[tpm2] Selecting a key which was created via Fapi in the OpenSSL "engine"

Sergey 'Jin' Bostandzhyan <jin at mediatomb.cc> Thu, 07 Jul 2022 15:59:23 +0200
Newsgroups dev.linux.lists.tpm2
Message-ID <[email protected]>
Hi,

I am struggling to figure out how the following scenario could work:

let's say I have a C application where I created a persistent key pair 
via Fapi_CreateKey(), the key can be identified by its path,
typically something like "HS/SRK/mykey".

Now, let's assume I need to use that key from OpenSSL as well, via the engine
option, i.e. "-engine tpm2tss", what I am failing to understand is - how do
I pass the path/key identifier, to tell OpenSSL which key to use?

All examples in the tpm2-tss-engine README somehow assume that you first
used tpm2tss-genkey which produces an actual key file in the fs, and then
this file is being used in OpenSSL?

From https://github.com/tpm2-software/tpm2-tss-engine
tpm2tss-genkey -a rsa -s 2048 mykey
openssl rsa -engine tpm2tss -inform engine -in mykey -pubout -outform pem -out mykey.pub
openssl pkeyutl -pubin -inkey mykey.pub -in mydata -encrypt -out mycipher
openssl pkeyutl -engine tpm2tss -keyform engine -inkey mykey -decrypt -in mycipher -out mydata

I naively tried passing "-in HS/SRK/mykey", but of course it did not work.

So what is the correct way to do it, if the key has not been generated using 
tpm2tss-genkey, but if the key has been created via the Fapi_CreateKey() 
function?

My actual scenario is, that my application is using libmosquitto which in
turn needs to use the private key which I have in TPM. The library uses OpenSSL
and allows to pass equivalents of "-engine" and "-keyform" parameters to the
OpenSSL library. The question however remains the same as with the above
command line example - how do I select the key, if "mykey" is not a file, but
something that is stored in TPM?

I am not an expert in any of those TPM or security related questions, so I may
very well misunderstand how this is supposed to work overall, so far I was not
able to figure it out by studying the docs, I hope someone has a hint for me.

Kind regards,
Jin