diff --git a/SOURCES/0001-utils-Generate-X509-certificate-serial-number-using-.patch b/SOURCES/0001-utils-Generate-X509-certificate-serial-number-using-.patch new file mode 100644 index 0000000..e1ec3dc --- /dev/null +++ b/SOURCES/0001-utils-Generate-X509-certificate-serial-number-using-.patch @@ -0,0 +1,62 @@ +From e0c1e3efd187a3cfa77906eef978fa6beada0b31 Mon Sep 17 00:00:00 2001 +From: Ken Goldman +Date: Thu, 1 Jul 2021 13:55:28 -0400 +Subject: [PATCH] utils: Generate X509 certificate serial number using sha256 + +This is just a test certificate, not a real CA. Certificate serial +numbers can be 20 octets maximum. Use a truncated sha256 because some +'lint' programs are now scanning for sha1. + +Signed-off-by: Ken Goldman +--- + utils/ekutils.c | 18 ++++++++++++++---- + 1 file changed, 14 insertions(+), 4 deletions(-) + +diff --git a/utils/ekutils.c b/utils/ekutils.c +index a0a2734..aad6fba 100644 +--- a/utils/ekutils.c ++++ b/utils/ekutils.c +@@ -61,6 +61,7 @@ + + #include + #include ++#include + + #include + #include +@@ -1835,7 +1836,7 @@ TPM_RC startCertificate(X509 *x509Certificate, /* X509 certificate to be generat + ASN1_TIME *arc; /* return code */ + ASN1_INTEGER *x509Serial; /* certificate serial number in ASN1 */ + BIGNUM *x509SerialBN; /* certificate serial number as a BIGNUM */ +- unsigned char x509Serialbin[SHA1_DIGEST_SIZE]; /* certificate serial number in binary */ ++ unsigned char x509Serialbin[EVP_MAX_MD_SIZE]; /* certificate serial number in binary */ + X509_NAME *x509IssuerName; /* composite issuer name, key/value pairs */ + X509_NAME *x509SubjectName; /* composite subject name, key/value pairs */ + +@@ -1855,11 +1856,20 @@ TPM_RC startCertificate(X509 *x509Certificate, /* X509 certificate to be generat + add certificate serial number + */ + if (rc == 0) { ++ const EVP_MD *type; ++ + if (tssUtilsVerbose) printf("startCertificate: Adding certificate serial number\n"); + /* to create a unique serial number, hash the key to be certified */ +- SHA1(keyBuffer, keyLength, x509Serialbin); +- /* convert the SHA1 digest to a BIGNUM */ +- x509SerialBN = BN_bin2bn(x509Serialbin, SHA1_DIGEST_SIZE, x509SerialBN); ++ type = EVP_sha256(); ++ irc = EVP_Digest(keyBuffer, keyLength, x509Serialbin, NULL, type, NULL); ++ if (irc == 0) { ++ printf("startCertificate: Error in serial number EVP_Digest\n"); ++ rc = TSS_RC_X509_ERROR; ++ } ++ } ++ if (rc == 0) { ++ /* convert the digest to a BIGNUM, use 20 octets */ ++ x509SerialBN = BN_bin2bn(x509Serialbin, 20, x509SerialBN); + if (x509SerialBN == NULL) { + printf("startCertificate: Error in serial number BN_bin2bn\n"); + rc = TSS_RC_X509_ERROR; +-- +2.34.1 + diff --git a/SOURCES/0002-Update-SHA-1-to-SHA-256-in-tests-without-restricting.patch b/SOURCES/0002-Update-SHA-1-to-SHA-256-in-tests-without-restricting.patch new file mode 100644 index 0000000..bf9022a --- /dev/null +++ b/SOURCES/0002-Update-SHA-1-to-SHA-256-in-tests-without-restricting.patch @@ -0,0 +1,600 @@ +From 14ccbe9112e21fe62d5cbbbebeae71ec38b77e4a Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?=C5=A0t=C4=9Bp=C3=A1n=20Hor=C3=A1=C4=8Dek?= + +Date: Thu, 17 Feb 2022 16:29:39 +0100 +Subject: [PATCH 2/4] Update SHA-1 to SHA-256 in tests without restricting the + scope +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Signed-off-by: Štěpán Horáček +--- + utils/policies/policycountertimer.bin | Bin 20 -> 32 bytes + utils/policies/policycphash.bin | Bin 20 -> 32 bytes + utils/policies/policycphash.txt | 2 +- + utils/policies/policycphashhash.bin | 2 +- + utils/policies/policynvargs.txt | Bin 13 -> 12 bytes + utils/policies/policynvnv.bin | Bin 20 -> 32 bytes + utils/policies/policynvnv.txt | 2 +- + utils/policies/policypcr.bin | 2 +- + utils/policies/policypcr0.txt | 2 +- + utils/policies/policypcrbm0.bin | Bin 20 -> 32 bytes + utils/policies/policywrittenset.bin | 2 +- + utils/reg.sh | 2 + + utils/regtests/testchangeauth.sh | 4 +- + utils/regtests/testevict.sh | 12 ++-- + utils/regtests/testnv.sh | 6 +- + utils/regtests/testpolicy.sh | 80 +++++++++++++------------- + utils/regtests/testrsa.sh | 8 +-- + utils/regtests/testsign.sh | 12 ++-- + 18 files changed, 69 insertions(+), 67 deletions(-) + +diff --git a/utils/policies/policycountertimer.bin b/utils/policies/policycountertimer.bin +index f767440113ab39251794257628b34f761ae05121..8937a155bdcdc535e5f013a03ce58fd5a193a6fd 100644 +GIT binary patch +literal 32 +ocmeBTv0vY?A&j>pRZ{#s$085m*E`r54EYbFMa|K0nsfat0L0V`*#H0l + +literal 20 +ccmaFX(x@JK!18iNvf_!!0jhUbsX5I80B48^c>n+a + +diff --git a/utils/policies/policycphash.bin b/utils/policies/policycphash.bin +index 1c357a65cc7cf408bc27d0a2a5c6a0735778e5ed..0f998b85ac2b6620049e350b0c31cc38b2f7414a 100644 +GIT binary patch +literal 32 +qcmV+*0N?)`MNQmbPb!)?)%V_-p09oM)7XSbN + +diff --git a/utils/policies/policynvnv.txt b/utils/policies/policynvnv.txt +index a124ea9..5d3d62e 100644 +--- a/utils/policies/policynvnv.txt ++++ b/utils/policies/policynvnv.txt +@@ -1 +1 @@ +-000001492c513f149e737ec4063fc1d37aee9beabc4b4bbf00042234b8df7cdf8605ee0a2088ac7dfe34c6566c5c +\ No newline at end of file ++0000014915ec7bf0b50732b49f8228e07d24365338f9e3ab994b00af08e5a3bffe55fd8b000b45a8f4283309cd5ef189746d7526786f712eb3df9960508ee343d3e63376bc6c +\ No newline at end of file +diff --git a/utils/policies/policypcr.bin b/utils/policies/policypcr.bin +index 8f69740..2597338 100644 +--- a/utils/policies/policypcr.bin ++++ b/utils/policies/policypcr.bin +@@ -1 +1 @@ +-3<`C4o7!v +\ No newline at end of file ++Վ|Or3pRwT 6 +\ No newline at end of file +diff --git a/utils/policies/policypcr0.txt b/utils/policies/policypcr0.txt +index b61f288..cd09bbf 100644 +--- a/utils/policies/policypcr0.txt ++++ b/utils/policies/policypcr0.txt +@@ -1 +1 @@ +-0000000000000000000000000000000000000000 +\ No newline at end of file ++0000000000000000000000000000000000000000000000000000000000000000 +diff --git a/utils/policies/policypcrbm0.bin b/utils/policies/policypcrbm0.bin +index bd0f292e05dc793b2831fec273c2eefa7b3a9672..666ea3c731d2f46d4d94768cab4464ff0bb0e5af 100644 +GIT binary patch +literal 32 +ocmb>Z5cE02?1^I8ss%e3mgaqqyRPviCuhr<=Bo*jp4^KQ0V0YJ<^TWy + +literal 20 +bcmd0`@U(b%wL7eEQs@+Ww#>9`zjTxVT?`1l + +diff --git a/utils/policies/policywrittenset.bin b/utils/policies/policywrittenset.bin +index 4f6bb8c..4ed9066 100644 +--- a/utils/policies/policywrittenset.bin ++++ b/utils/policies/policywrittenset.bin +@@ -1 +1 @@ +-0sH_e" +\ No newline at end of file ++}ӋSzaHE run.out ++ ${PREFIX}sign -hk 80000001 -halg sha256 -if policies/aaa -os sig.bin -pwdk sig ${SESS} > run.out + checkSuccess $? + + echo "Sign a digest with the changed key" +- ${PREFIX}sign -hk 80000002 -halg sha1 -if policies/aaa -os sig.bin -pwdk xxx > run.out ++ ${PREFIX}sign -hk 80000002 -halg sha256 -if policies/aaa -os sig.bin -pwdk xxx > run.out + checkSuccess $? + + echo "Flush the key" +diff --git a/utils/regtests/testevict.sh b/utils/regtests/testevict.sh +index 761eaa8..8f2806f 100755 +--- a/utils/regtests/testevict.sh ++++ b/utils/regtests/testevict.sh +@@ -58,11 +58,11 @@ ${PREFIX}evictcontrol -ho 80000001 -hp 81800000 -hi p > run.out + checkSuccess $? + + echo "Sign a digest with the transient key" +-${PREFIX}sign -hk 80000001 -halg sha1 -if policies/aaa -os sig.bin -pwdk sig > run.out ++${PREFIX}sign -hk 80000001 -halg sha256 -if policies/aaa -os sig.bin -pwdk sig > run.out + checkSuccess $? + + echo "Sign a digest with the persistent key" +-${PREFIX}sign -hk 81800000 -halg sha1 -if policies/aaa -os sig.bin -pwdk sig > run.out ++${PREFIX}sign -hk 81800000 -halg sha256 -if policies/aaa -os sig.bin -pwdk sig > run.out + checkSuccess $? + + echo "Flush the transient key" +@@ -74,11 +74,11 @@ ${PREFIX}flushcontext -ha 81800000 > run.out + checkFailure $? + + echo "Sign a digest with the transient key- should fail" +-${PREFIX}sign -hk 80000001 -halg sha1 -if policies/aaa -os sig.bin -pwdk sig > run.out ++${PREFIX}sign -hk 80000001 -halg sha256 -if policies/aaa -os sig.bin -pwdk sig > run.out + checkFailure $? + + echo "Sign a digest with the persistent key" +-${PREFIX}sign -hk 81800000 -halg sha1 -if policies/aaa -os sig.bin -pwdk sig > run.out ++${PREFIX}sign -hk 81800000 -halg sha256 -if policies/aaa -os sig.bin -pwdk sig > run.out + checkSuccess $? + + echo "Flush the persistent key" +@@ -86,11 +86,11 @@ ${PREFIX}evictcontrol -ho 81800000 -hp 81800000 -hi p > run.out + checkSuccess $? + + echo "Sign a digest with the persistent key - should fail" +-${PREFIX}sign -hk 81800000 -halg sha1 -if policies/aaa -os sig.bin -pwdk sig > run.out ++${PREFIX}sign -hk 81800000 -halg sha256 -if policies/aaa -os sig.bin -pwdk sig > run.out + checkFailure $? + + echo "Sign a digest with the transient key - should fail" +-${PREFIX}sign -hk 80000001 -halg sha1 -if policies/aaa -os sig.bin -pwdk sig > run.out ++${PREFIX}sign -hk 80000001 -halg sha256 -if policies/aaa -os sig.bin -pwdk sig > run.out + checkFailure $? + + # ${PREFIX}getcapability -cap 1 -pr 80000000 +diff --git a/utils/regtests/testnv.sh b/utils/regtests/testnv.sh +index b941f2e..39a9a18 100755 +--- a/utils/regtests/testnv.sh ++++ b/utils/regtests/testnv.sh +@@ -56,7 +56,7 @@ checkSuccess $? + NALG=(${ITERATE_ALGS}) + BADNALG=(${BAD_ITERATE_ALGS}) + +-for ((i = 0 ; i < 4; i++)) ++for ((i = 0 ; i < ${ITERATE_ALGS_COUNT}; i++)) + do + + for SESS in "" "-se0 02000000 1" +@@ -212,10 +212,10 @@ checkSuccess $? + for SESS in "" "-se0 02000000 1" + do + +- SZ=(20 32 48 64) ++ SZ=(${ITERATE_ALGS_SIZES}) + HALG=(${ITERATE_ALGS}) + +- for ((i = 0 ; i < 4; i++)) ++ for ((i = 0 ; i < ${ITERATE_ALGS_COUNT}; i++)) + do + + echo "NV Define Space ${HALG[$i]}" +diff --git a/utils/regtests/testpolicy.sh b/utils/regtests/testpolicy.sh +index e2e8bec..971e67f 100755 +--- a/utils/regtests/testpolicy.sh ++++ b/utils/regtests/testpolicy.sh +@@ -752,17 +752,17 @@ echo "Policy PCR no select" + echo "" + + # create AND term for policy PCR +-# > policymakerpcr -halg sha1 -bm 0 -v -pr -of policies/policypcr.txt ++# > policymakerpcr -halg sha256 -bm 0 -v -pr -of policies/policypcr.txt + # 0000017f00000001000403000000da39a3ee5e6b4b0d3255bfef95601890afd80709 + + # convert to binary policy +-# > policymaker -halg sha1 -if policies/policypcr.txt -of policies/policypcrbm0.bin -pr -v ++# > policymaker -halg sha256 -if policies/policypcr.txt -of policies/policypcrbm0.bin -pr -v + + # 6d 38 49 38 e1 d5 8b 56 71 92 55 94 3f 06 69 66 + # b6 fa 2c 23 + + echo "Create a signing key with policy PCR no select" +-${PREFIX}create -hp 80000000 -si -kt f -kt p -opr tmppriv.bin -opu tmppub.bin -pwdp sto -pwdk sig -nalg sha1 -pol policies/policypcrbm0.bin > run.out ++${PREFIX}create -hp 80000000 -si -kt f -kt p -opr tmppriv.bin -opu tmppub.bin -pwdp sto -pwdk sig -nalg sha256 -pol policies/policypcrbm0.bin > run.out + checkSuccess $? + + echo "Load the signing key under the primary key" +@@ -770,11 +770,11 @@ ${PREFIX}load -hp 80000000 -ipr tmppriv.bin -ipu tmppub.bin -pwdp sto > run.out + checkSuccess $? + + echo "Start a policy session" +-${PREFIX}startauthsession -halg sha1 -se p > run.out ++${PREFIX}startauthsession -halg sha256 -se p > run.out + checkSuccess $? + + echo "Policy PCR, update with the correct digest" +-${PREFIX}policypcr -ha 03000000 -halg sha1 -bm 0 > run.out ++${PREFIX}policypcr -ha 03000000 -halg sha256 -bm 0 > run.out + checkSuccess $? + + echo "Policy get digest - should be 6d 38 49 38 ... " +@@ -790,11 +790,11 @@ ${PREFIX}policyrestart -ha 03000000 > run.out + checkSuccess $? + + echo "Policy PCR, update with the correct digest" +-${PREFIX}policypcr -ha 03000000 -halg sha1 -bm 0 > run.out ++${PREFIX}policypcr -ha 03000000 -halg sha256 -bm 0 > run.out + checkSuccess $? + + echo "PCR extend PCR 0, updates pcr counter" +-${PREFIX}pcrextend -ha 0 -halg sha1 -if policies/aaa > run.out ++${PREFIX}pcrextend -ha 0 -halg sha256 -if policies/aaa > run.out + checkSuccess $? + + echo "Sign, should fail" +@@ -816,17 +816,17 @@ echo "" + # policypcr0.txt has 20 * 00 + + # create AND term for policy PCR +-# > policymakerpcr -halg sha1 -bm 010000 -if policies/policypcr0.txt -v -pr -of policies/policypcr.txt ++# > policymakerpcr -halg sha256 -bm 010000 -if policies/policypcr0.txt -v -pr -of policies/policypcr.txt + # 0000017f000000010004030000016768033e216468247bd031a0a2d9876d79818f8f + + # convert to binary policy +-# > policymaker -halg sha1 -if policies/policypcr.txt -of policies/policypcr.bin -pr -v ++# > policymaker -halg sha256 -if policies/policypcr.txt -of policies/policypcr.bin -pr -v + + # 85 33 11 83 19 03 12 f5 e8 3c 60 43 34 6f 9f 37 + # 21 04 76 8e + + echo "Create a signing key with policy PCR PCR 16 zero" +-${PREFIX}create -hp 80000000 -si -kt f -kt p -opr tmppriv.bin -opu tmppub.bin -pwdp sto -pwdk sig -nalg sha1 -pol policies/policypcr.bin > run.out ++${PREFIX}create -hp 80000000 -si -kt f -kt p -opr tmppriv.bin -opu tmppub.bin -pwdp sto -pwdk sig -nalg sha256 -pol policies/policypcr.bin > run.out + checkSuccess $? + + echo "Load the signing key under the primary key" +@@ -838,11 +838,11 @@ ${PREFIX}pcrreset -ha 16 > run.out + checkSuccess $? + + echo "Read PCR 16, should be 00 00 00 00 ..." +-${PREFIX}pcrread -ha 16 -halg sha1 > run.out ++${PREFIX}pcrread -ha 16 -halg sha256 > run.out + checkSuccess $? + + echo "Start a policy session" +-${PREFIX}startauthsession -se p -halg sha1 > run.out ++${PREFIX}startauthsession -se p -halg sha256 > run.out + checkSuccess $? + + echo "Sign, policy not satisfied - should fail" +@@ -850,7 +850,7 @@ ${PREFIX}sign -hk 80000001 -if msg.bin -os sig.bin -se0 03000000 0 > run.out + checkFailure $? + + echo "Policy PCR, update with the correct digest" +-${PREFIX}policypcr -ha 03000000 -halg sha1 -bm 10000 > run.out ++${PREFIX}policypcr -ha 03000000 -halg sha256 -bm 10000 > run.out + checkSuccess $? + + echo "Policy get digest - should be 85 33 11 83 ..." +@@ -862,19 +862,19 @@ ${PREFIX}sign -hk 80000001 -if msg.bin -os sig.bin -se0 03000000 0 > run.out + checkSuccess $? + + echo "PCR extend PCR 16" +-${PREFIX}pcrextend -ha 16 -halg sha1 -if policies/aaa > run.out ++${PREFIX}pcrextend -ha 16 -halg sha256 -if policies/aaa > run.out + checkSuccess $? + + echo "Read PCR 0, should be 1d 47 f6 8a ..." +-${PREFIX}pcrread -ha 16 -halg sha1 > run.out ++${PREFIX}pcrread -ha 16 -halg sha256 > run.out + checkSuccess $? + + echo "Start a policy session" +-${PREFIX}startauthsession -se p -halg sha1 > run.out ++${PREFIX}startauthsession -se p -halg sha256 > run.out + checkSuccess $? + + echo "Policy PCR, update with the wrong digest" +-${PREFIX}policypcr -ha 03000000 -halg sha1 -bm 10000 > run.out ++${PREFIX}policypcr -ha 03000000 -halg sha256 -bm 10000 > run.out + checkSuccess $? + + echo "Policy get digest - should be 66 dd e5 e3" +@@ -903,21 +903,21 @@ checkSuccess $? + # + # policynvargs.txt (binary) + # args = hash of 0000 0000 0000 0000 | 0000 | 0000 (eight bytes of zero | offset | op ==) +-# hash -hi n -halg sha1 -if policies/policynvargs.txt -v +-# openssl dgst -sha1 policies/policynvargs.txt ++# hash -hi n -halg sha256 -if policies/policynvargs.txt -v ++# openssl dgst -sha256 policies/policynvargs.txt + # 2c513f149e737ec4063fc1d37aee9beabc4b4bbf + # + # NV authorizing index + # + # after defining index and NV write to set written, use +-# ${PREFIX}nvreadpublic -ha 01000000 -nalg sha1 ++# ${PREFIX}nvreadpublic -ha 01000000 -nalg sha256 + # to get name + # 00042234b8df7cdf8605ee0a2088ac7dfe34c6566c5c + # + # append Name to policynvnv.txt + # + # convert to binary policy +-# > policymaker -halg sha1 -if policies/policynvnv.txt -of policies/policynvnv.bin -pr -v ++# > policymaker -halg sha256 -if policies/policynvnv.txt -of policies/policynvnv.bin -pr -v + # bc 9b 4c 4f 7b 00 66 19 5b 1d d9 9c 92 7e ad 57 e7 1c 2a fc + # + # file zero8.bin has 8 bytes of hex zero +@@ -927,11 +927,11 @@ echo "Policy NV, NV index authorizing" + echo "" + + echo "Define a setbits index, authorizing index" +-${PREFIX}nvdefinespace -hi p -nalg sha1 -ha 01000000 -pwdn nnn -ty b > run.out ++${PREFIX}nvdefinespace -hi p -nalg sha256 -ha 01000000 -pwdn nnn -ty b > run.out + checkSuccess $? + + echo "NV Read public, get Name, not written" +-${PREFIX}nvreadpublic -ha 01000000 -nalg sha1 > run.out ++${PREFIX}nvreadpublic -ha 01000000 -nalg sha256 > run.out + checkSuccess $? + + echo "NV setbits to set written" +@@ -939,7 +939,7 @@ ${PREFIX}nvsetbits -ha 01000000 -pwdn nnn > run.out + checkSuccess $? + + echo "NV Read public, get Name, written" +-${PREFIX}nvreadpublic -ha 01000000 -nalg sha1 > run.out ++${PREFIX}nvreadpublic -ha 01000000 -nalg sha256 > run.out + checkSuccess $? + + echo "NV Read, should be zero" +@@ -947,11 +947,11 @@ ${PREFIX}nvread -ha 01000000 -pwdn nnn -sz 8 > run.out + checkSuccess $? + + echo "Define an ordinary index, authorized index, policyNV" +-${PREFIX}nvdefinespace -hi p -nalg sha1 -ha 01000001 -pwdn nnn -sz 2 -ty o -pol policies/policynvnv.bin > run.out ++${PREFIX}nvdefinespace -hi p -nalg sha256 -ha 01000001 -pwdn nnn -sz 2 -ty o -pol policies/policynvnv.bin > run.out + checkSuccess $? + + echo "NV Read public, get Name, not written" +-${PREFIX}nvreadpublic -ha 01000001 -nalg sha1 > run.out ++${PREFIX}nvreadpublic -ha 01000001 -nalg sha256 > run.out + checkSuccess $? + + echo "NV write to set written" +@@ -959,7 +959,7 @@ ${PREFIX}nvwrite -ha 01000001 -pwdn nnn -ic aa > run.out + checkSuccess $? + + echo "Start policy session" +-${PREFIX}startauthsession -se p -halg sha1 > run.out ++${PREFIX}startauthsession -se p -halg sha256 > run.out + checkSuccess $? + + echo "NV write, policy not satisfied - should fail" +@@ -1015,15 +1015,15 @@ echo "Policy NV Written" + echo "" + + echo "Define an ordinary index, authorized index, policyNV" +-${PREFIX}nvdefinespace -hi p -nalg sha1 -ha 01000000 -pwdn nnn -sz 2 -ty o -pol policies/policywrittenset.bin > run.out ++${PREFIX}nvdefinespace -hi p -nalg sha256 -ha 01000000 -pwdn nnn -sz 2 -ty o -pol policies/policywrittenset.bin > run.out + checkSuccess $? + + echo "NV Read public, get Name, not written" +-${PREFIX}nvreadpublic -ha 01000000 -nalg sha1 > run.out ++${PREFIX}nvreadpublic -ha 01000000 -nalg sha256 > run.out + checkSuccess $? + + echo "Start policy session" +-${PREFIX}startauthsession -se p -halg sha1 > run.out ++${PREFIX}startauthsession -se p -halg sha256 > run.out + checkSuccess $? + + echo "NV write, policy not satisfied - should fail" +@@ -1043,7 +1043,7 @@ ${PREFIX}flushcontext -ha 03000000 > run.out + checkSuccess $? + + echo "Start policy session" +-${PREFIX}startauthsession -se p -halg sha1 > run.out ++${PREFIX}startauthsession -se p -halg sha256 > run.out + checkSuccess $? + + echo "Policy NV Written yes, satisfy policy" +@@ -1063,7 +1063,7 @@ ${PREFIX}nvwrite -ha 01000000 -ic aa -pwdn nnn > run.out + checkSuccess $? + + echo "Start policy session" +-${PREFIX}startauthsession -se p -halg sha1 > run.out ++${PREFIX}startauthsession -se p -halg sha256 > run.out + checkSuccess $? + + echo "Policy NV Written yes, satisfy policy" +@@ -1079,7 +1079,7 @@ ${PREFIX}flushcontext -ha 03000000 > run.out + checkSuccess $? + + echo "Start policy session" +-${PREFIX}startauthsession -se p -halg sha1 > run.out ++${PREFIX}startauthsession -se p -halg sha256 > run.out + checkSuccess $? + + echo "Policy NV Written no" +@@ -1326,12 +1326,12 @@ checkSuccess $? + + # test using clockrateadjust + # policycphashhash.txt is (hex) 00000130 4000000c 000 +-# hash -if policycphashhash.txt -oh policycphashhash.bin -halg sha1 -v +-# openssl dgst -sha1 policycphashhash.txt ++# hash -if policycphashhash.txt -oh policycphashhash.bin -halg sha256 -v ++# openssl dgst -sha256 policycphashhash.txt + # cpHash is + # b5f919bbc01f0ebad02010169a67a8c158ec12f3 + # append to policycphash.txt 00000163 + cpHash +-# policymaker -halg sha1 -if policies/policycphash.txt -of policies/policycphash.bin -pr ++# policymaker -halg sha256 -if policies/policycphash.txt -of policies/policycphash.bin -pr + # 06 e4 6c f9 f3 c7 0f 30 10 18 7c a6 72 69 b0 84 b4 52 11 6f + + echo "" +@@ -1339,7 +1339,7 @@ echo "Policy cpHash" + echo "" + + echo "Set the platform policy to policy cpHash" +-${PREFIX}setprimarypolicy -hi p -pol policies/policycphash.bin -halg sha1 > run.out ++${PREFIX}setprimarypolicy -hi p -pol policies/policycphash.bin -halg sha256 > run.out + checkSuccess $? + + echo "Clockrate