github.com/linuxboot/fiano@v1.2.0/pkg/amd/psb/keys_test.go (about) 1 // Copyright 2023 the LinuxBoot Authors. All rights reserved 2 // Use of this source code is governed by a BSD-style 3 // license that can be found in the LICENSE file. 4 5 package psb 6 7 import ( 8 "bytes" 9 "crypto/sha256" 10 "testing" 11 12 "github.com/stretchr/testify/assert" 13 "github.com/stretchr/testify/require" 14 "github.com/stretchr/testify/suite" 15 ) 16 17 // SHA256 of the common RSA exponent, 0x10001 18 var ( 19 rsaCommonExponentSHA256 = [32]uint8{0xc8, 0xa2, 0x22, 0xa2, 0x60, 0xf3, 0x57, 0xf5, 0xfd, 0x2b, 0x6d, 0x22, 0x49, 0x2, 0x2e, 0xef, 0xea, 0xa2, 0x8, 0xbd, 0x12, 0x13, 0x7, 0x89, 0xa2, 0x60, 0x0, 0x9b, 0x6a, 0xea, 0x58, 0xbb} 20 // Key ID of the root key belonging to AMD 21 rootKeyID = Buf16B{0x94, 0xc3, 0x8e, 0x41, 0x77, 0xd0, 0x47, 0x92, 0x92, 0xa7, 0xae, 0x67, 0x1d, 0x08, 0x3f, 0xb6} 22 // KeyID of the OEM signing key 23 oemKeyID = Buf16B{0xef, 0x99, 0x1d, 0xb4, 0x41, 0x42, 0x44, 0x67, 0x92, 0x65, 0x92, 0x3d, 0xe8, 0xbc, 0x51, 0xd8} 24 // KeyID of the signing key for SMU off chip (0x08, 0x12) firmware and MP5 firmware (0x2A) 25 smuSigningKeyID = Buf16B{0x6e, 0x97, 0xee, 0xe0, 0x86, 0xbd, 0x4b, 0x41, 0xb5, 0x82, 0x01, 0xce, 0x9f, 0xe3, 0x08, 0x73} 26 // KeyID of the signing key for PSP early secure unblock debug image 27 earlySecurePSPKeyID = Buf16B{0x80, 0xac, 0x38, 0xa7, 0x85, 0x99, 0x45, 0xf8, 0xba, 0x5f, 0xb9, 0xb4, 0xc7, 0xa5, 0x79, 0x8f} 28 // KeyID of the signing key for security policy binary 29 securityPolicyBinaryKeyID = Buf16B{0xf2, 0x4b, 0x7f, 0x7e, 0xdc, 0xe5, 0x45, 0xdd, 0x89, 0xb6, 0x5c, 0xd0, 0x7e, 0xf7, 0x40, 0x97} 30 // KeyID of the signing key for PSP AGESA Binary 31 agesaKeyID = Buf16B{0x28, 0x9a, 0xfe, 0x36, 0xf6, 0x3c, 0x4f, 0x88, 0xbc, 0x13, 0x85, 0xaa, 0x6d, 0x92, 0x38, 0x91} 32 // KeyID of the signing key for SEV Code (0x39) 33 sevCodeKeyID = Buf16B{0x03, 0x11, 0x7b, 0x7e, 0x60, 0xcb, 0x40, 0x3e, 0xbf, 0x9e, 0xcd, 0x55, 0x7e, 0xcb, 0x99, 0x71} 34 // KeyID of the signing key for DXIO PHY SRAM FW (0x42) 35 dxioKeyID = Buf16B{0xff, 0xfe, 0x23, 0x6b, 0x8b, 0xcc, 0x4a, 0x2b, 0xac, 0xbb, 0x85, 0x6e, 0x12, 0x03, 0x68, 0xfd} 36 // KeyID of the signing key DRTM TA (0x47) 37 drtmTaKeyID = Buf16B{0x25, 0x59, 0xbe, 0x9e, 0x7b, 0xef, 0x4c, 0x54, 0x99, 0x02, 0x42, 0xc4, 0xfa, 0xe1, 0x55, 0x22} 38 39 // Unknown keys (i.e. for which it is not clear what they sign) 40 unknownKey1 = Buf16B{0xea, 0x94, 0x0a, 0x66, 0x12, 0x38, 0x41, 0x2d, 0xb3, 0x9e, 0xab, 0xa2, 0x93, 0x4d, 0x4a, 0x9f} 41 ) 42 43 type KeySuite struct { 44 suite.Suite 45 } 46 47 func (suite *KeySuite) TestKeySetAddKey() { 48 49 rootKey, err := NewRootKey(bytes.NewBuffer(amdRootKey)) 50 assert.NoError(suite.T(), err) 51 52 keySet := NewKeySet() 53 err = keySet.AddKey(rootKey, AMDRootKey) 54 assert.NoError(suite.T(), err) 55 56 assert.Equal(suite.T(), 1, len(keySet.AllKeyIDs())) 57 assert.NotNil(suite.T(), keySet.GetKey(KeyID(rootKeyID))) 58 59 } 60 61 func (suite *KeySuite) TestRootKeyFields() { 62 key, err := NewRootKey(bytes.NewBuffer(amdRootKey)) 63 assert.NoError(suite.T(), err) 64 assert.Equal(suite.T(), uint32(0x01), key.data.VersionID) 65 66 assert.Equal(suite.T(), KeyID(rootKeyID), key.data.KeyID) 67 assert.Equal(suite.T(), rootKeyID, key.data.CertifyingKeyID) 68 assert.Equal(suite.T(), SignAMDBootloaderPSPSMU, key.data.KeyUsageFlag) 69 70 assert.Equal(suite.T(), uint32(0x1000), key.data.ExponentSize) 