google · josephlr · Sep 28, 2019 · Sep 28, 2019 · Sep 28, 2019 · Sep 28, 2019
diff --git a/server/ecc_utils.go b/server/ecc_utils.go
@@ -0,0 +1,47 @@
+package server
+
+import (
+	"crypto/elliptic"
+	"fmt"
+	"math/big"
+
+	"github.com/google/go-tpm/tpm2"
+)
+
+// ECC coordinates need to maintain a specific size based on the curve, so we pad the front with zeros.
+// This is particularly an issue for NIST-P521 coordinates, as they are frequently missing their first byte.
+func eccIntToBytes(curve elliptic.Curve, i *big.Int) []byte {
+	bytes := i.Bytes()
+	curveBytes := (curve.Params().BitSize + 7) / 8
+	return append(make([]byte, curveBytes-len(bytes)), bytes...)
+}
+
+func curveIDToGoCurve(curve tpm2.EllipticCurve) (elliptic.Curve, error) {
+	switch curve {
+	case tpm2.CurveNISTP224:
+		return elliptic.P224(), nil
+	case tpm2.CurveNISTP256:
+		return elliptic.P256(), nil
+	case tpm2.CurveNISTP384:
+		return elliptic.P384(), nil
+	case tpm2.CurveNISTP521:
+		return elliptic.P521(), nil
+	default:
+		return nil, fmt.Errorf("unsupported TPM2 curve: %v", curve)
+	}
+}
+
+func goCurveToCurveID(curve elliptic.Curve) (tpm2.EllipticCurve, error) {
+	switch curve.Params().Name {
+	case elliptic.P224().Params().Name:
+		return tpm2.CurveNISTP224, nil
+	case elliptic.P256().Params().Name:
+		return tpm2.CurveNISTP256, nil
+	case elliptic.P384().Params().Name:
+		return tpm2.CurveNISTP384, nil
+	case elliptic.P521().Params().Name:
+		return tpm2.CurveNISTP521, nil
+	default:
+		return 0, fmt.Errorf("unsupported Go curve: %v", curve.Params().Name)
+	}
+}
diff --git a/server/key_conversion.go b/server/key_conversion.go
@@ -2,6 +2,7 @@ package server
 
 import (
 	"crypto"
+	"crypto/ecdsa"
 	"crypto/rsa"
 	"fmt"
 
@@ -10,12 +11,19 @@ import (
 )
 
 // CreateEKPublicAreaFromKey creates a public area from a go interface PublicKey.
-// Currently only supports RSA keys.
+// Supports RSA and ECC keys.
 func CreateEKPublicAreaFromKey(k crypto.PublicKey) (tpm2.Public, error) {
-	rsaKey, ok := k.(*rsa.PublicKey)
-	if !ok {
-		return tpm2.Public{}, fmt.Errorf("unsupported public key type: %v", k)
+	switch key := k.(type) {
+	case *rsa.PublicKey:
+		return createEKPublicRSA(key)
+	case *ecdsa.PublicKey:
+		return createEKPublicECC(key)
+	default:
+		return tpm2.Public{}, fmt.Errorf("unsupported public key type: %T", k)
 	}
+}
+
+func createEKPublicRSA(rsaKey *rsa.PublicKey) (tpm2.Public, error) {
 	public := tpm2tools.DefaultEKTemplateRSA()
 	if rsaKey.N.BitLen() != int(public.RSAParameters.KeyBits) {
 		return tpm2.Public{}, fmt.Errorf("unexpected RSA modulus size: %d bits", rsaKey.N.BitLen())
@@ -26,3 +34,13 @@ func CreateEKPublicAreaFromKey(k crypto.PublicKey) (tpm2.Public, error) {
 	public.RSAParameters.ModulusRaw = rsaKey.N.Bytes()
 	return public, nil
 }
+
+func createEKPublicECC(eccKey *ecdsa.PublicKey) (public tpm2.Public, err error) {
+	public = tpm2tools.DefaultEKTemplateECC()
+	public.ECCParameters.Point = tpm2.ECPoint{
+		XRaw: eccIntToBytes(eccKey.Curve, eccKey.X),
+		YRaw: eccIntToBytes(eccKey.Curve, eccKey.Y),
+	}
+	public.ECCParameters.CurveID, err = goCurveToCurveID(eccKey.Curve)
+	return public, err
+}
diff --git a/server/key_conversion_test.go b/server/key_conversion_test.go
@@ -1,44 +1,103 @@
 package server
 
 import (
+	"crypto"
+	"crypto/ecdsa"
+	"crypto/elliptic"
 	"crypto/rand"
 	"crypto/rsa"
 	"testing"
 
 	"github.com/google/go-tpm-tools/internal"
 	"github.com/google/go-tpm-tools/tpm2tools"
+	"github.com/google/go-tpm/tpm2"
 )
 
