[tpm2] Why is validation structure required for ESAPI sign() in tpm2-pytss?
Gadacz, Henry <henry.gadacz at sit.fraunhofer.de> Wed, 14 Sep 2022 12:29:51 +0000
| Newsgroups | dev.linux.lists.tpm2 |
|---|---|
| Message-ID | <FR2P281MB17046964DE7928F9FA495B64D1469@FR2P281MB1704.DEUP281.PROD.OUTLOOK.COM> |
Hello everyone, thank you all very much for your answers and replies on my previous question. I have another one :D Why is validation structure required for ESAPI sign() in tpm2-pytss? In the tpm2-tools tpm2_sign has the optional parameter -t for passing a validation structure. When I try to use the ESAPI sign() method from tpm2-pytss, it is required (giving ESAPI.sign() missing 1 required positional argument: 'validation' error when not setting it). But what should it be for data that was not generated by the TPM? Below you can see my try to somehow build a structure for the validation parameter, but it results in tpm:parameter(3):invalid ticket error. digest="To be signed" scheme = TPMT_SIG_SCHEME(scheme=TPM2_ALG.RSASSA) scheme.details.rsassa.hashAlg = TPM2_ALG.SHA256 validation = TPMT_TK_HASHCHECK(tag=TPM2_ST.HASHCHECK, hierarchy=TPM2_RH.OWNER, digest=[0]*len(digest)) esapi.sign(key_handle=esapi.tr_from_tpmpublic(TPM2_HANDLE(0x81000001)), digest=digest, in_scheme=scheme, validation=validation) Viele Grüße / Best Regards, Henry
attachment.htm
(text/html, 2.9 KB)
<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=iso-8859-1"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
.MsoChpDefault
{mso-style-type:export-only;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 2.0cm 70.85pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link="#0563C1" vlink="#954F72" style='word-wrap:break-word'><div class=WordSection1><p class=MsoNormal><span lang=DE>Hello everyone, <o:p></o:p></span></p><p class=MsoNormal><span lang=DE><o:p> </o:p></span></p><p class=MsoNormal>thank you all very much for your answers and replies on my previous question.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>I have another one :D <o:p></o:p></p><p class=MsoNormal>Why is validation structure required for ESAPI sign() in tpm2-pytss?<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>In the tpm2-tools tpm2_sign has the optional parameter -t for passing a validation structure. When I try to use the ESAPI sign() method from tpm2-pytss, it is required (giving “ESAPI.sign() missing 1 required positional argument: 'validation' “ error when not setting it).<o:p></o:p></p><p class=MsoNormal>But what should it be for data that was not generated by the TPM? Below you can see my try to somehow build a structure for the validation parameter, but it results in “tpm:parameter(3):invalid ticket” error.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>digest="To be signed"<o:p></o:p></p><p class=MsoNormal>scheme = TPMT_SIG_SCHEME(scheme=TPM2_ALG.RSASSA)<o:p></o:p></p><p class=MsoNormal>scheme.details.rsassa.hashAlg = TPM2_ALG.SHA256<o:p></o:p></p><p class=MsoNormal>validation = TPMT_TK_HASHCHECK(tag=TPM2_ST.HASHCHECK, hierarchy=TPM2_RH.OWNER, digest=[0]*len(digest))<o:p></o:p></p><p class=MsoNormal>esapi.sign(key_handle=esapi.tr_from_tpmpublic(TPM2_HANDLE(0x81000001)), digest=digest, in_scheme=scheme, validation=validation)<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Viele Grüße / Best Regards,<o:p></o:p></p><p class=MsoNormal>Henry<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p></div></body></html>
smime.p7s
(application/pkcs7-signature, 7.7 KB) - not displayed