[tpm2] Re: {External} Re: OpenSSL 3 and tpm2 provider...
Sievert, James <james.sievert at bsci.com> Tue, 26 Apr 2022 12:06:46 +0000
| Newsgroups | dev.linux.lists.tpm2 |
|---|---|
| Message-ID | < <DS7PR03MB55763190258B91401A7D93EA9AFB9@DS7PR03MB5576.namprd03.prod.outlook.com>> |
Thanks, Petr. That did the trick (actually, base was sufficient). In a similar vein, the corresponding private key is also held persistently in the TPM, handle 0x81800002. I'm now attempting the following:
openssl cms -sign -provider tpm2 -provider default -in file.txt -inkey handle:0x81800002 -signer handle:0x01000013
I get no output, and a return value of 3. I get the same result if I reference the public key certificate as a file:
openssl cms -sign -provider tpm2 -provider default -in file.txt -inkey handle:0x81800002 -signer signer.pem
Any insight on that would be appreciated…
-----Original Message-----
From: Petr Gotthard <petr.gotthard(a)centrum.cz>
Sent: Tuesday, April 26, 2022 7:42 AM
To: Sievert, James <james.sievert(a)bsci.com>; tpm2(a)lists.01.org
Subject: {External} Re: [tpm2] OpenSSL 3 and tpm2 provider...
Hello,
you may be missing "-provider default", please try
$ openssl x509 -provider tpm2 -provider default -in handle:0x01000013 -noout -text
Some explanation why is that is here:
https://github.com/tpm2-software/tpm2-openssl/blob/master/docs/initialization.md#loading-multiple-providers
Petr
______________________________________________________________
> Od: "Sievert, James" <james.sievert(a)bsci.com<mailto:james.sievert(a)bsci.com>>
> Komu: "tpm2(a)lists.01.org<mailto:tpm2(a)lists.01.org>" <tpm2(a)lists.01.org<mailto:tpm2(a)lists.01.org>>
> Datum: 26.04.2022 13:32
> Předmět: [tpm2] OpenSSL 3 and tpm2 provider...
>
>Hi,
>
>I'm using the following OpenSSL version under Ubuntu 22.04: OpenSSL 3.0.2 15 Mar 2022 (Library: OpenSSL 3.0.2 15 Mar 2022).
>
>I have an EC public key certificate held persistently in a TPM 2.0, handle 0x01000013. I'm attempting the following:
>
>$ openssl x509 -provider tpm2 -in handle:0x01000013 -noout -text
>
>and finding that OpenSSL x509 is unable to load the public key:
>
>Certificate:
> Data:
> Version: 3 (0x2)
> Serial Number: 9177472452311271732 (0x7f5cee922ff24934)
> Signature Algorithm: ecdsa-with-SHA256
> Issuer: CN = aaaa, OU = yyyy, O = zzzz
> Validity
> Not Before: Apr 25 16:43:35 2022 GMT
> Not After : Dec 31 12:00:00 2045 GMT
> Subject: CN = xxxx, OU = yyyy, O = zzzz
> Subject Public Key Info:
> Public Key Algorithm: id-ecPublicKey
> Unable to load Public Key
>402C48BB567F0000:error:03000072:digital envelope routines:X509_PUBKEY_get0:decode error:../crypto/x509/x_pubkey.c:458:
>402C48BB567F0000:error:03000072:digital envelope routines:X509_PUBKEY_get0:decode error:../crypto/x509/x_pubkey.c:458:
> X509v3 extensions:
> X509v3 Basic Constraints: critical
> CA:FALSE
> X509v3 Authority Key Identifier:
> B0:06:08:77:FC:C0:3B:0A:F5:8E:0C:B8:F1:DE:A9:55:8B:E5:F1:79
> X509v3 Extended Key Usage:
> TLS Web Client Authentication, Code Signing, E-mail Protection, TLS Web Server Authentication
> X509v3 Subject Key Identifier:
> 4D:5D:71:84:B5:D9:7B:B1:11:52:58:BC:5E:BE:A8:0D:8C:AE:17:63
> X509v3 Key Usage: critical
> Digital Signature, Non Repudiation, Key Encipherment
> Signature Algorithm: ecdsa-with-SHA256
