WIP: Provide an optional auth value for a key #32

dmulder · 2024-03-20T16:54:43Z

(Refers|Fixes) #

Checklist

This pr contains no AI generated code
cargo fmt has been run
cargo clippy has been run and there's no issues
cargo test has been run and passes

dmulder · 2024-03-20T16:56:10Z

This isn't working, but I'm posting it here so we can investigate why:

running 11 tests
test soft::tests::aes_256_gcm_enc_dec ... ok
test soft::tests::aes_256_gcm_enc_dec_large ... ok
test soft::ms_extn_tests::soft_ms_extensions ... FAILED
test soft::tests::soft_identity_ecdsa256_csr ... FAILED
test soft::tests::soft_hmac_hw_bound ... FAILED
test soft::tests::soft_identity_ecdsa256_hw_bound ... FAILED
test soft::tests::soft_identity_rsa2048_hw_bound ... FAILED
WARNING:esys:src/tss2-esys/api/Esys_Load.c:324:Esys_Load_Finish() Received TPM Error 
ERROR:esys:src/tss2-esys/api/Esys_Load.c:112:Esys_Load() Esys Finish ErrorCode (0x0000098e) 
2024-03-20T16:44:20.007156Z ERROR tss_esapi::context::tpm_commands::object_commands: Error in loading: 0x0000098E    
2024-03-20T16:44:20.007204Z ERROR kanidm_hsm_crypto::tpm: tpm_err=TssError(Tpm(FormatOne(TpmFormatOneResponseCode { error_number: AuthFail, argument_number: Session(1) })))
WARNING:esys:src/tss2-esys/api/Esys_Load.c:324:Esys_Load_Finish() Received TPM Error 
ERROR:esys:src/tss2-esys/api/Esys_Load.c:112:Esys_Load() Esys Finish ErrorCode (0x0000098e) 
2024-03-20T16:44:20.136390Z ERROR tss_esapi::context::tpm_commands::object_commands: Error in loading: 0x0000098E    
2024-03-20T16:44:20.136423Z ERROR kanidm_hsm_crypto::tpm: tpm_err=TssError(Tpm(FormatOne(TpmFormatOneResponseCode { error_number: AuthFail, argument_number: Session(1) })))
test tpm::ms_extn_tests::tpm_ms_extensions ... FAILED
test tpm::tests::tpm_hmac_hw_bound ... FAILED
WARNING:esys:src/tss2-esys/api/Esys_Load.c:324:Esys_Load_Finish() Received TPM Error 
ERROR:esys:src/tss2-esys/api/Esys_Load.c:112:Esys_Load() Esys Finish ErrorCode (0x0000098e) 
2024-03-20T16:44:47.307023Z ERROR tss_esapi::context::tpm_commands::object_commands: Error in loading: 0x0000098E    
2024-03-20T16:44:47.307096Z ERROR kanidm_hsm_crypto::tpm: tpm_err=TssError(Tpm(FormatOne(TpmFormatOneResponseCode { error_number: AuthFail, argument_number: Session(1) })))
WARNING:esys:src/tss2-esys/api/Esys_Load.c:324:Esys_Load_Finish() Received TPM Error 
ERROR:esys:src/tss2-esys/api/Esys_Load.c:112:Esys_Load() Esys Finish ErrorCode (0x0000098e) 
2024-03-20T16:44:47.637676Z ERROR tss_esapi::context::tpm_commands::object_commands: Error in loading: 0x0000098E    
2024-03-20T16:44:47.637759Z ERROR kanidm_hsm_crypto::tpm: tpm_err=TssError(Tpm(FormatOne(TpmFormatOneResponseCode { error_number: AuthFail, argument_number: Session(1) })))
test tpm::tests::tpm_identity_rsa2048_hw_bound ... FAILED
test tpm::tests::tpm_identity_ecdsa256_hw_bound ... FAILED

failures:

---- soft::ms_extn_tests::soft_ms_extensions stdout ----
thread 'soft::ms_extn_tests::soft_ms_extensions' panicked at src/soft.rs:1051:9:
Unable to create new hmac key: TpmOperationUnsupported
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace

---- soft::tests::soft_identity_ecdsa256_csr stdout ----
thread 'soft::tests::soft_identity_ecdsa256_csr' panicked at src/soft.rs:1039:9:
Unable to create id key: TpmOperationUnsupported

