[tpm2] CMP error: cannot duplicate context:2306 tpm:warn(2.0): out of memory for object contexts

Chris Newman <chris at mode51.software> Mon, 04 Oct 2021 00:40:59 +0100

Newsgroups	dev.linux.lists.tpm2
Message-ID	<[email protected]>

Hi,

I create an EK and AK using tpm2_createek, tpm2_createak and 
tpm2_evictcontrol to persist the AK in 0x81010002. The I use the 
following command with DigiCert's CMPv2 server:

openssl cmp -config /opt/sdk/openssl/current/ssl/openssl.cnf -provider 
tpm2 -provider default -propquery ?provider=tpm2,tpm2.digest!=yes -cmd 
ir -server https://demo.one.digicert.com/iot/api/v1/cmp/IOT_1234 -ref 
1234 -secret pass:1234 -recipient "/CN=mode51.software" -key 
handle:0x81010002 -subject "/CN=TestTest" -cacertsout ./capubs.pem 
-certout ./cl_cert.pem -tls_used -verbosity 8

I get the following error:

DIGEST NEW
DIGEST INIT
DIGEST UPDATE
DIGEST DUP
DIGEST FINAL
DIGEST FREE
DIGEST NEW
DIGEST INIT
DIGEST UPDATE
DIGEST NEW
DIGEST INIT
DIGEST UPDATE
DIGEST DUP
WARNING:esys:src/tss2-esys/api/Esys_ContextLoad.c:279:Esys_ContextLoad_Finish() 
Received TPM Error
ERROR:esys:src/tss2-esys/api/Esys_ContextLoad.c:93:Esys_ContextLoad() 
Esys Finish ErrorCode (0x00000902)
DIGEST FREE
DIGEST FREE
DIGEST FREE
CMP DEBUG: disconnected from CMP server
*CMP error: cannot duplicate context:2306 tpm:warn(2.0): out of memory 
for object contexts*
CMP error: not able to copy ctx
CMP error: internal error
CMP error: error sending
CMP error: shutdown while in init
CMP error: transfer error:request sent: IR, expected response: IP
RSA FREE
RAND FREE
RAND FREE
RAND FREE
PROVIDER TEARDOWN


I've tried tpm2_flushcontext -t.

I recompiled tpm2-openssl with the following option and that appears to 
have worked around the issue:

--disable-op-digest

Is this what "?provider=tpm2,tpm2.digest!=yes" should effectively do?


-- 

Chris Newman
https://mode51.software <https://mode51.software>
@mode51software <https://twitter.com/mode51software>




mode51 Software Ltd is registered in England and Wales
Company Number 13007792 Registered Office 3 Orchard Way, CB24 1AG, UK

GPG Encryption key 
<https://mode51.software/downloads/chrisnewman-mode51-pub-20201111.asc>

attachment.htm (text/html, 3 KB)

<html>
  <head>

    <meta http-equiv="content-type" content="text/html; charset=UTF-8">
  </head>
  <body>
    <p>Hi,</p>
    <p>I create an EK and AK using tpm2_createek, tpm2_createak and
      tpm2_evictcontrol to persist the AK in 0x81010002. The I use the
      following command with DigiCert's CMPv2 server:<br>
    </p>
    <p>openssl cmp -config /opt/sdk/openssl/current/ssl/openssl.cnf
      -provider tpm2 -provider default -propquery
      ?provider=tpm2,tpm2.digest!=yes -cmd ir -server
      <a class="moz-txt-link-freetext" href="https://demo.one.digicert.com/iot/api/v1/cmp/IOT_1234">https://demo.one.digicert.com/iot/api/v1/cmp/IOT_1234</a> -ref 1234
      -secret pass:1234 -recipient "/CN=mode51.software" -key
      handle:0x81010002 -subject "/CN=TestTest" -cacertsout ./capubs.pem
      -certout ./cl_cert.pem -tls_used -verbosity 8<br>
    </p>
    <p>I get the following error:<br>
    </p>
    <p>DIGEST NEW<br>
      DIGEST INIT<br>
      DIGEST UPDATE<br>
      DIGEST DUP<br>
      DIGEST FINAL<br>
      DIGEST FREE<br>
      DIGEST NEW<br>
      DIGEST INIT<br>
      DIGEST UPDATE<br>
      DIGEST NEW<br>
      DIGEST INIT<br>
      DIGEST UPDATE<br>
      DIGEST DUP<br>
WARNING:esys:src/tss2-esys/api/Esys_ContextLoad.c:279:Esys_ContextLoad_Finish()
      Received TPM Error<br>
ERROR:esys:src/tss2-esys/api/Esys_ContextLoad.c:93:Esys_ContextLoad()
      Esys Finish ErrorCode (0x00000902)<br>
      DIGEST FREE<br>
      DIGEST FREE<br>
      DIGEST FREE<br>
      CMP DEBUG: disconnected from CMP server<br>
      <b>CMP error: cannot duplicate context:2306 tpm:warn(2.0): out of
        memory for object contexts</b><br>
      CMP error: not able to copy ctx<br>
      CMP error: internal error<br>
      CMP error: error sending<br>
      CMP error: shutdown while in init<br>
      CMP error: transfer error:request sent: IR, expected response: IP<br>
      RSA FREE<br>
      RAND FREE<br>
      RAND FREE<br>
      RAND FREE<br>
      PROVIDER TEARDOWN<br>
    </p>
    <p><br>
    </p>
    <p>I've tried tpm2_flushcontext -t.</p>
    <p>I recompiled tpm2-openssl with the following option and that
      appears to have worked around the issue:</p>
    <p>--disable-op-digest<br>
    </p>
    <p>Is this what "?provider=tpm2,tpm2.digest!=yes" should effectively
      do?</p>
    <p><br>
    </p>
    <div class="moz-signature">-- <br>
      <br>
      Chris Newman
      <br>
      <a href="https://mode51.software">https://mode51.software</a>
      <br>
      <a href="https://twitter.com/mode51software">@mode51software</a>
      <br>
      <br>
      <img src="cid:[email protected]">
      <br>
      <br>
      <small>
        <br>
        mode51 Software Ltd is registered in England and Wales
        <br>
        Company Number 13007792 Registered Office 3 Orchard Way, CB24
        1AG, UK
        <br>
        <br>
        <a
href="https://mode51.software/downloads/chrisnewman-mode51-pub-20201111.asc">GPG
          Encryption key</a> </small></div>
  </body>
</html>

hbofnihajndifnfn.png (image/png, 6.9 KB) - not displayed

smime.p7s (application/pkcs7-signature, 3.9 KB) - not displayed