[tpm2] Re: {External} Re: OpenSSL 3 and tpm2 provider...

> Could you please suggest a sequence of openssl (and other commands) to verify all required CMS functions?

Tell you what, I'll frame the test sequences in terms of the tpm2tss engine commands as I can verify correct syntax and command operation.  I'll assume for the time being that the necessary keys and certs are stored in TPM NVRAM through tpm2_* commands.

The a good start to testing would be something to the effect:

	echo "this is some text" >file.txt

	openssl cms -sign -engine tpm2tss -keyform engine -inkey 0x81800002 -signer signer.pem -in file.txt -binary -nodetach -out file.sig

	(note that although the tpm2tss engine doesn't support it, the signer could also be given as a handle to the tpm2 provider)

	openssl cms -verify -in file.sig -binary -noverify

	(note that you can remove the -noverify and point to a truststore if necessary with -CApath /somewhere/truststore)

	openssl cms -encrypt -recip signer.pem -in file.txt -out file.enc

	(note that although the tpm2tss engine doesn't support it, the recip could also be given as a handle to the tpm2 provider)

	openssl cms -decrypt -engine tpm2tss -keyform engine -inkey 0x81800002 -in file.enc -recip signer.pem

	(note that this command doesn't work with the tpm2tss engine.  See:  https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1962549.)

	openssl cms  -encrypt  -sign...

	(the cms command can encrypt, sign, and bundle everything into an output with a single command -- the syntax is a combination of what's above)

	openssl cms -verify -decrypt ...

	(the cms command can verify and decrypt an input with a single command -- the syntax is a combination of what's above)