2020-02-14 11:50:13 +01:00
|
|
|
// Copyright 2020 Patrick Uiterwijk
|
|
|
|
//
|
2021-12-09 12:12:37 +01:00
|
|
|
// Licensed under the MIT license
|
2020-02-14 11:50:13 +01:00
|
|
|
|
2020-12-03 14:49:41 +01:00
|
|
|
use std::convert::{TryFrom, TryInto};
|
2020-02-14 11:50:13 +01:00
|
|
|
use std::env;
|
|
|
|
use std::io::{self, Read, Write};
|
|
|
|
|
2021-12-07 16:16:15 +01:00
|
|
|
use anyhow::{bail, Context, Error, Result};
|
|
|
|
use josekit::jwe::{alg::direct::DirectJweAlgorithm::Dir, enc::A256GCM};
|
2020-02-14 11:50:13 +01:00
|
|
|
use serde::{Deserialize, Serialize};
|
2020-08-03 17:07:04 +02:00
|
|
|
use tpm2_policy::TPMPolicyStep;
|
2021-12-07 16:16:15 +01:00
|
|
|
use tss_esapi::structures::SensitiveData;
|
2020-08-03 12:11:43 +02:00
|
|
|
|
2020-08-03 17:07:04 +02:00
|
|
|
mod cli;
|
2020-08-03 16:47:21 +02:00
|
|
|
mod tpm_objects;
|
2020-08-03 17:07:04 +02:00
|
|
|
mod utils;
|
2020-08-03 16:47:21 +02:00
|
|
|
|
2020-08-03 17:07:04 +02:00
|
|
|
use cli::TPM2Config;
|
2020-07-17 10:42:04 +02:00
|
|
|
|
2021-12-07 16:16:15 +01:00
|
|
|
fn perform_encrypt(cfg: TPM2Config, input: Vec<u8>) -> Result<()> {
|
2020-02-14 11:50:13 +01:00
|
|
|
let key_type = match &cfg.key {
|
|
|
|
None => "ecc",
|
|
|
|
Some(key_type) => key_type,
|
|
|
|
};
|
2021-12-08 13:18:23 +01:00
|
|
|
let key_public = tpm_objects::get_key_public(key_type, cfg.get_name_hash_alg())?;
|
2020-02-14 11:50:13 +01:00
|
|
|
|
2020-08-03 17:07:04 +02:00
|
|
|
let mut ctx = utils::get_tpm2_ctx()?;
|
2022-04-19 14:01:11 +02:00
|
|
|
let key_handle = utils::get_tpm2_primary_key(&mut ctx, key_public)?;
|
2020-02-14 11:50:13 +01:00
|
|
|
|
|
|
|
let policy_runner: TPMPolicyStep = TPMPolicyStep::try_from(&cfg)?;
|
|
|
|
|
|
|
|
let pin_type = match policy_runner {
|
|
|
|
TPMPolicyStep::NoStep => "tpm2",
|
|
|
|
TPMPolicyStep::PCRs(_, _, _) => "tpm2",
|
|
|
|
_ => "tpm2plus",
|
|
|
|
};
|
|
|
|
|
2020-12-03 14:49:41 +01:00
|
|
|
let (_, policy_digest) = policy_runner.send_policy(&mut ctx, true)?;
|
2020-02-14 11:50:13 +01:00
|
|
|
|
2021-12-07 16:16:15 +01:00
|
|
|
let mut jwk = josekit::jwk::Jwk::generate_oct_key(32).context("Error generating random JWK")?;
|
|
|
|
jwk.set_key_operations(vec!["encrypt", "decrypt"]);
|
|
|
|
let jwk_str = serde_json::to_string(&jwk.as_ref())?;
|
2020-02-14 11:50:13 +01:00
|
|
|
|
2022-04-19 14:01:11 +02:00
|
|
|
let public = tpm_objects::create_tpm2b_public_sealed_object(policy_digest)?.try_into()?;
|
2020-08-13 10:42:18 +02:00
|
|
|
let jwk_str = SensitiveData::try_from(jwk_str.as_bytes().to_vec())?;
|
2020-12-03 14:49:41 +01:00
|
|
|
let jwk_result = ctx.execute_with_nullauth_session(|ctx| {
|
2022-04-19 14:01:11 +02:00
|
|
|
ctx.create(key_handle, public, None, Some(jwk_str), None, None)
|
2020-12-03 14:49:41 +01:00
|
|
|
})?;
|
2020-02-14 11:50:13 +01:00
|
|
|
|
2021-04-06 09:45:14 +02:00
|
|
|
let jwk_priv = tpm_objects::get_tpm2b_private(jwk_result.out_private.into())?;
