<[jBLrUddlmZddlZddlmZddlmZmZddlm Z m Z ddl m Z ddl mZddlmZdd lmZdd lmZmZd d lmZd d lmZmZddlmZmZmZm Z mZm!Z!m"Z"dZ#e j$dZ%eGddeZ&eGddeZ'eGddeZ(eGddZ)dZ*dZ+eGddZ,eGddZ-Gd d!e.Z/eGd"d#eZ0eGd$d%eZ1eGd&d'Z2eGd(d)Z3eGd*d+eZ4ej5ej6zZ7d,e8d-<e-e2zZ9e/e3zZ:eGd.d/Z;d0Z<Gd1d2eZ=dS)3) annotationsN) dataclass)IntEnumunique) TypeAliascast)x509)InvalidSignature)default_backend)hashes)ecrsa)CoseKey) ByteBuffer bytes2int) AttestationAttestationResultAttestationType InvalidDatar _validate_cert_commoncatch_builtinsz 2.23.133.8.3ceZdZdZdZdZdZdS) TpmRsaSchemeN)__name__ __module__ __qualname__RSASSARSAPSSOAEPRSAES]/home/thesage/.hermes/hermes-agent/venv/lib/python3.11/site-packages/fido2/attestation/tpm.pyrr;s" F F D EEEr)rceZdZdZdZdS) TpmAlgAsymr#N)r!r"r#RSAECCr(r)r*r,r,Cs C CCCr)r,c&eZdZdZdZdZdZd dZdS) TpmAlgHash returnhashes.HashAlgorithmc>|tjkrtjS|tjkrtjS|tjkrtjS|tjkrtjSt d|)Nz!_hash_alg is not implemented for )r1SHA1r SHA256SHA384SHA512NotImplementedErrorselfs r* _hash_algzTpmAlgHash._hash_algPs :? " ";== Z& & &=?? " Z& & &=?? " Z& & &=?? "!"Nd"N"NOOOr)N)r6r7)r!r"r#r9r:r;r<r@r(r)r*r1r1IsB D F F F P P P P P Pr)r1c$eZdZUded<ded<dS)TpmsCertifyInfobytesnamequalified_nameN)r!r"r#__annotations__r(r)r*rBrB]s'KKKr)rBsTCGsc^eZdZUdZded<ded<ded<ded<d ed <edd Zd S)TpmAttestationFormatuthe signature data is defined by [TPMv2-Part2] Section 10.12.8 (TPMS_ATTEST) as: TPM_GENERATED_VALUE (0xff544347 aka "ÿTCG") TPMI_ST_ATTEST - always TPM_ST_ATTEST_CERTIFY (0x8017) because signing procedure defines it should call TPM_Certify [TPMv2-Part3] Section 18.2 TPM2B_NAME size (uint16) name (size long) TPM2B_DATA size (uint16) name (size long) TPMS_CLOCK_INFO clock (uint64) resetCount (uint32) restartCount (uint32) safe (byte) 1 yes, 0 no firmwareVersion uint64 attested TPMS_CERTIFY_INFO (because TPM_ST_ATTEST_CERTIFY) name TPM2B_NAME qualified_name TPM2B_NAME See: https://www.trustedcomputinggroup.org/wp-content/uploads/TPM-Rev-2.0-Part-2-Structures-01.38.pdf https://www.trustedcomputinggroup.org/wp-content/uploads/TPM-Rev-2.0-Part-3-Commands-01.38.pdf rCrDdataztuple[int, int, int, bool] clock_infointfirmware_versionrBattestedr6c t|}|d}|tkrtd|d}|tkrtd ||d}||d}|d}|d}|d}|d} | d vrtd | d d | d k} |d} ||d} ||d} n&#t j$r}t|d}~wwxYw||||||| f| t| | S)Nr2z generated value field is invalidrztpmi_st_attest field is invalid!Hz!Q!LB)rrzinvalid value 0xxz for booleanr)rDrE)rDrIrJrLrM) rreadTPM_GENERATED_VALUE ValueErrorTPM_ST_ATTEST_CERTIFYunpackstructerrorrB)clsrIreadergenerated_valuetpmi_st_attestrDclock reset_count restart_count safe_valuesaferL attested_nameattested_qualified_namees r*parsezTpmAttestationFormat.parsesD!! ++a.. 1 1 1?@@ @  Q 2 2 2>?? ? ;;v}}T2233D;;v}}T2233DMM$''E ----K"MM$//Ms++J'' !NJ!N!N!N!NOOO?D%}}T22 "KK d(;(;<eZdZdZdZdZdZdZdZdZ dZ d Z d Z dd Z dS) TpmEccCurvezTPM_ECC_CURVE https://www.trustedcomputinggroup.org/wp-content/uploads/TPM-Rev-2.0-Part-2-Structures-01.38.pdf section 6.4 rrrr2r r6ec.EllipticCurvec|tjkrtd|tjkrt jS|tjkrt jS|tjkrt j S|tj krt j S|tj krt j Std|)Nz No such curvezcurve is not supported)rNONErU NIST_P192r SECP192R1 NIST_P224 SECP224R1 NIST_P256 SECP256R1 NIST_P384 SECP384R1 NIST_P521 SECP521R1r>s r*to_curvezTpmEccCurve.to_curve%s ;# # #_-- - [* * *<>> ! [* * *<>> ! [* * *<>> ! [* * *<>> ! [* * *<>> !14888r)N)r6r)r!r"r#rhrrrrrrBN_P256BN_P638SM2_P256rr(r)r*rrsa DIIIIIGGH999999r)rc"eZdZdZeZdZdZdZdS) TpmiAlgKdfzTPMI_ALG_KDF https://www.trustedcomputinggroup.org/wp-content/uploads/TPM-Rev-2.0-Part-2-Structures-01.38.pdf section 9.28 r!"N) r!r"r#rhruNULLKDF1_SP800_56AKDF2KDF1_SP800_108r(r)r*rr6s. DN DNNNr)rcPeZdZUded<ded<ded<ded<ed d Zd S) TpmsEccParmsrKrlrmrcurve_idrkdfr[rr6cb|d}|d}|tkrtd|tkrtdt|d}t |d}|||||S)NrOrqzscheme is expected to be NULL)rWrurUrr)rZr[rlrmr kdf_schemes r*rfzTpmsEccParms.parseJsMM$'' t$$  $ $?