+func getECCTemplate(curve tpm2.EllipticCurve) tpm2.Public {
+	public := tpm2tools.DefaultEKTemplateECC()
+	public.ECCParameters.CurveID = curve
+	public.ECCParameters.Point.XRaw = nil
+	public.ECCParameters.Point.YRaw = nil
+	return public
+}
+
 func TestCreateEKPublicAreaFromKeyGeneratedKey(t *testing.T) {
-	template := tpm2tools.DefaultEKTemplateRSA()
-	key, err := rsa.GenerateKey(rand.Reader, int(template.RSAParameters.KeyBits))
-	if err != nil {
-		t.Fatal(err)
-	}
-	newArea, err := CreateEKPublicAreaFromKey(key.Public())
-	if err != nil {
-		t.Fatalf("failed to create public area from public key: %v", err)
+	tests := []struct {
+		name        string
+		template    tpm2.Public
+		generateKey func() (crypto.PublicKey, error)
+	}{
+		{"RSA", tpm2tools.DefaultEKTemplateRSA(), func() (crypto.PublicKey, error) {
+			priv, err := rsa.GenerateKey(rand.Reader, 2048)
+			return priv.Public(), err
+		}},
+		{"ECC", tpm2tools.DefaultEKTemplateECC(), func() (crypto.PublicKey, error) {
+			priv, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+			return priv.Public(), err
+		}},
+		{"ECC-P224", getECCTemplate(tpm2.CurveNISTP224), func() (crypto.PublicKey, error) {
+			priv, err := ecdsa.GenerateKey(elliptic.P224(), rand.Reader)
+			return priv.Public(), err
+		}},
+		{"ECC-P256", getECCTemplate(tpm2.CurveNISTP256), func() (crypto.PublicKey, error) {
+			priv, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+			return priv.Public(), err
+		}},
+		{"ECC-P384", getECCTemplate(tpm2.CurveNISTP384), func() (crypto.PublicKey, error) {
+			priv, err := ecdsa.GenerateKey(elliptic.P384(), rand.Reader)
+			return priv.Public(), err
+		}},
+		{"ECC-P521", getECCTemplate(tpm2.CurveNISTP521), func() (crypto.PublicKey, error) {
+			priv, err := ecdsa.GenerateKey(elliptic.P521(), rand.Reader)
+			return priv.Public(), err
+		}},
 	}
-	if !newArea.MatchesTemplate(template) {
-		t.Errorf("public areas did not match. got: %+v want: %+v", newArea, template)
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			key, err := test.generateKey()
+			if err != nil {
+				t.Fatal(err)
+			}
+			newArea, err := CreateEKPublicAreaFromKey(key)
+			if err != nil {
+				t.Fatalf("failed to create public area from public key: %v", err)
+			}
+			if !newArea.MatchesTemplate(test.template) {
+				t.Errorf("public areas did not match. got: %+v want: %+v", newArea, test.template)
+			}
+		})
 	}
 }
 
 func TestCreateEKPublicAreaFromKeyTPMKey(t *testing.T) {
 	rwc := internal.GetTPM(t)
 	defer tpm2tools.CheckedClose(t, rwc)
 
-	ek, err := tpm2tools.EndorsementKeyRSA(rwc)
-	if err != nil {
-		t.Fatal(err)
+	tests := []struct {
+		name     string
+		template tpm2.Public
+	}{
+		{"RSA", tpm2tools.DefaultEKTemplateRSA()},
+		{"ECC", tpm2tools.DefaultEKTemplateECC()},
+		{"ECC-P224", getECCTemplate(tpm2.CurveNISTP224)},
+		{"ECC-P256", getECCTemplate(tpm2.CurveNISTP256)},
+		{"ECC-P384", getECCTemplate(tpm2.CurveNISTP384)},
+		{"ECC-P521", getECCTemplate(tpm2.CurveNISTP521)},
 	}
-	defer ek.Close()
-	newArea, err := CreateEKPublicAreaFromKey(ek.PublicKey())
-	if err != nil {
-		t.Fatalf("failed to create public area from public key: %v", err)
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			ek, err := tpm2tools.NewKey(rwc, tpm2.HandleEndorsement, test.template)
+			if err != nil {
+				t.Fatal(err)
+			}
+			defer ek.Close()
+			newArea, err := CreateEKPublicAreaFromKey(ek.PublicKey())
+			if err != nil {
+				t.Fatalf("failed to create public area from public key: %v", err)
+			}
+			if matches, err := ek.Name().MatchesPublic(newArea); err != nil || !matches {
+				t.Error("public areas did not match or match check failed.")
+			}
+		})
 	}
-	if matches, err := ek.Name().MatchesPublic(newArea); !matches || err != nil {
-		t.Error("public areas did not match or match check failed.")
-	}
-
 }