply to all callers of tpm_pcr_extend(). Roberto > The only issue, from the kernel's perspective, will be determining the > algorithm's digest size as the kernel has no knowledge of it. On TPM > registration/initialization, if you're not already querying the TPM > for the algorithm digest sizes, you will need to do so. > > Mimi > -- HUAWEI TECHNOLOGIES Duesseldorf GmbH, HRB 56063 Managing Director: Bo PENG, Qiuen PENG, Shengli WANG