@@ @ \ ! !<== =v}}T2233 d 3 344 s9fh ;;;r)N)r[rr6r)r!r"r#rFrirfr(r)r*rrCs[NNNKKKOOO < < <[ < < >JKK Ks h KVT   r)rc|jtjkrztt|jj}ttt|j }tj || tS|jtjkrtt|j }t!jt|jt|jtt(|jj tSt/d|j)Nzpublic_key not implemented for )rr,r.rrkrrorrrrRSAPublicNumbers public_keyr r/rr EllipticCurvePublicNumbersrRrrrrr=)r?romodulusrs r*rzTpmPublicFormat.public_keys =JN * *L$/::CH%6 D DEEG''::EEoFWFWXX X ]jn , ,, 44F0&(##&(##\4?33<EEGGj**++  , ""UDM"U"UVVVr)ctjd|j}tj|jt }||j|| z }|S)u Computing Entity Names see: https://www.trustedcomputinggroup.org/wp-content/uploads/TPM-Rev-2.0-Part-1-Architecture-01.38.pdf section 16 Names Name ≔ nameAlg || HnameAlg (handle→nvPublicArea) where nameAlg algorithm used to compute Name HnameAlg hash using the nameAlg parameter in the NV Index location associated with handle nvPublicArea contents of the TPMS_NV_PUBLIC associated with handle rObackend) rXpackrr Hashr@r updaterIfinalize)r?outputdigests r*rDzTpmPublicFormat.nameslT4=11T]4466@Q@QRRR di   &//### r)N)rIrCr6r)r6r)r6rC) r!r"r#rhrFrirfrrDr(r)r*rrs  OOOOOOKKK   [ 8 W W W Wr)rclt|t|jdkrtd|jt j}|std|jt j}d|j D}d|vrtddS)Nrz#Certificate should not have Subjectz.Certificate should have SubjectAlternativeNamec$g|] }|tkSr()OID_AIK_CERTIFICATE).0rRs r* z&_validate_tpm_cert..s;;;Aq'';;;r)TzExtended key usage MUST contain the "joint-iso-itu-t(2) internationalorganizations(23) 133 tcg-kp(8) tcg-kp-AIKCertificate(3)" OID.) rrsubjectr extensionsget_extension_for_classr SubjectAlternativeNameExtendedKeyUsagevalue)certsexthas_aiks r*_validate_tpm_certrs$ 4<1?@@@ //0KLLA LJKKK / 1 1$2G H HC;;;;;G 7 -   r)c(eZdZdZedZdS)TpmAttestationtpmcd|vrtd|d}|d}|d}tj|dt}t |t j||} t |d} n"#t$r} td| d} ~ wwxYw|j J|j j| |j jkrtd  t |} ||z} |j} t#j| t }|| |}| j|krtd | jj| krtd |||d t3t4j|S#t8$rtdwxYw)N ecdaaKeyIdzECDAA not implementedalgx5ccertInforpubAreazunable to parse pubAreaz9attestation pubArea does not match attestedCredentialDatarz5attestation does not sign for authData and ClientDataz;TPMS_CERTIFY_INFO does not include a valid name for pubAreasigz$signature of certInfo does not match)r=r load_der_x509_certificater rrfor_algfrom_cryptography_keyrrrf Exceptionrcredential_datar rH _HASH_ALGr rrrrIrMrDverifyrrATT_CA_InvalidSignature)r? statement auth_dataclient_data_hashrr cert_inforpub_keypub_areareratt_to_be_signedhash_algrrIs r*rzTpmAttestation.verifysY 9 $ $%&=>> >j) -c!fo6G6GHH4   /#&&< __future__rrX dataclassesrenumrrtypingrr cryptographyr cryptography.exceptionsr rcryptography.hazmat.backendsr cryptography.hazmat.primitivesr )cryptography.hazmat.primitives.asymmetricr rcoserutilsrrbaserrrrrrruObjectIdentifierrrr,r1rBrTrVrHrkrCrrrrrrr RSAPublicKeyEllipticCurvePublicKeyrrFrrrrrr(r)r*r s<#"""""" !!!!!! """"""""IIIIII888888111111========)))))))) +d+N;;7 PPPPPPPP&   !# N N N N N N N  N b Q:Q:Q:Q:Q:Q:Q: Q:h55555555 99999'999B         <<<<<<< <*  "6(2+DD DDDD\) l * XXXXXXX Xv   (FKFKFKFKFK[FKFKFKFKFKr)