|
2020-02-14 11:50:13 +01:00
|
|
|
|
2022-04-19 14:01:11 +02:00
|
|
|
let jwk_pub = tpm_objects::get_tpm2b_public(jwk_result.out_public.try_into()?)?;
|
2020-02-14 11:50:13 +01:00
|
|
|
|
2021-12-07 16:16:15 +01:00
|
|
|
let private_hdr = ClevisInner {
|
|
|
|
pin: pin_type.to_string(),
|
|
|
|
tpm2: Tpm2Inner {
|
|
|
|
hash: cfg.hash.as_ref().unwrap_or(&"sha256".to_string()).clone(),
|
|
|
|
key: key_type.to_string(),
|
|
|
|
jwk_pub,
|
|
|
|
jwk_priv,
|
|
|
|
pcr_bank: cfg.pcr_bank.clone(),
|
|
|
|
pcr_ids: cfg.get_pcr_ids_str(),
|
|
|
|
policy_pubkey_path: cfg.policy_pubkey_path,
|
|
|
|
policy_ref: cfg.policy_ref,
|
|
|
|
policy_path: cfg.policy_path,
|
2020-02-14 11:50:13 +01:00
|
|
|
},
|
|
|
|
};
|
|
|
|
|
2021-12-07 16:16:15 +01:00
|
|
|
let mut hdr = josekit::jwe::JweHeader::new();
|
|
|
|
hdr.set_algorithm(Dir.name());
|
|
|
|
hdr.set_content_encryption(A256GCM.name());
|
|
|
|
hdr.set_claim(
|
|
|
|
"clevis",
|
|
|
|
Some(serde_json::value::to_value(private_hdr).context("Error serializing private header")?),
|
|
|
|
)
|
|
|
|
.context("Error adding clevis claim")?;
|
|
|
|
|
|
|
|
let encrypter = Dir
|
|
|
|
.encrypter_from_jwk(&jwk)
|
|
|
|
.context("Error creating direct encrypter")?;
|
|
|
|
let jwe_token = josekit::jwe::serialize_compact(&input, &hdr, &encrypter)
|
|
|
|
.context("Error serializing JWE token")?;
|
2020-02-14 11:50:13 +01:00
|
|
|
|
2021-12-07 16:16:15 +01:00
|
|
|
io::stdout().write_all(jwe_token.as_bytes())?;
|
2020-02-14 11:50:13 +01:00
|
|
|
|
|
|
|
Ok(())
|
|
|
|
}
|
|
|
|
|
|
|
|
#[derive(Debug, Serialize, Deserialize, Clone)]
|
|
|
|
struct Tpm2Inner {
|
|
|
|
hash: String,
|
|
|
|
#[serde(
|
2020-08-03 17:07:04 +02:00
|
|
|
deserialize_with = "utils::deserialize_as_base64_url_no_pad",
|
|
|
|
serialize_with = "utils::serialize_as_base64_url_no_pad"
|
2020-02-14 11:50:13 +01:00
|
|
|
)]
|
|
|
|
jwk_priv: Vec<u8>,
|
|
|
|
#[serde(
|
2020-08-03 17:07:04 +02:00
|
|
|
deserialize_with = "utils::deserialize_as_base64_url_no_pad",
|
|
|
|
serialize_with = "utils::serialize_as_base64_url_no_pad"
|
2020-02-14 11:50:13 +01:00
|
|
|
)]
|
|
|
|
jwk_pub: Vec<u8>,
|
|
|
|
key: String,
|
|
|
|
|
|
|
|
// PCR Binding may be specified, may not
|
|
|
|
#[serde(skip_serializing_if = "Option::is_none")]
|
|
|
|
pcr_bank: Option<String>,
|
|
|
|
#[serde(skip_serializing_if = "Option::is_none")]
|
|
|
|
pcr_ids: Option<String>,
|
|
|
|
|
|
|
|
// Public key (in PEM format) for a wildcard policy that's OR'd with the PCR one
|
|
|
|
#[serde(skip_serializing_if = "Option::is_none")]
|
|
|
|
policy_pubkey_path: Option<String>,
|
|
|
|
#[serde(skip_serializing_if = "Option::is_none")]
|
|
|
|
policy_ref: Option<String>,
|
|
|
|
#[serde(skip_serializing_if = "Option::is_none")]
|
|
|
|
policy_path: Option<String>,
|
|
|
|
}
|
|
|
|
|
|
|
|
impl Tpm2Inner {
|
|
|
|
fn get_pcr_ids(&self) -> Option<Vec<u64>> {
|
|
|
|
Some(
|
|
|
|
self.pcr_ids
|
|
|
|
.as_ref()?
