Re: TPM2_Sign vs TPM2_RSA_Decrypt

On Thu May 16, 2024 at 4:44 PM EEST, James Prestwood wrote:
> To be honest I started with encrypt/decrypt and included the signing=20
> operation because it was basically "free" by using tpm2_rsa_decrypt(). I=
=20
> was not aware of this distinction/difference between that and doing=20
> signing on the TPM itself. I don't think I ever looked into the signing=
=20
> command on the TPM itself.

My personal take: I'd start RSA with the working code and just
clean up the parts for the first round. It is tested code and
does the job, right? :-)

Then we will weight the odds and cons in the review. That said,
if you want to use TPM_Sign and TPM2_EncryptDecrypt(2) that is
fine too, but not demand.

As for ECDSA, it can be part of the patch set, or we can start
just with the RSA part.

Andreas, is it OK if the patch set is CC'd to you so you can
give your feedback/remarks on it?

BR, Jarkko