[tpm2] Re: CMP error: cannot duplicate context:2306 tpm:warn(2.0): out of memory for object contexts

Chris Newman <chris at mode51.software>
Newsgroups dev.linux.lists.tpm2
Message-ID <[email protected]> 
Hi Petr,

I've tried abrmd and it works fine for the ir:

openssl cmp -config /opt/sdk/openssl/current/ssl/openssl.cnf -provider 
tpm2 -provider default -propquery ?provider=tpm2 -cmd ir -server 
https://demo.one.digicert.com/iot/api/v1/cmp/IOT_1234 -ref 1234 -secret 
pass:1234 -recipient "/CN=mode51.software" -key handle:0x81010002 
-subject "/CN=TestTest" -cacertsout ./capubs.pem -certout ./cl_cert.pem 
-tls_used -verbosity 8

Also works with the cr:

/opt/sdk/openssl/current/bin/openssl cmp -config 
/opt/sdk/openssl/current/ssl/openssl.cnf -provider tpm2 -provider 
default -propquery ?provider=tpm2 -cmd cr -server 
https://demo.one.digicert.com/iot/api/v1/cmp/IOT_1234 -ref 1234 -key 
handle:0x81010002 -certout ./cl_cert2.pem -cert ./cl_cert.pem -tls_used 
-verbosity 8 -trusted ./capubs.pem -unprotected_errors

Is there anything you want me to test with the DigiCert CMPv2 responder?

Many thanks for the really great software.


On 04/10/2021 09:18, Chris Newman wrote:
>
> Thanks Petr,
>
> I'm using in-kernel. I'll try abrmd and report back.
>
>
> On 04/10/2021 08:31, Petr Gotthard wrote:
>>
>> Hello,
>>
>> this sounds like a known limitation of the openssl provider: 
>> https://github.com/tpm2-software/tpm2-openssl/issues/4
>>
>> Some applications (like CMP) are too greedy and consume more 
>> resources than the TPM has. The resource managers (to my best 
>> knowledge) cannot swap resources from the same user.
>>
>> Are you using the tpm2-abrmd resource manager, or the in-kernel 
>> manager? The tpm2-abrmd behaves much better.
>>
>> Petr
>>
>> ______________________________________________________________
>> > Od: "Chris Newman" <chris(a)mode51.software>
>> > Komu: tpm2(a)lists.01.org
>> > Datum: 04.10.2021 01:41
>> > Předmět: [tpm2] CMP error: cannot duplicate context:2306 
>> tpm:warn(2.0): out of memory for object contexts
>> >
>>
>> Hi,
>>
>> I create an EK and AK using tpm2_createek, tpm2_createak and 
>> tpm2_evictcontrol to persist the AK in 0x81010002. The I use the 
>> following command with DigiCert's CMPv2 server:
>>
>> openssl cmp -config /opt/sdk/openssl/current/ssl/openssl.cnf 
>> -provider tpm2 -provider default -propquery 
>> ?provider=tpm2,tpm2.digest!=yes -cmd ir -server 
>> https://demo.one.digicert.com/iot/api/v1/cmp/IOT_1234 
>> <https://demo.one.digicert.com/iot/api/v1/cmp/IOT_1234> -ref 1234 
>> -secret pass:1234 -recipient "/CN=mode51.software" -key 
>> handle:0x81010002 -subject "/CN=TestTest" -cacertsout ./capubs.pem 
>> -certout ./cl_cert.pem -tls_used -verbosity 8
>>
>> I get the following error:
>>
>> DIGEST NEW
>> DIGEST INIT
>> DIGEST UPDATE
>> DIGEST DUP
>> DIGEST FINAL
>> DIGEST FREE
>> DIGEST NEW
>> DIGEST INIT
>> DIGEST UPDATE
>> DIGEST NEW
>> DIGEST INIT
>> DIGEST UPDATE
>> DIGEST DUP
>> WARNING:esys:src/tss2-esys/api/Esys_ContextLoad.c:279:Esys_ContextLoad_Finish() 
>> Received TPM Error
>> ERROR:esys:src/tss2-esys/api/Esys_ContextLoad.c:93:Esys_ContextLoad() 
>> Esys Finish ErrorCode (0x00000902)
>> DIGEST FREE
>> DIGEST FREE
>> DIGEST FREE
>> CMP DEBUG: disconnected from CMP server
>> *CMP error: cannot duplicate context:2306 tpm:warn(2.0): out of 
>> memory for object contexts*
>> CMP error: not able to copy ctx
>> CMP error: internal error
>> CMP error: error sending
>> CMP error: shutdown while in init
>> CMP error: transfer error:request sent: IR, expected response: IP
>> RSA FREE
>> RAND FREE
>> RAND FREE
>> RAND FREE
>> PROVIDER TEARDOWN
>>
>> I've tried tpm2_flushcontext -t.
>>
>> I recompiled tpm2-openssl with the following option and that appears 
>> to have worked around the issue:
>>
>> --disable-op-digest
>>
>> Is this what "?provider=tpm2,tpm2.digest!=yes" should effectively do?
>>
>> -- 
>>
>> Chris Newman
>> https://mode51.software <https://mode51.software>
>> @mode51software <https://twitter.com/mode51software>
>>
>>
>>
>>
>> mode51 Software Ltd is registered in England and Wales
>> Company Number 13007792 Registered Office 3 Orchard Way, CB24 1AG, UK
>>
>> GPG Encryption key 
>> <https://mode51.software/downloads/chrisnewman-mode51-pub-20201111.asc>
>>
>>
>> ----------
>>
>> _______________________________________________
>> tpm2 mailing list -- tpm2(a)lists.01.org
>> To unsubscribe send an email to tpm2-leave(a)lists.01.org
>> %(web_page_url)slistinfo%(cgiext)s/%(_internal_name)s 
> -- 
>
> Chris Newman
> +44 7958 745368
> https://mode51.software <https://mode51.software>
> @mode51software <https://twitter.com/mode51software>
>
>
>
>
> mode51 Software Ltd is registered in England and Wales
> Company Number 13007792 Registered Office 3 Orchard Way, CB24 1AG, UK
>
> GPG Encryption key 
> <https://mode51.software/downloads/chrisnewman-mode51-pub-20201111.asc>
-- 

