tomoveu
commented
3 years ago Quick update (this is the short version)
Had a "fun" tiny bug on the XOR symmetric attributes that made me sweat. Once solved, I figured out how to use unbounded, unsalted session for XOR parameter encryption. Turns out the logical first choice is the one with most specifics....
TCG Spec, Part 1
Chapter 21.2
the XOR obfuscation is (parameter, hashAlg, sessionValue, nonceNewer, nonceOlder)
Chapter 21.1
If the session is not being used for authorization, sessionValue is sessionKey.
Chapter 19.6.8
the sessionKey is Empty buffer when tpmKey and bind are TPM_RH_NULL (i.e unbounded, unsalted session).
So, if we have an empty buffer and no shared secret, how do we have parameter encryption? Well, see below ...
Chapter 19.6.9
A session started using this format (unbound, unsalted) can be used for parameter encryption while executing TPM commands. However, during these commands, the key used to encrypt the parameter will only use the authValue of the object being accessed by the commands in the key generation, so the strength of the encryption will be no better than the entropy in the authValue of the object.
Back to Chapter 19.6.8 we find
sessionKey ≔ KDFa(sessionAlg, (authValue || salt), “ATH” , nonceTPM, nonceCaller, bits)
and later clarifies
authValue if bind is not TPM_RH_NULL, a TPM2B_AUTH.buffer that is found in the sensitive area of a TPM entity; otherwise, an Empty Buffer
Also, the tradeoff now becomes obvious, but funny it is briefly mentioned on one single place. This is the result of extensive digging into the TCG Spec until I find the answers. Unbounded & unsalted session is supposed to be the simplest one, yet it is also the one with most specifics to get parameter encryption(surprisingly).
Anyways, both big challenges are solved - TPM session and SessionKey. I just need to use the KDFa and replace the parameter with the encrypted buffer. I will try to use your KDFa port @dgarske with Woflcrypt. Hopefully, no new surprises arise and next week I am done with the XOR. And I move to the CFB/AES :)
Cheers, Dimi
dgarske
XOR then AES CFB @tomoveu