[tpm2] seal with external public EK
Gadacz, Henry <henry.gadacz at sit.fraunhofer.de> Wed, 31 Aug 2022 14:32:24 +0000
| Newsgroups | dev.linux.lists.tpm2 |
|---|---|
| Message-ID | <FR0P281MB170641DAAFCCBBC8E9EFC847D1789@FR0P281MB1706.DEUP281.PROD.OUTLOOK.COM> |
Hello everyone, I want to encrypt a larger file on TPM A and decrypt it on TPM B. To share a symmetric key for that I have TPM B's public endorsement keys on TPM A. The EK of TPM B is created and persisted as followed: tpm2_createek -P endPW -w ownerPW -c $EK_HANDLE -G rsa The public part is exported with: pm2_readpublic -c $EK_HANDLE -o B_EK.pem -f pem On TPM A I load the public EK key of TPM B: tpm2_loadexternal -C o -G rsa -u B_EK.pem -c B_EK.ctx To seal random data that is used as symmetric key to the TPM B EK I tried: tpm2_getrandom --hex 32 | tpm2_create -C B_EK.ctx -i- -u A_transportKey_pub.seal -r A_transportKey_priv.seal But I always get the following error: WARNING:esys:src/tss2-esys/api/Esys_Create.c:399:Esys_Create_Finish() Received TPM Error ERROR:esys:src/tss2-esys/api/Esys_Create.c:134:Esys_Create() Esys Finish ErrorCode (0x0000012f) ERROR: Esys_Create(0x12F) - tpm:error(2.0): authValue or authPolicy is not available for selected entity ERROR: Unable to run tpm2_create Why is an authValue or authPolicy required? I created the EK without authorization value or policy. I want to use the sealing method instead of tpm2_rsaencrypt to be able to process the symmetric key inside TPM B when doing the decryption and don't need to store a file with the symmetric key on the disk. Any help on what's the problem or other suggestions to solve this task are really appreciated. Best Regards, Henry
attachment.htm
(text/html, 3.6 KB)
<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
.MsoChpDefault
{mso-style-type:export-only;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 2.0cm 70.85pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link="#0563C1" vlink="#954F72" style='word-wrap:break-word'><div class=WordSection1><p class=MsoNormal><span lang=DE>Hello everyone,<o:p></o:p></span></p><p class=MsoNormal><span lang=DE><o:p> </o:p></span></p><p class=MsoNormal>I want to encrypt a larger file on TPM A and decrypt it on TPM B. To share a symmetric key for that I have TPM B’s public endorsement keys on TPM A. The EK of TPM B is created and persisted as followed:<o:p></o:p></p><p class=MsoNormal>tpm2_createek -P endPW -w ownerPW -c $EK_HANDLE -G rsa <o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>The public part is exported with:<o:p></o:p></p><p class=MsoNormal>pm2_readpublic -c $EK_HANDLE -o B_EK.pem -f pem<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>On TPM A I load the public EK key of TPM B:<o:p></o:p></p><p class=MsoNormal>tpm2_loadexternal -C o -G rsa -u B_EK.pem -c B_EK.ctx<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>To seal random data that is used as symmetric key to the TPM B EK I tried:<o:p></o:p></p><p class=MsoNormal>tpm2_getrandom --hex 32 | tpm2_create -C B_EK.ctx -i- -u A_transportKey_pub.seal -r A_transportKey_priv.seal<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>But I always get the following error:<o:p></o:p></p><p class=MsoNormal>WARNING:esys:src/tss2-esys/api/Esys_Create.c:399:Esys_Create_Finish() Received TPM Error <o:p></o:p></p><p class=MsoNormal>ERROR:esys:src/tss2-esys/api/Esys_Create.c:134:Esys_Create() Esys Finish ErrorCode (0x0000012f) <o:p></o:p></p><p class=MsoNormal>ERROR: Esys_Create(0x12F) - tpm:error(2.0): authValue or authPolicy is not available for selected entity<o:p></o:p></p><p class=MsoNormal>ERROR: Unable to run tpm2_create<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Why is an authValue or authPolicy required? I created the EK without authorization value or policy. <o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>I want to use the sealing method instead of tpm2_rsaencrypt to be able to process the symmetric key inside TPM B when doing the decryption and don’t need to store a file with the symmetric key on the disk.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Any help on what’s the problem or other suggestions to solve this task are really appreciated.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Best Regards,<o:p></o:p></p><p class=MsoNormal>Henry<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p></div></body></html>
smime.p7s
(application/pkcs7-signature, 7.7 KB) - not displayed