[tpm2] Re: {External} Re: OpenSSL 3 and tpm2 provider...
Sievert, James <james.sievert at bsci.com> Tue, 26 Apr 2022 12:57:41 +0000
| Newsgroups | dev.linux.lists.tpm2 |
|---|---|
| Message-ID | < <DS7PR03MB5576C7FFBE1AA4907B99441C9AFB9@DS7PR03MB5576.namprd03.prod.outlook.com>> |
I was embarking on that and hit another snag:
$ tpm2_getcap ecc-curves
TPM2_ECC_NIST_P256: 0x3
TPM2_ECC_BN_P256: 0x10
$ openssl genpkey -provider tpm2 -algorithm EC -pkeyopt group:P-256 -out testkey.priv
Warning: generating random key material may take a long time
if the system has a poor entropy source
WARNING:esys:src/tss2-esys/api/Esys_CreateLoaded.c:368:Esys_CreateLoaded_Finish() Received TPM Error
ERROR:esys:src/tss2-esys/api/Esys_CreateLoaded.c:129:Esys_CreateLoaded() Esys Finish ErrorCode (0x000b0143)
genpkey: Error generating EC key
403C86A7007F0000:error:4000000B:tpm2::cannot create key::-1:721219 rmt:error(2.0): command code not supported
I’m curious, does one have control over the hierarchy under which the key is created?
Also, related to my initial query, the TPM vendor has internal certificates stored at 0x1c0000a and 0x1c00002:
0x1c00002:
name: 000bec00c657a4e2724101954c2c9d51ddd45c825c3997ec0786c3afeb0f7fca3ec7
hash algorithm:
friendly: sha256
value: 0xB
attributes:
friendly: ppwrite|writedefine|ppread|ownerread|authread|no_da|written|platformcreate
value: 0x1200762
size: 1177
0x1c0000a:
name: 000b2571404112c8aae1cde797c438d921093fc89b74d44564c25c296aaa26a6f041
hash algorithm:
friendly: sha256
value: 0xB
attributes:
friendly: ppwrite|writedefine|ppread|ownerread|authread|no_da|written|platformcreate
value: 0x1200762
size: 781
I cannot retrieve them using openssl x509:
$ openssl x509 -provider tpm2 -provider default -in handle:0x1c0000a
WARNING:esys:src/tss2-esys/api/Esys_NV_Read.c:315:Esys_NV_Read_Finish() Received TPM Error
ERROR:esys:src/tss2-esys/api/Esys_NV_Read.c:105:Esys_NV_Read() Esys Finish ErrorCode (0x00000095)
Could not read certificate from handle:0x1c0000a
405C04A14E7F0000:error:4000000C:tpm2::cannot load key::-1:149 tpm:handle(unk):structure is the wrong size
Unable to load certificate
$ openssl x509 -provider tpm2 -provider default -in handle:0x1c00002
WARNING:esys:src/tss2-esys/api/Esys_NV_Read.c:315:Esys_NV_Read_Finish() Received TPM Error
ERROR:esys:src/tss2-esys/api/Esys_NV_Read.c:105:Esys_NV_Read() Esys Finish ErrorCode (0x00000095)
Could not read certificate from handle:0x1c00002
40DC7060527F0000:error:4000000C:tpm2::cannot load key::-1:149 tpm:handle(unk):structure is the wrong size
Unable to load certificate
This does work; however:
bsci(a)ip-10-132-42-225:~/test$ tpm2_nvread -C p -s 781 0x1c0000a |openssl x509 -in /dev/stdin -inform der -noout -text
Certificate:
Data:
Version: 3 (0x2)
Serial Number: 756297432 (0x2d142ed8)
Signature Algorithm: ecdsa-with-SHA256
Issuer: C = DE, O = Infineon Technologies AG, OU = OPTIGA(TM) TPM2.0, CN = Infineon OPTIGA(TM) ECC Manufacturing CA 029
Validity
Not Before: Sep 29 02:49:58 2021 GMT
Not After : Sep 29 02:49:58 2036 GMT
…
-----Original Message-----
From: Petr Gotthard <petr.gotthard(a)centrum.cz>
Sent: Tuesday, April 26, 2022 8:20 AM
To: tpm2(a)lists.01.org
Subject: [tpm2] Re: {External} Re: OpenSSL 3 and tpm2 provider...
Oh, I never tested the `openssl cms` commands. There may be something missing from the OpenSSL. What CMS functions you need? Could you please suggest a sequence of openssl (and other commands) to verify all required CMS functions? Something like a new (set of) test(s), similar e.g. to https://github.com/tpm2-software/tpm2-openssl/blob/master/test/ecdsa_genpkey_auth.sh.
