/********************************************************************************/
/*										*/
/*		Functions used for ticket computations.				*/
/*			     Written by Ken Goldman				*/
/*		       IBM Thomas J. Watson Research Center			*/
/*										*/
/*  Licenses and Notices							*/
/*										*/
/*  1. Copyright Licenses:							*/
/*										*/
/*  - Trusted Computing Group (TCG) grants to the user of the source code in	*/
/*    this specification (the "Source Code") a worldwide, irrevocable, 		*/
/*    nonexclusive, royalty free, copyright license to reproduce, create 	*/
/*    derivative works, distribute, display and perform the Source Code and	*/
/*    derivative works thereof, and to grant others the rights granted herein.	*/
/*										*/
/*  - The TCG grants to the user of the other parts of the specification 	*/
/*    (other than the Source Code) the rights to reproduce, distribute, 	*/
/*    display, and perform the specification solely for the purpose of 		*/
/*    developing products based on such documents.				*/
/*										*/
/*  2. Source Code Distribution Conditions:					*/
/*										*/
/*  - Redistributions of Source Code must retain the above copyright licenses, 	*/
/*    this list of conditions and the following disclaimers.			*/
/*										*/
/*  - Redistributions in binary form must reproduce the above copyright 	*/
/*    licenses, this list of conditions	and the following disclaimers in the 	*/
/*    documentation and/or other materials provided with the distribution.	*/
/*										*/
/*  3. Disclaimers:								*/
/*										*/
/*  - THE COPYRIGHT LICENSES SET FORTH ABOVE DO NOT REPRESENT ANY FORM OF	*/
/*  LICENSE OR WAIVER, EXPRESS OR IMPLIED, BY ESTOPPEL OR OTHERWISE, WITH	*/
/*  RESPECT TO PATENT RIGHTS HELD BY TCG MEMBERS (OR OTHER THIRD PARTIES)	*/
/*  THAT MAY BE NECESSARY TO IMPLEMENT THIS SPECIFICATION OR OTHERWISE.		*/
/*  Contact TCG Administration (admin@trustedcomputinggroup.org) for 		*/
/*  information on specification licensing rights available through TCG 	*/
/*  membership agreements.							*/
/*										*/
/*  - THIS SPECIFICATION IS PROVIDED "AS IS" WITH NO EXPRESS OR IMPLIED 	*/
/*    WARRANTIES WHATSOEVER, INCLUDING ANY WARRANTY OF MERCHANTABILITY OR 	*/
/*    FITNESS FOR A PARTICULAR PURPOSE, ACCURACY, COMPLETENESS, OR 		*/
/*    NONINFRINGEMENT OF INTELLECTUAL PROPERTY RIGHTS, OR ANY WARRANTY 		*/
/*    OTHERWISE ARISING OUT OF ANY PROPOSAL, SPECIFICATION OR SAMPLE.		*/
/*										*/
/*  - Without limitation, TCG and its members and licensors disclaim all 	*/
/*    liability, including liability for infringement of any proprietary 	*/
/*    rights, relating to use of information in this specification and to the	*/
/*    implementation of this specification, and TCG disclaims all liability for	*/
/*    cost of procurement of substitute goods or services, lost profits, loss 	*/
/*    of use, loss of data or any incidental, consequential, direct, indirect, 	*/
/*    or special damages, whether under contract, tort, warranty or otherwise, 	*/
/*    arising in any way out of use or reliance upon this specification or any 	*/
/*    information herein.							*/
/*										*/
/*  (c) Copyright IBM Corp. and others, 2016 - 2023				*/
/*										*/
/********************************************************************************/

//** Introduction
/*
  This clause contains the functions used for ticket computations.
*/

//** Includes
#include "Tpm.h"
#include "Marshal.h"

//** Functions

//*** TicketIsSafe()
// This function indicates if producing a ticket is safe.
// It checks if the leading bytes of an input buffer is TPM_GENERATED_VALUE
// or its substring of canonical form.  If so, it is not safe to produce ticket
// for an input buffer claiming to be TPM generated buffer
//  Return Type: BOOL
//      TRUE(1)         safe to produce ticket
//      FALSE(0)        not safe to produce ticket
BOOL TicketIsSafe(TPM2B* buffer)
{
    TPM_CONSTANTS32 valueToCompare = TPM_GENERATED_VALUE;
    BYTE            bufferToCompare[sizeof(valueToCompare)];
    BYTE*           marshalBuffer;
    //
    // If the buffer size is less than the size of TPM_GENERATED_VALUE, assume
    // it is not safe to generate a ticket
    if(buffer->size < sizeof(valueToCompare))
	return FALSE;
    marshalBuffer = bufferToCompare;
    TPM_CONSTANTS32_Marshal(&valueToCompare, &marshalBuffer, NULL);
    if(MemoryEqual(buffer->buffer, bufferToCompare, sizeof(valueToCompare)))
	return FALSE;
    else
	return TRUE;
}

