[tpm2] Re: CMP error: cannot duplicate context:2306 tpm:warn(2.0): out of memory for object contexts

[Petr Gotthard <petr.gotthard at centrum.cz>]

[-- Attachment #1: Type: text/plain, Size: 4108 bytes --]

Bill,
we solved this particular issue, but I expect more resource-related troubles are yet to come.
 
Example 1: OpenSSL often duplicates hash sequences: To hash sequences A,B,C1 and then A,B,C2 they first hash A,B, then duplicate/fork the hash sequence and then complete the hash first for C1 and then for C2. This is a great performance optimization, but when too many dup (forks) are made, the TPM runs out of objects.
 
Example 2: The CMP key update needs 4 objects to operate (old client key, new client key, server key and hash sequence), but the kernel RM (tpm_space.context_tbl) allows only 3 objects. (If I am right.)
 
 
In general, the OpenSSL code often pre-loads or caches objects, which will be used later, which causes troubles with the space-constrained TPM. I was not sure whether the tpm2-openssl provider should act as another level of a resource manager and swap the objects to simulate more space than available on the TPM hardware, or whether this is something the resource manager could/should do.
 
It's definitely a nice problem to think about and most likely something which will need to be addressed in the tpm2-openssl 2.0
 
 
Petr

______________________________________________________________
> Od: "Roberts, William C" <william.c.roberts(a)intel.com>
> Komu: "Chris Newman" <chris(a)mode51.software>, "tpm2(a)lists.01.org" <tpm2(a)lists.01.org>, "Petr Gotthard" <petr.gotthard(a)centrum.cz>
> Datum: 08.10.2021 17:46
> Předmět: [tpm2] Re: CMP error: cannot duplicate context:2306 tpm:warn(2.0): out of memory for object contexts
>
Thats:tpm2_rc_decode 0x00000902
 tpm:warn(2.0): out of memory for object contextsAre you running against a resource manager? You should probably either use /dev/tpmrm0 or tpm2-abrmd.You can set the TCTI via the TPM2OPENSSL_TCTI which AFAICT takes strings like tpm2-tools, so something like:"device:/dev/tpmrm0" or "abrmd".
 This also might be a bug, the provider is pretty new. Petr any other ideas I am missing?
 Bill
 From: Chris Newman <chris(a)mode51.software>
 Sent: Sunday, October 3, 2021 6:40 PM
 To: tpm2(a)lists.01.org <tpm2(a)lists.01.org>
 Subject: [tpm2] CMP error: cannot duplicate context:2306 tpm:warn(2.0): out of memory for object contexts Hi,
I create an EK and AK using tpm2_createek, tpm2_createak and tpm2_evictcontrol to persist the AK in 0x81010002. The I use the following command with DigiCert's CMPv2 server:
openssl cmp -config /opt/sdk/openssl/current/ssl/openssl.cnf -provider tpm2 -provider default -propquery ?provider=tpm2,tpm2.digest!=yes -cmd ir -server  https://demo.one.digicert.com/iot/api/v1/cmp/IOT_1234 <https://demo.one.digicert.com/iot/api/v1/cmp/IOT_1234> -ref 1234 -secret pass:1234 -recipient "/CN=mode51.software" -key handle:0x81010002 -subject "/CN=TestTest" -cacertsout ./capubs.pem -certout ./cl_cert.pem -tls_used -verbosity 8
I get the following error:
DIGEST NEW
 DIGEST INIT
 DIGEST UPDATE
 DIGEST DUP
 DIGEST FINAL
 DIGEST FREE
 DIGEST NEW
 DIGEST INIT
 DIGEST UPDATE
 DIGEST NEW
 DIGEST INIT
 DIGEST UPDATE
 DIGEST DUP
 WARNING:esys:src/tss2-esys/api/Esys_ContextLoad.c:279:Esys_ContextLoad_Finish() Received TPM Error
 ERROR:esys:src/tss2-esys/api/Esys_ContextLoad.c:93:Esys_ContextLoad() Esys Finish ErrorCode (0x00000902)
 DIGEST FREE
 DIGEST FREE
 DIGEST FREE
 CMP DEBUG: disconnected from CMP server
 CMP error: cannot duplicate context:2306 tpm:warn(2.0): out of memory for object contexts
 CMP error: not able to copy ctx
 CMP error: internal error
 CMP error: error sending
 CMP error: shutdown while in init
 CMP error: transfer error:request sent: IR, expected response: IP
 RSA FREE
 RAND FREE
 RAND FREE
 RAND FREE
 PROVIDER TEARDOWN
 
I've tried tpm2_flushcontext -t.
I recompiled tpm2-openssl with the following option and that appears to have worked around the issue:
--disable-op-digest
Is this what "?provider=tpm2,tpm2.digest!=yes" should effectively do?
 
-- 
 
 Chris Newman 
 https://mode51.software <https://mode51.software> 
 @mode51software <https://twitter.com/mode51software>

[-- Attachment #2: attachment.htm --]
[-- Type: text/html, Size: 7694 bytes --]