June 2022 - tpm2 - Ml01.01.Org

by Roberts, William C

Hello, I am pleased to announce the release of the tpm2-pytss (python bindings and utilities) version 1.0.0 RC 1 with the following CHANGELOG over RC0: ## [1.0.0-rc1] - 2022-01-10 ### Fixed: - Misspellings in Code on things like RuntimeError. - Fix documentation of ESAPI methods and exceptions. - Double ESAPI.Close call resulting in "Esys_Finalize() Finalizing NULL context." - type hint for verify_signature was an int, should be a str. - Parent cdata memory being freed when no parent reference. This causes sub-field references to parent cdata to be invalid. - in util method unwrap, fix variable `encdupsens` does not exist, it is `decsens` instead. ### Changed: - Renamed ESAPI.set_auth to ESAPI.tr_set_auth for consistenency. - Use None over 0 for default auth_handle. ### Added: - Check for bad type enum type in ESAPI.load_blob. - Support for deprecation of `TPM2_RH_PW` in tpm2-tss with proper TPM2_RS_PW attribute. The release can be found here: - https://pypi.org/project/tpm2-pytss/1.0.0rc1/ Sorry for the long delay on this RC period, we wanted to make sure we got as much bugs and broken things before the 1.0 release to help minimize breaking changes in the future. Thanks, Bill

1 month, 1 week

3
5
0 / 0

Possible TPM uses in fprintd/libfprint

by Benjamin Berg

Hi, I was wondering if someone has ideas about integrating the TPM with Fingerprint readers. Recently I started looking into supporting Secure Device Connection Protocol (SDCP, [1]) in libfprint. The general idea is to verify that the Fingerprint reader can be trusted, but I initially also imagined that further use-cases like unsealing data in a TPM may be possible (e.g. to retrieve disk encryption keys). However, looking into it more, my current conclusion is that there is little to no advantage to use the TPM. At least not unless one also has a trusted (userspace) program which is capable of signing TPM authorizations. One could easily offload the required parts into a small helper, but that may require ensuring it runs in a trusted execution environment. Microsoft seems to run relevant parts as trustlets that are walled off from the rest of the system. That seems sensible to me, but it also means requiring all the infrastructure for execution and signing and I doubt that is feasible currently. Right now I'll probably go the way of not using the TPM at all. But I am really not an expert for this. So should someone see scenarios where a TPM is actually helpful in this context, then I would like to hear about them. Benjamin PS: A quick summary of how SDCP works: * Device has a private ECC key that signs the firmware and ephemeral keys during boot (and is inaccessible afterwards) * A certificate proofs that this key was provisioned in factory * Device builds a shared secret with the host (s) * Device sends id, HMAC_SHA256(s, "identify" || nonce || id) when the finger "id" was presented. * The HMAC proofs knowledge of the shared secret and authorizes the print. [1] https://github.com/microsoft/SecureDeviceConnectionProtocol/wiki/Secure-D...

1 month, 1 week

5
7
0 / 0

Using a session with TPM2_CreatePrimary

by Shaw, Adrian

Hi everyone, I’m trying to create a primary key using an authenticated and encrypted session. I looked at the man page for tpm2_createprimary https://github.com/tpm2-software/tpm2-tools/blob/1226b5333e0f051edf677397... It does not seem to be possible - there is no way to specify the session to use. However, it is possible to do this in the IBM TSS equivalent https://www.mankier.com/1/tsscreateprimary I noticed you can specify a session for other commands though, like tpm2_create, but not with tpm2_createprimary. Is this a missing feature or am I missing some fundamental understanding? Thanks, Adrian

1 month, 2 weeks

3
3
0 / 0

Calculating name of created AK- server side

by kuba.michal.n＠gmail.com

Hello! I would like to know if it is possible to calculate name of AK generated by host on a remote server? I have read about remote attestation. To ensure the AK matches EK we have to make credential using name of the AK. To achieve this we have to either: a) calculate name of the AK on server b) receive name of the AK from host and believe it's a name for a proper AK Am I missing something? I have searched for explanation in docs posted on TCG's site, but I just can't find anything useful for nameAlg. I would be thankful for any help or advice :D