Petr
______________________________________________________________
> Od: "Sievert, James" <james.sievert(a)bsci.com<mailto:james.sievert(a)bsci.com>>
> Komu: "tpm2(a)lists.01.org<mailto:tpm2(a)lists.01.org>" <tpm2(a)lists.01.org<mailto:tpm2(a)lists.01.org>>
> Datum: 26.04.2022 14:07
> Předmět: [tpm2] Re: {External} Re: OpenSSL 3 and tpm2 provider...
>
>Thanks, Petr. That did the trick (actually, base was sufficient). In a similar vein, the corresponding private key is also held persistently in the TPM, handle 0x81800002. I'm now attempting the following:
>
> openssl cms -sign -provider tpm2 -provider default -in file.txt
> -inkey handle:0x81800002 -signer handle:0x01000013
>
>I get no output, and a return value of 3. I get the same result if I reference the public key certificate as a file:
>
> openssl cms -sign -provider tpm2 -provider default -in file.txt
> -inkey handle:0x81800002 -signer signer.pem
>
>Any insight on that would be appreciated…
>
_______________________________________________
tpm2 mailing list -- tpm2(a)lists.01.org<mailto:tpm2(a)lists.01.org>
To unsubscribe send an email to tpm2-leave(a)lists.01.org<mailto:tpm2-leave(a)lists.01.org> %(web_page_url)slistinfo%(cgiext)s/%(_internal_name)s
attachment.htm
(text/html, 12.5 KB)
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Exchange Server">
<!-- converted from rtf -->
<style><!-- .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left: #800000 2px solid; } --></style>
</head>
<body>
<font face="Calibri" size="2"><span style="font-size:11pt;">
<div>I was embarking on that and hit another snag:</div>
<div> </div>
<div> <font face="Courier New" size="1"><span style="font-size:8pt;">$ tpm2_getcap ecc-curves</span></font></div>
<div style="padding-left:36pt;"><font face="Courier New" size="1"><span style="font-size:8pt;">TPM2_ECC_NIST_P256: 0x3</span></font></div>
<div style="padding-left:36pt;"><font face="Courier New" size="1"><span style="font-size:8pt;">TPM2_ECC_BN_P256: 0x10</span></font></div>
<div style="padding-left:36pt;"> </div>
<div style="padding-left:36pt;"><font face="Courier New" size="1"><span style="font-size:8pt;">$ openssl genpkey -provider tpm2 -algorithm EC -pkeyopt group:P-256 -out testkey.priv</span></font></div>
<div style="padding-left:36pt;"><font face="Courier New" size="1"><span style="font-size:8pt;">Warning: generating random key material may take a long time</span></font></div>
<div style="padding-left:36pt;"><font face="Courier New" size="1"><span style="font-size:8pt;">if the system has a poor entropy source</span></font></div>
<div style="padding-left:36pt;"><font face="Courier New" size="1"><span style="font-size:8pt;">WARNING:esys:src/tss2-esys/api/Esys_CreateLoaded.c:368:Esys_CreateLoaded_Finish() Received TPM Error</span></font></div>
<div style="padding-left:36pt;"><font face="Courier New" size="1"><span style="font-size:8pt;">ERROR:esys:src/tss2-esys/api/Esys_CreateLoaded.c:129:Esys_CreateLoaded() Esys Finish ErrorCode (0x000b0143)</span></font></div>
<div style="padding-left:36pt;"><font face="Courier New" size="1"><span style="font-size:8pt;">genpkey: Error generating EC key</span></font></div>
<div style="padding-left:36pt;"><font face="Courier New" size="1"><span style="font-size:8pt;">403C86A7007F0000:error:4000000B:tpm2::cannot create key::-1:721219 rmt:error(2.0): command code not supported</span></font></div>
<div> </div>
<div>I’m curious, does one have control over the hierarchy under which the key is created?</div>
<div> </div>
<div>Also, related to my initial query, the TPM vendor has internal certificates stored at 0x1c0000a and 0x1c00002:</div>
<div> </div>
<div style="padding-left:36pt;"><font face="Courier New" size="1"><span style="font-size:8pt;">0x1c00002:</span></font></div>
<div style="padding-left:36pt;"><font face="Courier New" size="1"><span style="font-size:8pt;"> name: 000bec00c657a4e2724101954c2c9d51ddd45c825c3997ec0786c3afeb0f7fca3ec7</span></font></div>
<div style="padding-left:36pt;"><font face="Courier New" size="1"><span style="font-size:8pt;"> hash algorithm:</span></font></div>
<div style="padding-left:36pt;"><font face="Courier New" size="1"><span style="font-size:8pt;"> friendly: sha256</span></font></div>
