[tpm2] Re: {External} Re: OpenSSL 3 and tpm2 provider... / openssl cms

> Debugging openssl is tricky when it fails without any error message

Sorry about that.  ☹

> If you create e.g. a RSA-PSS key restricted to a specific hash-algorithm you shouldn't need this extra argument

I was under the impression that the key was created using the sha256 hashing algorithm.  Here's the command used for creating the key:

tpm2_create -C /run/user/201/platform.ctx -G ecc256:ecdsa-sha256 -r /run/user/201/private -u /run/user/201/public -a 'fixedtpm|fixedparent|sensitivedataorigin|sign|userwithauth|noda'

Here's the result:

$ tpm2_readpublic -c 0x81800002
name: 000bb512ddf666370d1d957955207a3159f07a499acdb36a43b5bb928000874aff0e
qualified name: 000b087ef34ba32025d7430d242d5b95813935c8b0c66983bf0107b63fdf00e62b07
name-alg:
  value: sha256
  raw: 0xb
attributes:
  value: fixedtpm|fixedparent|sensitivedataorigin|userwithauth|noda|sign
  raw: 0x40472
type:
  value: ecc
  raw: 0x23
curve-id:
  value: NIST p256
  raw: 0x3
kdfa-alg:
  value: null
  raw: 0x10
kdfa-halg:
  value: (null)
  raw: 0x0
scheme:
  value: ecdsa
  raw: 0x18
scheme-halg:
  value: sha256
  raw: 0xb
sym-alg:
  value: null
  raw: 0x10
sym-mode:
  value: (null)
  raw: 0x0
sym-keybits: 0
x: b326cf2f3088979065d64f692dabb8e72384cd480738325a92ec6e0af3ad066d
y: 7147de064a9b5d438b3e5c4f64f9437eec64816f1c3ddc21b0b194ab620706d1

> Adding "-md sha256" fixed the issue for me.

I'm unable to test at the moment.  I'll hopefully be able to confirm tomorrow.