[tpm2] tpm2_create fails when using -c option
henry.gadacz at stud.h-da.de Wed, 24 Aug 2022 11:48:06 +0200
| Newsgroups | dev.linux.lists.tpm2 |
|---|---|
| Message-ID | <[email protected]> |
Hello everyone, I’m trying to create a signing key protected by an NV and PCR policy. The key is child of the storage primary key, which is protected by the storage hierarchy authorization (using tpm2_policysecret). I am running it on the swtpm emulator. With the following script the storage primary key and its policy is created # create storage primary key tpm2_startauthsession -S session.dat tpm2_policysecret -S session.dat -c o -L storage_hierarchy.plcy $ownerPW tpm2_flushcontext session.dat rm session.dat tpm2_createprimary -C o -P $ownerPW -c SPK.ctx -L storage_hierarchy.plcy tpm2_flushcontext -t For me, the output looks fine: 0d84f55daf6e43ac97966e62c9bb989d3397777d25c5f749868055d65394f952 name-alg: value: sha256 raw: 0xb attributes: value: fixedtpm|fixedparent|sensitivedataorigin|userwithauth|restricted|decrypt raw: 0x30072 type: value: rsa raw: 0x1 exponent: 65537 bits: 2048 scheme: value: null raw: 0x10 scheme-halg: value: (null) raw: 0x0 sym-alg: value: aes raw: 0x6 sym-mode: value: cfb raw: 0x43 sym-keybits: 128 rsa: bac3fa1c537e49a84780fe71df03431d78bf41bc2cbc35433d0d5f737f74cd38d499222ab6a551b92378099a25bbb960e185979c216a0e10e1a7eb357baba60aef6a09ea191e5fad9cc060ecc9ac5bc9807cd81ac7dd7bcc2e7c0a7d1cd5649ad950178957d343a763087234e2294160b609ef2912d5514207867957a602ae3c005a487f8009cebce304b014da0b919d318ca6ea6e5aef074290debbbeabb2bfaf85356f98d445b18535725c6b4b56bb598f2c390552c2ab604d7bcd53105c2660101a26628387054860debe5a71ab08cc101a71581c4ab4614d9aa09851c6e085e1e9364403cc519f53d825e2944cd4d6dd740449be1557118426ba03e374d3 authorization policy: 0d84f55daf6e43ac97966e62c9bb989d3397777d25c5f749868055d65394f952 The following script creates the PCR and NV policy and should create the signing key # create policy for signing key tpm2_startauthsession -S session.dat tpm2_policypcr -S session.dat -l "sha256:$PCR_MB" echo 0x00 | tpm2_policynv -S session.dat -L A_Sig.plcy -i- $NV_Sig_Rev eq tpm2_flushcontext session.dat rm session.dat # create signing key. Start session to fulfill policy of SPK tpm2_startauthsession -S session.dat --policy-session tpm2_policysecret -S session.dat -c o $ownerPW tpm2_create -C SPK.ctx -P session:session.dat -c A_Sig.ctx -u A_Sig.pub -G rsa2048 -a "sign|sensitivedataorigin|userwithauth" -L A_Sig.plcy --creation-data A_sig.creationdata -d A_Sig.dgst -t A_Sig.tckt tpm2_flushcontext session.dat rm session.dat Here I receive the an error after everything seems to be created fine. c0a056f1359a7a6ee39a1616316ef306e88bf690b2531b943b649c0a405c41a6 6e8f172b71dea4db9530edfb5d347aceca5b32e23631b7efc38ab3bb96efa8cb 0d84f55daf6e43ac97966e62c9bb989d3397777d25c5f749868055d65394f952 name-alg: value: sha256 raw: 0xb attributes: value: sensitivedataorigin|userwithauth|sign raw: 0x40060 type: value: rsa raw: 0x1 exponent: 65537 bits: 2048 scheme: value: null raw: 0x10 scheme-halg: value: (null) raw: 0x0 sym-alg: value: null raw: 0x10 sym-mode: value: (null) raw: 0x0 sym-keybits: 0 rsa: 9216b7fbeebb9eae7ff3fdf1664ddd6af6939f28d451692220a58f186a0ce79b56a534acb3da15523136259e58cc2030d996d99982eb3a38f240a1f55d03bf4304c714dd8d4fdc1d4338baba330359f06d7fc0d5749fe62e2ee3310a9b6b610e74205a8cbb16e5b5c71f69681b00f724bf31195434b6c8839594569e5d2fdafa6ec69cd883ad374c1afb1e973114fac06fbcef93d99191dafcaabc1d951ddc89866c4a996686d2397868becc1cba29fe0e5f2c8eeb5e1c990e17701002b3b02636ccfe6b015d989f24087693ab2451592a9a58e38f714488fa0dbb15f98ffbddb10b53f132469592a90bc042166daf8eb302843c7de43d03fea5853aa5cdd21f authorization policy: 6e8f172b71dea4db9530edfb5d347aceca5b32e23631b7efc38ab3bb96efa8cb WARNING:esys:src/tss2-esys/api/Esys_ContextSave.c:247:Esys_ContextSave_Finish() Received TPM Error ERROR:esys:src/tss2-esys/api/Esys_ContextSave.c:92:Esys_ContextSave() Esys Finish ErrorCode (0x00000184) ERROR: Esys_ContextSave(0x184) - tpm:handle(1):value is out of range or is not correct for the context ERROR: Unable to run tpm2_create The A_Sig.ctx file is created but is 0 bytes large. The other files seem to be fine (at least they are larger than 0 bytes). However, when I run tpm2_create without the -c A_Sig.ctx option it works fine. I know I can work around that issue using tpm2_load, but why does it fail when using the -c option? Any thoughts on that are appreciated. Best regards, Henry
