[tpm2] OpenSSL 3 and TPM 2 vendor certs in NVRAM...
Sievert, James <james.sievert at bsci.com> Tue, 26 Apr 2022 13:18:08 +0000
| Newsgroups | dev.linux.lists.tpm2 |
|---|---|
| Message-ID | < <DS7PR03MB5576FAC869D72A73FD8F8FDC9AFB9@DS7PR03MB5576.namprd03.prod.outlook.com>> |
Hi,
The TPM vendor has internal certificates stored at 0x1c0000a and 0x1c00002:
0x1c00002:
name: 000bec00c657a4e2724101954c2c9d51ddd45c825c3997ec0786c3afeb0f7fca3ec7
hash algorithm:
friendly: sha256
value: 0xB
attributes:
friendly: ppwrite|writedefine|ppread|ownerread|authread|no_da|written|platformcreate
value: 0x1200762
size: 1177
0x1c0000a:
name: 000b2571404112c8aae1cde797c438d921093fc89b74d44564c25c296aaa26a6f041
hash algorithm:
friendly: sha256
value: 0xB
attributes:
friendly: ppwrite|writedefine|ppread|ownerread|authread|no_da|written|platformcreate
value: 0x1200762
size: 781
I cannot retrieve them using openssl x509:
$ openssl x509 -provider tpm2 -provider default -in handle:0x1c0000a
WARNING:esys:src/tss2-esys/api/Esys_NV_Read.c:315:Esys_NV_Read_Finish() Received TPM Error
ERROR:esys:src/tss2-esys/api/Esys_NV_Read.c:105:Esys_NV_Read() Esys Finish ErrorCode (0x00000095)
Could not read certificate from handle:0x1c0000a
405C04A14E7F0000:error:4000000C:tpm2::cannot load key::-1:149 tpm:handle(unk):structure is the wrong size
Unable to load certificate
$ openssl x509 -provider tpm2 -provider default -in handle:0x1c00002
WARNING:esys:src/tss2-esys/api/Esys_NV_Read.c:315:Esys_NV_Read_Finish() Received TPM Error
ERROR:esys:src/tss2-esys/api/Esys_NV_Read.c:105:Esys_NV_Read() Esys Finish ErrorCode (0x00000095)
Could not read certificate from handle:0x1c00002
40DC7060527F0000:error:4000000C:tpm2::cannot load key::-1:149 tpm:handle(unk):structure is the wrong size
Unable to load certificate
This does work; however:
bsci(a)ip-10-132-42-225:~/test$ tpm2_nvread -C p -s 781 0x1c0000a |openssl x509 -in /dev/stdin -inform der -noout -text
Certificate:
Data:
Version: 3 (0x2)
Serial Number: 756297432 (0x2d142ed8)
Signature Algorithm: ecdsa-with-SHA256
Issuer: C = DE, O = Infineon Technologies AG, OU = OPTIGA(TM) TPM2.0, CN = Infineon OPTIGA(TM) ECC Manufacturing CA 029
Validity
Not Before: Sep 29 02:49:58 2021 GMT
Not After : Sep 29 02:49:58 2036 GMT
...
Thanks.
attachment.htm
(text/html, 10.5 KB)
<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:dt="uuid:C2F41010-65B3-11d1-A29F-00AA00C14882" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
{mso-style-priority:99;
mso-style-link:"Plain Text Char";
margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.PlainTextChar
{mso-style-name:"Plain Text Char";
mso-style-priority:99;
mso-style-link:"Plain Text";
font-family:"Calibri",sans-serif;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">Hi,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoPlainText">The TPM vendor has internal certificates stored at 0x1c0000a and 0x1c00002:<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New"">0x1c00002:<o:p></o:p></span></p>
<p class="MsoPlainText" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New""> name: 000bec00c657a4e2724101954c2c9d51ddd45c825c3997ec0786c3afeb0f7fca3ec7<o:p></o:p></span></p>
<p class="MsoPlainText" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New""> hash algorithm:<o:p></o:p></span></p>
<p class="MsoPlainText" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New""> friendly: sha256<o:p></o:p></span></p>
<p class="MsoPlainText" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New""> value: 0xB<o:p></o:p></span></p>
<p class="MsoPlainText" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New""> attributes:<o:p></o:p></span></p>
<p class="MsoPlainText" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New""> friendly: ppwrite|writedefine|ppread|ownerread|authread|no_da|written|platformcreate<o:p></o:p></span></p>
<p class="MsoPlainText" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New""> value: 0x1200762<o:p></o:p></span></p>
<p class="MsoPlainText" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New""> size: 1177<o:p></o:p></span></p>
<p class="MsoPlainText" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New""><o:p> </o:p></span></p>
<p class="MsoPlainText" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New"">0x1c0000a:<o:p></o:p></span></p>
<p class="MsoPlainText" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New""> name: 000b2571404112c8aae1cde797c438d921093fc89b74d44564c25c296aaa26a6f041<o:p></o:p></span></p>
<p class="MsoPlainText" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New""> hash algorithm:<o:p></o:p></span></p>
<p class="MsoPlainText" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New""> friendly: sha256<o:p></o:p></span></p>