<div style="padding-left:36pt;"><font face="Courier New" size="1"><span style="font-size:8pt;"> value: 0xB</span></font></div>
<div style="padding-left:36pt;"><font face="Courier New" size="1"><span style="font-size:8pt;"> attributes:</span></font></div>
<div style="padding-left:36pt;"><font face="Courier New" size="1"><span style="font-size:8pt;"> friendly: ppwrite|writedefine|ppread|ownerread|authread|no_da|written|platformcreate</span></font></div>
<div style="padding-left:36pt;"><font face="Courier New" size="1"><span style="font-size:8pt;"> value: 0x1200762</span></font></div>
<div style="padding-left:36pt;"><font face="Courier New" size="1"><span style="font-size:8pt;"> size: 1177</span></font></div>
<div style="padding-left:36pt;"><font face="Courier New" size="1"><span style="font-size:8pt;"> </span></font></div>
<div style="padding-left:36pt;"><font face="Courier New" size="1"><span style="font-size:8pt;">0x1c0000a:</span></font></div>
<div style="padding-left:36pt;"><font face="Courier New" size="1"><span style="font-size:8pt;"> name: 000b2571404112c8aae1cde797c438d921093fc89b74d44564c25c296aaa26a6f041</span></font></div>
<div style="padding-left:36pt;"><font face="Courier New" size="1"><span style="font-size:8pt;"> hash algorithm:</span></font></div>
<div style="padding-left:36pt;"><font face="Courier New" size="1"><span style="font-size:8pt;"> friendly: sha256</span></font></div>
<div style="padding-left:36pt;"><font face="Courier New" size="1"><span style="font-size:8pt;"> value: 0xB</span></font></div>
<div style="padding-left:36pt;"><font face="Courier New" size="1"><span style="font-size:8pt;"> attributes:</span></font></div>
<div style="padding-left:36pt;"><font face="Courier New" size="1"><span style="font-size:8pt;"> friendly: ppwrite|writedefine|ppread|ownerread|authread|no_da|written|platformcreate</span></font></div>
<div style="padding-left:36pt;"><font face="Courier New" size="1"><span style="font-size:8pt;"> value: 0x1200762</span></font></div>
<div style="padding-left:36pt;"><font face="Courier New" size="1"><span style="font-size:8pt;"> size: 781</span></font></div>
<div> </div>
<div>I cannot retrieve them using openssl x509:</div>
<div> </div>
<div style="padding-left:36pt;"><font face="Courier New" size="1"><span style="font-size:8pt;">$ openssl x509 -provider tpm2 -provider default -in handle:0x1c0000a</span></font></div>
<div style="padding-left:36pt;"><font face="Courier New" size="1"><span style="font-size:8pt;">WARNING:esys:src/tss2-esys/api/Esys_NV_Read.c:315:Esys_NV_Read_Finish() Received TPM Error</span></font></div>
<div style="padding-left:36pt;"><font face="Courier New" size="1"><span style="font-size:8pt;">ERROR:esys:src/tss2-esys/api/Esys_NV_Read.c:105:Esys_NV_Read() Esys Finish ErrorCode (0x00000095)</span></font></div>
<div style="padding-left:36pt;"><font face="Courier New" size="1"><span style="font-size:8pt;">Could not read certificate from handle:0x1c0000a</span></font></div>
<div style="padding-left:36pt;"><font face="Courier New" size="1"><span style="font-size:8pt;">405C04A14E7F0000:error:4000000C:tpm2::cannot load key::-1:149 tpm:handle(unk):structure is the wrong size</span></font></div>
<div style="padding-left:36pt;"><font face="Courier New" size="1"><span style="font-size:8pt;">Unable to load certificate</span></font></div>
<div style="padding-left:36pt;"> </div>
<div style="padding-left:36pt;"><font face="Courier New" size="1"><span style="font-size:8pt;">$ openssl x509 -provider tpm2 -provider default -in handle:0x1c00002</span></font></div>
<div style="padding-left:36pt;"><font face="Courier New" size="1"><span style="font-size:8pt;">WARNING:esys:src/tss2-esys/api/Esys_NV_Read.c:315:Esys_NV_Read_Finish() Received TPM Error</span></font></div>
<div style="padding-left:36pt;"><font face="Courier New" size="1"><span style="font-size:8pt;">ERROR:esys:src/tss2-esys/api/Esys_NV_Read.c:105:Esys_NV_Read() Esys Finish ErrorCode (0x00000095)</span></font></div>
<div style="padding-left:36pt;"><font face="Courier New" size="1"><span style="font-size:8pt;">Could not read certificate from handle:0x1c00002</span></font></div>
<div style="padding-left:36pt;"><font face="Courier New" size="1"><span style="font-size:8pt;">40DC7060527F0000:error:4000000C:tpm2::cannot load key::-1:149 tpm:handle(unk):structure is the wrong size</span></font></div>