|
|
|
|
.split(',')
|
|
|
|
.map(|x| x.parse::<u64>().unwrap())
|
|
|
|
.collect(),
|
|
|
|
)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
impl TryFrom<&Tpm2Inner> for TPMPolicyStep {
|
2021-12-07 16:16:15 +01:00
|
|
|
type Error = Error;
|
2020-02-14 11:50:13 +01:00
|
|
|
|
2021-12-07 16:16:15 +01:00
|
|
|
fn try_from(cfg: &Tpm2Inner) -> Result<Self> {
|
2020-02-14 11:50:13 +01:00
|
|
|
if cfg.pcr_ids.is_some() && cfg.policy_pubkey_path.is_some() {
|
|
|
|
Ok(TPMPolicyStep::Or([
|
|
|
|
Box::new(TPMPolicyStep::PCRs(
|
2021-11-03 10:24:38 +01:00
|
|
|
utils::get_hash_alg_from_name(cfg.pcr_bank.as_ref()),
|
2020-02-14 11:50:13 +01:00
|
|
|
cfg.get_pcr_ids().unwrap(),
|
|
|
|
Box::new(TPMPolicyStep::NoStep),
|
|
|
|
)),
|
2020-08-03 17:07:04 +02:00
|
|
|
Box::new(utils::get_authorized_policy_step(
|
2020-02-14 11:50:13 +01:00
|
|
|
cfg.policy_pubkey_path.as_ref().unwrap(),
|
|
|
|
&cfg.policy_path,
|
|
|
|
&cfg.policy_ref,
|
|
|
|
)?),
|
|
|
|
Box::new(TPMPolicyStep::NoStep),
|
|
|
|
Box::new(TPMPolicyStep::NoStep),
|
|
|
|
Box::new(TPMPolicyStep::NoStep),
|
|
|
|
Box::new(TPMPolicyStep::NoStep),
|
|
|
|
Box::new(TPMPolicyStep::NoStep),
|
|
|
|
Box::new(TPMPolicyStep::NoStep),
|
|
|
|
]))
|
|
|
|
} else if cfg.pcr_ids.is_some() {
|
|
|
|
Ok(TPMPolicyStep::PCRs(
|
2021-11-03 10:24:38 +01:00
|
|
|
utils::get_hash_alg_from_name(cfg.pcr_bank.as_ref()),
|
2020-02-14 11:50:13 +01:00
|
|
|
cfg.get_pcr_ids().unwrap(),
|
|
|
|
Box::new(TPMPolicyStep::NoStep),
|
|
|
|
))
|
|
|
|
} else if cfg.policy_pubkey_path.is_some() {
|
2020-08-03 17:07:04 +02:00
|
|
|
utils::get_authorized_policy_step(
|
2020-02-14 11:50:13 +01:00
|
|
|
cfg.policy_pubkey_path.as_ref().unwrap(),
|
|
|
|
&cfg.policy_path,
|
|
|
|
&cfg.policy_ref,
|
|
|
|
)
|
|
|
|
} else {
|
|
|
|
Ok(TPMPolicyStep::NoStep)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
#[derive(Debug, Serialize, Deserialize, Clone)]
|
|
|
|
struct ClevisInner {
|
|
|
|
pin: String,
|
|
|
|
tpm2: Tpm2Inner,
|
|
|
|
}
|
|
|
|
|
2021-12-07 16:16:15 +01:00
|
|
|
fn perform_decrypt(input: Vec<u8>) -> Result<()> {
|
|
|
|
let input = String::from_utf8(input).context("Error reading input")?;
|
|
|
|
let hdr = josekit::jwt::decode_header(&input).context("Error decoding header")?;
|
|
|
|
let hdr_clevis = hdr.claim("clevis").context("Error getting clevis claim")?;
|
|
|
|
let hdr_clevis: ClevisInner =
|
|
|
|
serde_json::from_value(hdr_clevis.clone()).context("Error deserializing clevis header")?;
|
2020-02-14 11:50:13 +01:00
|
|
|
|
2021-12-07 16:16:15 +01:00
|
|
|
if hdr_clevis.pin != "tpm2" && hdr_clevis.pin != "tpm2plus" {
|
|
|
|
bail!("JWE pin mismatch");