//*** TicketComputeVerified()
// This function creates a TPMT_TK_VERIFIED ticket.
/*(See part 2 specification)
//  The ticket is computed as:
//      HMAC(proof, (TPM_ST_VERIFIED | digest | keyName))
//  Where:
//      HMAC()              an HMAC using the hash of proof
//      proof               a TPM secret value associated with the hierarchy
//                          associated with keyName
//      TPM_ST_VERIFIED     a value to differentiate the tickets
//      digest              the signed digest
//      keyName             the Name of the key that signed digest
*/
TPM_RC TicketComputeVerified(
			     TPMI_RH_HIERARCHY hierarchy,  // IN: hierarchy constant for ticket
			     TPM2B_DIGEST*     digest,     // IN: digest
			     TPM2B_NAME*       keyName,    // IN: name of key that signed the values
			     TPMT_TK_VERIFIED* ticket      // OUT: verified ticket
			     )
{
    TPM_RC      result = TPM_RC_SUCCESS;
    TPM2B_PROOF proof;
    HMAC_STATE  hmacState;
    //
    // Fill in ticket fields
    ticket->tag       = TPM_ST_VERIFIED;
    ticket->hierarchy = hierarchy;
    result            = HierarchyGetProof(hierarchy, &proof);
    if(result != TPM_RC_SUCCESS)
	return result;

    // Start HMAC using the proof value of the hierarchy as the HMAC key
    ticket->digest.t.size =
	CryptHmacStart2B(&hmacState, CONTEXT_INTEGRITY_HASH_ALG, &proof.b);
    MemorySet(proof.b.buffer, 0, proof.b.size);

    //  TPM_ST_VERIFIED
    CryptDigestUpdateInt(&hmacState, sizeof(TPM_ST), ticket->tag);
    //  digest
    CryptDigestUpdate2B(&hmacState.hashState, &digest->b);
    // key name
    CryptDigestUpdate2B(&hmacState.hashState, &keyName->b);
    // done
    CryptHmacEnd2B(&hmacState, &ticket->digest.b);

    return TPM_RC_SUCCESS;
}

//*** TicketComputeAuth()
// This function creates a TPMT_TK_AUTH ticket.
/*(See part 2 specification)
//  The ticket is computed as:
//      HMAC(proof, (type || timeout || timeEpoch || cpHash
//                        || policyRef || keyName))
//  where:
//      HMAC()      an HMAC using the hash of proof
//      proof       a TPM secret value associated with the hierarchy of the key
//                  associated with keyName.
//      type        a value to differentiate the tickets.  It could be either
//                  TPM_ST_AUTH_SECRET or TPM_ST_AUTH_SIGNED
//      timeout     TPM-specific value indicating when the authorization expires
//      timeEpoch   TPM-specific value indicating the epoch for the timeout
//      cpHash      optional hash (digest only) of the authorized command
//      policyRef   optional reference to a policy value
//      keyName name of the key that signed the authorization
*/
TPM_RC TicketComputeAuth(
			 TPM_ST            type,            // IN: the type of ticket.
			 TPMI_RH_HIERARCHY hierarchy,       // IN: hierarchy constant for ticket
			 UINT64            timeout,         // IN: timeout
			 BOOL              expiresOnReset,  // IN: flag to indicate if ticket expires on
			 //      TPM Reset
			 TPM2B_DIGEST* cpHashA,             // IN: input cpHashA
			 TPM2B_NONCE*  policyRef,           // IN: input policyRef
			 TPM2B_NAME*   entityName,          // IN: name of entity
			 TPMT_TK_AUTH* ticket               // OUT: Created ticket
			 )
{
    TPM_RC      result = TPM_RC_SUCCESS;
    TPM2B_PROOF proof;
    HMAC_STATE  hmacState;
    //
    // Get proper proof
    result = HierarchyGetProof(hierarchy, &proof);
    if(result != TPM_RC_SUCCESS)
	return result;

    // Fill in ticket fields
    ticket->tag       = type;
    ticket->hierarchy = hierarchy;

    // Start HMAC with hierarchy proof as the HMAC key
    ticket->digest.t.size =
	CryptHmacStart2B(&hmacState, CONTEXT_INTEGRITY_HASH_ALG, &proof.b);
    MemorySet(proof.b.buffer, 0, proof.b.size);

