Skip to content

client: TPM key file fixes and default public key #1349

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
ejohnstown wants to merge 2 commits into
base: master
Choose a base branch
from
Open

client: TPM key file fixes and default public key #1349

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
0e43ce4
client: bound and wipe the TPM key blob load
ejohnstown Oct 29, 2026
c7b0aa4
client: load the built-in public key by default
ejohnstown Oct 29, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion examples/client/client.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1045,7 +1045,9 @@ THREAD_RETURN WOLFSSH_THREAD client_test(void* args)
}
else
#endif
if (pubKeyName) {
/* Without -i the built-in private key is loaded; a NULL name loads its
* public half. A TPM key fills in its own public key. */
if (pubKeyName != NULL || privKeyName == NULL) {
ret = ClientUsePubKey(pubKeyName, userEcc, NULL);
}
if (ret != 0) {
Expand Down
28 changes: 24 additions & 4 deletions examples/client/common.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -856,31 +856,41 @@ static int readKeyBlob(const char* filename, WOLFTPM2_KEYBLOB* key)
if (bytes_read != sizeof(key->pub.size)) {
printf("Read %zu, expected size marker of %zu bytes\n",
bytes_read, sizeof(key->pub.size));
goto exit;
rc = BUFFER_E; goto exit;
}
fileSz -= bytes_read;

if (sizeof(UINT16) + key->pub.size > sizeof(pubAreaBuffer)) {
printf("Public blob of %d bytes is too large\n", key->pub.size);
rc = BUFFER_E; goto exit;
}

bytes_read = WFREAD(NULL, pubAreaBuffer, 1,
sizeof(UINT16) + key->pub.size, fp);
if (bytes_read != sizeof(UINT16) + key->pub.size) {
printf("Read %zu, expected public blob %zu bytes\n",
bytes_read, sizeof(UINT16) + key->pub.size);
goto exit;
rc = BUFFER_E; goto exit;
}
fileSz -= bytes_read; /* Reminder bytes for private key part */

if (fileSz > sizeof(key->priv)) {
printf("Private blob of %zu bytes is too large\n", fileSz);
rc = BUFFER_E; goto exit;
}

/* Decode the byte stream into a publicArea structure ready for use */
rc = TPM2_ParsePublic(&key->pub, pubAreaBuffer,
(word32)sizeof(pubAreaBuffer), &pubAreaSize);
if (rc != 0) return rc;
if (rc != 0) goto exit;

if (fileSz > 0) {
printf("Reading the private part of the key\n");
bytes_read = WFREAD(NULL, &key->priv, 1, fileSz, fp);
if (bytes_read != fileSz) {
printf("Read %zu, expected private blob %zu bytes\n",
bytes_read, fileSz);
goto exit;
rc = BUFFER_E; goto exit;
}
rc = 0; /* success */
}
Expand Down Expand Up @@ -966,6 +976,11 @@ static int wolfSSH_TPM_InitKey(WOLFTPM2_DEV* dev, const char* name,
}

/* Use global auth if provided */
if (rc == 0 && tpmKeyAuth != NULL &&
XSTRLEN(tpmKeyAuth) > sizeof(tpmKeyBlob.handle.auth.buffer)) {
WLOG(WS_LOG_DEBUG, "TPM key auth is too long");
rc = BUFFER_E;
}
if (rc == 0 && tpmKeyAuth != NULL) {
tpmKeyBlob.handle.auth.size = (word32)XSTRLEN(tpmKeyAuth);
XMEMCPY(tpmKeyBlob.handle.auth.buffer, tpmKeyAuth,
Expand Down Expand Up @@ -1015,6 +1030,10 @@ static int wolfSSH_TPM_InitKey(WOLFTPM2_DEV* dev, const char* name,
wolfTPM2_UnloadHandle(dev, &endorse.handle);
}

/* The blob holds the key auth; the session may hold auth data too. */
wc_ForceZero(&tpmKeyBlob, sizeof(tpmKeyBlob));
wc_ForceZero(&tpmSession, sizeof(tpmSession));

WLOG(WS_LOG_DEBUG, "Leaving wolfSSH_TPM_InitKey(), rc = %d", rc);
return rc;
}
Expand All @@ -1024,6 +1043,7 @@ static void wolfSSH_TPM_Cleanup(WOLFTPM2_DEV* dev, WOLFTPM2_KEY* key)
WLOG(WS_LOG_DEBUG, "Entering wolfSSH_TPM_Cleanup()");
if (key != NULL) {
wolfTPM2_UnloadHandle(dev, &key->handle);
wc_ForceZero(key, sizeof(*key));
}

if (dev != NULL) {
Expand Down
Loading