|
2020-02-14 11:50:13 +01:00
|
|
|
}
|
|
|
|
|
2022-04-19 14:01:11 +02:00
|
|
|
let jwkpub = tpm_objects::build_tpm2b_public(&hdr_clevis.tpm2.jwk_pub)?.try_into()?;
|
2021-12-07 16:16:15 +01:00
|
|
|
let jwkpriv = tpm_objects::build_tpm2b_private(&hdr_clevis.tpm2.jwk_priv)?;
|
2020-02-14 11:50:13 +01:00
|
|
|
|
2021-12-07 16:16:15 +01:00
|
|
|
let policy = TPMPolicyStep::try_from(&hdr_clevis.tpm2)?;
|
2020-02-14 11:50:13 +01:00
|
|
|
|
2021-12-07 16:16:15 +01:00
|
|
|
let name_alg = crate::utils::get_hash_alg_from_name(Some(&hdr_clevis.tpm2.hash));
|
|
|
|
let key_public = tpm_objects::get_key_public(hdr_clevis.tpm2.key.as_str(), name_alg)?;
|
2020-02-14 11:50:13 +01:00
|
|
|
|
2020-08-03 17:07:04 +02:00
|
|
|
let mut ctx = utils::get_tpm2_ctx()?;
|
2022-04-19 14:01:11 +02:00
|
|
|
let key_handle = utils::get_tpm2_primary_key(&mut ctx, key_public)?;
|
2020-02-14 11:50:13 +01:00
|
|
|
|
2020-12-03 14:49:41 +01:00
|
|
|
let key =
|
|
|
|
ctx.execute_with_nullauth_session(|ctx| ctx.load(key_handle, jwkpriv.try_into()?, jwkpub))?;
|
2020-02-14 11:50:13 +01:00
|
|
|
|
2020-12-03 14:49:41 +01:00
|
|
|
let (policy_session, _) = policy.send_policy(&mut ctx, false)?;
|
2020-02-14 11:50:13 +01:00
|
|
|
|
2020-12-03 14:49:41 +01:00
|
|
|
let unsealed = ctx.execute_with_session(policy_session, |ctx| ctx.unseal(key.into()))?;
|
2020-02-14 11:50:13 +01:00
|
|
|
let unsealed = &unsealed.value();
|
2021-12-07 16:16:15 +01:00
|
|
|
let mut jwk = josekit::jwk::Jwk::from_bytes(unsealed).context("Error unmarshaling JWK")?;
|
2021-12-08 15:28:17 +01:00
|
|
|
jwk.set_parameter("alg", None)
|
|
|
|
.context("Error removing the alg parameter")?;
|
2021-12-07 16:16:15 +01:00
|
|
|
let decrypter = Dir
|
|
|
|
.decrypter_from_jwk(&jwk)
|
|
|
|
.context("Error creating decrypter")?;
|
2020-02-14 11:50:13 +01:00
|
|
|
|
2021-12-07 16:16:15 +01:00
|
|
|
let (payload, _) =
|
|
|
|
josekit::jwe::deserialize_compact(&input, &decrypter).context("Error decrypting JWE")?;
|
2020-02-14 11:50:13 +01:00
|
|
|
|
2021-12-07 16:16:15 +01:00
|
|
|
io::stdout().write_all(&payload)?;
|
2020-02-14 11:50:13 +01:00
|
|
|
|
|
|
|
Ok(())
|
|
|
|
}
|
|
|
|
|
2020-08-03 10:52:05 +02:00
|
|
|
fn print_summary() {
|
|
|
|
println!("Encrypts using a TPM2.0 chip binding policy");
|
|
|
|
}
|
|
|
|
|
|
|
|
fn print_help() {
|
2020-08-03 17:07:04 +02:00
|
|
|
eprintln!(
|
|
|
|
"
|
2022-09-14 16:23:43 +02:00
|
|
|
Usage (encryption): clevis encrypt tpm2 CONFIG < PLAINTEXT > JWE
|
|
|
|
Usage (decryption): clevis decrypt tpm2 CONFIG < JWE > PLAINTEXT
|
2020-08-03 10:52:05 +02:00
|
|
|
|
2022-09-14 16:23:43 +02:00
|
|
|