adjust using wrong password - should fail" +@@ -1347,7 +1347,7 @@ ${PREFIX}clockrateadjust -hi p -pwdp ppp -adj 0 > run.out + checkFailure $? + + echo "Start policy session" +-${PREFIX}startauthsession -se p -halg sha1 > run.out ++${PREFIX}startauthsession -se p -halg sha256 > run.out + checkSuccess $? + + echo "Clockrate adjust, policy not satisfied - should fail" +@@ -1690,7 +1690,7 @@ echo "Policy Counter Timer" + echo "" + + echo "Set the platform policy to policy " +-${PREFIX}setprimarypolicy -hi p -pol policies/policycountertimer.bin -halg sha1 > run.out ++${PREFIX}setprimarypolicy -hi p -pol policies/policycountertimer.bin -halg sha256 > run.out + checkSuccess $? + + echo "Clockrate adjust using wrong password - should fail" +@@ -1698,7 +1698,7 @@ ${PREFIX}clockrateadjust -hi p -pwdp ppp -adj 0 > run.out + checkFailure $? + + echo "Start policy session" +-${PREFIX}startauthsession -se p -halg sha1 > run.out ++${PREFIX}startauthsession -se p -halg sha256 > run.out + checkSuccess $? + + echo "Clockrate adjust, policy not satisfied - should fail" +diff --git a/utils/regtests/testrsa.sh b/utils/regtests/testrsa.sh +index 4f76522..6e25398 100755 +--- a/utils/regtests/testrsa.sh ++++ b/utils/regtests/testrsa.sh +@@ -131,10 +131,10 @@ do + ${PREFIX}load -hp 80000000 -ipu derrsa${BITS}pub.bin -ipr derrsa${BITS}priv.bin -pwdp sto > run.out + checkSuccess $? + ++ HSIZ=(${ITERATE_ALGS_SIZES}) + HALG=(${ITERATE_ALGS}) +- HSIZ=("20" "32" "48" "64") + +- for ((i = 0 ; i < 4 ; i++)) ++ for ((i = 0 ; i < ${ITERATE_ALGS_COUNT} ; i++)) + do + + echo "Decrypt/Sign with a caller specified OID - ${HALG[i]}" +@@ -298,7 +298,7 @@ echo "Encrypt with OpenSSL OAEP, decrypt with TPM" + echo "" + + echo "Create OAEP encryption key" +-${PREFIX}create -hp 80000000 -pwdp sto -deo -kt f -kt p -halg sha1 -opr tmpprivkey.bin -opu tmppubkey.bin -opem tmppubkey.pem > run.out ++${PREFIX}create -hp 80000000 -pwdp sto -deo -kt f -kt p -halg sha256 -opr tmpprivkey.bin -opu tmppubkey.bin -opem tmppubkey.pem > run.out + checkSuccess $? + + echo "Load encryption key at 80000001" +@@ -306,7 +306,7 @@ ${PREFIX}load -hp 80000000 -pwdp sto -ipr tmpprivkey.bin -ipu tmppubkey.bin > r + checkSuccess $? + + echo "Encrypt using OpenSSL and the PEM public key" +-openssl rsautl -oaep -encrypt -inkey tmppubkey.pem -pubin -in policies/aaa -out enc.bin > run.out 2>&1 ++openssl pkeyutl -encrypt -inkey tmppubkey.pem -pubin -pkeyopt rsa_padding_mode:oaep -pkeyopt rsa_oaep_md:sha256 -in policies/aaa -out enc.bin > run.out 2>&1 + checkSuccess $? + + echo "Decrypt using TPM key at 80000001" +diff --git a/utils/regtests/testsign.sh b/utils/regtests/testsign.sh +index edfa014..8a99bbf 100755 +--- a/utils/regtests/testsign.sh ++++ b/utils/regtests/testsign.sh +@@ -302,14 +302,14 @@ echo "" + # > openssl dgst -sha1 -sign rsaprivkey.pem -passin pass:rrrr -out pssig.bin msg.bin + + echo "Load external just the public part of PEM RSA" +-${PREFIX}loadexternal -halg sha1 -nalg sha1 -ipem policies/rsapubkey.pem > run.out ++${PREFIX}loadexternal -halg sha256 -nalg sha256 -ipem policies/rsapubkey.pem > run.out + checkSuccess $? + + echo "Sign a test message with openssl RSA" +-openssl dgst -sha1 -sign policies/rsaprivkey.pem -passin pass:rrrr -out pssig.bin msg.bin > run.out 2>&1 ++openssl dgst -sha256 -sign policies/rsaprivkey.pem -passin pass:rrrr -out pssig.bin msg.bin > run.out 2>&1 + + echo "Verify the RSA signature" +-${PREFIX}verifysignature -hk 80000001 -halg sha1 -if msg.bin -is pssig.bin -raw > run.out ++${PREFIX}verifysignature -hk 80000001 -halg sha256 -if msg.bin -is pssig.bin -raw > run.out + checkSuccess $? + + echo "Flush the signing key" +@@ -328,14 +328,14 @@ for CURVE in p256 p384 + do + + echo "Load external just the public part of PEM ECC ${CURVE}" +- ${PREFIX}loadexternal -halg sha1 -nalg sha1 -ipem policies/${CURVE}pubkey.pem -ecc > run.out ++ ${PREFIX}loadexternal -halg sha256 -nalg sha256 -ipem policies/${CURVE}pubkey.pem -ecc > run.out + checkSuccess $? + + echo "Sign a test message with openssl ECC ${CURVE}" +- openssl dgst -sha1 -sign policies/${CURVE}privkey.pem -out pssig.bin msg.bin > run.out 2>&1 ++ openssl dgst -sha256 -sign policies/${CURVE}privkey.pem -out pssig.bin msg.bin > run.out 2>&1 + + echo "Verify the ECC signature ${CURVE}" +- ${PREFIX}verifysignature -hk 80000001 -halg sha1 -if msg.bin -is pssig.bin -raw -ecc > run.out ++ ${PREFIX}verifysignature -hk 80000001 -halg sha256 -if msg.bin -is pssig.bin -raw -ecc > run.out + checkSuccess $? + + echo "Flush the ECC ${CURVE} signing key" +-- +2.34.1 + diff --git a/SOURCES/0003-Restrict-the-usage-of-SHA-1-in-code-examples.patch b/SOURCES/0003-Restrict-the-usage-of-SHA-1-in-code-examples.patch new file mode 100644 index 0000000..edb866d --- /dev/null +++ b/SOURCES/0003-Restrict-the-usage-of-SHA-1-in-code-examples.patch @@ -0,0 +1,1329 @@ +From 8004d7ddc5e1bd7809f6a385908ceff216061187 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?=C5=A0t=C4=9Bp=C3=A1n=20Hor=C3=A1=C4=8Dek?= + +Date: Thu, 17 Feb 2022 19:02:10 +0100 +Subject: [PATCH 3/4] Restrict the usage of SHA-1 in code examples +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Due to SHA-1 not being considered secure, it should be not used for +cryptographical purposes. This commit disables the usage of SHA-1 in +cases where it is used in potentially exploitable situations, most +notably for creating signatures. + +Signed-off-by: Štěpán Horáček +--- + configure.ac | 4 ++++ + utils/certify.c | 7 ++----- + utils/certifycreation.c | 7 ++----- + utils/create.c | 10 ++-------- + utils/createloaded.c | 10 ++-------- + utils/createprimary.c | 10 ++-------- + utils/cryptoutils.c | 3 --- + utils/getcommandauditdigest.c | 7 ++----- + utils/getsessionauditdigest.c | 7 ++----- + utils/gettime.c | 7 ++----- + utils/hash.c | 7 ++----- + utils/hashsequencestart.c | 7 ++----- + utils/hmac.c | 7 ++----- + utils/hmacstart.c | 7 ++----- + utils/importpem.c | 14 ++++---------- + utils/loadexternal.c | 14 ++++---------- + utils/man/man1/tsscertify.1 | 2 +- + utils/man/man1/tsscertifycreation.1 | 2 +- + utils/man/man1/tsscreate.1 | 4 ++-- + utils/man/man1/tsscreateloaded.1 | 4 ++-- + utils/man/man1/tsscreateprimary.1 | 4 ++-- + utils/man/man1/tssgetcommandauditdigest.1 | 2 +- + utils/man/man1/tssgetsessionauditdigest.1 | 2 +- + utils/man/man1/tssgettime.1 | 2 +- + utils/man/man1/tsshash.1 | 2 +- + utils/man/man1/tsshashsequencestart.1 | 2 +- + utils/man/man1/tsshmac.1 | 2 +- + utils/man/man1/tsshmacstart.1 | 2 +- + utils/man/man1/tssimportpem.1 | 4 ++-- + utils/man/man1/tssloadexternal.1 | 4 ++-- + utils/man/man1/tssnvcertify.1 | 2 +- + utils/man/man1/tssnvdefinespace.1 | 2 +- + utils/man/man1/tssnvreadpublic.1 | 2 +- + utils/man/man1/tsspolicymaker.1 | 2 +- + utils/man/man1/tsspolicysigned.1 | 2 +- + utils/man/man1/tsspublicname.1 | 4 ++-- + utils/man/man1/tssquote.1 | 2 +- + utils/man/man1/tssrsadecrypt.1 | 2 +- + utils/man/man1/tsssetcommandcodeauditstatus.1 | 2 +- + utils/man/man1/tsssetprimarypolicy.1 | 2 +- + utils/man/man1/tsssign.1 | 2 +- + utils/man/man1/tssstartauthsession.1 | 2 +- + utils/man/man1/tssverifysignature.1 | 2 +- + utils/nvcertify.c | 7 ++----- + utils/nvdefinespace.c | 8 ++------ + utils/nvreadpublic.c | 7 ++----- + utils/objecttemplates.c | 4 ++-- + utils/policymaker.c | 7 ++----- + utils/policysigned.c | 7 ++----- + utils/publicname.c | 14 ++++---------- + utils/quote.c | 7 ++----- + utils/reg.sh | 17 +++++++++++++---- + utils/regtests/testattest.sh | 15 ++++++++++----- + utils/regtests/testevent.sh | 2 +- + utils/rsadecrypt.c | 12 ++---------- + utils/setcommandcodeauditstatus.c | 7 ++----- + utils/setprimarypolicy.c | 5 +---- + utils/sign.c | 7 ++----- + utils/startauthsession.c | 7 ++----- + utils/verifysignature.c | 7 ++----- + 60 files changed, 122 insertions(+), 212 deletions(-) + +diff --git a/configure.ac b/configure.ac +index ad870b1..4e4052e 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -123,6 +123,10 @@ AC_ARG_ENABLE(rmtpm, + AM_CONDITIONAL([CONFIG_RMTPM], [test "x$enable_rmtpm" = "xyes"]) + AS_IF([test "$enable_rmtpm" != "yes"], [enable_rmtpm="no"]) + ++AC_ARG_ENABLE(restricted-hash-alg, ++ AS_HELP_STRING([--enable-restricted-hash-alg], [Restrict usage of SHA-1])) ++ AS_IF([test "$enable_restricted_hash_alg" = "yes"], [CFLAGS="-DRESTRICTED_HASH_ALG $CFLAGS"]) ++ + AC_CONFIG_FILES([Makefile + utils/Makefile + utils12/Makefile +diff --git a/utils/certify.c b/utils/certify.c +index f1f54d0..f3cfc84 100644 +--- a/utils/certify.c ++++ b/utils/certify.c +@@ -128,10 +128,7 @@ int main(int argc, char *argv[]) + else if (strcmp(argv[i],"-halg") == 0) { + i++; + if (i < argc) { +- if (strcmp(argv[i],"sha1") == 0) { +- halg = TPM_ALG_SHA1; +- } +- else if (strcmp(argv[i],"sha256") == 0) { ++ if (strcmp(argv[i],"sha256") == 0) { + halg = TPM_ALG_SHA256; + } + else if (strcmp(argv[i],"sha384") == 0) { +@@ -397,7 +394,7 @@ static void printUsage(void) + printf("\t[-pwdo\tpassword for object (default empty)]\n"); + printf("\t-hk\tcertifying key handle\n"); + printf("\t[-pwdk\tpassword for key (default empty)]\n"); +- printf("\t[-halg\t(sha1, sha256, sha384 sha512) (default sha256)]\n"); ++ printf("\t[-halg\t(sha256, sha384 sha512) (default sha256)]\n"); + printf("\t[-salg\tsignature algorithm (rsa, ecc, hmac) (default rsa)]\n"); + printf("\t[-qd\tqualifying data file name]\n"); + printf("\t[-os\tsignature file name (default do not save)]\n"); +diff --git a/utils/certifycreation.c b/utils/certifycreation.c +index ab54c0a..20377d2 100644 +--- a/utils/certifycreation.c ++++ b/utils/certifycreation.c +@@ -121,10 +121,7 @@ int main(int argc, char *argv[]) + else if (strcmp(argv[i],"-halg") == 0) { + i++; + if (i < argc) { +- if (strcmp(argv[i],"sha1") == 0) { +- halg = TPM_ALG_SHA1; +- } +- else if (strcmp(argv[i],"sha256") == 0) { ++ if (strcmp(argv[i],"sha256") == 0) { + halg = TPM_ALG_SHA256; + } + else if (strcmp(argv[i],"sha384") == 0) { +@@ -437,7 +434,7 @@ static void printUsage(void) + printf("\t-ho\tobject handle\n"); + printf("\t-hk\tcertifying key handle\n"); + printf("\t[-pwdk\tpassword for key (default empty)]\n"); +- printf("\t[-halg\t(sha1, sha256, sha384) (default