def _decode_encryption_parameters_blob(self, encryption_params_blob,
private_key):
encryption_params_blob = self.extract_encryption_parameters(
encryption_params_blob)[1]
tmp_config_file_path = c_path.store_data_to_temp_file(
encryption_params_blob)
encryption_params_parser = CoreConfig(auto_gen_ssd_xml_config,
tmp_config_file_path).root
encrypted_image_encryption_key_base64 = encryption_params_parser.MD_SIGN[
0].IEK_ENC_INFO[0].IEK_CIPHER_VALUE
encrypted_image_encryption_key = binascii.a2b_base64(
encrypted_image_encryption_key_base64)
if self.iek_enc_algo == IEK_ENC_ALGO_RSA_2048:
private_key_pem = crypto.rsa.get_key_in_format(
private_key, crypto.utils.FORMAT_PEM)
image_encryption_key = crypto.rsa.decrypt(
encrypted_image_encryption_key,
private_key_pem,
padding=crypto.rsa.RSA_PAD_PKCS)
else:
image_encryption_iv_base64 = encryption_params_parser.MD_SIGN[
0].IEK_ENC_INFO[0].IEK_ENC_IV
image_encryption_iv_bin = binascii.a2b_base64(
image_encryption_iv_base64)
image_encryption_iv_hex = binascii.hexlify(image_encryption_iv_bin)
image_encryption_key = crypto.aes_cbc.decrypt(
encrypted_image_encryption_key, binascii.hexlify(private_key),
image_encryption_iv_hex)
image_encryption_iv_base64 = encryption_params_parser.MD_SIGN[
0].IMG_ENC_INFO[0].IMG_ENC_IV
image_encryption_iv = binascii.a2b_base64(image_encryption_iv_base64)
return image_encryption_key, image_encryption_iv
def _generate_pkcs11_cfg(self, token_driver_home):
pkcs11_cfg_template_data = c_misc.load_data_from_file(self.PKCS11_CFG_TEMPLATE)
pkcs11_cfg_data = signerutils.macro_replace(pkcs11_cfg_template_data,
"token_driver_home",
token_driver_home,
isMandatory=True)
return c_path.store_data_to_temp_file(pkcs11_cfg_data)
def _generate_attestation_certificate_extensions(self,
attestation_certificate_extensions_path,
oid_name,
min_str,
max_str):
v3_attest_file = c_path.load_data_from_file(attestation_certificate_extensions_path)
v3_attest_file_new = v3_attest_file + self._generate_oid_config(oid_name, min_str, max_str)
v3_attest_file_temp = c_path.store_data_to_temp_file(v3_attest_file_new)
return v3_attest_file_temp
def _generate_new_encryption_params_blob(self):
enc_xml_fname = c_path.store_data_to_temp_file('')
self.ssd_p.gen_signed_ssd_xml(enc_xml_fname)
enc_xml = c_path.load_data_from_file(enc_xml_fname)
os.unlink(enc_xml_fname)
return enc_xml