Hi Imran, Thanks for your reply. I had two cases, but for now, let's talk about the one in the tpm2_policyduplicationselect(1) man page. I did the exact steps listed there in the example. Then after the duplication, I did an import and load, as follows: # tpm2_import -Q -C dst_n.ctx -i new_dupkey.priv -u dupkey.pub \     -s dupseed.dat -r imported.priv -L policydupselect.dat # tpm2_load -Q -C dst_n.ctx -r imported.priv -u dupkey.pub -c imported.ctx I then tried to do tpm2_rsa_en/decrypt with imported.ctx. The decrypt is where the policy errors came up. But as you point out below the "userwithauth" attribute is not part of the example in that man page. So let me try again with that attribute added. IIRC, the readpublic on the duplicated/imported key did reference a policy, which I could not figure out how to satisfy. Will get back to you shortly after trying again. Thanks, -ted On 5/20/20 10:31 AM, Imran Desai wrote: > Hi Ted, > > Based on what you said you want to accomplish and your > above-mentioned references, I have a hunch that you have the keys set > up incorrectly. > Can you please, > 1. Try to create a key with "userwithauth" set in the step in your > script that references policy_duplication man page as in here: > "tpm2_create -C src_o.ctx -g sha256 -G rsa -r dupkey.priv -u > dupkey.pub \ > -L policydupselect.dat  -a > "sensitivedataorigin|sign|decrypt|userwithauth" -c dupkey.ctx -Q" > 2. Share your exact steps/ script that you implemented. > 3. Share the key properties of the parent and child object you > created. You can use tpm2_readpublic command to dump the key properties. > > Thanks > _______________________________________________ > tpm2 mailing list -- tpm2(a)lists.01.org > To unsubscribe send an email to tpm2-leave(a)lists.01.org > %(web_page_url)slistinfo%(cgiext)s/%(_internal_name)s

I have a PR fixing this issue. If you want to try your script with this branch, it is here: https://urldefense.com/v3/__https://github.com/tpm2-software/tpm2-tools/p... _______________________________________________ tpm2 mailing list -- tpm2(a)lists.01.org To unsubscribe send an email to tpm2-leave(a)lists.01.org %(web_page_url)slistinfo%(cgiext)s/%(_internal_name)s

-----Original Message----- From: ted.h.kim(a)oracle.com [mailto:ted.h.kim@oracle.com] Sent: Wednesday, May 20, 2020 7:38 PM To: Desai, Imran <imran.desai(a)intel.com&gt; Cc: tpm2(a)lists.01.org Subject: [tpm2] Re: trying duplication and then rsa_en/decrypt Imran, The fix worked -- Thank you. One other suggestion would be to add "userwithauth" to the tpm2_create commands in the man page examples for tpm2_duplicate(1) and tpm2_policyduplicationselect(1). This would make the duplicated keys in those examples more useful.

Since I am on the 4.1.X branch, should I expect this fix to roll out with 4.1.3 ?

-----Original Message----- From: ted.h.kim(a)oracle.com [mailto:ted.h.kim@oracle.com] Sent: Thursday, May 21, 2020 11:19 AM To: Roberts, William C <william.c.roberts(a)intel.com&gt; Cc: Desai, Imran <imran.desai(a)intel.com&gt;; tpm2(a)lists.01.org Subject: Re: [tpm2] Re: trying duplication and then rsa_en/decrypt William, Thanks for your reply. On 5/21/20 8:08 AM, Roberts, William C wrote: >> -----Original Message----- >> From: ted.h.kim(a)oracle.com [mailto:ted.h.kim@oracle.com] >> Sent: Wednesday, May 20, 2020 7:38 PM >> To: Desai, Imran <imran.desai(a)intel.com&gt; >> Cc: tpm2(a)lists.01.org >> Subject: [tpm2] Re: trying duplication and then rsa_en/decrypt >> >> Imran, >> >> The fix worked -- Thank you. >> >> One other suggestion would be to add "userwithauth" to the >> tpm2_create commands in the man page examples for tpm2_duplicate(1) >> and tpm2_policyduplicationselect(1). This would make the duplicated >> keys in those examples more useful. > That patch I had to revert, a similar fix will come out, but we must > not turn down userwith when someone: > - doesn't provide attributes via -a > - doesn't provide a password > - does provide a policy > > If someone specifies a policy and no password without explicitly > providing the attributes, they likely want the authorization to the > object to be controlled via policy, not policy and an empty password. So when the tool is choosing attributes that's how it needs to do it. > So for your example, you'll have to specify userwithauth and then we > will update the manpage to reflect this. > > Note that your creating an object with no real auth value (empty > password), so keep that in mind. understand, looking forward to the final fix >> Since I am on the 4.1.X branch, should I expect this fix to roll out with 4.1.3 ? > Why not just bump versions? Everything on 4.X is backwards compat, nothing breaks. > You may need to bump your tss version, but again, backwards compat, > should just Work. I will eventually do that. But for the moment, I don't have the time. I know using tpm2-tools-4.2.X requires tpm2-tss-2.4.x which for my environment has some missing dependencies which I have yet to resolve.

Thanks, -ted >> Thanks, >> -ted >> >> On 5/20/20 1:49 PM, ted.h.kim(a)oracle.com wrote: >>> Imran, >>> >>> Okay, I will try it out. >>> >>> Also thanks for the pointer to the example on duplicating objects >>> between TPMs. >>> >>> Thanks, >>> -ted >>> >>> On 5/20/20 12:44 PM, Imran Desai wrote: >>>> I have a PR fixing this issue. If you want to try your script with >>>> this branch, it is here: >>>> https://urldefense.com/v3/__https://github.com/tpm2-software/tpm2-t >>>> oo >>>> ls/pull/2038__;!!GqivPVa7Brio!JgE6G26n2bbDPLYBuJ2jf-Buv9U53CDF_b_5y >>>> 43 >>>> EAj8Q9hiybuldt1D8ZH_RPlQ$ >>>> _______________________________________________ >>>> tpm2 mailing list -- tpm2(a)lists.01.org To unsubscribe send an email >>>> to tpm2-leave(a)lists.01.org >>>> %(web_page_url)slistinfo%(cgiext)s/%(_internal_name)s >> -- >> Ted H. Kim, PhD >> ted.h.kim(a)oracle.com >> +1 310-258-7515 >> >> _______________________________________________ >> tpm2 mailing list -- tpm2(a)lists.01.org To unsubscribe send an email >> to tpm2-leave(a)lists.01.org >> %(web_page_url)slistinfo%(cgiext)s/%(_internal_name)s -- Ted H. Kim, PhD ted.h.kim(a)oracle.com +1 310-258-7515