> Signature Value:
> 30:44:02:20:5b:ce:5e:3f:67:85:11:42:d5:5f:2a:ba:cd:12:
> f2:e7:bd:0e:f5:9e:ae:d1:65:8d:9c:d3:dc:7c:8d:63:ec:07:
> 02:20:33:3f:b6:22:39:62:ff:3b:9f:21:eb:43:e1:9e:40:31:
> 39:fb:14:a8:1f:c9:33:48:18:99:33:dd:03:86:2c:0e
>
>I am able to do this:
>
>$ openssl x509 -provider tpm2 -in handle:0x01000013 | openssl x509 -in
>/dev/stdin -noout -text
>Certificate:
> Data:
> Version: 3 (0x2)
> Serial Number: 9177472452311271732 (0x7f5cee922ff24934)
> Signature Algorithm: ecdsa-with-SHA256
> Issuer: CN = aaaa, OU = yyyy, O = zzzz
> Validity
> Not Before: Apr 25 16:43:35 2022 GMT
> Not After : Dec 31 12:00:00 2045 GMT
> Subject: CN = xxxx, OU = yyyy, O = zzzz
> Subject Public Key Info:
> Public Key Algorithm: id-ecPublicKey
> Public-Key: (256 bit)
> pub:
> 04:eb:d3:da:02:5a:43:4e:5c:1a:b5:09:e7:6a:8e:
> 1e:65:9f:eb:ab:35:d5:33:f9:1f:16:bf:d8:0d:c6:
> f0:09:ae:10:60:3d:82:cf:46:29:a0:a9:24:47:dd:
> e2:5a:ea:97:b6:c1:6a:fa:b2:8a:7c:30:36:36:1a:
> 8a:e2:91:62:4b
> ASN1 OID: prime256v1
> NIST CURVE: P-256
> X509v3 extensions:
> X509v3 Basic Constraints: critical
> CA:FALSE
> X509v3 Authority Key Identifier:
> B0:06:08:77:FC:C0:3B:0A:F5:8E:0C:B8:F1:DE:A9:55:8B:E5:F1:79
> X509v3 Extended Key Usage:
> TLS Web Client Authentication, Code Signing, E-mail Protection, TLS Web Server Authentication
> X509v3 Subject Key Identifier:
> 4D:5D:71:84:B5:D9:7B:B1:11:52:58:BC:5E:BE:A8:0D:8C:AE:17:63
> X509v3 Key Usage: critical
> Digital Signature, Non Repudiation, Key Encipherment
> Signature Algorithm: ecdsa-with-SHA256
> Signature Value:
> 30:44:02:20:5b:ce:5e:3f:67:85:11:42:d5:5f:2a:ba:cd:12:
> f2:e7:bd:0e:f5:9e:ae:d1:65:8d:9c:d3:dc:7c:8d:63:ec:07:
> 02:20:33:3f:b6:22:39:62:ff:3b:9f:21:eb:43:e1:9e:40:31:
> 39:fb:14:a8:1f:c9:33:48:18:99:33:dd:03:86:2c:0e
>
>Any help would be appreciated.
>Thanks.
>
>
>----------
>
>_______________________________________________
>tpm2 mailing list -- tpm2(a)lists.01.org<mailto:tpm2(a)lists.01.org>
>To unsubscribe send an email to tpm2-leave(a)lists.01.org<mailto:tpm2-leave(a)lists.01.org>
>%(web_page_url)slistinfo%(cgiext)s/%(_internal_name)s
>
>
attachment.htm
(text/html, 12.2 KB)
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Exchange Server">
<!-- converted from rtf -->
<style><!-- .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left: #800000 2px solid; } --></style>
</head>
<body>
<font face="Calibri" size="2"><span style="font-size:11pt;">
<div>Thanks, Petr. That did the trick (actually, base was sufficient). In a similar vein, the corresponding private key is also held persistently in the TPM, handle 0x81800002. I'm now attempting the following:</div>
<div> </div>
<div> <font face="Courier New" size="1"><span style="font-size:8pt;">openssl cms -sign -provider tpm2 -provider default -in </span></font><font face="Courier New" size="1"><span style="font-size:8pt;">file.txt</span></font><font face="Courier New" size="1"><span style="font-size:8pt;">
-inkey handle:0x81800002 -signer handle:0x01000013</span></font></div>
<div> </div>
<div><font face="Calibri">I get no output, and a return value of 3. I get the same result if I reference the public key certificate as a file:</font></div>
<div><font face="Calibri"> </font></div>