---- soft::tests::soft_hmac_hw_bound stdout ----
thread 'soft::tests::soft_hmac_hw_bound' panicked at src/soft.rs:1016:9:
Unable to create new hmac key: TpmOperationUnsupported

---- soft::tests::soft_identity_ecdsa256_hw_bound stdout ----
thread 'soft::tests::soft_identity_ecdsa256_hw_bound' panicked at src/soft.rs:1024:9:
Unable to create id key: TpmOperationUnsupported

---- soft::tests::soft_identity_rsa2048_hw_bound stdout ----
thread 'soft::tests::soft_identity_rsa2048_hw_bound' panicked at src/soft.rs:1032:9:
Unable to create id key: TpmOperationUnsupported

---- tpm::ms_extn_tests::tpm_ms_extensions stdout ----
thread 'tpm::ms_extn_tests::tpm_ms_extensions' panicked at src/tpm.rs:1631:9:
Unable to load ms rsa key: TpmKeyLoad

---- tpm::tests::tpm_hmac_hw_bound stdout ----
thread 'tpm::tests::tpm_hmac_hw_bound' panicked at src/tpm.rs:1604:9:
Unable to load hmac key: TpmKeyLoad

---- tpm::tests::tpm_identity_rsa2048_hw_bound stdout ----
thread 'tpm::tests::tpm_identity_rsa2048_hw_bound' panicked at src/tpm.rs:1619:9:
Unable to load id key: TpmKeyLoad

---- tpm::tests::tpm_identity_ecdsa256_hw_bound stdout ----
thread 'tpm::tests::tpm_identity_ecdsa256_hw_bound' panicked at src/tpm.rs:1611:9:
Unable to load id key: TpmKeyLoad


failures:
    soft::ms_extn_tests::soft_ms_extensions
    soft::tests::soft_hmac_hw_bound
    soft::tests::soft_identity_ecdsa256_csr
    soft::tests::soft_identity_ecdsa256_hw_bound
    soft::tests::soft_identity_rsa2048_hw_bound
    tpm::ms_extn_tests::tpm_ms_extensions
    tpm::tests::tpm_hmac_hw_bound
    tpm::tests::tpm_identity_ecdsa256_hw_bound
    tpm::tests::tpm_identity_rsa2048_hw_bound

test result: FAILED. 2 passed; 9 failed; 0 ignored; 0 measured; 0 filtered out; finished in 37.68s

dmulder · 2024-03-20T16:57:39Z

Obviously the soft errors are because it hasn't been implemented there yet, but the tpm errors concern me.

Firstyear · 2024-03-21T02:48:05Z

Okay, there are two parts here.

First, the error is the same as what occured with the machine keys. See

https://github.com/kanidm/hsm-crypto/blob/main/src/tpm.rs#L523

What's happening is that when you have a TPM object with an authValue, when we unload it's context (to free memory on the TPM, because we can only store 3 objects at a time) to reload the context you needs it's authValue again.

This means you need to duplicate what the MachineKey does where you have a storage key that has the authValue, then you have the actual key under that without the authValue. You can see this here https://github.com/kanidm/hsm-crypto/blob/main/src/lib.rs#L261 and it's why there is a private/public and an sk private/public.

So this means you need to change https://github.com/kanidm/hsm-crypto/blob/main/src/lib.rs#L402 to have an sk_private/public and then the private/public and cek_private/public need to be subordinate to the authenticated sk.

Second, is why are we adding auth values to all the other key types? I thought we only needed them on the MsOapxbcRsaKey for now to support the behaviours we needed?

dmulder · 2024-03-25T14:31:03Z

Second, is why are we adding auth values to all the other key types? I thought we only needed them on the MsOapxbcRsaKey for now to support the behaviours we needed?

Actually, it's just a plain rsa 2048 key. The key enrollment requires a public rsa 2048 bcrypt blob.

I was adding auth values for all of them because I modified the Tpm trait, forcing me to change all implementations of Tpm.

dmulder · 2024-03-25T20:10:44Z

I was adding auth values for all of them because I modified the Tpm trait, forcing me to change all implementations of Tpm.

Also had to do with all of them calling execute_key_load_to_context to load.

dmulder · 2024-03-25T20:52:51Z

Second, is why are we adding auth values to all the other key types? I thought we only needed them on the MsOapxbcRsaKey for now to support the behaviours we needed?

