August 2020 - tpm2 - Ml01.01.Org

by Benjamin Berg

Hi, I was wondering if someone has ideas about integrating the TPM with Fingerprint readers. Recently I started looking into supporting Secure Device Connection Protocol (SDCP, [1]) in libfprint. The general idea is to verify that the Fingerprint reader can be trusted, but I initially also imagined that further use-cases like unsealing data in a TPM may be possible (e.g. to retrieve disk encryption keys). However, looking into it more, my current conclusion is that there is little to no advantage to use the TPM. At least not unless one also has a trusted (userspace) program which is capable of signing TPM authorizations. One could easily offload the required parts into a small helper, but that may require ensuring it runs in a trusted execution environment. Microsoft seems to run relevant parts as trustlets that are walled off from the rest of the system. That seems sensible to me, but it also means requiring all the infrastructure for execution and signing and I doubt that is feasible currently. Right now I'll probably go the way of not using the TPM at all. But I am really not an expert for this. So should someone see scenarios where a TPM is actually helpful in this context, then I would like to hear about them. Benjamin PS: A quick summary of how SDCP works: * Device has a private ECC key that signs the firmware and ephemeral keys during boot (and is inaccessible afterwards) * A certificate proofs that this key was provisioned in factory * Device builds a shared secret with the host (s) * Device sends id, HMAC_SHA256(s, "identify" || nonce || id) when the finger "id" was presented. * The HMAC proofs knowledge of the shared secret and authorizes the print. [1] https://github.com/microsoft/SecureDeviceConnectionProtocol/wiki/Secure-D...

2 months, 4 weeks

5
7
0 / 0

IMA determinism

by Eduardo Falcão

Hi folks I know this is not a TPM doubt, but it's related and some people may have had this issue. Is there some form to make the digest collected through IMA deterministic? I rebooted my system several times, and on the very beginning of system initialization I've noticed the hash in PCR 10 of TPM is changing. The number of lines initializes equally, but it seems that the order the programs are ran always changes. Any ideas for overcoming this issue? []'s

2 years, 1 month

3
10
0 / 0

[RELEASE] tpm2-tools: 4.3.0

by Roberts, William C

Hello, I would like to announce the release of tpm2-tools version 4.3.0 with the following changelog: ### 4.3.0 - 2020-08-24 * tss2_*: Fix double-free errors in commands asking for password authorization * tss2_*: Fix shorthand command -f that was falsely requiring an argument * tss2_*: Update tss2_encrypt to the new FAPI interface - The argument 'policyPath' is removed which was never read anyway * tss2_*: Remove the additional '\n' that was appended when redirecting to stdout * tss2_*: Update mandatory vs optional treatment of arguments according to latest Fapi spec * tss2_*: tss2_getinfo now retrieves the correct FAPI version from Fapi_GetInfo * tss2_*: Fix the error handling in case of multiple inputs and/or outputs from stdin/stdout * tss2_*: Fix syntax errors and update content of man pages according to latest Fapi spec * tss2_*: Add parameter types to all man page * tss2_*: tss2_setappdata now reads from file or stdin allowing to store also binary data * tss2_*: Memory leaks are fixed in cases when a returned empty non-char output value was passed to file output * tss2_pcrextend: fix extending PCR 0 * tss2_quote: fix unused TSS2_RC in LOG_ERR The release can be found here: https://github.com/tpm2-software/tpm2-tools/releases/tag/4.3.0 Bill