Chris Newman
+44 7958 745368
https://mode51.software <https://mode51.software>
@mode51software <https://twitter.com/mode51software>




mode51 Software Ltd is registered in England and Wales
Company Number 13007792 Registered Office 3 Orchard Way, CB24 1AG, UK

GPG Encryption key 
<https://mode51.software/downloads/chrisnewman-mode51-pub-20201111.asc>
attachment.htm (text/html, 9.6 KB) 
<html>
  <head>
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
  </head>
  <body>
    <p>Hi Petr,</p>
    <p>I've tried abrmd and it works fine for the ir:<br>
    </p>
    <p>openssl cmp -config /opt/sdk/openssl/current/ssl/openssl.cnf
      -provider tpm2 -provider default -propquery ?provider=tpm2 -cmd ir
      -server <a class="moz-txt-link-freetext" href="https://demo.one.digicert.com/iot/api/v1/cmp/IOT_1234">https://demo.one.digicert.com/iot/api/v1/cmp/IOT_1234</a> -ref
      1234 -secret pass:1234 -recipient "/CN=mode51.software" -key
      handle:0x81010002 -subject "/CN=TestTest" -cacertsout ./capubs.pem
      -certout ./cl_cert.pem -tls_used -verbosity 8</p>
    <p>Also works with the cr:</p>
    <p>/opt/sdk/openssl/current/bin/openssl cmp -config
      /opt/sdk/openssl/current/ssl/openssl.cnf -provider tpm2 -provider
      default -propquery ?provider=tpm2 -cmd cr -server
      <a class="moz-txt-link-freetext" href="https://demo.one.digicert.com/iot/api/v1/cmp/IOT_1234">https://demo.one.digicert.com/iot/api/v1/cmp/IOT_1234</a> -ref 1234
      -key handle:0x81010002 -certout ./cl_cert2.pem -cert ./cl_cert.pem
      -tls_used -verbosity 8 -trusted ./capubs.pem -unprotected_errors<br>
    </p>
    <p>Is there anything you want me to test with the DigiCert CMPv2
      responder?<br>
    </p>
    <p>Many thanks for the really great software.</p>
    <p><br>
    </p>
    <div class="moz-cite-prefix">On 04/10/2021 09:18, Chris Newman
      wrote:<br>
    </div>
    <blockquote type="cite"
      cite="mid:[email protected]">
      <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
      <p>Thanks Petr,</p>
      <p>I'm using in-kernel. I'll try abrmd and report back.</p>
      <br>
      <div class="moz-cite-prefix">On 04/10/2021 08:31, Petr Gotthard
        wrote:<br>
      </div>
      <blockquote type="cite"
        cite="mid:[email protected]">
        <meta http-equiv="content-type" content="text/html;
          charset=UTF-8">
        <p style="padding:0 0 0 0; margin:0 0 0 0;">Hello,</p>
        <p style="padding:0 0 0 0; margin:0 0 0 0;"> </p>
        <p style="padding:0 0 0 0; margin:0 0 0 0;">this sounds like a
          known limitation of the openssl provider: <a
            class="moz-txt-link-freetext"
            href="https://github.com/tpm2-software/tpm2-openssl/issues/4"
            moz-do-not-send="true">https://github.com/tpm2-software/tpm2-openssl/issues/4</a></p>
        <p style="padding:0 0 0 0; margin:0 0 0 0;"> </p>
        <p style="padding:0 0 0 0; margin:0 0 0 0;">Some applications
          (like CMP) are too greedy and consume more resources than the
          TPM has. The resource managers (to my best knowledge) cannot
          swap resources from the same user.</p>
        <p style="padding:0 0 0 0; margin:0 0 0 0;"> </p>
        <p style="padding:0 0 0 0; margin:0 0 0 0;">Are you using the
          tpm2-abrmd resource manager, or the in-kernel manager? The
          tpm2-abrmd behaves much better.</p>
        <p style="padding:0 0 0 0; margin:0 0 0 0;"> </p>
