int main(int argc, char *argv[])
{
uint32_t startOrdinal = -1;
int ret;
int verbose = FALSE;
TPM_COUNTER_VALUE counter;
int i = 1;
char * keypass = NULL;
unsigned char keyAuth[TPM_HASH_SIZE];
unsigned char * keyAuthPtr = NULL;
uint32_t keyhandle = -1;
STACK_TPM_BUFFER(signature);
unsigned char digest[TPM_DIGEST_SIZE];
unsigned char ordinalDigest[TPM_DIGEST_SIZE];
unsigned char antiReplay[TPM_NONCE_SIZE];
TPM_setlog(0);
TSS_gennonce(antiReplay);
while (i < argc) {
if (!strcmp("-s",argv[i])) {
i++;
if (i < argc) {
sscanf(argv[i],"%d",&startOrdinal);
} else {
printf("Missing parameter for -s.\n");
usage();
}
} else
if (!strcmp("-h",argv[i])) {
i++;
if (i < argc) {
sscanf(argv[i],"%x",&keyhandle);
} else {
printf("Missing parameter for -h.\n");
usage();
}
} else
if (!strcmp("-p",argv[i])) {
i++;
if (i < argc) {
keypass = argv[i];
} else {
printf("Missing parameter for -p.\n");
usage();
}
} else
if (!strcmp("-v",argv[i])) {
verbose = TRUE;
TPM_setlog(1);
} else {
printf("\n%s is not a valid option\n", argv[i]);
usage();
}
i++;
}
(void)verbose;
if (-1 == (int)startOrdinal ||
-1 == (int)keyhandle) {
printf("Missing command line parameter.\n");
usage();
}
if (NULL != keypass) {
TSS_sha1(keypass,strlen(keypass),keyAuth);
keyAuthPtr = keyAuth;
}
ret = TPM_GetAuditDigestSigned(keyhandle,
FALSE,
keyAuthPtr,
antiReplay,
&counter,
digest,
ordinalDigest,
&signature);
if (0 != ret) {
printf("Error %s from GetAuditDigestSigned.\n",
TPM_GetErrMsg(ret));
} else {
TPM_SIGN_INFO tsi;
STACK_TPM_BUFFER(tsi_ser);
STACK_TPM_BUFFER(serial);
STACK_TPM_BUFFER(ctr_ser);
pubkeydata pubkey;
RSA *rsa;
i = 0;
printf("AuditDigest : ");
while (i < (int)sizeof(digest)) {
printf("%02X",digest[i]);
i++;
}
printf("\n");
i = 0;
printf("OrdinalDigest : ");
while (i < (int)sizeof(digest)) {
printf("%02X",ordinalDigest[i]);
i++;
}
printf("\n");
ret = TPM_GetPubKey(keyhandle, keyAuthPtr, &pubkey);
if (ret != 0) {
printf("Could not get public key of signing key.\n");
exit(-1);
}
rsa = TSS_convpubkey(&pubkey);
if (!rsa) {
printf("Could not convert public key.\n");
exit(-1);
}
tsi.tag = TPM_TAG_SIGNINFO;
memcpy(tsi.fixed, "ADIG", 4);
memcpy(tsi.replay, antiReplay, sizeof(antiReplay));
/* D4=ordinalDigest */
TPM_WriteCounterValue(&ctr_ser, &counter);
memcpy(&serial.buffer[0], digest, sizeof(digest));
memcpy(&serial.buffer[sizeof(digest)],
ctr_ser.buffer, ctr_ser.used);
memcpy(&serial.buffer[sizeof(digest)+ctr_ser.used],
ordinalDigest, sizeof(ordinalDigest));
serial.used = sizeof(digest) + ctr_ser.used + sizeof(ordinalDigest);
tsi.data.size = serial.used;
tsi.data.buffer = serial.buffer;
ret = TPM_WriteSignInfo(&tsi_ser, &tsi);
if ((ret & ERR_MASK)) {
printf("Error serializing TPM_SIGN_INFO.\n");
exit(-1);
}
ret = TPM_ValidateSignature(TPM_SS_RSASSAPKCS1v15_SHA1,
&tsi_ser,
&signature,
rsa);
if (ret != 0) {
printf("Error validating signature.\n");
exit(-1);
}
printf("Signature verification successful.\n");
}
exit(ret);
}
int main(int argc, char *argv[])
{
int ret;
struct stat sbuf;
unsigned char databuff[65535]; /* data read work buffer */
unsigned char datahash[20]; /* hash of data file */
unsigned char digest[20];
SHA_CTX sha;
FILE *datafile;
const char *datafilename = NULL;
FILE *sigfile;
const char *sigfilename = NULL;
FILE *keyfile;
const char *kfilename = NULL;
EVP_PKEY *pkey;
RSA *rsa;
uint16_t sigscheme = TPM_SS_RSASSAPKCS1v15_SHA1;
int plain;
unsigned char padded[4096];
unsigned char plainarray[4096];
TPM_SIGN_INFO tsi;
STACK_TPM_BUFFER(tsi_ser);
STACK_TPM_BUFFER(signature);
int i;
for (i=1 ; i<argc ; i++) {
if (!strcmp(argv[i], "-ss")) {
i++;
if (i < argc) {
if (!strcmp(argv[i], "info")) {
