[tpm2] Re: tss2_createkey - unable to set persistent handle
Roberts, William C <william.c.roberts at intel.com>
| Newsgroups | dev.linux.lists.tpm2 |
|---|---|
| Message-ID | <SN6PR11MB3437C1E23E367695EB060D13B8919@SN6PR11MB3437.namprd11.prod.outlook.com> |
+ Imran
> I think creating a loaded key in a persistent handle is a separate
> optional command not every TPM implements.
the command is TPM2_EvictControl to make a handle persistent. The command is mandatory per the PC Client Spec:
https://trustedcomputinggroup.org/wp-content/uploads/TCG_PC_Client_Platform_TPM_Profile_PTP_Specification_Family_2.0_Revision_1.3v22.pdf
> I don't know why the tool
> doesn't just use getcap to figure this out and make a multi step
> create-load-evict process when the one-step command is unavailable but
> there you are.
I think you're referring to the -c option on tpm2_create, which doesn't create a persistent object, but rather invokes the createloaded command.
and returns a transient object that is loaded.
That was actually a bad decision on my part, because when it comes to creating cphash's for policies, we know are invoking a different command,
which also has different inputs and outputs to tpm2_create and tpm2_load.
I thought their was bug in tpm2-tools to implement this feature, but perhaps it got dropped or completed. Imran, plans on this?
On Sun, Nov 7, 2021 at 11:38 PM Christian Plappert
<christian.plappert(a)sit.fraunhofer.de> wrote:
>
> Hi,
>
> for me it looks like that you use the fapi tools (tss2 command prefix)
> with the swtpm and the esapi tools (tpm2 command prefix) with the device
> tpm (since you did not specify anything). If you call the esapi tools
> with the swtpm as TCTI (-T swtpm), all commands should target the swtpm.
>
>
> I tried your commands like this and it works for me ("-T swtpm" for the
> esapi tools is important):
>
>
> ```
> - tss2_provision
> - tpm2_getcap -T swtpm handles-persistent
> - tss2_createkey --path="/P_ECCP256SHA256/HS/SRK/device_key"
> --type="sign, decrypt, noDa, 0x81020001" --authValue=""
> - tpm2_getcap -T swtpm handles-persistent
> ``
>
> Best,
> Christian
>
>
>
>
>
> On 02.11.21 05:41, z4pu(a)pm.me wrote:
> > Hello everyone
> >
> > I am having issues using the Feature_API to create a key under the `/P_ECCP256SHA256/HS/SRK/` path. This is using `tss2_createkey` as well as using the Feature API programmatically. The issue is that I am able to generate a key at the path, but I am never able to set a persistent handle for it.
> >
> > I would like to set a persistent handle for my child key as I am looking to use https://github.com/tpm2-software/tpm2-tss-engine/ programmatically. When loading a key using the engine library, according to https://github.com/tpm2-software/tpm2-tss-engine/blob/89327fa8b51962348c46ddc659fb8c3636336a60/src/tpm2-tss-engine.c#L190-L191, I can load a key by:
> > - specifying the persistent handle or
> > - providing the path to the encrypted TSS key file.
