1 //
2 // Copyright (C) 2020 The Android Open Source Project
3 //
4 // Licensed under the Apache License, Version 2.0 (the "License");
5 // you may not use this file except in compliance with the License.
6 // You may obtain a copy of the License at
7 //
8 //      http://www.apache.org/licenses/LICENSE-2.0
9 //
10 // Unless required by applicable law or agreed to in writing, software
11 // distributed under the License is distributed on an "AS IS" BASIS,
12 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 // See the License for the specific language governing permissions and
14 // limitations under the License.
15 
16 #pragma once
17 
18 #include <memory>
19 #include <string>
20 
21 #include <tss2/tss2_esys.h>
22 
23 #include "host/commands/secure_env/tpm_auth.h"
24 
25 namespace cuttlefish {
26 
27 class TpmResourceManager;
28 
29 struct EsysDeleter {
operatorEsysDeleter30   void operator()(void* data) { Esys_Free(data); }
31 };
32 
33 template<typename T>
34 using UniqueEsysPtr = std::unique_ptr<T, EsysDeleter>;
35 
36 /**
37  * Returns a HMAC signature for `data` with the key loaded into the TPM at
38  * `key_handle`.
39  *
40  * The signature is a byte string that certifies a process that can make TPM
41  * API calls has signed off on using another byte string (`data`) for some
42  * purpose, which is implicitly tied to the signing key. In this case, the
43  * secure_env process is the only process that should have TPM access.
44  * secure_env can then transmit some data together with a signature over that
45  * data, an external system (Android) can hold onto this data and the signature,
46  * and then the secure_env process can receive the data back. The signature
47  * is used to check that the data has not been tampered with.
48  */
49 UniqueEsysPtr<TPM2B_DIGEST> TpmHmac(
50     TpmResourceManager& resource_manager,
51     ESYS_TR key_handle,
52     TpmAuth auth,
53     const uint8_t* data,
54     size_t data_size);
55 
56 /**
57  * Returns a HMAC signature for `data` with a key created in the TPM with
58  * context / unique-data `context`.
59  */
60 UniqueEsysPtr<TPM2B_DIGEST> TpmHmacWithContext(
61     TpmResourceManager& resource_manager, const std::string& context,
62     const uint8_t* data, size_t data_size);
63 
64 }  // namespace cuttlefish
65