sha256)]\n"); ++ printf("\t[-halg\t(sha256, sha384) (default sha256)]\n"); + printf("\t[-salg\tsignature algorithm (rsa, ecc) (default rsa)]\n"); + printf("\t[-qd\tqualifying data file name]\n"); + printf("\t-tk\tinput ticket file name\n"); +diff --git a/utils/create.c b/utils/create.c +index a8b805c..93c5d43 100644 +--- a/utils/create.c ++++ b/utils/create.c +@@ -239,10 +239,7 @@ int main(int argc, char *argv[]) + else if (strcmp(argv[i],"-halg") == 0) { + i++; + if (i < argc) { +- if (strcmp(argv[i],"sha1") == 0) { +- halg = TPM_ALG_SHA1; +- } +- else if (strcmp(argv[i],"sha256") == 0) { ++ if (strcmp(argv[i],"sha256") == 0) { + halg = TPM_ALG_SHA256; + } + else if (strcmp(argv[i],"sha384") == 0) { +@@ -264,10 +261,7 @@ int main(int argc, char *argv[]) + else if (strcmp(argv[i],"-nalg") == 0) { + i++; + if (i < argc) { +- if (strcmp(argv[i],"sha1") == 0) { +- nalg = TPM_ALG_SHA1; +- } +- else if (strcmp(argv[i],"sha256") == 0) { ++ if (strcmp(argv[i],"sha256") == 0) { + nalg = TPM_ALG_SHA256; + } + else if (strcmp(argv[i],"sha384") == 0) { +diff --git a/utils/createloaded.c b/utils/createloaded.c +index d54f791..a21bbda 100644 +--- a/utils/createloaded.c ++++ b/utils/createloaded.c +@@ -235,10 +235,7 @@ int main(int argc, char *argv[]) + else if (strcmp(argv[i],"-halg") == 0) { + i++; + if (i < argc) { +- if (strcmp(argv[i],"sha1") == 0) { +- halg = TPM_ALG_SHA1; +- } +- else if (strcmp(argv[i],"sha256") == 0) { ++ if (strcmp(argv[i],"sha256") == 0) { + halg = TPM_ALG_SHA256; + } + else if (strcmp(argv[i],"sha384") == 0) { +@@ -257,10 +254,7 @@ int main(int argc, char *argv[]) + else if (strcmp(argv[i],"-nalg") == 0) { + i++; + if (i < argc) { +- if (strcmp(argv[i],"sha1") == 0) { +- nalg = TPM_ALG_SHA1; +- } +- else if (strcmp(argv[i],"sha256") == 0) { ++ if (strcmp(argv[i],"sha256") == 0) { + nalg = TPM_ALG_SHA256; + } + else if (strcmp(argv[i],"sha384") == 0) { +diff --git a/utils/createprimary.c b/utils/createprimary.c +index 52ae083..d6374dd 100644 +--- a/utils/createprimary.c ++++ b/utils/createprimary.c +@@ -246,10 +246,7 @@ int main(int argc, char *argv[]) + else if (strcmp(argv[i],"-halg") == 0) { + i++; + if (i < argc) { +- if (strcmp(argv[i],"sha1") == 0) { +- halg = TPM_ALG_SHA1; +- } +- else if (strcmp(argv[i],"sha256") == 0) { ++ if (strcmp(argv[i],"sha256") == 0) { + halg = TPM_ALG_SHA256; + } + else if (strcmp(argv[i],"sha384") == 0) { +@@ -271,10 +268,7 @@ int main(int argc, char *argv[]) + else if (strcmp(argv[i],"-nalg") == 0) { + i++; + if (i < argc) { +- if (strcmp(argv[i],"sha1") == 0) { +- nalg = TPM_ALG_SHA1; +- } +- else if (strcmp(argv[i],"sha256") == 0) { ++ if (strcmp(argv[i],"sha256") == 0) { + nalg = TPM_ALG_SHA256; + } + else if (strcmp(argv[i],"sha384") == 0) { +diff --git a/utils/cryptoutils.c b/utils/cryptoutils.c +index 57eade7..7b5de79 100644 +--- a/utils/cryptoutils.c ++++ b/utils/cryptoutils.c +@@ -2025,9 +2025,6 @@ TPM_RC signRSAFromRSA(uint8_t *signature, size_t *signatureLength, + /* map the hash algorithm to the openssl NID */ + if (rc == 0) { + switch (hashAlg) { +- case TPM_ALG_SHA1: +- nid = NID_sha1; +- break; + case TPM_ALG_SHA256: + nid = NID_sha256; + break; +diff --git a/utils/getcommandauditdigest.c b/utils/getcommandauditdigest.c +index a219785..cc67a17 100644 +--- a/utils/getcommandauditdigest.c ++++ b/utils/getcommandauditdigest.c +@@ -117,10 +117,7 @@ int main(int argc, char *argv[]) + else if (strcmp(argv[i],"-halg") == 0) { + i++; + if (i < argc) { +- if (strcmp(argv[i],"sha1") == 0) { +- halg = TPM_ALG_SHA1; +- } +- else if (strcmp(argv[i],"sha256") == 0) { ++ if (strcmp(argv[i],"sha256") == 0) { + halg = TPM_ALG_SHA256; + } + else if (strcmp(argv[i],"sha384") == 0) { +@@ -381,7 +378,7 @@ static void printUsage(void) + printf("\t[-pwde\tendorsement hierarchy password (default empty)]\n"); + printf("\t-hk\tsigning key handle\n"); + printf("\t[-pwdk\tpassword for key (default empty)]\n"); +- printf("\t[-halg\t(sha1, sha256, sha384, sha512) (default sha256)]\n"); ++ printf("\t[-halg\t(sha256, sha384, sha512) (default sha256)]\n"); + printf("\t[-salg\tsignature algorithm (rsa, ecc, hmac) (default rsa)]\n"); + printf("\t[-qd\tqualifying data file name]\n"); + printf("\t[-os\tsignature file name (default do not save)]\n"); +diff --git a/utils/getsessionauditdigest.c b/utils/getsessionauditdigest.c +index 61b12e6..e0706a1 100644 +--- a/utils/getsessionauditdigest.c ++++ b/utils/getsessionauditdigest.c +@@ -128,10 +128,7 @@ int main(int argc, char *argv[]) + else if (strcmp(argv[i],"-halg") == 0) { + i++; + if (i < argc) { +- if (strcmp(argv[i],"sha1") == 0) { +- halg = TPM_ALG_SHA1; +- } +- else if (strcmp(argv[i],"sha256") == 0) { ++ if (strcmp(argv[i],"sha256") == 0) { + halg = TPM_ALG_SHA256; + } + else if (strcmp(argv[i],"sha384") == 0) { +@@ -377,7 +374,7 @@ static void printUsage(void) + printf("\t[-hk\tsigning key handle]\n"); + printf("\t[-pwdk\tpassword for key (default empty)]\n"); + printf("\t-hs\taudit session handle\n"); +- printf("\t[-halg\t(sha1, sha256, sha384, sha512) (default sha256)]\n"); ++ printf("\t[-halg\t(sha256, sha384, sha512) (default sha256)]\n"); + printf("\t[-qd\tqualifying data file name]\n"); + printf("\t[-os\tsignature file name (default do not save)]\n"); + printf("\t[-oa\tattestation output file name (default do not save)]\n"); +diff --git a/utils/gettime.c b/utils/gettime.c +index b07baf1..2e4b819 100644 +--- a/utils/gettime.c ++++ b/utils/gettime.c +@@ -118,10 +118,7 @@ int main(int argc, char *argv[]) + else if (strcmp(argv[i],"-halg") == 0) { + i++; + if (i < argc) { +- if (strcmp(argv[i],"sha1") == 0) { +- halg = TPM_ALG_SHA1; +- } +- else if (strcmp(argv[i],"sha256") == 0) { ++ if (strcmp(argv[i],"sha256") == 0) { + halg = TPM_ALG_SHA256; + } + else if (strcmp(argv[i],"sha384") == 0) { +@@ -381,7 +378,7 @@ static void printUsage(void) + printf("\t-hk\tsigning key handle\n"); + printf("\t[-pwdk\tpassword for signing key (default empty)]\n"); + printf("\t[-pwde\tpassword for endorsement hierarchy (default empty)]\n"); +- printf("\t[-halg\t(sha1, sha256, sha384, sha512) (default sha256)]\n"); ++ printf("\t[-halg\t(sha256, sha384, sha512) (default sha256)]\n"); + printf("\t[-salg\tsignature algorithm (rsa, ecc, hmac) (default rsa)]\n"); + printf("\t[-qd\tqualifying data file name]\n"); + printf("\t[-os\tsignature file name (default do not save)]\n"); +diff --git a/utils/hash.c b/utils/hash.c +index 71b8a7c..e21ff8c 100644 +--- a/utils/hash.c ++++ b/utils/hash.c +@@ -93,10 +93,7 @@ int main(int argc, char *argv[]) + else if (strcmp(argv[i],"-halg") == 0) { + i++; + if (i < argc) { +- if (strcmp(argv[i],"sha1") == 0) { +- halg = TPM_ALG_SHA1; +- } +- else if (strcmp(argv[i],"sha256") == 0) { ++ if (strcmp(argv[i],"sha256") == 0) { + halg = TPM_ALG_SHA256; + } + else if (strcmp(argv[i],"sha384") == 0) { +@@ -300,7 +297,7 @@ static void printUsage(void) + printf("\n"); + printf("\t[-hi\thierarchy (e, o, p, n) (default null)]\n"); + printf("\t\te endorsement, o owner, p platform, n null\n"); +- printf("\t[-halg\t(sha1, sha256, sha384, sha512) (default sha256)]\n"); ++ printf("\t[-halg\t(sha256, sha384, sha512) (default sha256)]\n"); + printf("\t-if\tinput file to be hashed\n"); + printf("\t-ic\tdata string to be hashed\n"); + printf("\t[-ns\tno space, no text, no newlines]\n"); +diff --git a/utils/hashsequencestart.c b/utils/hashsequencestart.c +index d54fadd..8b1e6fc 100644 +--- a/utils/hashsequencestart.c ++++ b/utils/hashsequencestart.c +@@ -87,10 +87,7 @@ int main(int argc, char *argv[]) + else if (strcmp(argv[i],"-halg") == 0) { + i++; + if (i < argc) { +- if (strcmp(argv[i],"sha1") == 0) { +- hashAlg = TPM_ALG_SHA1; +- } +- else if (strcmp(argv[i],"sha256") == 0) { ++ if (strcmp(argv[i],"sha256") == 0) { + hashAlg = TPM_ALG_SHA256; + } + else if (strcmp(argv[i],"sha384") == 0) { +@@ -243,7 +240,7 @@ static void printUsage(void) + printf("Runs TPM2_HashSequenceStart\n"); + printf("\n"); + printf("\t[-pwda\tpassword for sequence (default empty)]\n"); +- printf("\t[-halg\t(sha1, sha256, sha384, sha512, null) (default sha256)]\n"); ++ printf("\t[-halg\t(sha256, sha384, sha512, null) (default sha256)]\n"); + printf("\t\tnull is an event sequence\n"); + printf("\n"); + printf("\t-se[0-2] session handle / attributes (default NULL)\n"); +diff --git a/utils/hmac.c b/utils/hmac.c +index be63e1b..7ea325d 100644 +--- a/utils/hmac.c ++++ b/utils/hmac.c +@@ -105,10 +105,7 @@ int main(int argc, char *argv[]) + else if (strcmp(argv[i],"-halg") == 0) { + i++; + if (i < argc) { +- if (strcmp(argv[i],"sha1") == 0) { +- halg = TPM_ALG_SHA1; +- } +- else if (strcmp(argv[i],"sha256") == 0) { ++ if (strcmp(argv[i],"sha256") == 0) { + halg = TPM_ALG_SHA256; + } + else if (strcmp(argv[i],"sha384") == 0) { +@@ -343,7 +340,7 @@ static void printUsage(void) + printf("\n"); + printf("\t-hk\tkey handle\n"); + printf("\t[-pwdk\tpassword for key (default empty)]\n"); +- printf("\t[-halg\t(sha1, sha256, sha384, sha512) (default sha256)]\n"); ++ printf("\t[-halg\t(sha256, sha384, sha512) (default sha256)]\n"); + printf("\t-if\tinput file to be HMACed\n"); + printf("\t-ic\tdata string to be HMACed\n"); + printf("\t[-os\thmac file name (default do not save)]\n"); +diff --git a/utils/hmacstart.c b/utils/hmacstart.c +index 3fdd0f9..4463376 100644 +--- a/utils/hmacstart.c ++++ b/utils/hmacstart.c +@@ -109,10 +109,7 @@ int main(int argc, char *argv[]) + else if (strcmp(argv[i],"-halg") == 0) { + i++; + if (i < argc) { +- if (strcmp(argv[i],"sha1") == 0) { +- halg = TPM_ALG_SHA1; +- } +- else if (strcmp(argv[i],"sha256") == 0) { ++ if (strcmp(argv[i],"sha256") == 0) { + halg = TPM_ALG_SHA256; + } + else if (strcmp(argv[i],"sha384") == 0) { +@@ -270,7 +267,7 @@ static void printUsage(void) + printf("\t-hk\tkey handle\n"); + printf("\t-pwdk\tpassword for key (default empty)\n"); + printf("\t-pwda\tpassword for sequence (default empty)\n"); +- printf("\t[-halg\t(sha1, sha256, sha384, sha512) (default sha256)]\n"); ++ printf("\t[-halg\t(sha256, sha384, sha512) (default sha256)]\n"); + printf("\n"); + printf("\t-se[0-2] session handle / attributes (default