> >
> > I am using the following:
> > - Ubuntu 20.04
> > - swtpm --version: TPM emulator version 0.7.0, Copyright (c) 2014-2021 IBM Corp. This is running in a Docker container exposing ports 2322 and 2321 using `docker run --name swtpm -p 2322:2322 -p 2321:2321 --rm --detach swtpm:latest`
> > - https://github.com/tpm2-software/tpm2-tss: latest master branch, based on release 2.4.6
> > - https://github.com/tpm2-software/tpm2-tools: latest master branch, based on 5.2 2021-09-28
> >
> > fapi-config.json :
> > ```
> > {
> > "profile_name": "P_ECCP256SHA256",
> > "profile_dir": "/usr/local/etc/tpm2-tss/fapi-profiles/",
> > "user_dir": "~/.local/share/tpm2-tss/user/keystore",
> > "system_dir": "/usr/local/var/lib/tpm2-tss/system/keystore",
> > "tcti": "swtpm:port=2321",
> > "ek_cert_less":"YES",
> > "system_pcrs" : [],
> > "log_dir" : "/usr/local/var/run/tpm2-tss/eventlog/"
> > }
> > ```
> > The profiles at /usr/local/etc/tpm2-tss/fapi-profiles are the defaults:
> > ```
> > cat /usr/local/etc/tpm2-tss/fapi-profiles/P_ECCP256SHA256.json
> > {
> > "type": "TPM2_ALG_ECC",
> > "nameAlg":"TPM2_ALG_SHA256",
> > "srk_template": "system,restricted,decrypt,0x81000001",
> > "srk_description": "Storage root key SRK",
> > "srk_persistent": 0,
> > "ek_template": "system,restricted,decrypt",
> > "ek_description": "Endorsement key EK",
> > "ecc_signing_scheme": {
> > "scheme":"TPM2_ALG_ECDSA",
> > "details":{
> > "hashAlg":"TPM2_ALG_SHA256"
> > },
> > },
> > "sym_mode":"TPM2_ALG_CFB",
> > "sym_parameters": {
> > "algorithm":"TPM2_ALG_AES",
> > "keyBits":"128",
> > "mode":"TPM2_ALG_CFB"
> > },
> > "sym_block_size": 16,
> > "pcr_selection": [
> > { "hash": "TPM2_ALG_SHA1",
> > "pcrSelect": [ ],
> > },
> > { "hash": "TPM2_ALG_SHA256",
> > "pcrSelect": [ 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23 ]
> > }
> > ],
> > "curveID": "TPM2_ECC_NIST_P256",
> > "ek_policy": {
> > "description": "Endorsement hierarchy used for policy secret.",
> > "policy":[
> > {
> > "type":"POLICYSECRET",
> > "objectName": "4000000b",
> > }
> > ]
> > }
> > }
> > ```
> > I'm also making sure to remove the following folders in between my experiments:
> > - /usr/local/var/lib/tpm2-tss/system/keystore/P_ECCP256SHA256
> > - /root/.local/share/tpm2-tss/user/keystore/P_ECCP256SHA256 (as my Docker container is running as root)
> > - ~/.local/share/tpm2-tss/user/keystore/P_ECCP256SHA256
> >
> > The handle I am choosing for the child key is `0x81020001`, based on my reading of Table 7 of and the surrounding text at https://www.trustedcomputinggroup.org/wp-content/uploads/131011-Registry-of-reserved-TPM2-handles-and-localities.pdf
> >
> > The sequence of commands I am running as root is:
> > - tss2_provision to provision the TPM
> > - tpm2_getcap handles-persistent to list the used handles: Output is `- 0x81800000 - 0x81800001`
> > - tss2_list to confirm that the keys under the hierarchies have been created. Output is `/P_ECCP256SHA256/HN:/P_ECCP256SHA256/HE:/P_ECCP256SHA256/HE/EK:/P_ECCP256SHA256/LOCKOUT:/P_ECCP256SHA256/HS/SRK:/P_ECCP256SHA256/HS`
> > - tss2_createkey --path="/P_ECCP256SHA256/HS/SRK/device_key" --type="sign, decrypt, noDa, 0x81020001" --authValue=""
> > - tss2_list again, Output is `/P_ECCP256SHA256/HN:/P_ECCP256SHA256/HE:/P_ECCP256SHA256/HE/EK:/P_ECCP256SHA256/LOCKOUT:/P_ECCP256SHA256/HS/SRK:/P_ECCP256SHA256/HS:/P_ECCP256SHA256/HS/SRK/device_key`