<p class="MsoPlainText" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New""> value: 0xB<o:p></o:p></span></p>
<p class="MsoPlainText" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New""> attributes:<o:p></o:p></span></p>
<p class="MsoPlainText" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New""> friendly: ppwrite|writedefine|ppread|ownerread|authread|no_da|written|platformcreate<o:p></o:p></span></p>
<p class="MsoPlainText" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New""> value: 0x1200762<o:p></o:p></span></p>
<p class="MsoPlainText" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New""> size: 781<o:p></o:p></span></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">I cannot retrieve them using openssl x509:<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New"">$ openssl x509 -provider tpm2 -provider default -in handle:0x1c0000a<o:p></o:p></span></p>
<p class="MsoPlainText" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New"">WARNING:esys:src/tss2-esys/api/Esys_NV_Read.c:315:Esys_NV_Read_Finish() Received TPM Error<o:p></o:p></span></p>
<p class="MsoPlainText" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New"">ERROR:esys:src/tss2-esys/api/Esys_NV_Read.c:105:Esys_NV_Read() Esys Finish ErrorCode (0x00000095)<o:p></o:p></span></p>
<p class="MsoPlainText" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New"">Could not read certificate from handle:0x1c0000a<o:p></o:p></span></p>
<p class="MsoPlainText" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New"">405C04A14E7F0000:error:4000000C:tpm2::cannot load key::-1:149 tpm:handle(unk):structure is the wrong size<o:p></o:p></span></p>
<p class="MsoPlainText" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New"">Unable to load certificate<o:p></o:p></span></p>
<p class="MsoPlainText" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New""><o:p> </o:p></span></p>
<p class="MsoPlainText" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New"">$ openssl x509 -provider tpm2 -provider default -in handle:0x1c00002<o:p></o:p></span></p>
<p class="MsoPlainText" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New"">WARNING:esys:src/tss2-esys/api/Esys_NV_Read.c:315:Esys_NV_Read_Finish() Received TPM Error<o:p></o:p></span></p>
<p class="MsoPlainText" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New"">ERROR:esys:src/tss2-esys/api/Esys_NV_Read.c:105:Esys_NV_Read() Esys Finish ErrorCode (0x00000095)<o:p></o:p></span></p>
<p class="MsoPlainText" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New"">Could not read certificate from handle:0x1c00002<o:p></o:p></span></p>
<p class="MsoPlainText" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New"">40DC7060527F0000:error:4000000C:tpm2::cannot load key::-1:149 tpm:handle(unk):structure is the wrong size<o:p></o:p></span></p>
<p class="MsoPlainText" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New"">Unable to load certificate<o:p></o:p></span></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">This does work; however:<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New"">bsci@ip-10-132-42-225:~/test$ tpm2_nvread -C p -s 781 0x1c0000a |openssl x509 -in /dev/stdin -inform der -noout -text<o:p></o:p></span></p>
<p class="MsoPlainText" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New"">Certificate:<o:p></o:p></span></p>
<p class="MsoPlainText" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New""> Data:<o:p></o:p></span></p>
<p class="MsoPlainText" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New""> Version: 3 (0x2)<o:p></o:p></span></p>
<p class="MsoPlainText" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New""> Serial Number: 756297432 (0x2d142ed8)<o:p></o:p></span></p>
<p class="MsoPlainText" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New""> Signature Algorithm: ecdsa-with-SHA256<o:p></o:p></span></p>
<p class="MsoPlainText" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New""> Issuer: C = DE, O = Infineon Technologies AG, OU = OPTIGA(TM) TPM2.0, CN = Infineon OPTIGA(TM) ECC Manufacturing CA 029<o:p></o:p></span></p>
<p class="MsoPlainText" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New""> Validity<o:p></o:p></span></p>
<p class="MsoPlainText" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New""> Not Before: Sep 29 02:49:58 2021 GMT<o:p></o:p></span></p>
<p class="MsoPlainText" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New""> Not After : Sep 29 02:49:58 2036 GMT<o:p></o:p></span></p>
<p class="MsoPlainText" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New""> …<o:p></o:p></span></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoNormal">Thanks.<o:p></o:p></p>
</div>
</body>
</html>