attachment.htm
(text/html, 14.6 KB)
<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=utf-8">
<meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Vorformatiert Zchn";
margin:0cm;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";}
p.MsoNoSpacing, li.MsoNoSpacing, div.MsoNoSpacing
{mso-style-priority:1;
margin:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.HTMLVorformatiertZchn
{mso-style-name:"HTML Vorformatiert Zchn";
mso-style-priority:99;
mso-style-link:"HTML Vorformatiert";
font-family:"Courier New";}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 2.0cm 70.85pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link="#0563C1" vlink="#954F72" style='word-wrap:break-word'><div class=WordSection1><p class=MsoNormal>Hello everyone,<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>I’m trying to create a signing key protected by an NV and PCR policy. The key is child of the storage primary key, which is protected by the storage hierarchy authorization (using tpm2_policysecret). I am running it on the swtpm emulator. <o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>With the following script the storage primary key and its policy is created<o:p></o:p></p><pre style='background:white'><i><span style='color:#8C8C8C'># create storage primary key</span></i><span style='color:#0073BF'><o:p></o:p></span></pre><pre style='background:white'><span style='color:#0073BF'>tpm2_startauthsession </span><span style='color:#080808'>-S session.dat<br></span><span style='color:#0073BF'>tpm2_policysecret </span><span style='color:#080808'>-S session.dat -c o -L storage_hierarchy.plcy </span><span style='color:black'>$ownerPW</span><span style='color:#0073BF'><o:p></o:p></span></pre><pre style='background:white'><span style='color:#0073BF'>tpm2_flushcontext </span><span style='color:#080808'>session.dat<br></span><span style='color:#0073BF'>rm </span><span style='color:#080808'>session.dat<o:p></o:p></span></pre><pre style='background:white'><span style='color:#0073BF'>tpm2_createprimary </span><span style='color:#080808'>-C o -P </span><span style='color:black'>$ownerPW </span><span style='color:#080808'>-c SPK.ctx -L storage_hierarchy.plcy<br></span><span style='color:#0073BF'>tpm2_flushcontext </span><span style='color:#080808'>-t<o:p></o:p></span></pre><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>For me, the output looks fine:<o:p></o:p></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Courier New"'>0d84f55daf6e43ac97966e62c9bb989d3397777d25c5f749868055d65394f952<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Courier New"'>name-alg:<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Courier New"'> value: sha256<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Courier New"'> raw: 0xb<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Courier New"'>attributes:<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Courier New"'> value: fixedtpm|fixedparent|sensitivedataorigin|userwithauth|restricted|decrypt<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Courier New"'> raw: 0x30072<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Courier New"'>type:<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Courier New"'> value: rsa<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Courier New"'> raw: 0x1<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Courier New"'>exponent: 65537<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Courier New"'>bits: 2048<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Courier New"'>scheme:<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Courier New"'> value: null<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Courier New"'> raw: 0x10<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Courier