71 assert.Equal(suite.T(), uint32(0x1000), key.data.ModulusSize) 72 73 hashExponent := sha256.Sum256(key.data.Exponent) 74 hashModulus := sha256.Sum256(key.data.Modulus) 75 76 expectedModulusHash := [32]uint8{0x87, 0xdb, 0xd4, 0x5, 0x40, 0x23, 0x7d, 0xf3, 0x9c, 0x7, 0x2e, 0xfc, 0x2b, 0xa9, 0x1e, 0xc2, 0x3a, 0xe, 0xe5, 0x7e, 0x2a, 0xf0, 0x74, 0xdd, 0xe8, 0x44, 0xa4, 0x61, 0x4d, 0xc4, 0x57, 0x7b} 77 78 assert.Equal(suite.T(), rsaCommonExponentSHA256, hashExponent) 79 assert.Equal(suite.T(), expectedModulusHash, hashModulus) 80 81 } 82 83 func (suite *KeySuite) TestOEMKeyFields() { 84 rootKey, err := NewRootKey(bytes.NewBuffer(amdRootKey)) 85 assert.NoError(suite.T(), err) 86 87 // parse root key and use it to validate token key 88 keySet := NewKeySet() 89 err = keySet.AddKey(rootKey, AMDRootKey) 90 assert.NoError(suite.T(), err) 91 92 key, err := NewTokenKey(bytes.NewBuffer(oemSigningKey), keySet) 93 assert.NoError(suite.T(), err) 94 assert.Equal(suite.T(), uint32(0x01), key.data.VersionID) 95 96 assert.Equal(suite.T(), KeyID(oemKeyID), key.data.KeyID) 97 assert.Equal(suite.T(), rootKey.data.KeyID, KeyID(key.data.CertifyingKeyID)) 98 99 assert.Equal(suite.T(), PSBSignBIOS, key.data.KeyUsageFlag) 100 platSignInfo, err := GetPlatformBindingInfo(key) 101 require.NoError(suite.T(), err) 102 assert.Equal(suite.T(), byte(0x8D), platSignInfo.VendorID) 103 assert.Zero(suite.T(), platSignInfo.KeyRevisionID) 104 assert.Zero(suite.T(), platSignInfo.PlatformModelID) 105 106 secutiryFeatures, err := GetSecurityFeatureVector(key) 107 require.NoError(suite.T(), err) 108 assert.False(suite.T(), secutiryFeatures.DisableAMDBIOSKeyUse) 109 assert.False(suite.T(), secutiryFeatures.DisableBIOSKeyAntiRollback) 110 assert.False(suite.T(), secutiryFeatures.DisableSecureDebugUnlock) 111 112 assert.Equal(suite.T(), uint32(0x1000), key.data.ExponentSize) 113 assert.Equal(suite.T(), uint32(0x1000), key.data.ModulusSize) 114 115 hashExponent := sha256.Sum256(key.data.Exponent) 116 hashModulus := sha256.Sum256(key.data.Modulus) 117 118 expectedModulusHash := [32]uint8{0x53, 0xbf, 0x68, 0xb9, 0x67, 0x97, 0xc5, 0x1f, 0xdd, 0xd3, 0xe6, 0x65, 0x2b, 0x2d, 0xdd, 0x2c, 0x6e, 0x57, 0x37, 0xee, 0x69, 0x6c, 0x50, 0x83, 0xa1, 0x25, 0xa9, 0x74, 0x24, 0xc1, 0xaf, 0x91} 119 120 assert.Equal(suite.T(), rsaCommonExponentSHA256, hashExponent) 121 assert.Equal(suite.T(), expectedModulusHash, hashModulus) 122 } 123 124 func (suite *KeySuite) TestKeyDBParsing() { 125 126 keySet := NewKeySet() 127 err := parseKeyDatabase(keyDB, keySet) 128 assert.NoError(suite.T(), err) 129 130 assert.Equal(suite.T(), 7, len(keySet.AllKeyIDs())) 131 132 // assert presence of all known keys 133 assert.NotNil(suite.T(), keySet.GetKey(KeyID(securityPolicyBinaryKeyID))) 134 assert.NotNil(suite.T(), keySet.GetKey(KeyID(sevCodeKeyID))) 135 assert.NotNil(suite.T(), keySet.GetKey(KeyID(smuSigningKeyID))) 136 assert.NotNil(suite.T(), keySet.GetKey(KeyID(earlySecurePSPKeyID))) 137 assert.NotNil(suite.T(), keySet.GetKey(KeyID(unknownKey1))) 138 assert.NotNil(suite.T(), keySet.GetKey(KeyID(dxioKeyID))) 139 assert.NotNil(suite.T(), keySet.GetKey(KeyID(drtmTaKeyID))) 140 141 // assert absence of keys which are not included in the key database 142 assert.Nil(suite.T(), keySet.GetKey(KeyID(oemKeyID))) 143 assert.Nil(suite.T(), keySet.GetKey(KeyID(agesaKeyID))) 144 145 } 146 147 func TestKeySuite(t *testing.T) { 148 suite.Run(t, new(KeySuite)) 149 }