Improve TPMUSymKeyBits and TPMUSymMode #384
Conversation
tpm2/structures.go
Outdated
| // AES returns the 'aes' member of the union. | ||
| // | ||
| // Deprecated: AES exists for historical compatibility |
There was a problem hiding this comment.
The structure does indeed have members for each algorithm, see https://trustedcomputinggroup.org/wp-content/uploads/TPM-2.0-1.83-Part-2-Structures.pdf#page=150 (and see https://trustedcomputinggroup.org/wp-content/uploads/TPM-2.0-1.83-Part-2-Structures.pdf#page=32 for an explanation of the algorithm tokens). sym is there as a convenience within the reference implementation and IMHO probably shouldn't even be mentioned in the spec. Also, I'm expecting that a future version of the spec flattens these macros, because they're hard to understand.
There was a problem hiding this comment.
Oh! I really didn't understand the specification like that the first time I look at it (it was really not clear), but looking at it a second time, I actually understand.
| @@ -1446,7 +1461,7 @@ type SymModeContents interface { | |||
| // create implements the unmarshallableWithHint interface. | |||
| func (u *TPMUSymMode) create(hint int64) (reflect.Value, error) { | |||
| switch TPMAlgID(hint) { | |||
| case TPMAlgAES: | |||
| case TPMAlgTDES, TPMAlgAES, TPMAlgSM4, TPMAlgCamellia: | |||
There was a problem hiding this comment.
TDES is deprecated (https://csrc.nist.gov/news/2023/nist-to-withdraw-sp-800-67-rev-2) so can we just not implement support for it?
There was a problem hiding this comment.
I know that TDES is deprecated by NIST, but I find that not allowing access to the information in a TPM structure would be a wrong choice. In the Golang standard library, access to verify a DSA signature is still possible even if DSA have been deprecated by the NIST. The Golang standard library don't offer method to generate new DSA signatures. In addition, TDES is still widely used in some areas such as payment, even if deprecated by NIST.
There was a problem hiding this comment.
This is a fair point.
Can we mark the relevant fields as Deprecated to discourage new uses?
|
Sorry for the delayed review @AlexandreEXFO! Thanks for this contribution! |
No description provided.