New"'>scheme-halg:<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Courier New"'> value: (null)<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Courier New"'> raw: 0x0<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Courier New"'>sym-alg:<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Courier New"'> value: aes<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Courier New"'> raw: 0x6<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Courier New"'>sym-mode:<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Courier New"'> value: cfb<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Courier New"'> raw: 0x43<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Courier New"'>sym-keybits: 128<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Courier New"'>rsa: bac3fa1c537e49a84780fe71df03431d78bf41bc2cbc35433d0d5f737f74cd38d499222ab6a551b92378099a25bbb960e185979c216a0e10e1a7eb357baba60aef6a09ea191e5fad9cc060ecc9ac5bc9807cd81ac7dd7bcc2e7c0a7d1cd5649ad950178957d343a763087234e2294160b609ef2912d5514207867957a602ae3c005a487f8009cebce304b014da0b919d318ca6ea6e5aef074290debbbeabb2bfaf85356f98d445b18535725c6b4b56bb598f2c390552c2ab604d7bcd53105c2660101a26628387054860debe5a71ab08cc101a71581c4ab4614d9aa09851c6e085e1e9364403cc519f53d825e2944cd4d6dd740449be1557118426ba03e374d3<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Courier New"'>authorization policy: 0d84f55daf6e43ac97966e62c9bb989d3397777d25c5f749868055d65394f952<o:p></o:p></span></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNoSpacing>The following script creates the PCR and NV policy and should create the signing key<br><i><span style='color:#8C8C8C'># create policy for signing key<o:p></o:p></span></i></p><pre style='background:white'><span style='color:#0073BF'>tpm2_startauthsession </span><span style='color:#080808'>-S session.dat<br></span><span style='color:#0073BF'>tpm2_policypcr </span><span style='color:#080808'>-S session.dat -l </span><span style='color:#067D17'>"sha256:</span><span style='color:black'>$PCR_MB</span><span style='color:#067D17'>"<br></span><span style='color:#0073BF'>echo </span><span style='color:#1750EB'>0x00 </span><span style='color:#080808'>| </span><span style='color:#0073BF'>tpm2_policynv </span><span style='color:#080808'>-S session.dat -L A_Sig.plcy -i- </span><span style='color:black'>$NV_Sig_Rev </span><span style='color:#080808'>eq<br></span><span style='color:#0073BF'>tpm2_flushcontext </span><span style='color:#080808'>session.dat<br></span><span style='color:#0073BF'>rm </span><span style='color:#080808'>session.dat<o:p></o:p></span></pre><pre style='background:white'><span style='color:#0073BF'><br><br></span><i><span style='color:#8C8C8C'># create signing key. Start session to fulfill policy of SPK<br></span></i><span style='color:#0073BF'>tpm2_startauthsession </span><span style='color:#080808'>-S session.dat --policy-session<br></span><span style='color:#0073BF'>tpm2_policysecret </span><span style='color:#080808'>-S session.dat -c o </span><span style='color:black'>$ownerPW<br></span><span style='color:#0073BF'>tpm2_create </span><span style='color:#080808'>-C SPK.ctx -P session:session.dat -c A_Sig.ctx -u A_Sig.pub -G rsa2048 -a </span><span style='color:#067D17'>"sign|sensitivedataorigin|userwithauth" </span><span style='color:#080808'>-L A_Sig.plcy --creation-data A_sig.creationdata -d A_Sig.dgst -t A_Sig.tckt<br></span><span style='color:#0073BF'>tpm2_flushcontext </span><span style='color:#080808'>session.dat<br></span><span style='color:#0073BF'>rm </span><span style='color:#080808'>session.dat<o:p></o:p></span></pre><p class=MsoNormal><o:p> </o:p></p><p class=MsoNoSpacing>Here I receive the an error after everything seems to be created fine.