fwTPM: TPM2_Sign answers TPM_RC_FAILURE for an all-zero ECDSA digest #654

TPM2_Sign with an ECDSA key and an all-zero digest answers TPM_RC_FAILURE, where swtpm (libtpms) signs it. #649 mentions this in passing; it comes up in practice, so here it is on its own.

A PKCS#11 client signing an empty message with CKM_ECDSA hands the token an empty digest. tpm2-pkcs11 zero-pads it to the hash length to call TPM2_Sign, so the TPM gets 32 zero bytes. ECDSA defines e = 0 (FIPS 186-5, section 6.4.1), and the TCG reference and libtpms sign it.

Cause. FwSignDigestAndAppend calls wc_ecc_sign_hash, and wolfCrypt refuses an all-zero hash with ECC_BAD_ARG_E (-170, "ECC input argument wrong type, invalid input"). The fwTPM maps that error to TPM_RC_FAILURE. That code means the TPM is in failure mode, but fwTPM keeps answering: TPM2_GetRandom succeeds right after. So a client can't tell it apart from a broken TPM.

A standalone wolfCrypt check (v5.9.4-stable, P-256 key from wc_ecc_make_key):

non-zero hash: 0 (ok)
zero hash: -170 (ECC input argument wrong type, invalid input)

Reproduction (ESYS). Create a P-256 ECDSA signing key (Esys_Create + Esys_Load under a storage primary). Call Esys_Sign with a 32-byte SHA-256 digest of 0x5A bytes, then with 32 zero bytes, then Esys_GetRandom:

                        fwTPM master                swtpm 0.10.2
ECDSA, non-zero digest  ok                          ok
ECDSA, zero digest      TPM_RC_FAILURE              ok
GetRandom afterwards    ok                          ok

Suggested fix. Sign e = 0 as ECDSA defines it. If wolfCrypt keeps refusing it, the fwTPM could at least answer a code that doesn't say the TPM failed, such as TPM_RC_VALUE on the digest parameter.

Environment

• wolfTPM master at d7f73b5 (also seen in v4.2.0), fwTPM built with ./configure --enable-fwtpm-only --enable-swtpm on wolfSSL v5.9.4-stable (--enable-wolftpm --enable-pkcallbacks --enable-keygen).
• fwtpm_server on its default port, reached through the tpm2-tss 4.2.0 mssim TCTI.
• For comparison, the same program against swtpm 0.10.2 (libtpms).
• Found while running tpm2-pkcs11 on fwTPM.