[tpm2] Conflicting TPM2 engines and storage formats

[David Woodhouse <dwmw2 at infradead.org>]

[-- Attachment #1: Type: text/plain, Size: 1131 bytes --]

I'd like to add TPMv2 support to the OpenConnect VPN client. It's had
TPMv1.2 support since 2008, and I'm a bit late to the party with TPMv2.

For the OpenSSL build, it was trivial to support James's engine at
https://git.kernel.org/pub/scm/linux/kernel/git/jejb/openssl_tpm2_engine.git/

That was as simple as this:
http://git.infradead.org/users/dwmw2/openconnect.git/commitdiff/7edab6c6c

However, I've now discovered there's another, incompatible TPM2 engine
at https://github.com/tpm2-software/tpm2-tss-engine

Not only does the engine name seem to be different, but the label of
the PEM file ('BEGIN TSS2 KEY BLOB') is different. And possibly the
ASN.1 therein? Neither seem to have a definition outside the source
code, as far as I can tell.

I was actually looking for some code I could re-use to implement the
support in the GnuTLS build, much as I did the TPMv1.2 version¹ some
time ago. I'd settle for getting some consensus on what a wrapped key
actually looks like on the disk first, though....

-- 
dwmw2


¹ http://git.infradead.org/users/dwmw2/openconnect.git/blob/HEAD:/gnutls_tpm.c


[-- Attachment #2: smime.p7s --]
[-- Type: application/x-pkcs7-signature, Size: 5213 bytes --]