Hrm, I see what you mean now. I was just adding the auth_value to every function signature that made sense to me in src/libs.rs, doh.

Signed-off-by: David Mulder <[email protected]>

dmulder · 2024-03-26T17:14:02Z

Now I'm getting these errors:

WARNING:esys:src/tss2-esys/api/Esys_Create.c:399:Esys_Create_Finish() Received TPM Error 
ERROR:esys:src/tss2-esys/api/Esys_Create.c:134:Esys_Create() Esys Finish ErrorCode (0x0000018a) 
2024-03-26T17:07:40.836483Z ERROR tss_esapi::context::tpm_commands::object_commands: Error in creating derived key: 0x0000018A    
2024-03-26T17:07:40.836612Z ERROR kanidm_hsm_crypto::tpm: tpm_err=TssError(Tpm(FormatOne(TpmFormatOneResponseCode { error_number: Type, argument_number: Handle(1) })))
WARNING:esys:src/tss2-esys/api/Esys_Create.c:399:Esys_Create_Finish() Received TPM Error 
ERROR:esys:src/tss2-esys/api/Esys_Create.c:134:Esys_Create() Esys Finish ErrorCode (0x0000018a) 
2024-03-26T17:07:41.127127Z ERROR tss_esapi::context::tpm_commands::object_commands: Error in creating derived key: 0x0000018A    
2024-03-26T17:07:41.127213Z ERROR kanidm_hsm_crypto::tpm: tpm_err=TssError(Tpm(FormatOne(TpmFormatOneResponseCode { error_number: Type, argument_number: Handle(1) })))

Trying to track them down.

dmulder · 2024-03-26T18:41:16Z

src/tpm.rs

+                            TpmError::TpmIdentityKeyCreate
+                        })?;
+
+                    let storage_key_pub = Self::create_storage_key_public()?;


I suspect this storage_key_pub is causing the error, but I don't know the correct parameters to build one of these. Reusing (or recreating) key_pub from above causes the same error still.

dmulder · 2024-03-26T18:41:38Z

src/tpm.rs

+                                )
+                                .map_err(|tpm_err| {
+                                    error!(?tpm_err);
+                                    TpmError::TpmIdentityKeyCreate


The failure is happening right here.

Firstyear · 2024-03-27T04:14:10Z

I've fixed the TPM issue in a new PR.

dmulder changed the title ~~Provide an optional auth value for a key~~ WIP: Provide an optional auth value for a key Mar 20, 2024

dmulder requested a review from Firstyear March 20, 2024 16:56

Provide an optional auth value for an IdentityKey

1ec0303

Signed-off-by: David Mulder <[email protected]>

dmulder force-pushed the dmulder/key_auth_value branch from 8731a08 to 1ec0303 Compare March 26, 2024 17:09

dmulder commented Mar 26, 2024

View reviewed changes

Firstyear mentioned this pull request Mar 27, 2024

Dmulder/key auth value #33

Merged

Firstyear closed this Mar 27, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

WIP: Provide an optional auth value for a key #32

WIP: Provide an optional auth value for a key #32

dmulder commented Mar 20, 2024

dmulder commented Mar 20, 2024

dmulder commented Mar 20, 2024

Firstyear commented Mar 21, 2024

dmulder commented Mar 25, 2024 •

edited

Loading

dmulder commented Mar 25, 2024

dmulder commented Mar 25, 2024

dmulder commented Mar 26, 2024

dmulder Mar 26, 2024

dmulder Mar 26, 2024

Firstyear commented Mar 27, 2024

WIP: Provide an optional auth value for a key #32

WIP: Provide an optional auth value for a key #32

Conversation

dmulder commented Mar 20, 2024

Checklist

dmulder commented Mar 20, 2024

dmulder commented Mar 20, 2024

Firstyear commented Mar 21, 2024

dmulder commented Mar 25, 2024 • edited Loading

dmulder commented Mar 25, 2024

dmulder commented Mar 25, 2024

dmulder commented Mar 26, 2024

dmulder Mar 26, 2024

Choose a reason for hiding this comment

dmulder Mar 26, 2024

Choose a reason for hiding this comment

Firstyear commented Mar 27, 2024

dmulder commented Mar 25, 2024 •

edited

Loading