<div> <font face="Courier New" size="1"><span style="font-size:8pt;">openssl cms -sign -provider tpm2 -provider default -in </span></font><font face="Courier New" size="1"><span style="font-size:8pt;">file.txt</span></font><font face="Courier New" size="1"><span style="font-size:8pt;">
-inkey handle:0x81800002 -signer</span></font><font face="Courier New" size="1"><span style="font-size:8pt;"> signer.pem</span></font></div>
<div> </div>
<div>Any insight on that would be appreciated…</div>
<a name="_MailEndCompose"></a>
<div> </div>
<div>-----Original Message-----<br>
From: Petr Gotthard <[email protected]> <br>
Sent: Tuesday, April 26, 2022 7:42 AM<br>
To: Sievert, James <[email protected]>; [email protected]<br>
Subject: {External} Re: [tpm2] OpenSSL 3 and tpm2 provider...</div>
<div> </div>
<div>Hello,</div>
<div>you may be missing "-provider default", please try</div>
<div> </div>
<div>$ openssl x509 -provider tpm2 -provider default -in handle:0x01000013 -noout -text</div>
<div> </div>
<div> </div>
<div>Some explanation why is that is here:</div>
<div><a href="https://github.com/tpm2-software/tpm2-openssl/blob/master/docs/initialization.md#loading-multiple-providers">https://github.com/tpm2-software/tpm2-openssl/blob/master/docs/initialization.md#loading-multiple-providers</a></div>
<div> </div>
<div>Petr</div>
<div> </div>
<div>______________________________________________________________</div>
<div>> Od: "Sievert, James" <<a href="mailto:[email protected]">[email protected]</a>></div>
<div>> Komu: "<a href="mailto:[email protected]">[email protected]</a>" <<a href="mailto:[email protected]">[email protected]</a>></div>
<div>> Datum: 26.04.2022 13:32</div>
<div><font face="Calibri CE">> Předmět: [tpm2] OpenSSL 3 and tpm2 provider...</font></div>
<div>></div>
<div>>Hi,</div>
<div>></div>
<div>>I'm using the following OpenSSL version under Ubuntu 22.04: OpenSSL 3.0.2 15 Mar 2022 (Library: OpenSSL 3.0.2 15 Mar 2022).</div>
<div>></div>
<div>>I have an EC public key certificate held persistently in a TPM 2.0, handle 0x01000013. I'm attempting the following:</div>
<div>></div>
<div>>$ openssl x509 -provider tpm2 -in handle:0x01000013 -noout -text</div>
<div>></div>
<div>>and finding that OpenSSL x509 is unable to load the public key:</div>
<div>></div>
<div>>Certificate:</div>
<div>> Data:</div>
<div>> Version: 3 (0x2)</div>
<div>> Serial Number: 9177472452311271732 (0x7f5cee922ff24934)</div>
<div>> Signature Algorithm: ecdsa-with-SHA256</div>
<div>> Issuer: CN = aaaa, OU = yyyy, O = zzzz</div>
<div>> Validity</div>
<div>> Not Before: Apr 25 16:43:35 2022 GMT</div>
<div>> Not After : Dec 31 12:00:00 2045 GMT</div>
<div>> Subject: CN = xxxx, OU = yyyy, O = zzzz</div>
<div>> Subject Public Key Info:</div>
<div>> Public Key Algorithm: id-ecPublicKey</div>
<div>> Unable to load Public Key</div>
<div>>402C48BB567F0000:error:03000072:digital envelope routines:X509_PUBKEY_get0:decode error:../crypto/x509/x_pubkey.c:458:</div>
<div>>402C48BB567F0000:error:03000072:digital envelope routines:X509_PUBKEY_get0:decode error:../crypto/x509/x_pubkey.c:458:</div>
<div>> X509v3 extensions:</div>
<div>> X509v3 Basic Constraints: critical</div>
<div>> CA:FALSE</div>
<div>> X509v3 Authority Key Identifier:</div>
<div>> B0:06:08:77:FC:C0:3B:0A:F5:8E:0C:B8:F1:DE:A9:55:8B:E5:F1:79</div>
