[tpm2] Re: Selecting a key which was created via Fapi in the OpenSSL "engine"
Roberts, William C <william.c.roberts at intel.com> Thu, 07 Jul 2022 14:19:00 +0000
| Newsgroups | dev.linux.lists.tpm2 |
|---|---|
| Message-ID | <SN6PR11MB3437D11A247D968F3197D14DB8839@SN6PR11MB3437.namprd11.prod.outlook.com> |
Offhand you could use Fapi_GetTpmBlobs which will return the TPM2B_PUBLIC and TPM2B_PRIVATE blobs for the TPM and then encode it into a PEM file using tpm2-tools tpm2_encodeobject command. So lets say you had the public as key.pub and private as key.priv, something like: tpm2_encodeobject -u key.pub -r key.priv -C 0x81000001 -o key.pem Then you can use key.pem with the engine commands. Note that the 0x81000001 is the default address for the SRK, but if you have something configured differently you may need to tweak the paramters. A call to tpm2_getcap handles-persistent should show you where your SRK is at hopefully. I don't know FAPI well or use FAPI much, so their may be an API I am overlooking that does this. Bill ________________________________ From: Sergey 'Jin' Bostandzhyan <jin(a)mediatomb.cc> Sent: Thursday, July 7, 2022 8:59 AM To: tpm2(a)lists.01.org <tpm2(a)lists.01.org> Subject: [tpm2] Selecting a key which was created via Fapi in the OpenSSL "engine" Hi, I am struggling to figure out how the following scenario could work: let's say I have a C application where I created a persistent key pair via Fapi_CreateKey(), the key can be identified by its path, typically something like "HS/SRK/mykey". Now, let's assume I need to use that key from OpenSSL as well, via the engine option, i.e. "-engine tpm2tss", what I am failing to understand is - how do I pass the path/key identifier, to tell OpenSSL which key to use? All examples in the tpm2-tss-engine README somehow assume that you first used tpm2tss-genkey which produces an actual key file in the fs, and then this file is being used in OpenSSL? From https://github.com/tpm2-software/tpm2-tss-engine tpm2tss-genkey -a rsa -s 2048 mykey openssl rsa -engine tpm2tss -inform engine -in mykey -pubout -outform pem -out mykey.pub openssl pkeyutl -pubin -inkey mykey.pub -in mydata -encrypt -out mycipher openssl pkeyutl -engine tpm2tss -keyform engine -inkey mykey -decrypt -in mycipher -out mydata I naively tried passing "-in HS/SRK/mykey", but of course it did not work. So what is the correct way to do it, if the key has not been generated using tpm2tss-genkey, but if the key has been created via the Fapi_CreateKey() function? My actual scenario is, that my application is using libmosquitto which in turn needs to use the private key which I have in TPM. The library uses OpenSSL and allows to pass equivalents of "-engine" and "-keyform" parameters to the OpenSSL library. The question however remains the same as with the above command line example - how do I select the key, if "mykey" is not a file, but something that is stored in TPM? I am not an expert in any of those TPM or security related questions, so I may very well misunderstand how this is supposed to work overall, so far I was not able to figure it out by studying the docs, I hope someone has a hint for me. Kind regards, Jin _______________________________________________ tpm2 mailing list -- tpm2(a)lists.01.org To unsubscribe send an email to tpm2-leave(a)lists.01.org %(web_page_url)slistinfo%(cgiext)s/%(_internal_name)s
attachment.htm
(text/html, 6 KB)
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
Offhand you could use Fapi_GetTpmBlobs which will return the TPM2B_PUBLIC and TPM2B_PRIVATE blobs</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
for the TPM and then encode it into a PEM file using tpm2-tools tpm2_encodeobject command.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
So lets say you had the public as key.pub and private as key.priv, something like:</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
tpm2_encodeobject -u key.pub -r key.priv -C 0x81000001 -o key.pem<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
Then you can use key.pem with the engine commands.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
Note that the 0x81000001 is the default address for the SRK, but if you have something</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
configured differently you may need to tweak the paramters. A call to tpm2_getcap handles-persistent</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
should show you where your SRK is at hopefully.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
I don't know FAPI well or use FAPI much, so their may be an API I am overlooking that does this.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
Bill</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> Sergey 'Jin' Bostandzhyan <[email protected]><br>
<b>Sent:</b> Thursday, July 7, 2022 8:59 AM<br>
<b>To:</b> [email protected] <[email protected]><br>
<b>Subject:</b> [tpm2] Selecting a key which was created via Fapi in the OpenSSL "engine"</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt;">
<div class="PlainText">Hi,<br>
<br>
I am struggling to figure out how the following scenario could work:<br>
<br>
let's say I have a C application where I created a persistent key pair <br>
via Fapi_CreateKey(), the key can be identified by its path,<br>
typically something like "HS/SRK/mykey".<br>
<br>
Now, let's assume I need to use that key from OpenSSL as well, via the engine<br>
option, i.e. "-engine tpm2tss", what I am failing to understand is - how do<br>
I pass the path/key identifier, to tell OpenSSL which key to use?<br>
<br>
All examples in the tpm2-tss-engine README somehow assume that you first<br>
used tpm2tss-genkey which produces an actual key file in the fs, and then<br>
this file is being used in OpenSSL?<br>
<br>
From <a href="https://github.com/tpm2-software/tpm2-tss-engine">https://github.com/tpm2-software/tpm2-tss-engine</a><br>
tpm2tss-genkey -a rsa -s 2048 mykey<br>
openssl rsa -engine tpm2tss -inform engine -in mykey -pubout -outform pem -out mykey.pub<br>
openssl pkeyutl -pubin -inkey mykey.pub -in mydata -encrypt -out mycipher<br>
openssl pkeyutl -engine tpm2tss -keyform engine -inkey mykey -decrypt -in mycipher -out mydata<br>
<br>
I naively tried passing "-in HS/SRK/mykey", but of course it did not work.<br>
<br>
So what is the correct way to do it, if the key has not been generated using <br>
tpm2tss-genkey, but if the key has been created via the Fapi_CreateKey() <br>
function?<br>
<br>
My actual scenario is, that my application is using libmosquitto which in<br>
turn needs to use the private key which I have in TPM. The library uses OpenSSL<br>
and allows to pass equivalents of "-engine" and "-keyform" parameters to the<br>
OpenSSL library. The question however remains the same as with the above<br>
command line example - how do I select the key, if "mykey" is not a file, but<br>
something that is stored in TPM?<br>
<br>
I am not an expert in any of those TPM or security related questions, so I may<br>
very well misunderstand how this is supposed to work overall, so far I was not<br>
able to figure it out by studying the docs, I hope someone has a hint for me.<br>
<br>
Kind regards,<br>
Jin<br>
<br>
<br>
_______________________________________________<br>
tpm2 mailing list -- [email protected]<br>
To unsubscribe send an email to [email protected]<br>
%(web_page_url)slistinfo%(cgiext)s/%(_internal_name)s<br>
</div>
</span></font></div>
</body>
</html>