From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752426AbdAYWLr (ORCPT ); Wed, 25 Jan 2017 17:11:47 -0500 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]:51387 "EHLO mx0a-001b2d01.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751703AbdAYWLq (ORCPT ); Wed, 25 Jan 2017 17:11:46 -0500 To: linux-kernel@vger.kernel.org, linux-security-module@vger.kernel.org, tpmdd-devel@lists.sourceforge.net From: Ken Goldman Subject: [tpmdd-devel] [PATCH v6 2/2] tpm: enhance TPM 2.0 PCR extend to,support multiple banks Date: Wed, 25 Jan 2017 17:11:42 -0500 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.6.0 MIME-Version: 1.0 Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit X-TM-AS-GCONF: 00 X-Content-Scanned: Fidelis XPS MAILER x-cbid: 17012522-0044-0000-0000-00000260AC03 X-IBM-SpamModules-Scores: X-IBM-SpamModules-Versions: BY=3.00006498; HX=3.00000240; KW=3.00000007; PH=3.00000004; SC=3.00000200; SDB=6.00812667; UDB=6.00396356; IPR=6.00590085; BA=6.00005090; NDR=6.00000001; ZLA=6.00000005; ZF=6.00000009; ZB=6.00000000; ZP=6.00000000; ZH=6.00000000; ZU=6.00000002; MB=3.00014048; XFM=3.00000011; UTC=2017-01-25 22:11:42 X-IBM-AV-DETECTION: SAVI=unused REMOTE=unused XFE=unused x-cbparentid: 17012522-0045-0000-0000-0000068DABB2 Message-Id: X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:,, definitions=2017-01-25_16:,, signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 suspectscore=0 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1612050000 definitions=main-1701250207 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org > The current TPM 2.0 device driver extends only the SHA1 PCR bank > but the TCG Specification[1] recommends extending all active PCR > banks, to prevent malicious users from setting unused PCR banks with > fake measurements and quoting them. > > The existing in-kernel interface(tpm_pcr_extend()) expects only a > SHA1 digest. To extend all active PCR banks with differing > digest sizes, the SHA1 digest is padded with trailing 0's as needed. > > This patch reuses the defined digest sizes from the crypto subsystem, > adding a dependency on CRYPTO_HASH_INFO module. > > [1] TPM 2.0 Specification referred here is "TCG PC Client Specific > Platform Firmware Profile for TPM 2.0" Tested-by: Kenneth Goldman I obtained an IMA event log from a Power platform, along with the PCR 10 value from both the SHA-1 and SHA-256 banks of its Nuvoton TPM 2.0. I independently validated that the event log matches the TPM PCR values.