Re: TPM2_Sign vs TPM2_RSA_Decrypt

On Thu May 16, 2024 at 4:59 PM EEST, James Prestwood wrote:
> On 5/16/24 6:55 AM, Jarkko Sakkinen wrote:
> > On Thu May 16, 2024 at 4:44 PM EEST, James Prestwood wrote:
> >> To be honest I started with encrypt/decrypt and included the signing
> >> operation because it was basically "free" by using tpm2_rsa_decrypt().=
 I
> >> was not aware of this distinction/difference between that and doing
> >> signing on the TPM itself. I don't think I ever looked into the signin=
g
> >> command on the TPM itself.
> > My personal take: I'd start RSA with the working code and just
> > clean up the parts for the first round. It is tested code and
> > does the job, right? :-)
> It was tested then yes, obviously need to verify that after 4 years :)

Yeah, I gave some nitpicks for you (private) and yeah branch (tpm2_key)
branch has shenigans to call ANS.1 template acquiring function from the
stock RSA code in the kernel :-)

Better to do as little as possible and then we look at what actually
needs to be done.

In addition to Andreas, I'd recommend to first of all CC the patch
set to linux-crypto too in addition to linux-integrity and
keyrings and also Herbert Xu (crypto maintainer).

I know this is some effort to you but isn't it any way worth it
because then the work that you did years ago was not wasted? :-)

BR, Jarkko