    //  TPM_ST_AUTH_SECRET or TPM_ST_AUTH_SIGNED,
    CryptDigestUpdateInt(&hmacState, sizeof(UINT16), ticket->tag);
    // cpHash
    CryptDigestUpdate2B(&hmacState.hashState, &cpHashA->b);
    //  policyRef
    CryptDigestUpdate2B(&hmacState.hashState, &policyRef->b);
    //  keyName
    CryptDigestUpdate2B(&hmacState.hashState, &entityName->b);
    //  timeout
    CryptDigestUpdateInt(&hmacState, sizeof(timeout), timeout);
    if(timeout != 0)
	{
	    //  epoch
	    CryptDigestUpdateInt(&hmacState.hashState, sizeof(CLOCK_NONCE), g_timeEpoch);
	    // reset count
	    if(expiresOnReset)
		CryptDigestUpdateInt(
				     &hmacState.hashState, sizeof(gp.totalResetCount), gp.totalResetCount);
	}
    // done
    CryptHmacEnd2B(&hmacState, &ticket->digest.b);

    return TPM_RC_SUCCESS;
}

//*** TicketComputeHashCheck()
// This function creates a TPMT_TK_HASHCHECK ticket.
/*(See part 2 specification)
//  The ticket is computed as:
//      HMAC(proof, (TPM_ST_HASHCHECK || digest ))
//  where:
//      HMAC()  an HMAC using the hash of proof
//      proof   a TPM secret value associated with the hierarchy
//      TPM_ST_HASHCHECK
//              a value to differentiate the tickets
//      digest  the digest of the data
*/
TPM_RC TicketComputeHashCheck(
			      TPMI_RH_HIERARCHY  hierarchy,  // IN: hierarchy constant for ticket
			      TPM_ALG_ID         hashAlg,    // IN: the hash algorithm for 'digest'
			      TPM2B_DIGEST*      digest,     // IN: input digest
			      TPMT_TK_HASHCHECK* ticket      // OUT: Created ticket
			      )
{
    TPM_RC      result = TPM_RC_SUCCESS;
    TPM2B_PROOF proof;
    HMAC_STATE  hmacState;
    //
    // Get proper proof
    result = HierarchyGetProof(hierarchy, &proof);
    if(result != TPM_RC_SUCCESS)
	return result;

    // Fill in ticket fields
    ticket->tag       = TPM_ST_HASHCHECK;
    ticket->hierarchy = hierarchy;

    // Start HMAC using hierarchy proof as HMAC key
    ticket->digest.t.size =
	CryptHmacStart2B(&hmacState, CONTEXT_INTEGRITY_HASH_ALG, &proof.b);
    MemorySet(proof.b.buffer, 0, proof.b.size);

    //  TPM_ST_HASHCHECK
    CryptDigestUpdateInt(&hmacState, sizeof(TPM_ST), ticket->tag);
    //  hash algorithm
    CryptDigestUpdateInt(&hmacState, sizeof(hashAlg), hashAlg);
    //  digest
    CryptDigestUpdate2B(&hmacState.hashState, &digest->b);
    // done
    CryptHmacEnd2B(&hmacState, &ticket->digest.b);

    return TPM_RC_SUCCESS;
}

//*** TicketComputeCreation()
// This function creates a TPMT_TK_CREATION ticket.
/*(See part 2 specification)
// The ticket is computed as:
//      HMAC(proof, (TPM_ST_CREATION || Name || hash(TPMS_CREATION_DATA)))
//  Where:
//  HMAC()  an HMAC using the hash of proof
//  proof   a TPM secret value associated with the hierarchy associated with Name
//  TPM_ST_VERIFIED     a value to differentiate the tickets
//  Name    the Name of the object to which the creation data is to be associated
//  TPMS_CREATION_DATA  the creation data structure associated with Name
*/
TPM_RC TicketComputeCreation(TPMI_RH_HIERARCHY hierarchy,  // IN: hierarchy for ticket
			     TPM2B_NAME*       name,       // IN: object name
			     TPM2B_DIGEST*     creation,   // IN: creation hash
			     TPMT_TK_CREATION* ticket      // OUT: created ticket
			     )
{
    TPM_RC      result = TPM_RC_SUCCESS;
    TPM2B_PROOF proof;
    HMAC_STATE  hmacState;

    // Get proper proof
    result = HierarchyGetProof(hierarchy, &proof);
    if(result != TPM_RC_SUCCESS)
	return result;

    // Fill in ticket fields
    ticket->tag       = TPM_ST_CREATION;
    ticket->hierarchy = hierarchy;

    // Start HMAC using hierarchy proof as HMAC key
    ticket->digest.t.size =
	CryptHmacStart2B(&hmacState, CONTEXT_INTEGRITY_HASH_ALG, &proof.b);
    MemorySet(proof.b.buffer, 0, proof.b.size);

    //  TPM_ST_CREATION
    CryptDigestUpdateInt(&hmacState, sizeof(TPM_ST), ticket->tag);
    //  name if provided
    if(name != NULL)
	CryptDigestUpdate2B(&hmacState.hashState, &name->b);
    //  creation hash
    CryptDigestUpdate2B(&hmacState.hashState, &creation->b);
    // Done
    CryptHmacEnd2B(&hmacState, &ticket->digest.b);

    return TPM_RC_SUCCESS;
}