PWAP)\n"); + printf("\t01\tcontinue\n"); +diff --git a/utils/importpem.c b/utils/importpem.c +index 38ad125..cbf3794 100644 +--- a/utils/importpem.c ++++ b/utils/importpem.c +@@ -215,10 +215,7 @@ int main(int argc, char *argv[]) + else if (strcmp(argv[i],"-halg") == 0) { + i++; + if (i < argc) { +- if (strcmp(argv[i],"sha1") == 0) { +- halg = TPM_ALG_SHA1; +- } +- else if (strcmp(argv[i],"sha256") == 0) { ++ if (strcmp(argv[i],"sha256") == 0) { + halg = TPM_ALG_SHA256; + } + else if (strcmp(argv[i],"sha384") == 0) { +@@ -240,10 +237,7 @@ int main(int argc, char *argv[]) + else if (strcmp(argv[i],"-nalg") == 0) { + i++; + if (i < argc) { +- if (strcmp(argv[i],"sha1") == 0) { +- nalg = TPM_ALG_SHA1; +- } +- else if (strcmp(argv[i],"sha256") == 0) { ++ if (strcmp(argv[i],"sha256") == 0) { + nalg = TPM_ALG_SHA256; + } + else if (strcmp(argv[i],"sha384") == 0) { +@@ -478,8 +472,8 @@ static void printUsage(void) + printf("\t[-uwa\tuserWithAuth attribute clear (default set)]\n"); + printf("\t-opu\tpublic area file name\n"); + printf("\t-opr\tprivate area file name\n"); +- printf("\t[-nalg\tname hash algorithm (sha1, sha256, sha384, sha512) (default sha256)]\n"); +- printf("\t[-halg\tscheme hash algorithm (sha1, sha256, sha384, sha512) (default sha256)]\n"); ++ printf("\t[-nalg\tname hash algorithm (sha256, sha384, sha512) (default sha256)]\n"); ++ printf("\t[-halg\tscheme hash algorithm (sha256, sha384, sha512) (default sha256)]\n"); + printf("\t[-pol\tpolicy file (default empty)]\n"); + printf("\n"); + printf("\t-se[0-2] session handle / attributes (default PWAP)\n"); +diff --git a/utils/loadexternal.c b/utils/loadexternal.c +index 877501c..fc8cd1a 100644 +--- a/utils/loadexternal.c ++++ b/utils/loadexternal.c +@@ -127,10 +127,7 @@ int main(int argc, char *argv[]) + else if (strcmp(argv[i],"-halg") == 0) { + i++; + if (i < argc) { +- if (strcmp(argv[i],"sha1") == 0) { +- halg = TPM_ALG_SHA1; +- } +- else if (strcmp(argv[i],"sha256") == 0) { ++ if (strcmp(argv[i],"sha256") == 0) { + halg = TPM_ALG_SHA256; + } + else if (strcmp(argv[i],"sha384") == 0) { +@@ -152,10 +149,7 @@ int main(int argc, char *argv[]) + else if (strcmp(argv[i],"-nalg") == 0) { + i++; + if (i < argc) { +- if (strcmp(argv[i],"sha1") == 0) { +- nalg = TPM_ALG_SHA1; +- } +- else if (strcmp(argv[i],"sha256") == 0) { ++ if (strcmp(argv[i],"sha256") == 0) { + nalg = TPM_ALG_SHA256; + } + else if (strcmp(argv[i],"sha384") == 0) { +@@ -511,8 +505,8 @@ static void printUsage(void) + printf("Runs TPM2_LoadExternal\n"); + printf("\n"); + printf("\t[-hi\thierarchy (e, o, p, n) (default NULL)]\n"); +- printf("\t[-nalg\tname hash algorithm (sha1, sha256, sha384, sha512) (default sha256)]\n"); +- printf("\t[-halg\tscheme hash algorithm (sha1, sha256, sha384, sha512) (default sha256)]\n"); ++ printf("\t[-nalg\tname hash algorithm (sha256, sha384, sha512) (default sha256)]\n"); ++ printf("\t[-halg\tscheme hash algorithm (sha256, sha384, sha512) (default sha256)]\n"); + printf("\n"); + printf("\t[Asymmetric Key Algorithm]\n"); + printf("\n"); +diff --git a/utils/man/man1/tsscertify.1 b/utils/man/man1/tsscertify.1 +index 6895ee7..b837209 100644 +--- a/utils/man/man1/tsscertify.1 ++++ b/utils/man/man1/tsscertify.1 +@@ -20,7 +20,7 @@ certifying key handle + password for key (default empty)] + .TP + [\-halg +-(sha1, sha256, sha384 sha512) (default sha256)] ++(sha256, sha384 sha512) (default sha256)] + .TP + [\-salg + signature algorithm (rsa, ecc, hmac) (default rsa)] +diff --git a/utils/man/man1/tsscertifycreation.1 b/utils/man/man1/tsscertifycreation.1 +index 4382ed9..7c77a1e 100644 +--- a/utils/man/man1/tsscertifycreation.1 ++++ b/utils/man/man1/tsscertifycreation.1 +@@ -17,7 +17,7 @@ certifying key handle + password for key (default empty)] + .TP + [\-halg +-(sha1, sha256, sha384) (default sha256)] ++(sha256, sha384) (default sha256)] + .TP + [\-salg + signature algorithm (rsa, ecc) (default rsa)] +diff --git a/utils/man/man1/tsscreate.1 b/utils/man/man1/tsscreate.1 +index b4eda75..f2f6fc4 100644 +--- a/utils/man/man1/tsscreate.1 ++++ b/utils/man/man1/tsscreate.1 +@@ -89,10 +89,10 @@ userWithAuth attribute clear (default set)] + data (inSensitive) file name] + .TP + [\-nalg +-name hash algorithm (sha1, sha256, sha384, sha512) (default sha256)] ++name hash algorithm (sha256, sha384, sha512) (default sha256)] + .TP + [\-halg +-scheme hash algorithm (sha1, sha256, sha384, sha512) (default sha256)] ++scheme hash algorithm (sha256, sha384, sha512) (default sha256)] + .TP + [\-pwdk + password for key (default empty)] +diff --git a/utils/man/man1/tsscreateloaded.1 b/utils/man/man1/tsscreateloaded.1 +index ccd3d73..ebcf721 100644 +--- a/utils/man/man1/tsscreateloaded.1 ++++ b/utils/man/man1/tsscreateloaded.1 +@@ -93,10 +93,10 @@ userWithAuth attribute clear (default set)] + data (inSensitive) file name] + .TP + [\-nalg +-name hash algorithm (sha1, sha256, sha384, sha512) (default sha256)] ++name hash algorithm (sha256, sha384, sha512) (default sha256)] + .TP + [\-halg +-scheme hash algorithm (sha1, sha256, sha384, sha512) (default sha256)] ++scheme hash algorithm (sha256, sha384, sha512) (default sha256)] + .TP + [\-der + object's parent is a derivation parent] +diff --git a/utils/man/man1/tsscreateprimary.1 b/utils/man/man1/tsscreateprimary.1 +index 895a42e..55a9d85 100644 +--- a/utils/man/man1/tsscreateprimary.1 ++++ b/utils/man/man1/tsscreateprimary.1 +@@ -114,10 +114,10 @@ userWithAuth attribute clear (default set)] + data (inSensitive) file name] + .TP + [\-nalg +-name hash algorithm (sha1, sha256, sha384, sha512) (default sha256)] ++name hash algorithm (sha256, sha384, sha512) (default sha256)] + .TP + [\-halg +-scheme hash algorithm (sha1, sha256, sha384, sha512) (default sha256)] ++scheme hash algorithm (sha256, sha384, sha512) (default sha256)] + .HP + \fB\-se[0\-2]\fR session handle / attributes (default PWAP) + .TP +diff --git a/utils/man/man1/tssgetcommandauditdigest.1 b/utils/man/man1/tssgetcommandauditdigest.1 +index 34711e0..11d3b78 100644 +--- a/utils/man/man1/tssgetcommandauditdigest.1 ++++ b/utils/man/man1/tssgetcommandauditdigest.1 +@@ -17,7 +17,7 @@ signing key handle + password for key (default empty)] + .TP + [\-halg +-(sha1, sha256, sha384, sha512) (default sha256)] ++(sha256, sha384, sha512) (default sha256)] + .TP + [\-salg + signature algorithm (rsa, ecc, hmac) (default rsa)] +diff --git a/utils/man/man1/tssgetsessionauditdigest.1 b/utils/man/man1/tssgetsessionauditdigest.1 +index d09c78b..3fa4a03 100644 +--- a/utils/man/man1/tssgetsessionauditdigest.1 ++++ b/utils/man/man1/tssgetsessionauditdigest.1 +@@ -20,7 +20,7 @@ password for key (default empty)] + audit session handle + .TP + [\-halg +-(sha1, sha256, sha384, sha512) (default sha256)] ++(sha256, sha384, sha512) (default sha256)] + .TP + [\-qd + qualifying data file name] +diff --git a/utils/man/man1/tssgettime.1 b/utils/man/man1/tssgettime.1 +index bec0627..ac4b425 100644 +--- a/utils/man/man1/tssgettime.1 ++++ b/utils/man/man1/tssgettime.1 +@@ -17,7 +17,7 @@ password for signing key (default empty)] + password for endorsement hierarchy (default empty)] + .TP + [\-halg +-(sha1, sha256, sha384, sha512) (default sha256)] ++(sha256, sha384, sha512) (default sha256)] + .TP + [\-salg + signature algorithm (rsa, ecc, hmac) (default rsa)] +diff --git a/utils/man/man1/tsshash.1 b/utils/man/man1/tsshash.1 +index 6eff929..01fa758 100644 +--- a/utils/man/man1/tsshash.1 ++++ b/utils/man/man1/tsshash.1 +@@ -12,7 +12,7 @@ hierarchy (e, o, p, n) (default null)] + e endorsement, o owner, p platform, n null + .TP + [\-halg +-(sha1, sha256, sha384, sha512) (default sha256)] ++(sha256, sha384, sha512) (default sha256)] + .TP + \fB\-if\fR + input file to be hashed +diff --git a/utils/man/man1/tsshashsequencestart.1 b/utils/man/man1/tsshashsequencestart.1 +index f6d7f52..33225da 100644 +--- a/utils/man/man1/tsshashsequencestart.1 ++++ b/utils/man/man1/tsshashsequencestart.1 +@@ -11,7 +11,7 @@ Runs TPM2_HashSequenceStart + password for sequence (default empty)] + .TP + [\-halg +-(sha1, sha256, sha384, sha512, null) (default sha256)] ++(sha256, sha384, sha512, null) (default sha256)] + null is an event sequence + .HP + \fB\-se[0\-2]\fR session handle / attributes (default NULL) +diff --git a/utils/man/man1/tsshmac.1 b/utils/man/man1/tsshmac.1 +index e64a861..c55b998 100644 +--- a/utils/man/man1/tsshmac.1 ++++ b/utils/man/man1/tsshmac.1 +@@ -14,7 +14,7 @@ key handle + password for key (default empty)] + .TP + [\-halg +-(sha1, sha256, sha384, sha512) (default sha256)] ++(sha256, sha384, sha512) (default sha256)] + .TP + \fB\-if\fR + input file to be HMACed +diff --git a/utils/man/man1/tsshmacstart.1 b/utils/man/man1/tsshmacstart.1 +index 65d4ab6..9dd8fbf 100644 +--- a/utils/man/man1/tsshmacstart.1 ++++ b/utils/man/man1/tsshmacstart.1 +@@ -17,7 +17,7 @@ password for key (default empty) + password for sequence (default empty) + .TP + [\-halg +-(sha1, sha256, sha384, sha512) (default sha256)] ++(sha256, sha384, sha512) (default sha256)] + .HP + \fB\-se[0\-2]\fR session handle / attributes (default PWAP) + .TP +diff --git a/utils/man/man1/tssimportpem.1 b/utils/man/man1/tssimportpem.1 +index 21c362e..46821eb 100644 +--- a/utils/man/man1/tssimportpem.1 ++++ b/utils/man/man1/tssimportpem.1 +@@ -49,10 +49,10 @@ public area file name + private area file name + .TP + [\-nalg +-name hash algorithm (sha1, sha256, sha384, sha512) (default sha256)] ++name hash algorithm (sha256, sha384, sha512) (default sha256)] + .TP + [\-halg +-scheme hash algorithm (sha1, sha256, sha384, sha512) (default sha256)] ++scheme hash algorithm (sha256, sha384, sha512) (default sha256)] + .TP + [\-pol + policy file (default empty)] +diff --git a/utils/man/man1/tssloadexternal.1 b/utils/man/man1/tssloadexternal.1 +index e32a251..729d357 100644 +--- a/utils/man/man1/tssloadexternal.1 ++++ b/utils/man/man1/tssloadexternal.1 +@@ -11,10 +11,10 @@ Runs TPM2_LoadExternal + hierarchy (e, o, p, n) (default NULL)] + .TP + [\-nalg +-name hash algorithm (sha1, sha256, sha384, sha512) (default sha256)] ++name hash algorithm (sha256, sha384, sha512) (default sha256)] + .TP + [\-halg +-scheme hash