[tpm2] Re: Ecrypting and decrypting a file using a TPM2
Petr Gotthard <petr.gotthard at centrum.cz> Thu, 16 Jun 2022 17:42:07 +0200
| Newsgroups | dev.linux.lists.tpm2 |
|---|---|
| Message-ID | <[email protected]> |
Hi Dawn, there are code samples in the OpenSSL documentation. First, you need OSSL_PROVIDER_load as shown here https://github.com/tpm2-software/tpm2-openssl/blob/master/test/selftest.c Then, to load EVP_PKEY from the TPM you need the OSSL_STORE* functions and the shipplet from here https://github.com/tpm2-software/tpm2-openssl/issues/26#issuecomment-1057929799 Finally, I believe the OpenSSL routines to use for file encrypting are EVP_Seal* and EVP_Open* https://wiki.openssl.org/index.php/EVP_Asymmetric_Encryption_and_Decryption_of_an_Envelope these work exactly like Steven suggested. I you face any troubles, just let me know. Petr ______________________________________________________________ > Od: dawn.howe(a)alten.com > Komu: tpm2(a)lists.01.org > Datum: 15.06.2022 21:29 > Předmět: [tpm2] Re: Ecrypting and decrypting a file using a TPM2 > Petr: Thanks so much for the suggestion. I was able to encrypt and decrypt my files based on the pattern in https://github.com/tpm2-software/tpm2-openssl/blob/master/test/cipher_aes128_cbc.sh <https://github.com/tpm2-software/tpm2-openssl/blob/master/test/cipher_aes128_cbc.sh>. I think I can accomplish what I want with some system calls to openssl. The code I'm writing is in C++. Is there a way to replace the system call to openssl with a c++ library call (perhaps that takes a provider parameter)? i.e. Replace the following with a C++ library call openssl enc -provider tpm2 -aes128 -e -K $KEY -iv $IV -in testdata -out testdata.enc I'd love to see a code sample if you have one. thanks, Dawn _______________________________________________ tpm2 mailing list -- tpm2(a)lists.01.org To unsubscribe send an email to tpm2-leave(a)lists.01.org %(web_page_url)slistinfo%(cgiext)s/%(_internal_name)s
attachment.htm
(text/html, 3 KB)
<p style="padding:0 0 0 0; margin:0 0 0 0;">Hi Dawn,</p> <p style="padding:0 0 0 0; margin:0 0 0 0;">there are code samples in the OpenSSL documentation.</p> <p style="padding:0 0 0 0; margin:0 0 0 0;"> </p> <p style="padding:0 0 0 0; margin:0 0 0 0;">First, you need OSSL_PROVIDER_load as shown here</p> <p style="padding:0 0 0 0; margin:0 0 0 0;">https://github.com/tpm2-software/tpm2-openssl/blob/master/test/selftest.c</p> <p style="padding:0 0 0 0; margin:0 0 0 0;"> </p> <p style="padding:0 0 0 0; margin:0 0 0 0;"> </p> <p style="padding:0 0 0 0; margin:0 0 0 0;">Then, to load EVP_PKEY from the TPM you need the OSSL_STORE* functions and the shipplet from here</p> <p style="padding:0 0 0 0; margin:0 0 0 0;">https://github.com/tpm2-software/tpm2-openssl/issues/26#issuecomment-1057929799</p> <p style="padding:0 0 0 0; margin:0 0 0 0;"> </p> <p style="padding:0 0 0 0; margin:0 0 0 0;"> </p> <p style="padding:0 0 0 0; margin:0 0 0 0;">Finally, I believe the OpenSSL routines to use for file encrypting are EVP_Seal* and EVP_Open*</p> <p style="padding:0 0 0 0; margin:0 0 0 0;">https://wiki.openssl.org/index.php/EVP_Asymmetric_Encryption_and_Decryption_of_an_Envelope</p> <p style="padding:0 0 0 0; margin:0 0 0 0;">these work exactly like Steven suggested.</p> <p style="padding:0 0 0 0; margin:0 0 0 0;"> </p> <p style="padding:0 0 0 0; margin:0 0 0 0;">I you face any troubles, just let me know.</p> <p style="padding:0 0 0 0; margin:0 0 0 0;"> </p> <p style="padding:0 0 0 0; margin:0 0 0 0;"> </p> <p style="padding:0 0 0 0; margin:0 0 0 0;">Petr</p> <p style="padding:0 0 0 0; margin:0 0 0 0;"> </p> <p style="padding:0 0 0 0; margin:0 0 0 0;">______________________________________________________________<br /> > Od: [email protected]<br /> > Komu: [email protected]<br /> > Datum: 15.06.2022 21:29<br /> > Předmět: [tpm2] Re: Ecrypting and decrypting a file using a TPM2<br /> ></p> Petr:<br /> Thanks so much for the suggestion. I was able to encrypt and decrypt my files based on the pattern in <a href="https://github.com/tpm2-software/tpm2-openssl/blob/master/test/cipher_aes128_cbc.sh">https://github.com/tpm2-software/tpm2-openssl/blob/master/test/cipher_aes128_cbc.sh</a>. I think I can accomplish what I want with some system calls to openssl.<br /> <br /> The code I'm writing is in C++. Is there a way to replace the system call to openssl with a c++ library call (perhaps that takes a provider parameter)?<br /> <br /> i.e. Replace the following with a C++ library call <br /> openssl enc -provider tpm2 -aes128 -e -K $KEY -iv $IV -in testdata -out testdata.enc<br /> <br /> I'd love to see a code sample if you have one.<br /> <br /> thanks,<br /> Dawn<br /> _______________________________________________<br /> tpm2 mailing list -- [email protected]<br /> To unsubscribe send an email to [email protected]<br /> %(web_page_url)slistinfo%(cgiext)s/%(_internal_name)s<br />