> > - tpm2_getcap handles-persistent does not list the requested handle: Output is `- 0x81800000 - 0x81800001`
> >
> > However, when I restart the TPM, and do not provision it, I can run the following commands as root to generate a child key and the parent key with a persistent handle:
> > - tpm2_getcap handles-persistent: Output is `- 0x81800000 - 0x81800001`
> > - tpm2_createprimary --hierarchy=o --key-algorithm=ecc256 --key-context=owner_primary.ctx --format=pem --output=owner_primary_public_key.pem
> > output is
> > ```
> > name-alg:
> > value: sha256
> > raw: 0xb
> > attributes:
> > value: fixedtpm|fixedparent|sensitivedataorigin|userwithauth|restricted|decrypt
> > raw: 0x30072
> > type:
> > value: ecc
> > raw: 0x23
> > curve-id:
> > value: NIST p256
> > raw: 0x3
> > kdfa-alg:
> > value: null
> > raw: 0x10
> > kdfa-halg:
> > value: (null)
> > raw: 0x0
> > scheme:
> > value: null
> > raw: 0x10
> > scheme-halg:
> > value: (null)
> > raw: 0x0
> > sym-alg:
> > value: aes
> > raw: 0x6
> > sym-mode:
> > value: cfb
> > raw: 0x43
> > sym-keybits: 128
> > x: 9eecfa05a9a8ddadc8adabe4c9ce3d34b60afe0fd35cc799e28badc638cae6ad
> > y: 30dfc43266c2aa3480f31366ac5d189abf793dae100f30b50b344b7207f03994
> > ```
> > - tpm2_create --parent-context=owner_primary.ctx --key-algorithm=ecc256 --public=child_public.key --private=child_private.key
> > Output is
> > ```
> > name-alg:
> > value: sha256
> > raw: 0xb
> > attributes:
> > value: fixedtpm|fixedparent|sensitivedataorigin|userwithauth|decrypt|sign
> > raw: 0x60072
> > type:
> > value: ecc
> > raw: 0x23
> > curve-id:
> > value: NIST p256
> > raw: 0x3
> > kdfa-alg:
> > value: null
> > raw: 0x10
> > kdfa-halg:
> > value: (null)
> > raw: 0x0
> > scheme:
> > value: null
> > raw: 0x10
> > scheme-halg:
> > value: (null)
> > raw: 0x0
> > sym-alg:
> > value: null
> > raw: 0x10
> > sym-mode:
> > value: (null)
> > raw: 0x0
> > sym-keybits: 0
> > x: 801553461b62972e1e3894e1baa1d56196774f829285f714a163c63a57a219de
> > y: ebfd148f186f2560a0a6713b5f6f50bfaa39b7a320304f8620c36bdee4dfa379
> > ```
> > - tpm2_load --parent-context=owner_primary.ctx --public=child_public.key --private=child_private.key --key-context=child_key.ctx
> > Output is `name: 000b18738b4a5366d3f863920c7b98db696c723fd88e030b7cad32e1d3ac33e6fb6c`
> > - tpm2_evictcontrol --hierarchy=o --object-context=child_key.ctx 0x81020001
> > Output is
> > ```
> > persistent-handle: 0x81020001
> > action: persisted
> > ```
> > - tpm2_evictcontrol --hierarchy=o --object-context=owner_primary.ctx 0x81010001
> > Output is
> > ```
> > persistent-handle: 0x81010001
> > action: persisted
> > ```
> > - tpm2_getcap handles-persistent
> > Output is
> > ```
> > - 0x81010001
> > - 0x81020001
> > - 0x81800000
> > - 0x81800001
> > ```
> > - tss2_list
> > Output is an error message
> > ```
> > WARNING:fapi:src/tss2-fapi/api/Fapi_List.c:216:Fapi_List_Finish() Path not found:
> > ERROR:fapi:src/tss2-fapi/api/Fapi_List.c:81:Fapi_List() ErrorCode (0x00060034) Entities_List
> > Fapi_List(0x60034) - fapi:Provisioning was not executed.
> > ```
> > There isn't anything in `/usr/local/var/run/tpm2-tss/eventlog/` for me to look at, possibly because of the Dockerised setup.
> >
> > I can later delete these persistent handles using e.g. tpm2_evictcontrol --hierarchy=o --object-context=0x81020001
> >
> > Thanks very much in advance
> >
> > Cheers
> > z.