        <p style="padding:0 0 0 0; margin:0 0 0 0;"> </p>
        <p style="padding:0 0 0 0; margin:0 0 0 0;">Petr</p>
        <p style="padding:0 0 0 0; margin:0 0 0 0;"> </p>
        <p style="padding:0 0 0 0; margin:0 0 0 0;">______________________________________________________________<br>
          &gt; Od: "Chris Newman" <a class="moz-txt-link-rfc2396E"
            href="mailto:[email protected]" moz-do-not-send="true">&lt;[email protected]&gt;</a><br>
          &gt; Komu: <a class="moz-txt-link-abbreviated"
            href="mailto:[email protected]" moz-do-not-send="true">[email protected]</a><br>
          &gt; Datum: 04.10.2021 01:41<br>
          &gt; Předmět: [tpm2] CMP error: cannot duplicate context:2306
          tpm:warn(2.0): out of memory for object contexts<br>
          &gt;</p>
        <p style="padding:0 0 0 0; margin:0 0 0 0;">Hi,</p>
        <p style="padding:0 0 0 0; margin:0 0 0 0;">I create an EK and
          AK using tpm2_createek, tpm2_createak and tpm2_evictcontrol to
          persist the AK in 0x81010002. The I use the following command
          with DigiCert's CMPv2 server:</p>
        <p style="padding:0 0 0 0; margin:0 0 0 0;">openssl cmp -config
          /opt/sdk/openssl/current/ssl/openssl.cnf -provider tpm2
          -provider default -propquery ?provider=tpm2,tpm2.digest!=yes
          -cmd ir -server <a
            href="https://demo.one.digicert.com/iot/api/v1/cmp/IOT_1234"
            moz-do-not-send="true">https://demo.one.digicert.com/iot/api/v1/cmp/IOT_1234</a>
          -ref 1234 -secret pass:1234 -recipient "/CN=mode51.software"
          -key handle:0x81010002 -subject "/CN=TestTest" -cacertsout
          ./capubs.pem -certout ./cl_cert.pem -tls_used -verbosity 8</p>
        <p style="padding:0 0 0 0; margin:0 0 0 0;">I get the following
          error:</p>
        <p style="padding:0 0 0 0; margin:0 0 0 0;">DIGEST NEW<br>
          DIGEST INIT<br>
          DIGEST UPDATE<br>
          DIGEST DUP<br>
          DIGEST FINAL<br>
          DIGEST FREE<br>
          DIGEST NEW<br>
          DIGEST INIT<br>
          DIGEST UPDATE<br>
          DIGEST NEW<br>
          DIGEST INIT<br>
          DIGEST UPDATE<br>
          DIGEST DUP<br>
WARNING:esys:src/tss2-esys/api/Esys_ContextLoad.c:279:Esys_ContextLoad_Finish()
          Received TPM Error<br>
ERROR:esys:src/tss2-esys/api/Esys_ContextLoad.c:93:Esys_ContextLoad()
          Esys Finish ErrorCode (0x00000902)<br>
          DIGEST FREE<br>
          DIGEST FREE<br>
          DIGEST FREE<br>
          CMP DEBUG: disconnected from CMP server<br>
          <strong>CMP error: cannot duplicate context:2306
            tpm:warn(2.0): out of memory for object contexts</strong><br>
          CMP error: not able to copy ctx<br>
          CMP error: internal error<br>
          CMP error: error sending<br>
          CMP error: shutdown while in init<br>
          CMP error: transfer error:request sent: IR, expected response:
          IP<br>
          RSA FREE<br>
          RAND FREE<br>
          RAND FREE<br>
          RAND FREE<br>
          PROVIDER TEARDOWN</p>
        <p style="padding:0 0 0 0; margin:0 0 0 0;"> </p>
        <p style="padding:0 0 0 0; margin:0 0 0 0;">I've tried
          tpm2_flushcontext -t.</p>
        <p style="padding:0 0 0 0; margin:0 0 0 0;">I recompiled
          tpm2-openssl with the following option and that appears to