<div>> X509v3 Extended Key Usage:</div>
<div>> TLS Web Client Authentication, Code Signing, E-mail Protection, TLS Web Server Authentication</div>
<div>> X509v3 Subject Key Identifier:</div>
<div>> 4D:5D:71:84:B5:D9:7B:B1:11:52:58:BC:5E:BE:A8:0D:8C:AE:17:63</div>
<div>> X509v3 Key Usage: critical</div>
<div>> Digital Signature, Non Repudiation, Key Encipherment</div>
<div>> Signature Algorithm: ecdsa-with-SHA256</div>
<div>> Signature Value:</div>
<div>> 30:44:02:20:5b:ce:5e:3f:67:85:11:42:d5:5f:2a:ba:cd:12:</div>
<div>> f2:e7:bd:0e:f5:9e:ae:d1:65:8d:9c:d3:dc:7c:8d:63:ec:07:</div>
<div>> 02:20:33:3f:b6:22:39:62:ff:3b:9f:21:eb:43:e1:9e:40:31:</div>
<div>> 39:fb:14:a8:1f:c9:33:48:18:99:33:dd:03:86:2c:0e</div>
<div>></div>
<div>>I am able to do this:</div>
<div>></div>
<div>>$ openssl x509 -provider tpm2 -in handle:0x01000013 | openssl x509 -in </div>
<div>>/dev/stdin -noout -text</div>
<div>>Certificate:</div>
<div>> Data:</div>
<div>> Version: 3 (0x2)</div>
<div>> Serial Number: 9177472452311271732 (0x7f5cee922ff24934)</div>
<div>> Signature Algorithm: ecdsa-with-SHA256</div>
<div>> Issuer: CN = aaaa, OU = yyyy, O = zzzz</div>
<div>> Validity</div>
<div>> Not Before: Apr 25 16:43:35 2022 GMT</div>
<div>> Not After : Dec 31 12:00:00 2045 GMT</div>
<div>> Subject: CN = xxxx, OU = yyyy, O = zzzz</div>
<div>> Subject Public Key Info:</div>
<div>> Public Key Algorithm: id-ecPublicKey</div>
<div>> Public-Key: (256 bit)</div>
<div>> pub:</div>
<div>> 04:eb:d3:da:02:5a:43:4e:5c:1a:b5:09:e7:6a:8e:</div>
<div>> 1e:65:9f:eb:ab:35:d5:33:f9:1f:16:bf:d8:0d:c6:</div>
<div>> f0:09:ae:10:60:3d:82:cf:46:29:a0:a9:24:47:dd:</div>
<div>> e2:5a:ea:97:b6:c1:6a:fa:b2:8a:7c:30:36:36:1a:</div>
<div>> 8a:e2:91:62:4b</div>
<div>> ASN1 OID: prime256v1</div>
<div>> NIST CURVE: P-256</div>
<div>> X509v3 extensions:</div>
<div>> X509v3 Basic Constraints: critical</div>
<div>> CA:FALSE</div>
<div>> X509v3 Authority Key Identifier:</div>
<div>> B0:06:08:77:FC:C0:3B:0A:F5:8E:0C:B8:F1:DE:A9:55:8B:E5:F1:79</div>
<div>> X509v3 Extended Key Usage:</div>
<div>> TLS Web Client Authentication, Code Signing, E-mail Protection, TLS Web Server Authentication</div>
<div>> X509v3 Subject Key Identifier:</div>
<div>> 4D:5D:71:84:B5:D9:7B:B1:11:52:58:BC:5E:BE:A8:0D:8C:AE:17:63</div>
<div>> X509v3 Key Usage: critical</div>
<div>> Digital Signature, Non Repudiation, Key Encipherment</div>
<div>> Signature Algorithm: ecdsa-with-SHA256</div>
<div>> Signature Value:</div>
<div>> 30:44:02:20:5b:ce:5e:3f:67:85:11:42:d5:5f:2a:ba:cd:12:</div>
<div>> f2:e7:bd:0e:f5:9e:ae:d1:65:8d:9c:d3:dc:7c:8d:63:ec:07:</div>
<div>> 02:20:33:3f:b6:22:39:62:ff:3b:9f:21:eb:43:e1:9e:40:31:</div>
<div>> 39:fb:14:a8:1f:c9:33:48:18:99:33:dd:03:86:2c:0e</div>
<div>></div>
<div>>Any help would be appreciated.</div>
<div>>Thanks.</div>
<div>></div>
<div>></div>
<div>>----------</div>
<div>></div>
<div>>_______________________________________________</div>
<div>>tpm2 mailing list -- <a href="mailto:[email protected]">[email protected]</a></div>
<div>>To unsubscribe send an email to <a href="mailto:[email protected]">[email protected]</a> </div>
<div>>%(web_page_url)slistinfo%(cgiext)s/%(_internal_name)s</div>
<div>></div>
<div>></div>
<div> </div>
</span></font>
</body>
</html>