> > _______________________________________________
> > tpm2 mailing list -- tpm2(a)lists.01.org
> > To unsubscribe send an email to tpm2-leave(a)lists.01.org
> > %(web_page_url)slistinfo%(cgiext)s/%(_internal_name)s
> >
> _______________________________________________
> tpm2 mailing list -- tpm2(a)lists.01.org
> To unsubscribe send an email to tpm2-leave(a)lists.01.org
> %(web_page_url)slistinfo%(cgiext)s/%(_internal_name)s
_______________________________________________
tpm2 mailing list -- tpm2(a)lists.01.org
To unsubscribe send an email to tpm2-leave(a)lists.01.org
%(web_page_url)slistinfo%(cgiext)s/%(_internal_name)s
attachment.htm
(text/html, 17.1 KB)
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
+ Imran</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt">
<div class="PlainText">> I think creating a loaded key in a persistent handle is a separate<br>
> optional command not every TPM implements. </div>
<div class="PlainText"><br>
</div>
<div class="PlainText">the command is TPM2_EvictControl to make a handle persistent. The command is mandatory per the PC Client Spec:</div>
<div class="PlainText"><a href="https://trustedcomputinggroup.org/wp-content/uploads/TCG_PC_Client_Platform_TPM_Profile_PTP_Specification_Family_2.0_Revision_1.3v22.pdf" id="LPlnk905282">https://trustedcomputinggroup.org/wp-content/uploads/TCG_PC_Client_Platform_TPM_Profile_PTP_Specification_Family_2.0_Revision_1.3v22.pdf</a><br>
</div>
<div class="PlainText"><br>
</div>
<div class="PlainText">> I don't know why the tool<br>
> doesn't just use getcap to figure this out and make a multi step<br>
> create-load-evict process when the one-step command is unavailable but<br>
> there you are.</div>
<div class="PlainText"><br>
</div>
<div class="PlainText">I think you're referring to the -c option on tpm2_create, which doesn't create a persistent object, but rather invokes the createloaded command.<br>
</div>
<div class="PlainText">and returns a transient object that is loaded.</div>
<div class="PlainText"><br>
</div>
<div class="PlainText">That was actually a bad decision on my part, because when it comes to creating cphash's for policies, we know are invoking a different command,</div>
<div class="PlainText">which also has different inputs and outputs to tpm2_create and tpm2_load.</div>
<div class="PlainText"><br>
</div>
<div class="PlainText">I thought their was bug in tpm2-tools to implement this feature, but perhaps it got dropped or completed. Imran, plans on this?<br>
<br>
On Sun, Nov 7, 2021 at 11:38 PM Christian Plappert<br>
<[email protected]> wrote:<br>
><br>
> Hi,<br>
><br>
> for me it looks like that you use the fapi tools (tss2 command prefix)<br>
> with the swtpm and the esapi tools (tpm2 command prefix) with the device<br>
> tpm (since you did not specify anything). If you call the esapi tools<br>
> with the swtpm as TCTI (-T swtpm), all commands should target the swtpm.<br>
><br>
><br>
> I tried your commands like this and it works for me ("-T swtpm" for the<br>
> esapi tools is important):<br>
><br>
><br>
> ```<br>
> - tss2_provision<br>
> - tpm2_getcap -T swtpm handles-persistent<br>
> - tss2_createkey --path="/P_ECCP256SHA256/HS/SRK/device_key"<br>