          have worked around the issue:</p>
        <p style="padding:0 0 0 0; margin:0 0 0 0;">--disable-op-digest</p>
        <p style="padding:0 0 0 0; margin:0 0 0 0;">Is this what
          "?provider=tpm2,tpm2.digest!=yes" should effectively do?</p>
        <p style="padding:0 0 0 0; margin:0 0 0 0;"> </p>
        <div class="moz-signature">-- <br>
          <br>
          Chris Newman <br>
          <a href="https://mode51.software" moz-do-not-send="true">https://mode51.software</a>
          <br>
          <a href="https://twitter.com/mode51software"
            moz-do-not-send="true">@mode51software</a> <br>
          <br>
          <img src="cid:[email protected]"
            class="" border="0"> <br>
          <br>
          <small> <br>
            mode51 Software Ltd is registered in England and Wales <br>
            Company Number 13007792 Registered Office 3 Orchard Way,
            CB24 1AG, UK <br>
            <br>
            <a
href="https://mode51.software/downloads/chrisnewman-mode51-pub-20201111.asc"
              moz-do-not-send="true">GPG Encryption key</a> </small></div>
        <br>
        <br>
        ----------<br>
        <br>
        _______________________________________________<br>
        tpm2 mailing list -- <a class="moz-txt-link-abbreviated"
          href="mailto:[email protected]" moz-do-not-send="true">[email protected]</a><br>
        To unsubscribe send an email to <a
          class="moz-txt-link-abbreviated"
          href="mailto:[email protected]" moz-do-not-send="true">[email protected]</a><br>
        %(web_page_url)slistinfo%(cgiext)s/%(_internal_name)s </blockquote>
      <div class="moz-signature">-- <br>
        <br>
        Chris Newman <br>
        +44 7958 745368 <br>
        <a href="https://mode51.software" moz-do-not-send="true">https://mode51.software</a>
        <br>
        <a href="https://twitter.com/mode51software"
          moz-do-not-send="true">@mode51software</a> <br>
        <br>
        <img src="cid:[email protected]" class="">
        <br>
        <br>
        <small> <br>
          mode51 Software Ltd is registered in England and Wales <br>
          Company Number 13007792 Registered Office 3 Orchard Way, CB24
          1AG, UK <br>
          <br>
          <a
href="https://mode51.software/downloads/chrisnewman-mode51-pub-20201111.asc"
            moz-do-not-send="true">GPG Encryption key</a> </small></div>
    </blockquote>
    <div class="moz-signature">-- <br>
      <br>
      Chris Newman
      <br>
      +44 7958 745368
      <br>
      <a href="https://mode51.software">https://mode51.software</a>
      <br>
      <a href="https://twitter.com/mode51software">@mode51software</a>
      <br>
      <br>
      <img src="cid:[email protected]">
      <br>
      <br>
      <small>
        <br>
        mode51 Software Ltd is registered in England and Wales
        <br>
        Company Number 13007792 Registered Office 3 Orchard Way, CB24
        1AG, UK
        <br>
        <br>
        <a
href="https://mode51.software/downloads/chrisnewman-mode51-pub-20201111.asc">GPG
          Encryption key</a> </small></div>
  </body>
</html>
hbofnihajndifnfn.png (image/png, 6.9 KB) - not displayed
cgkpholajahjbjni.png (image/png, 6.9 KB) - not displayed
chokpedmodmgejcd.png (image/png, 6.9 KB) - not displayed
smime.p7s (application/pkcs7-signature, 3.9 KB) - not displayed
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.