<o:p></o:p></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Courier New"'>c0a056f1359a7a6ee39a1616316ef306e88bf690b2531b943b649c0a405c41a6<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Courier New"'>6e8f172b71dea4db9530edfb5d347aceca5b32e23631b7efc38ab3bb96efa8cb<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Courier New"'>0d84f55daf6e43ac97966e62c9bb989d3397777d25c5f749868055d65394f952<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Courier New"'>name-alg:<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Courier New"'> value: sha256<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Courier New"'> raw: 0xb<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Courier New"'>attributes:<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Courier New"'> value: sensitivedataorigin|userwithauth|sign<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Courier New"'> raw: 0x40060<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Courier New"'>type:<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Courier New"'> value: rsa<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Courier New"'> raw: 0x1<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Courier New"'>exponent: 65537<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Courier New"'>bits: 2048<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Courier New"'>scheme:<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Courier New"'> value: null<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Courier New"'> raw: 0x10<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Courier New"'>scheme-halg:<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Courier New"'> value: (null)<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Courier New"'> raw: 0x0<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Courier New"'>sym-alg:<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Courier New"'> value: null<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Courier New"'> raw: 0x10<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Courier New"'>sym-mode:<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Courier New"'> value: (null)<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Courier New"'> raw: 0x0<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Courier New"'>sym-keybits: 0<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Courier New"'>rsa: 9216b7fbeebb9eae7ff3fdf1664ddd6af6939f28d451692220a58f186a0ce79b56a534acb3da15523136259e58cc2030d996d99982eb3a38f240a1f55d03bf4304c714dd8d4fdc1d4338baba330359f06d7fc0d5749fe62e2ee3310a9b6b610e74205a8cbb16e5b5c71f69681b00f724bf31195434b6c8839594569e5d2fdafa6ec69cd883ad374c1afb1e973114fac06fbcef93d99191dafcaabc1d951ddc89866c4a996686d2397868becc1cba29fe0e5f2c8eeb5e1c990e17701002b3b02636ccfe6b015d989f24087693ab2451592a9a58e38f714488fa0dbb15f98ffbddb10b53f132469592a90bc042166daf8eb302843c7de43d03fea5853aa5cdd21f<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Courier New"'>authorization policy: 6e8f172b71dea4db9530edfb5d347aceca5b32e23631b7efc38ab3bb96efa8cb<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Courier New"'>WARNING:esys:src/tss2-esys/api/Esys_ContextSave.c:247:Esys_ContextSave_Finish() Received TPM Error <o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Courier New"'>ERROR:esys:src/tss2-esys/api/Esys_ContextSave.c:92:Esys_ContextSave() Esys Finish ErrorCode (0x00000184) <o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Courier New"'>ERROR: Esys_ContextSave(0x184) - tpm:handle(1):value is out of range or is not correct for the context<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Courier New"'>ERROR: Unable to run tpm2_create<o:p></o:p></span></p><p class=MsoNoSpacing><o:p> </o:p></p><p class=MsoNoSpacing>The A_Sig.ctx file is created but is 0 bytes large. The other files seem to be fine (at least they are larger than 0 bytes).<o:p></o:p></p><p class=MsoNoSpacing><o:p> </o:p></p><p class=MsoNormal>However, when I run tpm2_create without the <span style='color:#080808'>-c A_Sig.ctx</span> option it works fine. I know I can work around that issue using tpm2_load, but why does it fail when using the -c option? <o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Any thoughts on that are appreciated.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Best regards,<br>Henry<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p></div></body></html>