Re: Using TPM2_LoadExternal() for loading an HMAC key into the TPM?

Hello,

the error is caused by:
  .parameters.keyedHashDetail.scheme.scheme =3D TPM2_ALG_SHA256,

TPM2_ALG_HMAC, TPM2_ALG_XOR, and TPM2_ALG_NULL are possible selectors for =
TPMU_SCHEME_KEYEDHASH.

The hash alg has to be set with:
.parameters.keyedHashDetail.scheme.details.hmac.hashAlg =3D TPM2_ALG_SHA25=
6,

Unfortunately the error message for this error is only displayed if log le=
vel debug is activated.

Juergen

Am 16.04.24 um 15:05 schrieb Lennart Poettering:
> Hi!
>
> I was wondering, if anyone has an idea how precisely to set up a pair
> of TPM2B_PUBLIC and TPM2_SENSITIVE structures for loading an
> HMAC-SHA256 key into the TPM via TPM_LoadExternal()?
>
> I am currently setting things up more or less like this:
>
>          TPM2B_PUBLIC auth_hmac_public =3D {
>                  .size =3D sizeof(TPMT_PUBLIC),
>                  .publicArea =3D {
>                          .type =3D TPM2_ALG_KEYEDHASH,
>                          .nameAlg =3D TPM2_ALG_SHA256,
>                          .objectAttributes =3D TPMA_OBJECT_DECRYPT | TPM=
A_OBJECT_SIGN_ENCRYPT /* | TPMA_OBJECT_USERWITHAUTH */,
>                          .parameters.keyedHashDetail.scheme.scheme =3D T=
PM2_ALG_SHA256,
>                          .unique.keyedHash.size =3D buffer.size,
>                  },
>          };
>
>          TPM2B_SENSITIVE auth_hmac_private =3D {
>                  .size =3D sizeof(TPMT_SENSITIVE),
>                  .sensitiveArea =3D {
>                          .sensitiveType =3D TPM2_ALG_KEYEDHASH,
>                          .sensitive.sym.size =3D buffer.size,
>                  },
>          };
>
>          memcpy(auth_hmac_private.sensitiveArea.sensitive.sym.buffer, bu=
ffer.buffer, buffer.size);
>
> And then use TPM2_LoadExternal() with this, for the NULL hierarchy.
>
> tpm2-tss responds with these errors:
>
>           ERROR:esys:src/tss2-esys/api/Esys_LoadExternal.c:184:Esys_Load=
External_Async() SAPI Prepare returned error. ErrorCode (0x0009000b)
>           ERROR:esys:src/tss2-esys/api/Esys_LoadExternal.c:85:Esys_LoadE=
xternal() Error in async function ErrorCode (0x0009000b)
>
> But, uh, what am I supposed to make of this?
>
> I figure it's not even the TPM that refuses this, but it's tpm2-tss
> already?
>
> Anyone has an idea?
>
> (Background: I am trying to protect an nvindex that I want to use with
> TPM2_AuthorizeNV, with an TPM2_PolicySigned access policy. I want to
> use an HMAC key for the signature scheme. If you want to know even
> more, see =E2=86=92 https://github.com/systemd/systemd/pull/31790. The a=
bove
> is more or less a copy of the topmost commit of that)
>
> Any help appreciated!
>
> Lennart
>