Implemented and Tested CertifyCreation

direct/tpm2/certify_test.go

@@ -160,3 +160,100 @@ func TestCertify(t *testing.T) {
 		t.Errorf("Attested buffer is different from original buffer")
 	}
 }
+
+func TestCreateAndCertifyCreation(t *testing.T) {
+	thetpm, err := simulator.OpenSimulator()
+	if err != nil {
+		t.Fatalf("could not connect to TPM simulator: %v", err)
+	}
+	defer thetpm.Close()
+
+	public := tpm2b.Public{
+		PublicArea: tpmt.Public{
+			Type:    tpm.AlgRSA,
+			NameAlg: tpm.AlgSHA256,
+			ObjectAttributes: tpma.Object{
+				SignEncrypt:         true,
+				Restricted:          true,
+				FixedTPM:            true,
+				FixedParent:         true,
+				SensitiveDataOrigin: true,
+				UserWithAuth:        true,
+				NoDA:                true,
+			},
+			Parameters: tpmu.PublicParms{
+				RSADetail: &tpms.RSAParms{
+					Scheme: tpmt.RSAScheme{
+						Scheme: tpm.AlgRSASSA,
+						Details: tpmu.AsymScheme{
+							RSASSA: &tpms.SigSchemeRSASSA{
+								HashAlg: tpm.AlgSHA256,
+							},
+						},
+					},
+					KeyBits: 2048,
+				},
+			},
+		},
+	}
+
+	PCR7, err := CreatePCRSelection([]int{7})
+	if err != nil {
+		t.Fatalf("Failed to create PCRSelection")
+	}
+	pcrSelection := tpml.PCRSelection{
+		PCRSelections: []tpms.PCRSelection{
+			{
+				Hash:      tpm.AlgSHA1,
+				PCRSelect: PCR7,
+			},
+		},
+	}
+
+	createPrimary := CreatePrimary{
+		PrimaryHandle: tpm.RHEndorsement,
+		InPublic:      public,
+		CreationPCR:   pcrSelection,
+	}
+	rspCP, err := createPrimary.Execute(thetpm)
+	if err != nil {
+		t.Fatalf("Failed to create primary: %v", err)
+	}
+	flushContext := FlushContext{FlushHandle: rspCP.ObjectHandle}
+	defer flushContext.Execute(thetpm)
+
+	inScheme := tpmt.SigScheme{
+		Scheme: tpm.AlgRSASSA,
+		Details: tpmu.SigScheme{
+			RSASSA: &tpms.SchemeHash{
+				HashAlg: tpm.AlgSHA256,
+			},
+		},
+	}
+
+	certifyCreation := CertifyCreation{
+		SignHandle: AuthHandle{
+			Handle: rspCP.ObjectHandle,
+			Name:   rspCP.Name,
+			Auth:   PasswordAuth([]byte{}),
+		},
+		ObjectHandle: NamedHandle{
+			Handle: rspCP.ObjectHandle,
+			Name:   rspCP.Name,
+		},
+		CreationHash:   rspCP.CreationHash,
+		InScheme:       inScheme,
+		CreationTicket: rspCP.CreationTicket,
+	}
+
+	rspCC, err := certifyCreation.Execute(thetpm)
+	if err != nil {
+		t.Fatalf("Failed to certify creation: %v", err)
+	}
+
+	attName := rspCC.CertifyInfo.AttestationData.Attested.Creation.ObjectName.Buffer
+	pubName := rspCP.Name.Buffer
+	if !cmp.Equal(attName, pubName) {
+		t.Fatalf("Attested name: %v does not match returned public key: %v.", attName, pubName)
+	}
+}

direct/tpm2/tpm2.go

@@ -554,30 +554,70 @@ type Certify struct {
 	QualifyingData tpm2b.Data
 	// signing scheme to use if the scheme for signHandle is TPM_ALG_NULL
 	InScheme tpmt.SigScheme
- }
-  
- // Command implements the Command interface.
- func (*Certify) Command() tpm.CC { return tpm.CCCertify }
-  
- // Execute executes the command and returns the response.
- func (cmd *Certify) Execute(t transport.TPM, s ...Session) (*CertifyResponse, error) {
+}
+
+// Command implements the Command interface.
+func (*Certify) Command() tpm.CC { return tpm.CCCertify }
+
+// Execute executes the command and returns the response.
+func (cmd *Certify) Execute(t transport.TPM, s ...Session) (*CertifyResponse, error) {
 	var rsp CertifyResponse
 	if err := execute(t, cmd, &rsp, s...); err != nil {
 		return nil, err
 	}
 	return &rsp, nil
- }
-  
- // CertifyResponse is the response from TPM2_Certify.
- type CertifyResponse struct {
+}
+
+// CertifyResponse is the response from TPM2_Certify.
+type CertifyResponse struct {
 	// the structure that was signed
 	CertifyInfo tpm2b.Attest
 	// the asymmetric signature over certifyInfo using the key referenced by signHandle
 	Signature tpmt.Signature
- }
-
- // Response implements the Response interface.
- func (*CertifyResponse) Response() tpm.CC { return tpm.CCCertify } 
+}
+
+// Response implements the Response interface.
+func (*CertifyResponse) Response() tpm.CC { return tpm.CCCertify }
+
+// CertifyCreation is the input to TPM2_CertifyCreation.
+// See definition in Part 3, Commands, section 18.3.
+type CertifyCreation struct {
+	// handle of the key that will sign the attestation block
+	SignHandle handle `gotpm:"handle,auth"`
+	// the object associated with the creation data
+	ObjectHandle handle `gotpm:"handle"`
+	// user-provided qualifying data
+	QualifyingData tpm2b.Data
+	// hash of the creation data produced by TPM2_Create() or TPM2_CreatePrimary()
+	CreationHash tpm2b.Digest
+	// signing scheme to use if the scheme for signHandle is TPM_ALG_NULL
+	InScheme tpmt.SigScheme
+	// ticket produced by TPM2_Create() or TPM2_CreatePrimary()
+	CreationTicket tpmt.TKCreation
+}
+
+// Command implements the Command interface.
+func (*CertifyCreation) Command() tpm.CC { return tpm.CCCertifyCreation }
+
+// Execute executes the command and returns the response.
+func (cmd *CertifyCreation) Execute(t transport.TPM, s ...Session) (*CertifyCreationResponse, error) {
+	var rsp CertifyCreationResponse
+	if err := execute(t, cmd, &rsp, s...); err != nil {
+		return nil, err
+	}
+	return &rsp, nil
+}
+
+// CertifyCreationResponse is the response from TPM2_CertifyCreation.
+type CertifyCreationResponse struct {
+	// the structure that was signed
+	CertifyInfo tpm2b.Attest
+	// the signature over certifyInfo
+	Signature tpmt.Signature
+}
+
+// Response implements the Response interface.
+func (*CertifyCreationResponse) Response() tpm.CC { return tpm.CCCertifyCreation }
 
 // Quote is the input to TPM2_Quote.
 // See definition in Part 3, Commands, section 18.4