[tpm2] Re: {External} Re: OpenSSL 3 and tpm2 provider... / openssl cms

I've tested cms signing without specifying the -md option with the EC key.  That now works.

I also tested cms encryption.  I'm getting a different error:

$ openssl cms -encrypt -provider tpm2 -provider base -in file.txt -recip handle:0x01000013 -aes128 
409C92EDC37F0000:error:0308010C:digital envelope routines:inner_evp_generic_fetch:unsupported:../crypto/evp/evp_fetch.c:349:Global default library context, Algorithm (AES-128-CBC : 62), Properties ()
409C92EDC37F0000:error:17000065:CMS routines:ossl_cms_EncryptedContent_init_bio:cipher initialisation error:../crypto/cms/cms_enc.c:78:
409C92EDC37F0000:error:17000068:CMS routines:CMS_final:cms lib:../crypto/cms/cms_smime.c:881:

I suspect that the command is attempting to perform AES encryption using the TPM.  My particular TPM doesn't support symmetric encryption.

Jim

-----Original Message-----
From: Petr Gotthard <petr.gotthard(a)centrum.cz> 
Sent: Wednesday, April 27, 2022 1:38 PM
To: tpm2(a)lists.01.org
Subject: [tpm2] Re: {External} Re: OpenSSL 3 and tpm2 provider... / openssl cms

>CMS encryption fails as follows:
>
>$ openssl cms -encrypt -provider tpm2 -provider base -in file.txt 
>-recip handle:0x01000013
>WARNING:esys:src/tss2-esys/api/Esys_CreateLoaded.c:368:Esys_CreateLoade
>d_Finish() Received TPM Error
>ERROR:esys:src/tss2-esys/api/Esys_CreateLoaded.c:129:Esys_CreateLoaded(
>) Esys Finish ErrorCode (0x000b0143) 
>40FCFCC0017F0000:error:4000000B:tpm2::cannot create key::-1:721219 
>rmt:error(2.0): command code not supported
>
>This looks like https://github.com/tpm2-software/tpm2-openssl/issues/29.
> For my use case, support for TPMs without the CreateLoaded command will be essential.  My machines have an OPTIGA TPM2.

The CreateLoaded issue should be fixed now (in the latest master branch).


Petr
_______________________________________________
tpm2 mailing list -- tpm2(a)lists.01.org
To unsubscribe send an email to tpm2-leave(a)lists.01.org %(web_page_url)slistinfo%(cgiext)s/%(_internal_name)s