Re: [tpm2] Conflicting TPM2 engines and storage formats

[David Woodhouse <dwmw2 at infradead.org>]

[-- Attachment #1: Type: text/plain, Size: 5166 bytes --]

OK.. I think this makes a difference:


--- a/src/tpm2-tss-engine-common.h
+++ b/src/tpm2-tss-engine-common.h
@@ -55,8 +55,7 @@ TSS2_RC init_tpm_key(ESYS_CONTEXT **ctx, ESYS_TR *keyHandle,
         .objectAttributes = (TPMA_OBJECT_USERWITHAUTH | \
                              TPMA_OBJECT_RESTRICTED | \
                              TPMA_OBJECT_DECRYPT | \
-                             TPMA_OBJECT_FIXEDTPM | \
-                             TPMA_OBJECT_FIXEDPARENT | \
+                             TPMA_OBJECT_NODA | \
                              TPMA_OBJECT_SENSITIVEDATAORIGIN), \
         .authPolicy = { \
              .size = 0, \


Now, I have two PEM files, one 'machine.tss' created with James's tpm2
engine, and a second 'tpm2-engine.tss' which is converted manually as
described in issue #11 to be used with the tpm2tss engine.


$ openssl rsautl -sign -engine tpm2tss -inkey tpm2-engine.tss -keyform engine < testfile > testsig.tpm2tss
$ openssl rsautl -sign -engine tpm2 -inkey machine.tss -keyform engine < testfile > testsig.tpm2
$ sha1sum testsig.tpm*
fb9e8c1f4a1872f4144fd760af1740af75a9a8b2  testsig.tpm2
fb9e8c1f4a1872f4144fd760af1740af75a9a8b2  testsig.tpm2tss

So... that now *is* working for signing. However, while the
corresponding 'rsautl -verify' works fine with James's tpm2 engine, it
fails with tpm2tss:

$ openssl rsautl -verify -engine tpm2tss -inkey ../openssl_tpm2_engine/tpm2-engine.tss -keyform engine -in testsig.tpm2tss
Initializing
engine "tpm2tss" set.
Loading private key ../openssl_tpm2_engine/tpm2-engine.tss
get_auth called for object user key with ui_method 0x55ced253fdc0
Enter password for user key:
password is 
Loaded key uses alg-id 1
Creating RSA key object.
Created RSA key object.
TPM2 Key loaded
RSA operation error
140407559393728:error:0407006A:rsa routines:RSA_padding_check_PKCS1_type_1:block type is not 01:../crypto/rsa/rsa_pk1.c:75:
140407559393728:error:04067072:rsa routines:rsa_ossl_public_decrypt:padding check failed:../crypto/rsa/rsa_ossl.c:586:


So... is it the public key that I've misconverted somehow?

 $ openssl asn1parse -in machine.tss 
    0:d=0  hl=4 l= 503 cons: SEQUENCE          
    4:d=1  hl=2 l=   5 prim: OBJECT            :2.23.133.10.2
   11:d=1  hl=2 l=   3 cons: cont [ 0 ]        
   13:d=2  hl=2 l=   1 prim: BOOLEAN           :1
   16:d=1  hl=2 l=   6 cons: cont [ 1 ]        
   18:d=2  hl=2 l=   4 prim: INTEGER           :40000001
   24:d=1  hl=4 l= 284 cons: cont [ 2 ]        
   28:d=2  hl=4 l= 280 prim: OCTET STRING      [HEX DUMP]:01160001000B000204400000001000100800000000000100C696B23A22C1516E22352CD1309A48BD7E6F054EE10BB7265BFC3BC85B622E75B658A03E15BB74CD9C542C4CEA22337467913058B3711E6EF6CB4C8DA9B496E5888346B058426D645398613BF9BCE907947E63B5B4CD4ABA1FFC2EA396BEC0A7F3F1FEDF022966CED43C070B2000BEEEE7BB82375A4E1C1558E7FC7139DCEE9C6055C3332D50572E14A0747B907440598C93B77F356689EE71ACDAECA9C1FF33C74106CD8C23ACA4613F4D234A4C10A1D7AA3E469493A541838D40A065B17FD23F7D75A5F9BD29F59566BB7D450E970269FD90F914FFF0CE44D526D4914C32F35AD9A2C6BAF7F77BAAA0B4B77F80C29C683764BAFADEAFC397D344DB2ABF996D
  312:d=1  hl=3 l= 192 prim: OCTET STRING      [HEX DUMP]:00BE00204463515A27FC3B773B53F28C04C147D78991B02E7B2FAFE0E96FA11E79692FCA0010DE02ADCCECCADBA51D1C71283A37FFD608D0979B994054031FF7475505EBC0D45CB6808A93D83C64051CA06043721D55D8FE514BDD997CB8B26199B62D2E8517C1DE5293AC6ED97EF278F648B072855B73B2D32CB2B39315FA40FA6AAF618038D6F880465083A1140DF9792448F6D888C912A797EE943912E0EC78B9576748822580ABECE5D02B973DAF1C0F7CE15DC56D3BB15E9AE7FADDB7C2

 $ tail -8 tpm2-engine.tss | openssl asn1parse
    0:d=0  hl=4 l= 280 prim: OCTET STRING      [HEX DUMP]:01160001000B000204400000001000100800000000000100C696B23A22C1516E22352CD1309A48BD7E6F054EE10BB7265BFC3BC85B622E75B658A03E15BB74CD9C542C4CEA22337467913058B3711E6EF6CB4C8DA9B496E5888346B058426D645398613BF9BCE907947E63B5B4CD4ABA1FFC2EA396BEC0A7F3F1FEDF022966CED43C070B2000BEEEE7BB82375A4E1C1558E7FC7139DCEE9C6055C3332D50572E14A0747B907440598C93B77F356689EE71ACDAECA9C1FF33C74106CD8C23ACA4613F4D234A4C10A1D7AA3E469493A541838D40A065B17FD23F7D75A5F9BD29F59566BB7D450E970269FD90F914FFF0CE44D526D4914C32F35AD9A2C6BAF7F77BAAA0B4B77F80C29C683764BAFADEAFC397D344DB2ABF996D


I note that 'tpm2tss-genkey' stopped working with the change I made at
the beginning of this mail. I confess I haven't even looked up what any
of those flags mean...

$ ./tpm2tss-genkey  new.tss
Initializing
Setting owner auth to empty auth.
Generating RSA key for 2048 bits keysize.
Establishing connection with TPM.
WARNING:esys:src/tss2-esys/esys_tcti_default.c:137:tcti_from_file() Could not load TCTI file: libtss2-tcti-default.so 
WARNING:esys:src/tss2-esys/esys_tcti_default.c:137:tcti_from_file() Could not load TCTI file: libtss2-tcti-tabrmd.so 
Creating primary key under owner.
Generating the RSA key inside the TPM.
WARNING:esys:src/tss2-esys/api/Esys_Create.c:411:Esys_Create_Finish() Received TPM Error 
ERROR:esys:src/tss2-esys/api/Esys_Create.c:155:Esys_Create() Esys Finish ErrorCode (0x000002c2) 
Error: Generating key failed
Key could not be generated.


[-- Attachment #2: smime.p7s --]
[-- Type: application/x-pkcs7-signature, Size: 5213 bytes --]