[tpm2] Re: Fapi_Decrypt using auth value

Hi Anthony,

in FAPI the authValues are always asked for using the callback registered in Fapi_SetAuthCB.
The simplest to do this (as I did a few times) in a programs is

TSS2_RC myAuthCB(..., const char **auth, void* userdata) {
    *auth = (char *) userdata;
    return TSS2_RC_SUCCESS;
}

static const char *myauth = "password";
Fapi_SetAuthCB(ctx, myAuthCB, myauth);
Fapi_Decrypt(ctx, ...);
Fapi_setAuthCB(ctx, NULL, NULL);

Hope this helps you.

Cheers,
Andreas

________________________________________
Von: Anthony Arrascue <AArrascue(a)neuroloop.de>
Gesendet: Mittwoch, 30. Juni 2021 12:37
An: tpm2(a)lists.01.org
Betreff: [tpm2] Fapi_Decrypt using auth value

Hello,

I am learning about encryption / decryption using Fapi.
For that purpose, I create a key using tss2_createkey and use tss2_encrypt / tss2_decrypt (and their Fapi equivalents).

tss2_ createkey has the argument -a, --authValue to set up a decryption password.
With tss2_encrypt I generate the cipher text.

The problem is with the decryption process. When I decrypt with tss2_decrypt I got asked for that authValue. If it is given correctly it decrypts the cipher text. However, Fapi_Decrypt will fail throwing an authorization error.

I was wondering how to programmatically enter the authValue? Fapi_Decrypt has no arguments to pass it. Maybe through the FAPI_CONTEXT?

Using TPM2-TSS v. 2.4.x
TPM2-TOOLS v. 4.X

Thank you for any possible help.
Best,


Anthony Arrascue
--------------------------------------
neuroloop GmbH
Breisacher Str. 86, 79110 Freiburg, Germany
aarrascue(a)neuroloop.de<mailto:aarrascue(a)neuroloop.de>
neuroloop.de