[tpm2] Re: tpm2_create fails when using -c option
Kenneth Goldman <kgoldman at us.ibm.com> Fri, 09 Sep 2022 12:40:40 +0000
| Newsgroups | dev.linux.lists.tpm2 |
|---|---|
| Message-ID | < <BN8PR15MB2753A110F6F1675815886239F2439@BN8PR15MB2753.namprd15.prod.outlook.com>> |
Private keys come off the TPM encrypted with the parent. Nothing is exposed. Unless you have no other persistent storage (disk) and have complete control over applications, avoid evictcontrol. There are very few NV key slots - do not waste them. However, when I run tpm2_create without the -c A_Sig.ctx option it works fine. To work around that by storing the public and private part in a file using the -u and -r option and loading it later with tpm2_load is not a solution for my scenario as it exposes the private key on the hard disk. I require the context later in to make the key persistent using tpm2_evictcontrol.
attachment.htm
(text/html, 2.7 KB)
<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"DejaVu Sans";
panose-1:2 11 6 3 3 8 4 2 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"DejaVu Sans",sans-serif;
color:windowtext;
font-weight:normal;
font-style:normal;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:70.85pt 70.85pt 56.7pt 70.85pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link="#0563C1" vlink="#954F72" style='word-wrap:break-word'><div class=WordSection1><p class=MsoNormal><span style='font-family:"DejaVu Sans",sans-serif'>Private keys come off the TPM encrypted with the parent. Nothing is exposed.<o:p></o:p></span></p><p class=MsoNormal><span style='font-family:"DejaVu Sans",sans-serif'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-family:"DejaVu Sans",sans-serif'>Unless you have no other persistent storage (disk) and have complete control over applications, avoid evictcontrol. There are very few NV key slots - do not waste them.<o:p></o:p></span></p><p class=MsoNormal><span style='font-family:"DejaVu Sans",sans-serif'><o:p> </o:p></span></p><div style='border:none;border-left:solid blue 1.5pt;padding:0in 0in 0in 4.0pt'><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>However, when I run tpm2_create without the -c A_Sig.ctx option it works fine. To work around that by storing the public and private part in a file using the -u and -r option and loading it later with tpm2_load is not a solution for my scenario as it exposes the private key on the hard disk. I require the context later in to make the key persistent using tpm2_evictcontrol. <o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><span style='font-family:"DejaVu Sans",sans-serif'><o:p> </o:p></span></p></div></div></body></html>
smime.p7s
(application/pkcs7-signature, 5.3 KB) - not displayed