algorithm (sha1, sha256, sha384, sha512) (default sha256)] ++scheme hash algorithm (sha256, sha384, sha512) (default sha256)] + .IP + [Asymmetric Key Algorithm] + .TP +diff --git a/utils/man/man1/tssnvcertify.1 b/utils/man/man1/tssnvcertify.1 +index c55f6dc..1a50fd6 100644 +--- a/utils/man/man1/tssnvcertify.1 ++++ b/utils/man/man1/tssnvcertify.1 +@@ -20,7 +20,7 @@ certifying key handle + password for key (default empty)] + .TP + [\-halg +-(sha1, sha256, sha384, sha512) (default sha256)] ++(sha256, sha384, sha512) (default sha256)] + .TP + [\-salg + signature algorithm (rsa, ecc, hmac) (default rsa)] +diff --git a/utils/man/man1/tssnvdefinespace.1 b/utils/man/man1/tssnvdefinespace.1 +index 0f378e9..5d9d395 100644 +--- a/utils/man/man1/tssnvdefinespace.1 ++++ b/utils/man/man1/tssnvdefinespace.1 +@@ -36,7 +36,7 @@ password for NV index (default empty)] + sets AUTHWRITE (if not PIN index), AUTHREAD + .TP + [\-nalg +-name algorithm (sha1, sha256, sha384 sha512) (default sha256)] ++name algorithm (sha256, sha384 sha512) (default sha256)] + .TP + [\-sz + data size in decimal (default 0)] +diff --git a/utils/man/man1/tssnvreadpublic.1 b/utils/man/man1/tssnvreadpublic.1 +index b8c7bbb..c8619bb 100644 +--- a/utils/man/man1/tssnvreadpublic.1 ++++ b/utils/man/man1/tssnvreadpublic.1 +@@ -11,7 +11,7 @@ Runs TPM2_NV_ReadPublic + NV index handle + .TP + [\-nalg +-expected name hash algorithm (sha1, sha256, sha384 sha512) ++expected name hash algorithm (sha256, sha384 sha512) + (default no check)] + .TP + [\-opu +diff --git a/utils/man/man1/tsspolicymaker.1 b/utils/man/man1/tsspolicymaker.1 +index 6660f36..36beaaa 100644 +--- a/utils/man/man1/tsspolicymaker.1 ++++ b/utils/man/man1/tsspolicymaker.1 +@@ -6,7 +6,7 @@ policymaker \- Runs TPM2 policymaker + policymaker + .TP + [\-halg +-hash algorithm (sha1 sha256 sha384 sha512) (default sha256)] ++hash algorithm (sha256 sha384 sha512) (default sha256)] + .TP + [\-nz + do not extend starting with zeros, just hash the last line] +diff --git a/utils/man/man1/tsspolicysigned.1 b/utils/man/man1/tsspolicysigned.1 +index f50b81a..dab24ba 100644 +--- a/utils/man/man1/tsspolicysigned.1 ++++ b/utils/man/man1/tsspolicysigned.1 +@@ -26,7 +26,7 @@ policyRef file (default none)] + expiration in decimal (default none)] + .TP + [\-halg +-(sha1, sha256, sha384, sha512) (default sha256)] ++(sha256, sha384, sha512) (default sha256)] + .TP + \fB\-sk\fR + RSA signing key file name (PEM format) +diff --git a/utils/man/man1/tsspublicname.1 b/utils/man/man1/tsspublicname.1 +index 6600436..e42481c 100644 +--- a/utils/man/man1/tsspublicname.1 ++++ b/utils/man/man1/tsspublicname.1 +@@ -45,10 +45,10 @@ rsapss + null + .TP + [\-nalg +-name hash algorithm (sha1, sha256, sha384, sha512) (default sha256)] ++name hash algorithm (sha256, sha384, sha512) (default sha256)] + .TP + [\-halg +-scheme hash algorithm (sha1, sha256, sha384, sha512) (default sha256)] ++scheme hash algorithm (sha256, sha384, sha512) (default sha256)] + .TP + [\-uwa + userWithAuth attribute clear (default set)] +diff --git a/utils/man/man1/tssquote.1 b/utils/man/man1/tssquote.1 +index 04a2e60..3de384b 100644 +--- a/utils/man/man1/tssquote.1 ++++ b/utils/man/man1/tssquote.1 +@@ -17,7 +17,7 @@ quoting key handle + password for quoting key (default empty)] + .TP + [\-halg +-for signing (sha1, sha256, sha384, sha512) (default sha256)] ++for signing (sha256, sha384, sha512) (default sha256)] + .TP + [\-palg + for PCR bank selection (sha1, sha256, sha384, sha512) (default sha256)] +diff --git a/utils/man/man1/tssrsadecrypt.1 b/utils/man/man1/tssrsadecrypt.1 +index 6c35e42..ff2b0f2 100644 +--- a/utils/man/man1/tssrsadecrypt.1 ++++ b/utils/man/man1/tssrsadecrypt.1 +@@ -16,7 +16,7 @@ password for key (default empty)[ + [\-ipwdk password file for key, nul terminated (default empty)] + \fB\-ie\fR encrypt file name + \fB\-od\fR decrypt file name (default do not save) +-[\-oid (sha1, sha256, sha384 sha512)] ++[\-oid (sha256, sha384 sha512)] + .IP + optionally add OID and PKCS1 padding to the + encrypt data (demo of signing with arbitrary OID) +diff --git a/utils/man/man1/tsssetcommandcodeauditstatus.1 b/utils/man/man1/tsssetcommandcodeauditstatus.1 +index c4d19dc..d84a0c2 100644 +--- a/utils/man/man1/tsssetcommandcodeauditstatus.1 ++++ b/utils/man/man1/tsssetcommandcodeauditstatus.1 +@@ -14,7 +14,7 @@ authhandle hierarchy (o, p) (default platform)] + authorization password (default empty)] + .TP + [\-halg +-(sha1, sha256, sha384, sha512, null) (default null)] ++(sha256, sha384, sha512, null) (default null)] + .TP + [\-set + command code to set (may be specified more than once (default none)] +diff --git a/utils/man/man1/tsssetprimarypolicy.1 b/utils/man/man1/tsssetprimarypolicy.1 +index c67c1f9..9238407 100644 +--- a/utils/man/man1/tsssetprimarypolicy.1 ++++ b/utils/man/man1/tsssetprimarypolicy.1 +@@ -17,7 +17,7 @@ authorization password (default empty)] + policy file (default empty policy)] + .TP + [\-halg +-(sha1, sha256) (default null)] ++(sha256) (default null)] + .HP + \fB\-se[0\-2]\fR session handle / attributes (default PWAP) + .TP +diff --git a/utils/man/man1/tsssign.1 b/utils/man/man1/tsssign.1 +index d5ad351..df67aee 100644 +--- a/utils/man/man1/tsssign.1 ++++ b/utils/man/man1/tsssign.1 +@@ -17,7 +17,7 @@ input message to hash and sign + password for key (default empty)] + .TP + [\-halg +-(sha1, sha256, sha384, sha512) (default sha256)] ++(sha256, sha384, sha512) (default sha256)] + .TP + [\-salg + signature algorithm (rsa, ecc, hmac) (default rsa)] +diff --git a/utils/man/man1/tssstartauthsession.1 b/utils/man/man1/tssstartauthsession.1 +index 3e944bb..ad16b0f 100644 +--- a/utils/man/man1/tssstartauthsession.1 ++++ b/utils/man/man1/tssstartauthsession.1 +@@ -19,7 +19,7 @@ t + Trial policy session + .TP + [\-halg +-(sha1, sha256, sha384, sha512) (default sha256)] ++(sha256, sha384, sha512) (default sha256)] + .TP + [\-hs + salt handle (default TPM_RH_NULL)] +diff --git a/utils/man/man1/tssverifysignature.1 b/utils/man/man1/tssverifysignature.1 +index e2d6460..d30eee9 100644 +--- a/utils/man/man1/tssverifysignature.1 ++++ b/utils/man/man1/tssverifysignature.1 +@@ -37,7 +37,7 @@ One of \fB\-hk\fR, \fB\-ipem\fR, \fB\-ihmac\fR must be specified + ticket file name (requires \fB\-hk\fR)] + .TP + [\-halg +-(sha1, sha256, sha384 sha512) (default sha256)] ++(sha256, sha384 sha512) (default sha256)] + .IP + [Asymmetric Key Algorithm] + .TP +diff --git a/utils/nvcertify.c b/utils/nvcertify.c +index 81bde69..440c894 100644 +--- a/utils/nvcertify.c ++++ b/utils/nvcertify.c +@@ -131,10 +131,7 @@ int main(int argc, char *argv[]) + else if (strcmp(argv[i],"-halg") == 0) { + i++; + if (i < argc) { +- if (strcmp(argv[i],"sha1") == 0) { +- halg = TPM_ALG_SHA1; +- } +- else if (strcmp(argv[i],"sha256") == 0) { ++ if (strcmp(argv[i],"sha256") == 0) { + halg = TPM_ALG_SHA256; + } + else if (strcmp(argv[i],"sha384") == 0) { +@@ -433,7 +430,7 @@ static void printUsage(void) + printf("\t[-pwdn\tpassword for NV index (default empty)]\n"); + printf("\t-hk\tcertifying key handle\n"); + printf("\t[-pwdk\tpassword for key (default empty)]\n"); +- printf("\t[-halg\t(sha1, sha256, sha384, sha512) (default sha256)]\n"); ++ printf("\t[-halg\t(sha256, sha384, sha512) (default sha256)]\n"); + printf("\t[-salg\tsignature algorithm (rsa, ecc, hmac) (default rsa)]\n"); + printf("\t-sz\tdata size\n"); + printf("\t[-off\toffset (default 0)]\n"); +diff --git a/utils/nvdefinespace.c b/utils/nvdefinespace.c +index 18ce6ea..cbe253e 100644 +--- a/utils/nvdefinespace.c ++++ b/utils/nvdefinespace.c +@@ -124,11 +124,7 @@ int main(int argc, char *argv[]) + else if (strcmp(argv[i],"-nalg") == 0) { + i++; + if (i < argc) { +- if (strcmp(argv[i],"sha1") == 0) { +- nalg = TPM_ALG_SHA1; +- hashSize = SHA1_DIGEST_SIZE; +- } +- else if (strcmp(argv[i],"sha256") == 0) { ++ if (strcmp(argv[i],"sha256") == 0) { + nalg = TPM_ALG_SHA256; + hashSize = SHA256_DIGEST_SIZE; + } +@@ -562,7 +558,7 @@ static void printUsage(void) + printf("\n"); + printf("\t[-pwdn\tpassword for NV index (default empty)]\n"); + printf("\t\tsets AUTHWRITE (if not PIN index), AUTHREAD\n"); +- printf("\t[-nalg\tname algorithm (sha1, sha256, sha384 sha512) (default sha256)]\n"); ++ printf("\t[-nalg\tname algorithm (sha256, sha384 sha512) (default sha256)]\n"); + printf("\t[-sz\tdata size in decimal (default 0)]\n"); + printf("\t\tIgnored for other than ordinary index\n"); + printf("\t[-ty\tindex type (o, c, b, e, p, f) (default ordinary)]\n"); +diff --git a/utils/nvreadpublic.c b/utils/nvreadpublic.c +index cf36b96..cbcae63 100644 +--- a/utils/nvreadpublic.c ++++ b/utils/nvreadpublic.c +@@ -101,10 +101,7 @@ int main(int argc, char *argv[]) + else if (strcmp(argv[i],"-nalg") == 0) { + i++; + if (i < argc) { +- if (strcmp(argv[i],"sha1") == 0) { +- nalg = TPM_ALG_SHA1; +- } +- else if (strcmp(argv[i],"sha256") == 0) { ++ if (strcmp(argv[i],"sha256") == 0) { + nalg = TPM_ALG_SHA256; + } + else if (strcmp(argv[i],"sha384") == 0) { +@@ -336,7 +333,7 @@ static void printUsage(void) + printf("Runs TPM2_NV_ReadPublic\n"); + printf("\n"); + printf("\t-ha\tNV index handle\n"); +- printf("\t[-nalg\texpected name hash algorithm (sha1, sha256, sha384 sha512)\n" ++ printf("\t[-nalg\texpected name hash algorithm (sha256, sha384 sha512)\n" + "\t\t(default no check)]\n"); + printf("\t[-opu\tNV public file name (default do not save)]\n"); + printf("\t[-ns\tadditionally print Name in hex ascii on one line]\n"); +diff --git a/utils/objecttemplates.c b/utils/objecttemplates.c +index 37d7b64..4d1269c 100644 +--- a/utils/objecttemplates.c ++++ b/utils/objecttemplates.c +@@ -576,7 +576,7 @@ void printUsageTemplate(void) + printf("\t[-uwa\tuserWithAuth attribute clear (default set)]\n"); + printf("\t[-if\tdata (inSensitive) file name]\n"); + printf("\n"); +- printf("\t[-nalg\tname hash algorithm (sha1, sha256, sha384, sha512) (default sha256)]\n"); +- printf("\t[-halg\tscheme hash algorithm (sha1, sha256, sha384, sha512) (default sha256)]\n"); ++ printf("\t[-nalg\tname hash algorithm (sha256, sha384, sha512) (default sha256)]\n"); ++ printf("\t[-halg\tscheme hash algorithm (sha256, sha384, sha512) (default sha256)]\n"); + return; + } +diff --git a/utils/policymaker.c b/utils/policymaker.c +index 7290ed7..818ac8b 100644 +--- a/utils/policymaker.c ++++ b/utils/policymaker.c +@@ -107,10 +107,7 @@ int main(int argc, char *argv[]) + if (strcmp(argv[i],"-halg") == 0) { + i++; + if (i < argc) { +- if (strcmp(argv[i],"sha1") == 0) { +- digest.hashAlg = TPM_ALG_SHA1; +- } +- else if (strcmp(argv[i],"sha256") == 0) { ++ if (strcmp(argv[i],"sha256") == 0) { + digest.hashAlg = TPM_ALG_SHA256; + } + else if (strcmp(argv[i],"sha384") == 0) { +@@ -342,7 +339,7 @@ static void printUsage(void) + printf("\n"); + printf("policymaker\n"); + printf("\n"); +- printf("\t[-halg\thash algorithm (sha1 sha256 sha384 sha512) (default sha256)]\n"); ++ printf("\t[-halg\thash algorithm (sha256 sha384 sha512) (default sha256)]\n"); + printf("\t[-nz\tdo not extend starting with zeros, just hash the last line]\n"); + printf("\t-if\tinput policy statements in hex ascii\n"); + printf("\t[-of\toutput file - policy hash in binary]\n"); +diff --git a/utils/policysigned.c b/utils/policysigned.c +index 469cec9..dbecfe0 100644 +--- a/utils/policysigned.c ++++ b/utils/policysigned.c +@@ -216,10 +216,7 @@ int main(int argc, char *argv[]) + else if (strcmp(argv[i],"-halg") == 0) { + i++; + if (i < argc) { +- if (strcmp(argv[i],"sha1") == 0) { +- halg = TPM_ALG_SHA1; +- } +- else if (strcmp(argv[i],"sha256") == 0) { ++ if (strcmp(argv[i],"sha256") == 0) { + halg = TPM_ALG_SHA256; + } + else if (strcmp(argv[i],"sha384") == 0) { +@@ -444,7 +441,7 @@ static void printUsage(void) + printf("\t[-cp\tcpHash file (default none)]\n"); + printf("\t[-pref\tpolicyRef file (default none)]\n"); + printf("\t[-exp\texpiration in decimal (default none)]\n"); +- printf("\t[-halg\t(sha1, sha256, sha384, sha512) (default sha256)]\n"); ++ printf("\t[-halg\t(sha256, sha384, sha512) (default sha256)]\n"); + printf("\t-sk\tRSA signing key file name (PEM format)\n"); + printf("\t\tUse this signing key.\n"); + printf("\t-is\tsignature file name\n"); +diff --git a/utils/publicname.c b/utils/publicname.c +index f599d36..fbe9ee4 100644 +--- a/utils/publicname.c ++++ b/utils/publicname.c +@@ -90,10 +90,7 @@ int main(int argc, char *argv[]) + if (strcmp(argv[i],"-halg") == 0) { + i++; + if (i < argc) { +- if (strcmp(argv[i],"sha1") == 0) { +- halg = TPM_ALG_SHA1; +- } +- else if (strcmp(argv[i],"sha256") == 0) { ++ if (strcmp(argv[i],"sha256") == 0) { + halg = TPM_ALG_SHA256; + } + else if (strcmp(argv[i],"sha384") == 0) { +@@ -115,10 +112,7 @@ int main(int argc, char *argv[]) + else if (strcmp(argv[i],"-nalg") == 0) { + i++; + if (i < argc) { +- if (strcmp(argv[i],"sha1") == 0) { +- nalg = TPM_ALG_SHA1; +- } +- else if (strcmp(argv[i],"sha256") == 0) { ++ if (strcmp(argv[i],"sha256") == 0) { + nalg = TPM_ALG_SHA256; + } + else if (strcmp(argv[i],"sha384") == 0) { +@@ -441,8 +435,8 @@ static void printUsage(void) + printf("\t\trsassa\n"); + printf("\t\trsapss\n"); + printf("\t\tnull\n"); +- printf("\t[-nalg\tname hash algorithm (sha1, sha256, sha384, sha512) (default sha256)]\n"); +- printf("\t[-halg\tscheme hash algorithm (sha1, sha256, sha384, sha512) (default sha256)]\n"); ++ printf("\t[-nalg\tname hash algorithm (sha256, sha384, sha512) (default sha256)]\n"); ++ printf("\t[-halg\tscheme hash algorithm (sha256, sha384, sha512) (default sha256)]\n"); + printf("\t[-uwa\tuserWithAuth attribute clear (default set)]\n"); + printf("\t[-si\tsigning (default) RSA]\n"); + printf("\t[-st\tstorage (default NULL scheme)]\n"); +diff --git a/utils/quote.c b/utils/quote.c +index c29fad0..154187c 100644 +--- a/utils/quote.c ++++ b/utils/quote.c +@@ -130,10 +130,7 @@ int main(int argc, char *argv[]) + else if (strcmp(argv[i],"-halg") == 0) { + i++; + if (i < argc) { +- if (strcmp(argv[i],"sha1") == 0) { +- halg = TPM_ALG_SHA1; +- } +- else if (strcmp(argv[i],"sha256") == 0) { ++ if (strcmp(argv[i],"sha256") == 0) { + halg = TPM_ALG_SHA256; + } + else if (strcmp(argv[i],"sha384") == 0) { +@@ -424,7 +421,7 @@ static void printUsage(void) + printf("\t-hp\tpcr handle (may be specified more than once)\n"); + printf("\t-hk\tquoting key handle\n"); + printf("\t[-pwdk\tpassword for quoting key (default empty)]\n"); +- printf("\t[-halg\tfor signing (sha1, sha256, sha384, sha512) (default sha256)]\n"); ++ printf("\t[-halg\tfor signing (sha256, sha384, sha512) (default sha256)]\n"); + printf("\t[-palg\tfor PCR bank selection (sha1, sha256, sha384, sha512) (default sha256)]\n"); + printf("\t[-salg\tsignature algorithm (rsa, ecc, hmac) (default rsa)]\n"); + printf("\t[-qd\tqualifying data file name]\n"); +diff --git a/utils/reg.sh b/utils/reg.sh +index 2d9d100..671720f 100755 +--- a/utils/reg.sh ++++ b/utils/reg.sh +@@ -70,11 +70,20 @@ PREFIX=./ + #PREFIX="valgrind ./" + + # hash algorithms to be used for testing ++export RESTRICTED_HASH_ALG + +-export ITERATE_ALGS="sha1 sha256 sha384 sha512" +-export ITERATE_ALGS_SIZES="20 32 48 64" +-export ITERATE_ALGS_COUNT=4 +-export BAD_ITERATE_ALGS="sha256 sha384 sha512 sha1" ++if [ "${RESTRICTED_HASH_ALG}" ]; then ++ export ITERATE_ALGS="sha256 sha384 sha512" ++ export ITERATE_ALGS_SIZES="32 48 64" ++ export ITERATE_ALGS_COUNT=3 ++ export BAD_ITERATE_ALGS="sha384 sha512 sha256" ++else ++ export ITERATE_ALGS="sha1 sha256 sha384 sha512" ++ export ITERATE_ALGS_SIZES="20 32 48 64" ++ export ITERATE_ALGS_COUNT=4 ++ export BAD_ITERATE_ALGS="sha256 sha384 sha512 sha1" ++fi ++export ITERATE_ALGS_WITH_SHA1="sha1 sha256 sha384 sha512" + + printUsage () + { +diff --git a/utils/regtests/testattest.sh b/utils/regtests/testattest.sh +index 2dacf88..044d35f 100755 +--- a/utils/regtests/testattest.sh ++++ b/utils/regtests/testattest.sh +@@ -379,21 +379,26 @@ echo "" + echo "Audit a PCR Read" + echo "" + +-for HALG in ${ITERATE_ALGS} ++for HALG in ${ITERATE_ALGS_WITH_SHA1} + do ++ if [ "${HALG}" = "sha1" ] && [ "${RESTRICTED_HASH_ALG}" ]; then ++ ALT_HALG=sha256 ++ else ++ ALT_HALG=${HALG} ++ fi + + echo "Start an audit session ${HALG}" +- ${PREFIX}startauthsession -se h -halg ${HALG} > run.out ++ ${PREFIX}startauthsession -se h -halg ${ALT_HALG} > run.out + checkSuccess $? + + echo "PCR 16 reset" + ${PREFIX}pcrreset -ha 16 > run.out + checkSuccess $? + +- cp policies/zero${HALG}.bin tmpdigestr.bin ++ cp policies/zero${ALT_HALG}.bin tmpdigestr.bin + + echo "PCR 16 read ${HALG}" +- ${PREFIX}pcrread -ha 16 -halg ${HALG} -se0 02000000 81 -ahalg ${HALG} -iosad tmpdigestr.bin > run.out ++ ${PREFIX}pcrread -ha 16 -halg ${HALG} -se0 02000000 81 -ahalg ${ALT_HALG} -iosad tmpdigestr.bin > run.out + checkSuccess $? + + echo "Get session audit digest" +@@ -409,7 +414,7 @@ do + checkSuccess $? + + echo "PCR 16 read ${HALG}" +- ${PREFIX}pcrread -ha 16 -halg ${HALG} -se0 02000000 81 -ahalg ${HALG} -iosad tmpdigestr.bin > run.out ++ ${PREFIX}pcrread -ha 16 -halg ${HALG} -se0 02000000 81 -ahalg ${ALT_HALG} -iosad tmpdigestr.bin > run.out + checkSuccess $? + + echo "Get session audit digest" +diff --git a/utils/regtests/testevent.sh b/utils/regtests/testevent.sh +index 6336920..57a96d2 100755 +--- a/utils/regtests/testevent.sh ++++ b/utils/regtests/testevent.sh +@@ -62,7 +62,7 @@ echo "" + + for TYPE in "1" "2" + do +- for HALG in ${ITERATE_ALGS} ++ for HALG in ${ITERATE_ALGS_WITH_SHA1} + do + + echo "Power cycle to reset IMA PCR" +diff --git a/utils/rsadecrypt.c b/utils/rsadecrypt.c +index e2846af..a521edf 100644 +--- a/utils/rsadecrypt.c ++++ b/utils/rsadecrypt.c +@@ -130,10 +130,7 @@ int main(int argc, char *argv[]) + else if (strcmp(argv[i],"-oid") == 0) { + i++; + if (i < argc) { +- if (strcmp(argv[i],"sha1") == 0) { +- halg = TPM_ALG_SHA1; +- } +- else if (strcmp(argv[i],"sha256") == 0) { ++ if (strcmp(argv[i],"sha256") == 0) { + halg = TPM_ALG_SHA256; + } + else if (strcmp(argv[i],"sha384") == 0) { +@@ -391,7 +388,6 @@ static TPM_RC padData(uint8_t **buffer, + uint16_t digestSize; + const uint8_t *oid; + uint16_t oidSize; +- const uint8_t sha1Oid[] = {SHA1_DER}; + const uint8_t sha256Oid[] = {SHA256_DER}; + const uint8_t sha384Oid[] = {SHA384_DER}; + const uint8_t sha512Oid[] = {SHA512_DER}; +@@ -419,10 +415,6 @@ static TPM_RC padData(uint8_t **buffer, + /* determine the OID */ + if (rc == 0) { + switch (halg) { +- case TPM_ALG_SHA1: +- oid = sha1Oid; +- oidSize = SHA1_DER_SIZE; +- break; + case TPM_ALG_SHA256: + oid = sha256Oid; + oidSize = SHA256_DER_SIZE; +@@ -499,7 +491,7 @@ static void printUsage(void) + printf("\t[-ipwdk\tpassword file for key, nul terminated (default empty)]\n"); + printf("\t-ie\tencrypt file name\n"); + printf("\t-od\tdecrypt file name (default do not save)\n"); +- printf("\t[-oid\t(sha1, sha256, sha384 sha512)]\n"); ++ printf("\t[-oid\t(sha256, sha384 sha512)]\n"); + printf("\t\toptionally add OID and PKCS1 padding to the\n"); + printf("\t\tencrypt data (demo of signing with arbitrary OID)\n"); + printf("\n"); +diff --git a/utils/setcommandcodeauditstatus.c b/utils/setcommandcodeauditstatus.c +index 7a880ae..7a95a59 100644 +--- a/utils/setcommandcodeauditstatus.c ++++ b/utils/setcommandcodeauditstatus.c +@@ -125,10 +125,7 @@ int main(int argc, char *argv[]) + else if (strcmp(argv[i],"-halg") == 0) { + i++; + if (i < argc) { +- if (strcmp(argv[i],"sha1") == 0) { +- in.auditAlg = TPM_ALG_SHA1; +- } +- else if (strcmp(argv[i],"sha256") == 0) { ++ if (strcmp(argv[i],"sha256") == 0) { + in.auditAlg = TPM_ALG_SHA256; + } + else if (strcmp(argv[i],"sha384") == 0) { +@@ -287,7 +284,7 @@ static void printUsage(void) + printf("\n"); + printf("\t[-hi\tauthhandle hierarchy (o, p) (default platform)]\n"); + printf("\t[-pwda\tauthorization password (default empty)]\n"); +- printf("\t[-halg\t(sha1, sha256, sha384, sha512, null) (default null)]\n"); ++ printf("\t[-halg\t(sha256, sha384, sha512, null) (default null)]\n"); + printf("\t[-set\tcommand code to set (may be specified more than once (default none)]\n"); + printf("\t[-clr\tcommand code to clear (may be specified more than once (default none)]\n"); + printf("\n"); +diff --git a/utils/setprimarypolicy.c b/utils/setprimarypolicy.c +index 619937f..100e265 100644 +--- a/utils/setprimarypolicy.c ++++ b/utils/setprimarypolicy.c +@@ -113,9 +113,6 @@ int main(int argc, char *argv[]) + if (strcmp(argv[i],"sha256") == 0) { + in.hashAlg = TPM_ALG_SHA256; + } +- else if (strcmp(argv[i],"sha1") == 0) { +- in.hashAlg = TPM_ALG_SHA1; +- } + else { + printf("Bad parameter %s for -halg\n", argv[i]); + printUsage(); +@@ -291,7 +288,7 @@ static void printUsage(void) + printf("\t[-hi\tauthhandle hierarchy (l, e, o, p) (default platform)]\n"); + printf("\t[-pwda\tauthorization password (default empty)]\n"); + printf("\t[-pol\tpolicy file (default empty policy)]\n"); +- printf("\t[-halg\t(sha1, sha256) (default null)]\n"); ++ printf("\t[-halg\t(sha256) (default null)]\n"); + printf("\n"); + printf("\t-se[0-2] session handle / attributes (default PWAP)\n"); + printf("\t01\tcontinue\n"); +diff --git a/utils/sign.c b/utils/sign.c +index ba2be27..d37f786 100644 +--- a/utils/sign.c ++++ b/utils/sign.c +@@ -123,10 +123,7 @@ int main(int argc, char *argv[]) + else if (strcmp(argv[i],"-halg") == 0) { + i++; + if (i < argc) { +- if (strcmp(argv[i],"sha1") == 0) { +- halg = TPM_ALG_SHA1; +- } +- else if (strcmp(argv[i],"sha256") == 0) { ++ if (strcmp(argv[i],"sha256") == 0) { + halg = TPM_ALG_SHA256; + } + else if (strcmp(argv[i],"sha384") == 0) { +@@ -474,7 +471,7 @@ static void printUsage(void) + printf("\t-hk\tkey handle\n"); + printf("\t-if\tinput message to hash and sign\n"); + printf("\t[-pwdk\tpassword for key (default empty)]\n"); +- printf("\t[-halg\t(sha1, sha256, sha384, sha512) (default sha256)]\n"); ++ printf("\t[-halg\t(sha256, sha384, sha512) (default sha256)]\n"); + printf("\t[-salg\tsignature algorithm (rsa, ecc, hmac) (default rsa)]\n"); + printf("\t[-scheme signing scheme (rsassa, rsapss, ecdsa, ecdaa, hmac)]\n"); + printf("\t\t(default rsassa, ecdsa, hmac)]\n"); +diff --git a/utils/startauthsession.c b/utils/startauthsession.c +index d47c731..93dc511 100644 +--- a/utils/startauthsession.c ++++ b/utils/startauthsession.c +@@ -88,10 +88,7 @@ int main(int argc, char *argv[]) + else if (strcmp(argv[i],"-halg") == 0) { + i++; + if (i < argc) { +- if (strcmp(argv[i],"sha1") == 0) { +- halg = TPM_ALG_SHA1; +- } +- else if (strcmp(argv[i],"sha256") == 0) { ++ if (strcmp(argv[i],"sha256") == 0) { + halg = TPM_ALG_SHA256; + } + else if (strcmp(argv[i],"sha384") == 0) { +@@ -291,7 +288,7 @@ static void printUsage(void) + printf("\t\tp Policy session\n"); + printf("\t\tt Trial policy session\n"); + printf("\n"); +- printf("\t[-halg\t(sha1, sha256, sha384, sha512) (default sha256)]\n"); ++ printf("\t[-halg\t(sha256, sha384, sha512) (default sha256)]\n"); + printf("\t[-hs\tsalt handle (default TPM_RH_NULL)]\n"); + printf("\t[-bi\tbind handle (default TPM_RH_NULL)]\n"); + printf("\t[-pwdb\tbind password for bind handle (default empty)]\n"); +diff --git a/utils/verifysignature.c b/utils/verifysignature.c +index 57978d5..7603a1f 100644 +--- a/utils/verifysignature.c ++++ b/utils/verifysignature.c +@@ -133,10 +133,7 @@ int main(int argc, char *argv[]) + else if (strcmp(argv[i],"-halg") == 0) { + i++; + if (i < argc) { +- if (strcmp(argv[i],"sha1") == 0) { +- halg = TPM_ALG_SHA1; +- } +- else if (strcmp(argv[i],"sha256") == 0) { ++ if (strcmp(argv[i],"sha256") == 0) { + halg = TPM_ALG_SHA256; + } + else if (strcmp(argv[i],"sha384") == 0) { +@@ -473,7 +470,7 @@ static void printUsage(void) + printf("\n"); + printf("\t[-tk\tticket file name (requires -hk)]\n"); + printf("\n"); +- printf("\t[-halg\t(sha1, sha256, sha384 sha512) (default sha256)]\n"); ++ printf("\t[-halg\t(sha256, sha384 sha512) (default sha256)]\n"); + printf("\n"); + printf("\t[Asymmetric Key Algorithm]\n"); + printf("\n"); +-- +2.34.1 + diff --git a/SOURCES/0004-Restrict-SHA-1-in-TSS.patch b/SOURCES/0004-Restrict-SHA-1-in-TSS.patch new file mode 100644 index 0000000..0cdd45f --- /dev/null +++ b/SOURCES/0004-Restrict-SHA-1-in-TSS.patch @@ -0,0 +1,136 @@ +From 506ae7f508cdcaca1cad7433725e8f4c115f843b Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?=C5=A0t=C4=9Bp=C3=A1n=20Hor=C3=A1=C4=8Dek?= + +Date: Fri, 25 Feb 2022 15:28:28 +0100 +Subject: [PATCH 4/4] Restrict SHA-1 in TSS +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Signed-off-by: Štěpán Horáček +--- + utils/cryptoutils.c | 4 --- + utils/tss20.c | 81 ++++++++++++++++++++++++++++++++++++++++++++- + 2 files changed, 80 insertions(+), 5 deletions(-) + +diff --git a/utils/cryptoutils.c b/utils/cryptoutils.c +index 7b5de79..98396a7 100644 +--- a/utils/cryptoutils.c ++++ b/utils/cryptoutils.c +@@ -2136,10 +2136,6 @@ TPM_RC verifyRSASignatureFromRSA(unsigned char *message, + /* map from hash algorithm to openssl nid */ + if (rc == 0) { + switch (halg) { +- case TPM_ALG_SHA1: +- nid = NID_sha1; +- md = EVP_sha1(); +- break; + case TPM_ALG_SHA256: + nid = NID_sha256; + md = EVP_sha256(); +diff --git a/utils/tss20.c b/utils/tss20.c +index c778069..bd05cf3 100644 +--- a/utils/tss20.c ++++ b/utils/tss20.c +@@ -678,6 +678,76 @@ extern int tssVerbose; + extern int tssVverbose; + extern int tssFirstCall; + ++int TSS_CheckSha1_PublicArea(TPMT_PUBLIC *publicArea) ++{ ++ return publicArea->nameAlg == TPM_ALG_SHA1 || ++ ((publicArea->type == TPM_ALG_RSA || publicArea->type == TPM_ALG_ECC) && ++ publicArea->parameters.asymDetail.scheme.scheme != TPM_ALG_NULL && ++ publicArea->parameters.asymDetail.scheme.details.anySig.hashAlg == TPM_ALG_SHA1); ++} ++ ++int TSS_CheckSha1_SigScheme(TPMT_SIG_SCHEME *sigScheme) ++{ ++ return sigScheme->details.any.hashAlg == TPM_ALG_SHA1; ++} ++ ++int TSS_CheckSha1(COMMAND_PARAMETERS *in, ++ TPM_CC commandCode) ++{ ++ switch (commandCode) ++ { ++ case TPM_CC_Certify: ++ return TSS_CheckSha1_SigScheme(&in->Certify.inScheme); ++ case TPM_CC_CertifyCreation: ++ return TSS_CheckSha1_SigScheme(&in->CertifyCreation.inScheme); ++ case TPM_CC_Create: ++ return TSS_CheckSha1_PublicArea(&in->Create.inPublic.publicArea); ++ case TPM_CC_CreateLoaded: ++ return TSS_CheckSha1_PublicArea(&in->Create.inPublic.publicArea); ++ case TPM_CC_CreatePrimary: ++ return TSS_CheckSha1_PublicArea(&in->CreatePrimary.inPublic.publicArea); ++ case TPM_CC_GetCommandAuditDigest: ++ return TSS_CheckSha1_SigScheme(&in->GetCommandAuditDigest.inScheme); ++ case TPM_CC_GetSessionAuditDigest: ++ return TSS_CheckSha1_SigScheme(&in->GetSessionAuditDigest.inScheme); ++ case TPM_CC_GetTime: ++ return TSS_CheckSha1_SigScheme(&in->GetTime.inScheme); ++ case TPM_CC_Hash: ++ return in->Hash.hashAlg == TPM_ALG_SHA1; ++ case TPM_CC_HashSequenceStart: ++ return in->HashSequenceStart.hashAlg == TPM_ALG_SHA1; ++ case TPM_CC_HMAC: ++ return in->HMAC.hashAlg == TPM_ALG_SHA1; ++ case TPM_CC_HMAC_Start: ++ return in->HMAC_Start.hashAlg == TPM_ALG_SHA1; ++ case TPM_CC_Import: ++ return TSS_CheckSha1_PublicArea(&in->Import.objectPublic.publicArea); ++ case TPM_CC_LoadExternal: ++ return TSS_CheckSha1_PublicArea(&in->LoadExternal.inPublic.publicArea); ++ case TPM_CC_NV_Certify: ++ return TSS_CheckSha1_SigScheme(&in->NV_Certify.inScheme); ++ case TPM_CC_NV_DefineSpace: ++ return in->NV_DefineSpace.publicInfo.nvPublic.nameAlg == TPM_ALG_SHA1; ++ case TPM_CC_PolicySigned: ++ return in->PolicySigned.auth.signature.any.hashAlg == TPM_ALG_SHA1; ++ case TPM_CC_Quote: ++ return TSS_CheckSha1_SigScheme(&in->Quote.inScheme); ++ case TPM_CC_RSA_Decrypt: ++ return TSS_CheckSha1_SigScheme(&in->RSA_Decrypt.inScheme); ++ case TPM_CC_SetCommandCodeAuditStatus: ++ return in->SetCommandCodeAuditStatus.auditAlg == TPM_ALG_SHA1; ++ case TPM_CC_SetPrimaryPolicy: ++ return in->SetPrimaryPolicy.hashAlg == TPM_ALG_SHA1; ++ case TPM_CC_Sign: ++ return TSS_CheckSha1_SigScheme(&in->Sign.inScheme); ++ case TPM_CC_StartAuthSession: ++ return in->StartAuthSession.authHash == TPM_ALG_SHA1; ++ case TPM_CC_VerifySignature: ++ return in->VerifySignature.signature.signature.any.hashAlg == TPM_ALG_SHA1; ++ } ++ ++ return 0; ++} + + TPM_RC TSS_Execute20(TSS_CONTEXT *tssContext, + RESPONSE_PARAMETERS *out, +@@ -687,11 +757,20 @@ TPM_RC TSS_Execute20(TSS_CONTEXT *tssContext, + va_list ap) + { + TPM_RC rc = 0; +- ++ ++#ifdef RESTRICTED_HASH_ALG ++ if (rc == 0) { ++ if (TSS_CheckSha1(in, commandCode)) { ++ rc = TPM_RC_HASH; ++ } ++ } ++#endif /* RESTRICTED_HASH_ALG */ ++ + /* create a TSS authorization context */ + if (rc == 0) { + TSS_InitAuthContext(tssContext->tssAuthContext); + } ++ + /* handle any command specific command pre-processing */ + if (rc == 0) { + rc = TSS_Command_PreProcessor(tssContext, +-- +2.34.1 + diff --git a/SPECS/tss2.spec b/SPECS/tss2.spec index 4e95853..477825c 100644 --- a/SPECS/tss2.spec +++ b/SPECS/tss2.spec @@ -7,7 +7,7 @@ Name: tss2 Version: 1.6.0 -Release: 5%{?dist} +Release: 6%{?dist} Epoch: 1 Summary: IBM's TCG Software Stack (TSS) for TPM 2.0 and related utilities @@ -22,12 +22,18 @@ Patch4: 0004-utils-Clean-up-certifyx509-memory-allocation.patch Patch5: 0005-utils-Fix-errors-detected-by-gcc-asan.patch Patch6: 0006-tss-Port-HMAC-operations-to-openssl-3.0.patch Patch7: 0007-utils-Port-to-openssl-3.0.0-replaces-RSA-with-EVP_PK.patch +Patch8: 0001-utils-Generate-X509-certificate-serial-number-using-.patch +Patch9: 0002-Update-SHA-1-to-SHA-256-in-tests-without-restricting.patch +Patch10: 0003-Restrict-the-usage-of-SHA-1-in-code-examples.patch +Patch11: 0004-Restrict-SHA-1-in-TSS.patch + BuildRequires: automake BuildRequires: autoconf BuildRequires: libtool BuildRequires: gcc BuildRequires: openssl-devel +BuildRequires: git Requires: openssl %description @@ -48,11 +54,11 @@ Development libraries and headers for IBM's TSS 2.0. You will need this in order to build TSS 2.0 applications. %prep -%autosetup -p1 -c %{name}-%{version} +%autosetup -S git -p1 -c %{name}-%{version} %build autoreconf -vi -%configure --disable-static --disable-tpm-1.2 --program-prefix=tss +%configure --disable-static --disable-tpm-1.2 --program-prefix=tss --enable-restricted-hash-alg CCFLAGS="%{optflags}" \ LNFLAGS="%{__global_ldflags}" \ %{make_build} @@ -77,6 +83,10 @@ find %{buildroot} -type f -name "*.la" -delete -print %doc ibmtss.doc %changelog +* Thu Feb 24 2022 Stepan Horacek - 1:1.6.0-6 +- Restrict SHA-1 usage + Resolves: rhbz#1935450 + * Fri Jan 28 2022 Stepan Horacek - 1:1.6.0-5 - Fix failures introduced with OpenSSL 3 Resolves: rhbz#1984621