> --type="sign, decrypt, noDa, 0x81020001" --authValue=""<br>
> - tpm2_getcap -T swtpm handles-persistent<br>
> ``<br>
><br>
> Best,<br>
> Christian<br>
><br>
><br>
><br>
><br>
><br>
> On 02.11.21 05:41, [email protected] wrote:<br>
> > Hello everyone<br>
> ><br>
> > I am having issues using the Feature_API to create a key under the `/P_ECCP256SHA256/HS/SRK/` path. This is using `tss2_createkey` as well as using the Feature API programmatically. The issue is that I am able to generate a key at the path, but I am never
able to set a persistent handle for it.<br>
> ><br>
> > I would like to set a persistent handle for my child key as I am looking to use
<a href="https://github.com/tpm2-software/tpm2-tss-engine/">https://github.com/tpm2-software/tpm2-tss-engine/</a> programmatically. When loading a key using the engine library, according to
<a href="https://github.com/tpm2-software/tpm2-tss-engine/blob/89327fa8b51962348c46ddc659fb8c3636336a60/src/tpm2-tss-engine.c#L190-L191">
https://github.com/tpm2-software/tpm2-tss-engine/blob/89327fa8b51962348c46ddc659fb8c3636336a60/src/tpm2-tss-engine.c#L190-L191</a>, I can load a key by:<br>
> > - specifying the persistent handle or<br>
> > - providing the path to the encrypted TSS key file.<br>
> ><br>
> > I am using the following:<br>
> > - Ubuntu 20.04<br>
> > - swtpm --version: TPM emulator version 0.7.0, Copyright (c) 2014-2021 IBM Corp. This is running in a Docker container exposing ports 2322 and 2321 using `docker run --name swtpm -p 2322:2322 -p 2321:2321 --rm --detach swtpm:latest`<br>
> > - <a href="https://github.com/tpm2-software/tpm2-tss:">https://github.com/tpm2-software/tpm2-tss:</a> latest master branch, based on release 2.4.6<br>
> > - <a href="https://github.com/tpm2-software/tpm2-tools:">https://github.com/tpm2-software/tpm2-tools:</a> latest master branch, based on 5.2 2021-09-28<br>
> ><br>
> > fapi-config.json :<br>
> > ```<br>
> > {<br>
> > "profile_name": "P_ECCP256SHA256",<br>
> > "profile_dir": "/usr/local/etc/tpm2-tss/fapi-profiles/",<br>
> > "user_dir": "~/.local/share/tpm2-tss/user/keystore",<br>
> > "system_dir": "/usr/local/var/lib/tpm2-tss/system/keystore",<br>
> > "tcti": "swtpm:port=2321",<br>
> > "ek_cert_less":"YES",<br>
> > "system_pcrs" : [],<br>
> > "log_dir" : "/usr/local/var/run/tpm2-tss/eventlog/"<br>
> > }<br>
> > ```<br>
> > The profiles at /usr/local/etc/tpm2-tss/fapi-profiles are the defaults:<br>
> > ```<br>
> > cat /usr/local/etc/tpm2-tss/fapi-profiles/P_ECCP256SHA256.json<br>
> > {<br>
> > "type": "TPM2_ALG_ECC",<br>
> > "nameAlg":"TPM2_ALG_SHA256",<br>
> > "srk_template": "system,restricted,decrypt,0x81000001",<br>
> > "srk_description": "Storage root key SRK",<br>
> > "srk_persistent": 0,<br>
> > "ek_template": "system,restricted,decrypt",<br>
> > "ek_description": "Endorsement key EK",<br>
> > "ecc_signing_scheme": {<br>
> > "scheme":"TPM2_ALG_ECDSA",<br>
> > "details":{<br>
> > "hashAlg":"TPM2_ALG_SHA256"<br>
> > },<br>
> > },<br>
> > "sym_mode":"TPM2_ALG_CFB",<br>
> > "sym_parameters": {<br>
> > "algorithm":"TPM2_ALG_AES",<br>
> > "keyBits":"128",<br>
> > "mode":"TPM2_ALG_CFB"<br>
> > },<br>
> > "sym_block_size": 16,<br>
> > "pcr_selection": [<br>
> > { "hash": "TPM2_ALG_SHA1",<br>
> > "pcrSelect": [ ],<br>