Encrypts or decrypts using a TPM2.0 chip binding policy
|
2020-08-03 10:52:05 +02:00
|
|
|
|
|
|
|
This command uses the following configuration properties:
|
|
|
|
|
|
|
|
hash: <string> Hash algorithm used in the computation of the object name (default: sha256)
|
|
|
|
|
2022-09-14 16:23:43 +02:00
|
|
|
key: <string> Algorithm type for the generated key (options: ecc, rsa; default: ecc)
|
2020-08-03 10:52:05 +02:00
|
|
|
|
|
|
|
pcr_bank: <string> PCR algorithm bank to use for policy (default: sha256)
|
|
|
|
|
|
|
|
pcr_ids: <string> PCR list used for policy. If not present, no PCR policy is used
|
|
|
|
|
2020-12-03 17:41:48 +01:00
|
|
|
use_policy: <bool> Whether to use a policy
|
2020-08-03 10:52:05 +02:00
|
|
|
|
2020-12-03 17:41:48 +01:00
|
|
|
policy_ref: <string> Reference to search for in signed policy file (default: {})
|
2020-08-03 10:52:05 +02:00
|
|
|
|
2020-12-03 17:41:48 +01:00
|
|
|
> For policies, the path is {}, and the public key is at {}
|
|
|
|
",
|
|
|
|
cli::DEFAULT_POLICY_REF,
|
|
|
|
cli::DEFAULT_POLICY_PATH,
|
|
|
|
cli::DEFAULT_PUBKEY_PATH,
|
2020-08-03 17:07:04 +02:00
|
|
|
);
|
2020-08-03 10:52:05 +02:00
|
|
|
|
|
|
|
std::process::exit(2);
|
|
|
|
}
|
|
|
|
|
2021-12-07 16:16:15 +01:00
|
|
|
fn main() -> Result<()> {
|
2020-02-14 11:50:13 +01:00
|
|
|
let args: Vec<String> = env::args().collect();
|
2020-08-03 17:07:04 +02:00
|
|
|
let (mode, cfg) = match cli::get_mode_and_cfg(&args) {
|
2020-02-14 11:50:13 +01:00
|
|
|
Err(e) => {
|
|
|
|
eprintln!("Error during parsing operation: {}", e);
|
|
|
|
std::process::exit(1);
|
|
|
|
}
|
|
|
|
Ok((mode, cfg)) => (mode, cfg),
|
|
|
|
};
|
|
|
|
|
2020-08-03 10:52:05 +02:00
|
|
|
match mode {
|
2021-12-08 13:18:23 +01:00
|
|
|
cli::ActionMode::Summary => {
|
|
|
|
print_summary();
|
|
|
|
return Ok(());
|
|
|
|
}
|
|
|
|
cli::ActionMode::Help => {
|
|
|
|
print_help();
|
|
|
|
return Ok(());
|
|
|
|
}
|
2020-08-03 17:07:04 +02:00
|
|
|
_ => {}
|
2020-08-03 10:52:05 +02:00
|
|
|
};
|
|
|
|
|
2021-09-29 13:45:02 +02:00
|
|
|
let mut input = Vec::new();
|
|
|
|
if let Err(e) = io::stdin().read_to_end(&mut input) {
|
|
|
|
eprintln!("Error getting input token: {}", e);
|
|
|
|
std::process::exit(1);
|
|
|
|
}
|
2020-02-14 11:50:13 +01:00
|
|
|
|
2021-12-07 16:16:15 +01:00
|
|
|
match mode {
|
2021-09-29 13:45:02 +02:00
|
|
|
cli::ActionMode::Encrypt => perform_encrypt(cfg.unwrap(), input),
|
|
|
|
cli::ActionMode::Decrypt => perform_decrypt(input),
|
2021-12-07 16:16:15 +01:00
|
|
|
cli::ActionMode::Summary => unreachable!(),
|
|
|
|
cli::ActionMode::Help => unreachable!(),
|
2020-02-14 11:50:13 +01:00
|
|
|
}
|
|
|
|
}
|