tpm2: Prevent HMAC creation with sha1: no-sha1-hmac-creation

Signed-off-by: Stefan Berger <[email protected]>

man/man3/TPMLIB_SetProfile.pod

@@ -211,6 +211,14 @@ algorithms
 
 =back
 
+=item B<no-sha1-hmac-creation>: (since v0.10)
+
+=over 2
+
+=item * Prevents creation of an HMAC using SHA1
+
+=back
+
 =item B<fips-host>: (since v0.10)
 
 =over 2

src/tpm2/CryptUtil.c

@@ -1537,6 +1537,11 @@ CryptSign(OBJECT*          signKey,     // IN: signing key
 	        RuntimeProfileRequiresAttributeFlags(&g_RuntimeProfile,
 						     RUNTIME_ATTRIBUTE_NO_SHA1_SIGNING))
 		return TPM_RC_HASH;
+	  case TPM_ALG_KEYEDHASH:
+	    if (signScheme->details.any.hashAlg == TPM_ALG_SHA1 &&
+	        RuntimeProfileRequiresAttributeFlags(&g_RuntimeProfile,
+						     RUNTIME_ATTRIBUTE_NO_SHA1_HMAC_CREATION))
+		return TPM_RC_HASH;
 	  break;
 	}							// libtpms added end
 

src/tpm2/RuntimeAttributes.c

@@ -63,6 +63,8 @@ static const struct {
 	      7),
     ATTRIBUTE("no-sha1-verification", RUNTIME_ATTRIBUTE_NO_SHA1_VERIFICATION,
 	      7),
+    ATTRIBUTE("no-sha1-hmac-creation", RUNTIME_ATTRIBUTE_NO_SHA1_HMAC_CREATION,
+	      7),
     ATTRIBUTE("fips-host", RUNTIME_ATTRIBUTE_NO_UNPADDED_ENCRYPTION |
 			   RUNTIME_ATTRIBUTE_NO_SHA1_SIGNING |
 			   RUNTIME_ATTRIBUTE_NO_SHA1_VERIFICATION,

src/tpm2/RuntimeAttributes_fp.h

@@ -42,11 +42,12 @@
 #ifndef RUNTIME_ATTRIBUTES_H
 #define RUNTIME_ATTRIBUTES_H
 
-#define NUM_ENTRIES_ATTRIBUTE_PROPERTIES          4
+#define NUM_ENTRIES_ATTRIBUTE_PROPERTIES          5
 
 #define RUNTIME_ATTRIBUTE_NO_UNPADDED_ENCRYPTION  (1 << 0)
 #define RUNTIME_ATTRIBUTE_NO_SHA1_SIGNING         (1 << 1)
 #define RUNTIME_ATTRIBUTE_NO_SHA1_VERIFICATION    (1 << 2)
+#define RUNTIME_ATTRIBUTE_NO_SHA1_HMAC_CREATION   (1 << 3)
 
 struct RuntimeAttributes {
     /* */