[tpm2] Re: {External} Re: OpenSSL 3 and tpm2 provider... / openssl cms

Okay, Petr, I've added -md sha256 to the command line, and both signing and verification now work:

$ echo "hi there" >file.txt
$ openssl cms -sign -provider tpm2 -provider base -in file.txt -inkey handle:0x81800002 -signer handle:0x01000013 -md sha256 -out file.sig -outform der
$ echo $?
0
$ openssl cms -verify -content file.txt -in file.sig -inform der -CApath /run/user/201/trustStore/
hi there
CMS Verification successful

So, that's great!

CMS encryption fails as follows:

$ openssl cms -encrypt -provider tpm2 -provider base -in file.txt -recip handle:0x01000013
WARNING:esys:src/tss2-esys/api/Esys_CreateLoaded.c:368:Esys_CreateLoaded_Finish() Received TPM Error
ERROR:esys:src/tss2-esys/api/Esys_CreateLoaded.c:129:Esys_CreateLoaded() Esys Finish ErrorCode (0x000b0143)
40FCFCC0017F0000:error:4000000B:tpm2::cannot create key::-1:721219 rmt:error(2.0): command code not supported

This looks like https://github.com/tpm2-software/tpm2-openssl/issues/29.  For my use case, support for TPMs without the CreateLoaded command will be essential.  My machines have an OPTIGA TPM2.

Thanks!

-----Original Message-----
From: Petr Gotthard <petr.gotthard(a)centrum.cz> 
Sent: Tuesday, April 26, 2022 5:55 PM
To: tpm2(a)lists.01.org
Subject: [tpm2] Re: {External} Re: OpenSSL 3 and tpm2 provider... / openssl cms

>> Debugging openssl is tricky when it fails without any error message
>
>Sorry about that.  ☹

No problem. I am glad you are trying the tpm2 provider in your environment. :-)

>> If you create e.g. a RSA-PSS key restricted to a specific 
>> hash-algorithm you shouldn't need this extra argument
>
>I was under the impression that the key was created using the sha256 hashing algorithm.  Here's the command used for creating the key:
>
>tpm2_create -C /run/user/201/platform.ctx -G ecc256:ecdsa-sha256 -r /run/user/201/private -u /run/user/201/public -a 'fixedtpm|fixedparent|sensitivedataorigin|sign|userwithauth|noda'
>
>Here's the result:
>
>$ tpm2_readpublic -c 0x81800002
>scheme:
>  value: ecdsa
>  raw: 0x18
>scheme-halg:
>  value: sha256
>  raw: 0xb

Yeah. What I wrote was apparently true for RSA keys only. The EC keys do not correctly supply the hash algorithm. That is a bug that will be fixed in the coming days: https://github.com/tpm2-software/tpm2-openssl/issues/34


Petr
_______________________________________________
tpm2 mailing list -- tpm2(a)lists.01.org
To unsubscribe send an email to tpm2-leave(a)lists.01.org %(web_page_url)slistinfo%(cgiext)s/%(_internal_name)s