2 months

4
8
2 / 0

Ecrypting and decrypting a file using a TPM2

by dawn.howe＠alten.com

I am writing a c++ application on ubuntu 22.04 server that needs to encrypt and decrypt files and am using the FAPI api. The files need to be secured until the application uses them at a later time, so I am receiving plain files and encrypting them using Fapi_Encrypt(). I tried following the pattern in the integration tests found in the tpm2-tools. (tpm2-tools/test/integration/fapi/fapi-encrypt-decrypt.sh) It basically does the following: Fapi_Initialize(&global_fapi_context, NULL); Fapi_Provision (global_fapi_context, NULL, NULL, NULL); const char * key_type = "noDa, decrypt, system"; char * auth_value = NULL; // no password char * policy_path = NULL; Fapi_CreateKey (global_fapi_context, key_path, key_type, policy_path, auth_value); Fapi_Encrypt (global_fapi_context, key_path, (const uint8_t*)data, size, &cipherText, &cipherTextSize); The files (data buffer) I need to encrypt are about 3k bytes big. The encryption fails because the file is too big. The error comes from .../tpm2-tss/src/tss2-fapi/api/Fapi_Encrypt.c line 309: if (encKeyObject->misc.key.public.publicArea.type == TPM2_ALG_RSA) { TPM2B_DATA null_data = { .size = 0, .buffer = {} }; TPM2B_PUBLIC_KEY_RSA *rsa_message = (TPM2B_PUBLIC_KEY_RSA *)&context->aux_data; size_t key_size = encKeyObject->misc.key.public.publicArea.parameters.rsaDetail.keyBits / 8; if (context->cmd.Data_EncryptDecrypt.in_dataSize > key_size) { goto_error_reset_state(r, TSS2_FAPI_RC_BAD_VALUE, "Size to big for RSA encryption.", error_cleanup); Is my strategy completely wrong? What's the proper way to do this? Is my strategy ok, but need to generate a different type of key? I'm new to this technology and am curious how it ought to be done.

2 months

3
4
0 / 0

[RELEASE] tpm2-pytss version 1.2.0

by Roberts, William C

Hello, I am pleased to announce the release of version 1.2.0 of tpm2-pytss with the following CHANGELOG: ## 1.2.0 - 2022-06-14 ### Added - utils function to parse tpm2-tools PCR values as function: unmarshal_tools_pcr_values. - official python 3.10 support. - sm2 and sm4 tools like parsing support for TPMT_PUBLIC and TPM2B_PUBLIC structures. - tpm2-tools compatible YAML encoding and decoding of TPM structures ### Removed - pkgconfig as runtime dependency - Official Python 3.6 support. - internal distutils usage. - sm3 and sm4 support IF the backing cryptography package supports it. ### Fixed: - trsess_set_attributes attributes parameter should be a TPMA_SESSION or int, not just int. - setup.cfg install_requires requirement that cryptography be version 3.0 or greater. - Note in documentation incorrectly called None. - ability to build a wheel and run tests from directory root. Note code for package is now under src folder. The release can be found on pypi here: - https://pypi.org/project/tpm2-pytss/1.2.0/

2 months

1
0
0 / 0

TPM2 provider stuck during handshake

by Remi Tricot-Le Breton

Hello, I've been trying to make the TPM2 provider work in my environment (Ubuntu 20.04) for quite some time and I did not succeed yet. I tried using the commands suggested in docs/certificates.md to create a self signed certificate which I then used in an "openssl s_server" instance but when I try to connect to this SSL server, the handshake fails to complete. The three commands I used are the following: openssl req -provider tpm2 -x509 -subj "/C=GB/CN=foo" -keyout testkey.pem -out testcert.pem openssl s_server -provider tpm2 -provider default -propquery ?provider=tpm2 -accept 4443 -www -key testkey.pem -cert testcert.pem curl --cacert testcert.pem https://localhost:4443/ The curl command ends in a timeout and the server remains stuck (without raising errors). I rebuilt the tpm2 provider with the enable-debug=yes option added in order to understand what was happening and I noticed that the server was stuck when trying to duplicate a context ("DIGEST DUP" was dumped on the server's standard output), and more specifically in the Tss2_Sys_ExecuteFinish function which in turn calls tctildr_receive with a -1 timeout (out of which we apparently never get out). Do any of you know if I missed something or if it is a bug ? I could provide the full standard output log or a complete backtrace of the stuck server if needed but they might end up being unnecessary noise if the bug comes from my wrong use of the provider. Thanks Rémi LB