<div style="padding-left:36pt;"><font face="Courier New" size="1"><span style="font-size:8pt;">Unable to load certificate</span></font></div>
<div> </div>
<div>This does work; however:</div>
<div> </div>
<div style="padding-left:36pt;"><font face="Courier New" size="1"><span style="font-size:8pt;">bsci@ip-10-132-42-225:~/test$ tpm2_nvread -C p -s 781 0x1c0000a |openssl x509 -in /dev/stdin -inform der -noout -text</span></font></div>
<div style="padding-left:36pt;"><font face="Courier New" size="1"><span style="font-size:8pt;">Certificate:</span></font></div>
<div style="padding-left:36pt;"><font face="Courier New" size="1"><span style="font-size:8pt;"> Data:</span></font></div>
<div style="padding-left:36pt;"><font face="Courier New" size="1"><span style="font-size:8pt;"> Version: 3 (0x2)</span></font></div>
<div style="padding-left:36pt;"><font face="Courier New" size="1"><span style="font-size:8pt;"> Serial Number: 756297432 (0x2d142ed8)</span></font></div>
<div style="padding-left:36pt;"><font face="Courier New" size="1"><span style="font-size:8pt;"> Signature Algorithm: ecdsa-with-SHA256</span></font></div>
<div style="padding-left:36pt;"><font face="Courier New" size="1"><span style="font-size:8pt;"> Issuer: C = DE, O = Infineon Technologies AG, OU = OPTIGA(TM) TPM2.0, CN = Infineon OPTIGA(TM) ECC Manufacturing CA 029</span></font></div>
<div style="padding-left:36pt;"><font face="Courier New" size="1"><span style="font-size:8pt;"> Validity</span></font></div>
<div style="padding-left:36pt;"><font face="Courier New" size="1"><span style="font-size:8pt;"> Not Before: Sep 29 02:49:58 2021 GMT</span></font></div>
<div style="padding-left:36pt;"><font face="Courier New" size="1"><span style="font-size:8pt;"> Not After : Sep 29 02:49:58 2036 GMT</span></font></div>
<div style="padding-left:36pt;"> <font face="Courier New" size="1"><span style="font-size:8pt;">…</span></font></div>
<div> </div>
<a name="_MailEndCompose"></a>
<div> </div>
<div>-----Original Message-----<br>
From: Petr Gotthard <[email protected]> <br>
Sent: Tuesday, April 26, 2022 8:20 AM<br>
To: [email protected]<br>
Subject: [tpm2] Re: {External} Re: OpenSSL 3 and tpm2 provider...</div>
<div> </div>
<div>Oh, I never tested the `openssl cms` commands. There may be something missing from the OpenSSL. What CMS functions you need? Could you please suggest a sequence of openssl (and other commands) to verify all required CMS functions? Something like a new
(set of) test(s), similar e.g. to <a href="https://github.com/tpm2-software/tpm2-openssl/blob/master/test/ecdsa_genpkey_auth.sh">https://github.com/tpm2-software/tpm2-openssl/blob/master/test/ecdsa_genpkey_auth.sh</a>.</div>
<div> </div>
<div>Petr</div>
<div>______________________________________________________________</div>
<div>> Od: "Sievert, James" <<a href="mailto:[email protected]">[email protected]</a>></div>
<div>> Komu: "<a href="mailto:[email protected]">[email protected]</a>" <<a href="mailto:[email protected]">[email protected]</a>></div>
<div>> Datum: 26.04.2022 14:07</div>
<div><font face="Calibri CE">> Předmět: [tpm2] Re: {External} Re: OpenSSL 3 and tpm2 provider...</font></div>
<div>></div>
<div>>Thanks, Petr. That did the trick (actually, base was sufficient). In a similar vein, the corresponding private key is also held persistently in the TPM, handle 0x81800002. I'm now attempting the following:</div>
<div>></div>
<div>> openssl cms -sign -provider tpm2 -provider default -in file.txt </div>
<div>> -inkey handle:0x81800002 -signer handle:0x01000013</div>
<div>></div>
<div>>I get no output, and a return value of 3. I get the same result if I reference the public key certificate as a file:</div>
<div>></div>
<div>> openssl cms -sign -provider tpm2 -provider default -in file.txt </div>
<div>> -inkey handle:0x81800002 -signer signer.pem</div>
<div>></div>
<div>>Any insight on that would be appreciated…</div>
<div>></div>
<div>_______________________________________________</div>
<div>tpm2 mailing list -- <a href="mailto:[email protected]">[email protected]</a></div>
<div>To unsubscribe send an email to <a href="mailto:[email protected]">[email protected]</a> %(web_page_url)slistinfo%(cgiext)s/%(_internal_name)s</div>
<div> </div>
</span></font>
</body>
</html>