2 years, 1 month

1
1
0 / 0

[RELEASE] tpm2-pkcs11 1.4.0

by Roberts, William C

Hello, I would like to announce the release of tpm2-pkcs11 version 1.4.0. There are two highlights for this release That I would like to point out: - Support for integrating with the tss2-fapi library via selectable backends. The ESAPI and Sqlite3 database will continue to be the default. - Support for "linking" existing tpm2 objects into a token. These objects can be raw tpm blobs from tpm2_create, or tss2 engine PEM blobs. The release has the following CHANGELOG: ### 1.4.0 - 2020-08-24 * Fix superflous error message when falling back from TPM2\_EncryptDecrypt2 interface. * Support importing EC keys via tpm2\_ptool import. * C\_InitToken: Fix improper SRK handle of 0x81000000, it should be 0x81000001. * Fix a leak in in tpm.c of an EVP\_PKEY object. * C\_GenerateKeyPair: was not adding PSS signatures as supported by RSA objects, add it. * Fix PSS signatures. Non-FIPS mode TPMs produce PSS signatures with a max salt len that poses interoperability issues with verifying clients, notably TLS in OpenSSL. * Fix Java PKCS11 Provider Signature Verification: #401 * VerifyRecover support, known working with Public Key RSA objects and mechanism CKM_RSA_PKCS. * db: Modfiy search and create behavior. See [docs/INITIALIZING.md](https://github.com/tpm2-software/tpm2-pkcs11/blob/m... for details. * Fix printf(3) format specifier errors. * ci: increase CI coverage to: Fedora 30, Ubuntu 16.04, Ubuntu 18.04. * configure: check for Python version >= 3.7 and pass to Automake. No need to set PYTHON\_INTERPRETER anymore. * Fix segfault/memory corruption bugs in C\_Destroy(). * Fix segfault when no user pin is provisioned. * Support C\_SetAttributeValue. * Support for selectable backend using TPM2\_PKCS11\_BACKEND=esysdb being current version. * Support for backend fapi that uses the tss2-fapi keystore instead of an sqlite db. - This is auto-detected based on tss2-fapi being installed at configure time, and can be controlled via --enable/disable-fapi. * C\_CreateObject: Support for CKO\_DATA objects only with CKA\_PRIVATE set to CK\_TRUE. Token defaults to CK_TRUE. * Fix: src/lib/ssl\_util.c:555:54: error: passing argument 3 of 'EVP\_PKEY\_verify\_recover' from incompatible pointer type * Added tpm2\_ptool link commandlet for linking existing tpm2 objects into a compatible token. For details see [this](https://github.com/tpm2-software/tpm2-pkcs11/blob/master/docs/INTER... document. Supported tpm2 objects are: - serialized TPM2B_PUBLIC and TPM2B_PRIVATE data structures, as produced by [tpm2_create](https://github.com/tpm2-software/tpm2-tools/blob/master/man/... -u and -r outputs respectively. - PEM encoded keys produced by [tpm2tss-genkey](https://github.com/tpm2-software/tpm2-tss-engine/blob/mas... The release can be found here: https://github.com/tpm2-software/tpm2-pkcs11/releases/tag/1.4.0

2 years, 1 month

1
0
0 / 0

Want some help for tpm2-tss-engine in Windows

by Duc Duong

Hi everyone, Currently I'm trying to get tpm2-tss-engine work with OpenSSL in Windows, but as we know tpm2-tss-engine is built for Linux for now. I've already went through the whole process of how to run it in Linux, but I need to work with Windows in the future. I've already built tpm2-tss in Windows but got stuck by building and configuring tpm2-tss-engine. Also. if anyone know how to install IBM TPM simulator in Windows that will help a lot too! Thanks, Paul

2 years, 1 month

1
0
0 / 0

[RELEASE CANDIDATE] tpm2-tools: 4.3.0-rc1

by Roberts, William C

Hello, I would like to announce tpm2-tools release candidate 4.3.0-rc1 with the following changes over rc0: With the following changes between rc0: tss2_pcrextend: fix extending PCR 0 tss2_quote: fix unused TSS2_RC in LOG_ERR With the full changelog being: 4.3.0-rc1 - 2020-08-21 tss2_*: Fix double-free errors in commands asking for password authorization tss2_*: Fix shorthand command -f that was falsely requiring an argument tss2_*: Update tss2_encrypt to the new FAPI interface The argument 'policyPath' is removed which was never read anyway tss2_*: Remove the additional '\n' that was appended when redirecting to stdout tss2_*: Update mandatory vs optional treatment of arguments according to latest Fapi spec tss2_*: tss2_getinfo now retrieves the correct FAPI version from Fapi_GetInfo tss2_*: Fix the error handling in case of multiple inputs and/or outputs from stdin/stdout tss2_*: Fix syntax errors and update content of man pages according to latest Fapi spec tss2_*: Add parameter types to all man page tss2_*: tss2_setappdata now reads from file or stdin allowing to store also binary data tss2_*: Memory leaks are fixed in cases when a returned empty non-char output value was passed to file output tss2_pcrextend: fix extending PCR 0 tss2_quote: fix unused TSS2_RC in LOG_ERR The release can be found here: https://github.com/tpm2-software/tpm2-tools/releases/tag/4.3.0-rc1 Thanks, Bill

2 years, 1 month

1
0
0 / 0

Esys primary key creation error

by FIXED-TERM Schick Felix (CR/APA3)

Hello Everybody, I am currently experimenting with the Esys-API and have encountered a problem during the primary key creation. TPM2B_PUBLIC * primaryOutPublic; TPM2B_CREATION_DATA * primaryCreationData; TPM2B_DIGEST * primaryCreationHash; TPMT_TK_CREATION * primaryCreationTicket; ESYS_TR primaryObjectHandle; // Create primary key rc = Esys_CreatePrimary(esysContext, ESYS_TR_RH_OWNER, ESYS_TR_NONE, ESYS_TR_NONE, ESYS_TR_NONE, &primaryInSensitive, &primaryInPublic, &outsideInfo, &creationPCR, &primaryObjectHandle, &primaryOutPublic, &primaryCreationData, &primaryCreationHash, &primaryCreationTicket); if( rc != TSS2_RC_SUCCESS){ std::cerr << "Creation of primary key failed with " << "response code: 0x"<< std::hex << rc << std::endl; Esys_Finalize(&esysContext); return EXIT_FAILURE; } I get the following error: ERROR:esys:src/tss2-esys/esys_iutil.c:1178:check_session_feasibility() Not enough sessions provided for the command. ERROR:esys:src/tss2-esys/api/Esys_CreatePrimary.c:208:Esys_CreatePrimary_Async() Check session usage ErrorCode (0x0007000b) ERROR:esys:src/tss2-esys/api/Esys_CreatePrimary.c:110:Esys_CreatePrimary() Error in async function ErrorCode (0x0007000b) I hope this is enough context for the trained eye, I would be very grateful for help with this issue. Thank you very much Felix Schick