sigscheme = TPM_SS_RSASSAPKCS1v15_INFO;
}
else if (!strcmp(argv[i], "der")) {
sigscheme = TPM_SS_RSASSAPKCS1v15_DER;
}
else {
printf("Bad parameter for -ss\n");
printUsage();
}
}
else {
printf("Missing parameter for -ss\n");
printUsage();
}
}
else if (strcmp(argv[i],"-if") == 0) {
i++;
if (i < argc) {
datafilename = argv[i];
}
else {
printf("-if option needs a value\n");
printUsage();
exit(2);
}
}
else if (strcmp(argv[i],"-is") == 0) {
i++;
if (i < argc) {
sigfilename = argv[i];
}
else {
printf("-is option needs a value\n");
printUsage();
}
}
else if (strcmp(argv[i],"-ik") == 0) {
i++;
if (i < argc) {
kfilename = argv[i];
}
else {
printf("-ik option needs a value\n");
printUsage();
exit(2);
}
}
else if (!strcmp(argv[i], "-h")) {
printUsage();
}
else if (!strcmp(argv[i], "-v")) {
TPM_setlog(1);
}
else {
printf("\n%s is not a valid option\n", argv[i]);
printUsage();
}
}
if ((datafilename == NULL) ||
(sigfilename == NULL) ||
(kfilename == NULL)) {
printf("Missing parameter\n");
printUsage();
}
/*
** read and hash the data file
*/
datafile = fopen(datafilename,"rb");
if (datafile == NULL)
{
printf("Unable to open data file '%s'\n",datafilename);
exit(2);
}
SHA1_Init(&sha);
for (;;)
{
ret = fread(databuff,1,sizeof databuff,datafile);
if (ret < 0)
{
printf("I/O Error while reading data file '%s'\n",datafilename);
exit(3);
}
SHA1_Update(&sha,databuff,ret);
if (ret < (int)sizeof(databuff)) break;
}
fclose(datafile);
SHA1_Final(datahash,&sha);
/*
** get size of signature file
*/
stat(sigfilename,&sbuf);
signature.used = (int)sbuf.st_size;
sigfile = fopen(sigfilename,"rb");
if (sigfile == NULL)
{
printf("Unable to open signature file '%s'\n",sigfilename);
exit(4);
}
/*
** read the signature file
*/
ret = fread(signature.buffer,1,signature.used,sigfile);
if (ret != (int)signature.used)
{
printf("I/O Error while reading signature file '%s'\n",sigfilename);
exit(5);
}
fclose(sigfile);
/*
** read the key file
*/
keyfile = fopen(kfilename,"rb");
if (keyfile == NULL)
{
printf("Unable to open public key file '%s'\n",kfilename);
exit(6);
}
pkey = PEM_read_PUBKEY(keyfile,NULL,NULL,NULL);
if (pkey == NULL)
{
printf("I/O Error while reading public key file '%s'\n",kfilename);
exit(7);
}
rsa = EVP_PKEY_get1_RSA(pkey);
if (rsa == NULL)
{
printf("Error while converting public key \n");
exit(8);
}
switch (sigscheme) {
default:
case TPM_SS_RSASSAPKCS1v15_SHA1:
ret = RSA_verify(NID_sha1,datahash,20,
signature.buffer,signature.used,
rsa);
if (ret != 1) {
printf("Verification Failed\n");
exit(100);
}
break;
case TPM_SS_RSASSAPKCS1v15_DER:
plain = RSA_public_decrypt(signature.used, signature.buffer,
plainarray, rsa, RSA_NO_PADDING);
if (plain == -1) {
printf("Verification (DER) had an error\n");
exit(100);
}
ret = RSA_padding_add_PKCS1_type_1(padded,plain,datahash,sizeof(datahash));
if (ret != 1) {
printf("Could not add the padding.\n");
exit(100);
}
if (memcmp(padded, plainarray, plain) != 0) {
printf("Verfication (DER) failed.\n");
exit(100);
}
break;
case TPM_SS_RSASSAPKCS1v15_INFO:
// the nonce is the digest of the hashed data!!
TSS_sha1(datahash, 20, digest);
tsi.tag = TPM_TAG_SIGNINFO;
memcpy(tsi.fixed,"SIGN",4);
tsi.data.size = TPM_HASH_SIZE;
tsi.data.buffer = datahash;
memcpy(tsi.replay, digest, TPM_HASH_SIZE);
/* need to calcualte the digest of the TPM_SIGN_INFO structure */
ret = TPM_WriteSignInfo(&tsi_ser, &tsi);
if ((ret & ERR_MASK)) {
printf("Could not serialize TPM_SIGN_INFO structure.\n");
exit(100);
}
ret = TPM_ValidateSignature(sigscheme,
&tsi_ser,
&signature,
rsa);
if (ret != 0) {
printf("Verification (INFO) failed.\n");
exit(-1);
}
break;
}
RSA_free(rsa);
EVP_PKEY_free(pkey);
exit(0);
}