> > },<br>
> > { "hash": "TPM2_ALG_SHA256",<br>
> > "pcrSelect": [ 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23 ]<br>
> > }<br>
> > ],<br>
> > "curveID": "TPM2_ECC_NIST_P256",<br>
> > "ek_policy": {<br>
> > "description": "Endorsement hierarchy used for policy secret.",<br>
> > "policy":[<br>
> > {<br>
> > "type":"POLICYSECRET",<br>
> > "objectName": "4000000b",<br>
> > }<br>
> > ]<br>
> > }<br>
> > }<br>
> > ```<br>
> > I'm also making sure to remove the following folders in between my experiments:<br>
> > - /usr/local/var/lib/tpm2-tss/system/keystore/P_ECCP256SHA256<br>
> > - /root/.local/share/tpm2-tss/user/keystore/P_ECCP256SHA256 (as my Docker container is running as root)<br>
> > - ~/.local/share/tpm2-tss/user/keystore/P_ECCP256SHA256<br>
> ><br>
> > The handle I am choosing for the child key is `0x81020001`, based on my reading of Table 7 of and the surrounding text at
<a href="https://www.trustedcomputinggroup.org/wp-content/uploads/131011-Registry-of-reserved-TPM2-handles-and-localities.pdf">
https://www.trustedcomputinggroup.org/wp-content/uploads/131011-Registry-of-reserved-TPM2-handles-and-localities.pdf</a><br>
> ><br>
> > The sequence of commands I am running as root is:<br>
> > - tss2_provision to provision the TPM<br>
> > - tpm2_getcap handles-persistent to list the used handles: Output is `- 0x81800000 - 0x81800001`<br>
> > - tss2_list to confirm that the keys under the hierarchies have been created. Output is `/P_ECCP256SHA256/HN:/P_ECCP256SHA256/HE:/P_ECCP256SHA256/HE/EK:/P_ECCP256SHA256/LOCKOUT:/P_ECCP256SHA256/HS/SRK:/P_ECCP256SHA256/HS`<br>
> > - tss2_createkey --path="/P_ECCP256SHA256/HS/SRK/device_key" --type="sign, decrypt, noDa, 0x81020001" --authValue=""<br>
> > - tss2_list again, Output is `/P_ECCP256SHA256/HN:/P_ECCP256SHA256/HE:/P_ECCP256SHA256/HE/EK:/P_ECCP256SHA256/LOCKOUT:/P_ECCP256SHA256/HS/SRK:/P_ECCP256SHA256/HS:/P_ECCP256SHA256/HS/SRK/device_key`<br>
> > - tpm2_getcap handles-persistent does not list the requested handle: Output is `- 0x81800000 - 0x81800001`<br>
> ><br>
> > However, when I restart the TPM, and do not provision it, I can run the following commands as root to generate a child key and the parent key with a persistent handle:<br>
> > - tpm2_getcap handles-persistent: Output is `- 0x81800000 - 0x81800001`<br>
> > - tpm2_createprimary --hierarchy=o --key-algorithm=ecc256 --key-context=owner_primary.ctx --format=pem --output=owner_primary_public_key.pem<br>
> > output is<br>
> > ```<br>
> > name-alg:<br>
> > value: sha256<br>
> > raw: 0xb<br>
> > attributes:<br>
> > value: fixedtpm|fixedparent|sensitivedataorigin|userwithauth|restricted|decrypt<br>
> > raw: 0x30072<br>
> > type:<br>
> > value: ecc<br>
> > raw: 0x23<br>
> > curve-id:<br>
> > value: NIST p256<br>
> > raw: 0x3<br>
> > kdfa-alg:<br>
> > value: null<br>
> > raw: 0x10<br>
> > kdfa-halg:<br>
> > value: (null)<br>
> > raw: 0x0<br>
> > scheme:<br>
> > value: null<br>
> > raw: 0x10<br>
> > scheme-halg:<br>
> > value: (null)<br>
> > raw: 0x0<br>
> > sym-alg:<br>
> > value: aes<br>
> > raw: 0x6<br>
> > sym-mode:<br>
> > value: cfb<br>
> > raw: 0x43<br>
> > sym-keybits: 128<br>
> > x: 9eecfa05a9a8ddadc8adabe4c9ce3d34b60afe0fd35cc799e28badc638cae6ad<br>