2 months, 1 week

3
4
0 / 0

Making porting ESAPI/SAPI to constrained environments easier

by Roberts, William C

Hi folks, I have been working on some commits to make SAPI and ESAPI easier to port to constrained environments. The first is run-time settable crypto backend for ESAPI. You can remove any linker dependencies and set your own crypto for whatever that env needs. - https://github.com/tpm2-software/tpm2-tss/pull/2365 The next is build time selectable functionality ala kconfig. You just tell it was SYS/ESYS commands you want, and it knows what to generate: - https://github.com/tpm2-software/tpm2-tss/pull/2369 That commit is pretty early still, but for instance if you enable an Esys function it knows you need W Esys_ functions, X sTSS2_Sys_ functions and Y TSS2_MU_ functions and sets up defines for them. I still need to "ifdef" ESAPI and MU, but SAPI is all done. The configuration engine takes a YAML file of a list of functions and uses ctags/cflow to analyze the source for leaf dependencies. I'd love comments. Thanks, Bill

2 months, 1 week

1
0
0 / 0

[RELEASE CANDIDATE] tpm2-pytss 1.1.0-rc0

by Roberts, William C

Hello, I would like to announce the release of tpm2-pytss version 1.1.0-rc0 which can be found on pypi at: - https://pypi.org/project/tpm2-pytss/1.1.0rc0/ With the following CHANGELOG: ## 1.1.0-rc0 - 2022-03-14 ### Fixed - Spelling of "Enhanced" in CHANGELOG for 1.0.0 release. - Ensure that TPM2_GENERATED.VALUE is encoded the same way as other constants. - Add support to unmarshal simple TPM2B types (such as TPM2B_ATTEST and TPM2B_NAME) directly using the unmarshal method ### Changed - Drop pkgconfig from runtime dependencies, thus no longer need dev packages of built bindings at runtime. - NOTE: Version information is cached, a change in the TSS libraries requires a rebuild of the bindings. ### Added - Support session contexts from tpm2-tools as well as function to marshal context to tpm2-tools format. - Support two new encoding/decoding classes to go to/from hex or json representation of objects. - Support for creating EK from templates and optionally NV index based templates. - Binding to `Esys_TR_GetTpmHandle` as `ESAPI` method `tr_get_tpm_handle`. Thanks, Bill

2 months, 2 weeks

4
3
0 / 0

Update Mod APK for free for android phones

by maurineell＠outlook.com

If you are looking for a way to get the latest version of the Mod APK for free, then you have come to the right place. In this article, we will provide you with a step-by-step guide on how to update your android phone to the latest version of the Mod APK. First of all, you need to go to the Google Play Store and search for the Mod APK. Once you have found the Mod APK, tap on it and then select "Update". Now, wait for the update to complete and then you will be able to use the latest version of the Mod APK on your android phone. There are many places from where you can download the updated Mod APK for free. However https://techupnew.com is the safest place for you to update You can also go through the reviews of other users to get an idea about the quality of services provided by that particular site. After checking all these factors, you can proceed with the downloading process. Once you have downloaded the file, you need to install it on your android phone. For this, you need to follow some simple steps which are mentioned below: - First of all, go to the settings option on your phone and enable the "Unknown Sources" feature. This will allow you to install files from external sources. - Now, open the file manager on your phone and locate the downloaded APK file. - Tap on the file to begin the installation process. - Follow the on-screen instructions to complete the installation process. After following these steps, you will be able to use the updated Mod APK on your android phone. Enjoy!

2 months, 2 weeks

1
0
0 / 0

2022

2021

2020

2019

2018

2017

tpm2 June 2022