Nick Meyer wrote on 4/8/2019 10:30 AM:
I'm working on implementing a TPM2_Sign operation protected by a PCR
policy. I have discovered that the policy digest appears to be zeroed
out as part of the sign operation.
yes, that is correct. Each policy digest can be used only once. You
have to redo all TPM2_PolicyXXX calls for second operation.
Is there another reason that this /successful/ sign operation would
invalidating the session?
That is per specification.
Successful sign (or any other) operation resets policy digest back to
initial state. Failing sign (or any other) operation leaves policy
unchanged - you should destruct it yourself to make sure nobody can come
and reuse it.
All TPM2_Policy* calls should be reasonably fast, so it should not cause
performance problems to recreate it. If you are using PolicyAuthorize,
you can cache result + ticket of signature validation, avoiding most