From a43052b448965c23964a0cab92bbe33c9aa4f3a2 Mon Sep 17 00:00:00 2001 From: Herman Slatman Date: Tue, 19 Nov 2024 16:30:59 +0100 Subject: [PATCH] Ensure the `0` hash algorithm isn't passed as a `tpm2.Algorithm` --- attest/wrapped_tpm20.go | 22 +++++++++++++++++++--- 1 file changed, 19 insertions(+), 3 deletions(-) diff --git a/attest/wrapped_tpm20.go b/attest/wrapped_tpm20.go index eb97721..bdcf48d 100644 --- a/attest/wrapped_tpm20.go +++ b/attest/wrapped_tpm20.go @@ -592,10 +592,26 @@ func signECDSA(rw io.ReadWriter, key tpmutil.Handle, digest []byte, curve ellipt // if opts is provided, it can override the hash function to use. if opts != nil { - h, err := tpm2.HashToAlgorithm(opts.HashFunc()) - if err != nil { - return nil, fmt.Errorf("incorrect hash algorithm: %v", err) + var ( + h tpm2.Algorithm + err error + ) + if v := opts.HashFunc(); v != 0 { + h, err = tpm2.HashToAlgorithm(v) + if err != nil { + return nil, fmt.Errorf("incorrect hash algorithm: %v", err) + } + } else { + switch curve { + case elliptic.P384(): + h = tpm2.AlgSHA384 + case elliptic.P521(): + h = tpm2.AlgSHA512 + default: + h = tpm2.AlgSHA256 + } } + scheme = &tpm2.SigScheme{ Alg: tpm2.AlgECDSA, Hash: h,