> > y: 30dfc43266c2aa3480f31366ac5d189abf793dae100f30b50b344b7207f03994<br>
> > ```<br>
> > - tpm2_create --parent-context=owner_primary.ctx --key-algorithm=ecc256 --public=child_public.key --private=child_private.key<br>
> > Output is<br>
> > ```<br>
> > name-alg:<br>
> > value: sha256<br>
> > raw: 0xb<br>
> > attributes:<br>
> > value: fixedtpm|fixedparent|sensitivedataorigin|userwithauth|decrypt|sign<br>
> > raw: 0x60072<br>
> > type:<br>
> > value: ecc<br>
> > raw: 0x23<br>
> > curve-id:<br>
> > value: NIST p256<br>
> > raw: 0x3<br>
> > kdfa-alg:<br>
> > value: null<br>
> > raw: 0x10<br>
> > kdfa-halg:<br>
> > value: (null)<br>
> > raw: 0x0<br>
> > scheme:<br>
> > value: null<br>
> > raw: 0x10<br>
> > scheme-halg:<br>
> > value: (null)<br>
> > raw: 0x0<br>
> > sym-alg:<br>
> > value: null<br>
> > raw: 0x10<br>
> > sym-mode:<br>
> > value: (null)<br>
> > raw: 0x0<br>
> > sym-keybits: 0<br>
> > x: 801553461b62972e1e3894e1baa1d56196774f829285f714a163c63a57a219de<br>
> > y: ebfd148f186f2560a0a6713b5f6f50bfaa39b7a320304f8620c36bdee4dfa379<br>
> > ```<br>
> > - tpm2_load --parent-context=owner_primary.ctx --public=child_public.key --private=child_private.key --key-context=child_key.ctx<br>
> > Output is `name: 000b18738b4a5366d3f863920c7b98db696c723fd88e030b7cad32e1d3ac33e6fb6c`<br>
> > - tpm2_evictcontrol --hierarchy=o --object-context=child_key.ctx 0x81020001<br>
> > Output is<br>
> > ```<br>
> > persistent-handle: 0x81020001<br>
> > action: persisted<br>
> > ```<br>
> > - tpm2_evictcontrol --hierarchy=o --object-context=owner_primary.ctx 0x81010001<br>
> > Output is<br>
> > ```<br>
> > persistent-handle: 0x81010001<br>
> > action: persisted<br>
> > ```<br>
> > - tpm2_getcap handles-persistent<br>
> > Output is<br>
> > ```<br>
> > - 0x81010001<br>
> > - 0x81020001<br>
> > - 0x81800000<br>
> > - 0x81800001<br>
> > ```<br>
> > - tss2_list<br>
> > Output is an error message<br>
> > ```<br>
> > WARNING:fapi:src/tss2-fapi/api/Fapi_List.c:216:Fapi_List_Finish() Path not found:<br>
> > ERROR:fapi:src/tss2-fapi/api/Fapi_List.c:81:Fapi_List() ErrorCode (0x00060034) Entities_List<br>
> > Fapi_List(0x60034) - fapi:Provisioning was not executed.<br>
> > ```<br>
> > There isn't anything in `/usr/local/var/run/tpm2-tss/eventlog/` for me to look at, possibly because of the Dockerised setup.<br>
> ><br>
> > I can later delete these persistent handles using e.g. tpm2_evictcontrol --hierarchy=o --object-context=0x81020001<br>
> ><br>
> > Thanks very much in advance<br>
> ><br>
> > Cheers<br>
> > z.<br>
> > _______________________________________________<br>
> > tpm2 mailing list -- [email protected]<br>
> > To unsubscribe send an email to [email protected]<br>
> > %(web_page_url)slistinfo%(cgiext)s/%(_internal_name)s<br>
> ><br>
> _______________________________________________<br>
> tpm2 mailing list -- [email protected]<br>
> To unsubscribe send an email to [email protected]<br>
> %(web_page_url)slistinfo%(cgiext)s/%(_internal_name)s<br>
_______________________________________________<br>
tpm2 mailing list -- [email protected]<br>
To unsubscribe send an email to [email protected]<br>
%(web_page_url)slistinfo%(cgiext)s/%(_internal_name)s<br>
</div>
</span></font></div>
</body>
</html>