2 years, 1 month

2
1
0 / 0

[RELEASE CANDIDATE] tpm2-pkcs11: 1.4.0-RC0

by Roberts, William C

Hello, I would like to announce the release of tpm2-pkcs11 version 1.4.0, which has a major feature addition in that it supports the Feature API (FAPI) backend. The changelog is super long, and thus I will just post a link to the changelog: https://github.com/tpm2-software/tpm2-pkcs11/blob/1.4.0-RC0/CHANGELOG.md The release may be found here: https://github.com/tpm2-software/tpm2-pkcs11/releases/tag/1.4.0-RC0 Thanks, Bill

2 years, 1 month

1
0
0 / 0

[RELEASE] tpm2-abrmd: 2.3.3

by Roberts, William C

Hello, I would like to announce the release of tpm2-abrmd version 2.3.3 with the following changelog: Fixed: - Fixed handle resource leak exhausting TPM resources. The release can be found here: - https://github.com/tpm2-software/tpm2-abrmd/releases/tag/2.3.3 Thanks, Bill

2 years, 1 month

1
0
0 / 0

Re: Need some suggestions about tpm2-tss in Windows

by Steffen Schwebel

Hello, thats is not gonna work, I think. With a standalone Windows you can use the certreq tool to generate a TPM backed CSR. Here is a short guide, using a virtual Smartcard. You should be able to use TPM directly as well, but I havent used that yet. 1) Generate virtual Smartcard tpmvscmgr.exe create /name TestVSC /pin default /adminkey random /generat 2) Create templare for certreq, save as cert-template.inf [NewRequest] Subject = "CN=[hostname],O=[Organisation],L=[Location],ST=[State],C=[Country]" Keylength = 2048 Exportable = FALSE UserProtected = TRUE MachineKeySet = FALSE ProviderName = "Microsoft Base Smart Card Crypto Provider" ProviderType = 1 RequestType = PKCS10 KeyUsage = 0x80 3) Create a CSR using the above template certreq.exe -new -f .\tpm_cert.inf cert.csr Hope that helps.. Regards, Steffen On 8/13/20 9:57 PM, Duc Duong wrote: > Hi, > > I just start doing research in tpm-software, I had a running instance > in Ubuntu, build and install four projects: tpm2-tss, tpm2-tss-engine, > tpm2-tools and tpm2-abrmd > > For professional purposes, I'd like to use this TPM TSS to generate > key and CSR with OpenSSL and I've already proof the concept in Ubuntu, > but actually trying to do the same thing in Windows is the final goal. > > The first challenge I met is how to build tpm2-tss in Windows, other > projects are even not VS project. > > I'm trying to build tpm2-tss with the environment they have tested, > like VS 2017 + v141 clang/c2 + UCRT 10.0.16299.0. > > But after that, how can I install it and test it? Cause without > tpm2-tss-engine I can not test it through command right? > > If it's not too tedious, please give me some suggestion, the more the > better. > > Like, it there a better way to build tpm2-tss and other project in > Windows. > > Thanks! > > Paul > > _______________________________________________ > tpm2 mailing list -- tpm2(a)lists.01.org > To unsubscribe send an email to tpm2-leave(a)lists.01.org > %(web_page_url)slistinfo%(cgiext)s/%(_internal_name)s -- Steffen Schwebel Mail: s.schwebel(a)uvensys.de uvensys GmbH Firmensitz und Sitz der Gesellschaft: uvensys GmbH Schorbachstraße 11 35510 Butzbach HRB: AG Friedberg, 7780 USt-Id: DE282879294 Geschäftsführer: Dr. Thomas Licht, t.licht(a)uvensys.de Volker Lieder, v.lieder(a)uvensys.de Mail: info(a)uvensys.de Internet: www.uvensys.de Durchwahl: 06033 - 18 19 225 Hotline: 06033 - 18 19 288 Zentrale: 06033 - 18 19 20 Fax: 06033 - 18 19 299 ========================================================== Jegliche Stellungnahmen und Meinungen dieser E-Mail sind alleine die des Autors und nicht notwendigerweise die der Firma. Falls erforderlich, können Sie eine gesonderte schriftliche Bestätigung anfordern. Any views or opinions presented in this email are solely those of the author and do not necessarily represent those of the company. If verification is required please request a hard-copy version.

2 years, 1 month

2
1
0 / 0

2022

2021

2020

2019

2018

2017

tpm2 August 2020