[tpm2] Re: {External} Re: OpenSSL 3 and tpm2 provider... / openssl cms

[Petr Gotthard <petr.gotthard at centrum.cz>]

[-- Attachment #1: Type: text/plain, Size: 1011 bytes --]

>> Debugging openssl is tricky when it fails without any error message
>
>Sorry about that.  ☹

No problem. I am glad you are trying the tpm2 provider in your environment. :-)

>> If you create e.g. a RSA-PSS key restricted to a specific hash-algorithm you shouldn't need this extra argument
>
>I was under the impression that the key was created using the sha256 hashing algorithm.  Here's the command used for creating the key:
>
>tpm2_create -C /run/user/201/platform.ctx -G ecc256:ecdsa-sha256 -r /run/user/201/private -u /run/user/201/public -a 'fixedtpm|fixedparent|sensitivedataorigin|sign|userwithauth|noda'
>
>Here's the result:
>
>$ tpm2_readpublic -c 0x81800002
>scheme:
>  value: ecdsa
>  raw: 0x18
>scheme-halg:
>  value: sha256
>  raw: 0xb

Yeah. What I wrote was apparently true for RSA keys only. The EC keys do not correctly supply the hash algorithm. That is a bug that will be fixed in the coming days: https://github.com/tpm2-software/tpm2-openssl/issues/34


Petr