[tpm2] Re: {External} Re: OpenSSL 3 and tpm2 provider... / openssl cms

[Petr Gotthard <petr.gotthard at centrum.cz>]

[-- Attachment #1: Type: text/plain, Size: 3328 bytes --]

I have no idea, unfortunately. I don't think the tpm was invoked, because there is no error message from the tpm libraries. It feels more like if openssl had not the right fields populated.

Could you please build tpm2-openssl with "./configure --enable-debug"? The openssl commands will then print tracing information about TPM functions being called. This could give us some indication on what could be wrong.

Another idea: Could you send me (privately) the "signer.pem"? If it fails on my machine as well it will be easier to track and fix.


Petr
______________________________________________________________
> Od: "Sievert, James" <james.sievert(a)bsci.com>
> Komu: "tpm2(a)lists.01.org" <tpm2(a)lists.01.org>
> Datum: 28.04.2022 17:46
> Předmět: [tpm2] Re: {External} Re: OpenSSL 3 and tpm2 provider... / openssl cms
>
>Actually here the error is different:
>
>bsci(a)ip-10-132-42-225:~$ openssl cms -encrypt -provider tpm2 -provider default -in file.txt -recip handle:0x01000013 -aes128
>409CFA23377F0000:error:17000074:CMS routines:cms_EnvelopedData_Encryption_init_bio:error setting recipientinfo:../crypto/cms/cms_env.c:1142:
>409CFA23377F0000:error:17000068:CMS routines:CMS_final:cms lib:../crypto/cms/cms_smime.c:881:
>
>I was thinking that perhaps the cert. didn't permit encryption, so I read handle 0x01000013 into a file -- signer.pem and took the tpm2 provider completely out of the picture:
>
>$ openssl cms -encrypt -in file.txt -recip signer.pem -aes128 -out file.cipher -outform der
>
>This works.  So, it doesn't seem to be a problem with the recipient certificate.  I also tried this essentially making no _explicit_ use of the tpm2, but specifying the provider anyway:
>
>$ openssl cms -encrypt -provider tpm2 -provider default -in file.txt -recip signer.pem -aes128
>40BCDCB85F7F0000:error:17000074:CMS routines:cms_EnvelopedData_Encryption_init_bio:error setting recipientinfo:../crypto/cms/cms_env.c:1142:
>40BCDCB85F7F0000:error:17000068:CMS routines:CMS_final:cms lib:../crypto/cms/cms_smime.c:881:
>
>For this encryption, there's a DH operation taking place under the covers to come up with an encryption key.  I'm thinking the TPM might be coming into play for that?
>
>-----Original Message-----
>From: Petr Gotthard <petr.gotthard(a)centrum.cz> 
>Sent: Thursday, April 28, 2022 11:11 AM
>To: Sievert, James <james.sievert(a)bsci.com>; tpm2(a)lists.01.org
>Subject: Re: [tpm2] Re: {External} Re: OpenSSL 3 and tpm2 provider... / openssl cms
>
>>I also tried this:  
>>
>>openssl cms -encrypt -provider tpm2 -provider base -propquery ?provider=tpm2,tpm2.cipher!=yes -in file.txt -recip handle:0x01000013 -aes128
>>
>>Same result...
>
>That should work as well. Have you tried "-provider default" instead of "-provider base"?
>
>Openssl should be able to combine algorithms from different providers and the tpm2-openssl provider announces to openssl only those algorithms that are supported by the tpm2 chip itself. The only tricky bit is when the same algorithm is implemented twice, which is not your case... yet ;-).
>
>
>Petr
>_______________________________________________
>tpm2 mailing list -- tpm2(a)lists.01.org
>To unsubscribe send an email to tpm2-leave(a)lists.01.org
>%(web_page_url)slistinfo%(cgiext)s/%(_internal_name)s
>
>