Skip to content

WIP: tpm2: Add RuntimeAttribute fips-140-3 to restrict TPM 2 (StateFo…#469

Draft
stefanberger wants to merge 1 commit intomasterfrom
stefanberger/fips-140-3
Draft

WIP: tpm2: Add RuntimeAttribute fips-140-3 to restrict TPM 2 (StateFo…#469
stefanberger wants to merge 1 commit intomasterfrom
stefanberger/fips-140-3

Conversation

@stefanberger
Copy link
Owner

…rmatLevel 8)

Add RuntimeAttribute 'fips-140-3' that restricts a TPM 2 following requirements of the FIPS-140-3 standard:

  • Prevents raw RSA encryption and decryption
  • Prevents SHA1 signature generation + verification
  • Prevents derivation of ECC keys from derivation parent and for creation of ephemeral keys
  • Performs a pairwise consistency test on RSA keys and ECC signing keys
  • Enables continous DRBG test

…rmatLevel 8)

Add RuntimeAttribute 'fips-140-3' that restricts a TPM 2 following
requirements of the FIPS-140-3 standard:

- Prevents raw RSA encryption and decryption
- Prevents SHA1 signature generation + verification
- Prevents derivation of ECC keys from derivation parent and for creation
  of ephemeral keys
- Performs a pairwise consistency test on RSA keys and ECC signing keys
- Enables continous DRBG test

Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
@stefanberger stefanberger added the help-wanted Help wanted label Oct 15, 2024
@stefanberger
Copy link
Owner Author

We can only enable the fips-140-3 attribute when we know that support for this is 'complete'. Problem is I do not know whether FIPS-140-3 support 'is complete' as it is implemented.

@stefanberger stefanberger marked this pull request as draft October 17, 2024 22:19
@stefanberger stefanberger mentioned this pull request Nov 14, 2024
11 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

help-wanted Help wanted

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant