[tpm2] tpm2-tools AK authorization question

[Munson, Charles - 0553 - MITLL <Charles.Munson at ll.mit.edu>]

[-- Attachment #1: Type: text/plain, Size: 1587 bytes --]

Hello, 

 

I'm not sure if this is user error or an issue with one of the tools.   I am
trying to do a createek -> createak -> makecredential -> activatecredential
workflow with the new ESAPI tools in master (following the advice when used
with a resource manager here:
https://github.com/tpm2-software/tpm2-tools/blob/master/man/tpm2_createak.1.
md).  This seems to work well when there is no AK authorization set (when
performing createak), though fails with an "authorization HMAC check failed"
error when setting an AK_AUTH.  

 

So for instance (following the documentation): 

 

tpm2_createek -c 0x81010001 -G rsa -p ek.pub

tpm2_createak -C 0x81010001 -k 0x81010002 -p ak.pub -n ak.name -P "akpw"

tpm2_makecredential -e ek.pub -s file_input_data.txt -n <ak.name here> -o
outcred.out

tpm2_activatecredential -c 0x81010002 -C 0x81010001 -f outcred.out -o
verify.out -P "akpw"

WARNING:esys:src/tss2-esys/api/Esys_ActivateCredential.c:342:Esys_ActivateCr
edential_Finish() Received TPM Error 

ERROR:esys:src/tss2-esys/api/Esys_ActivateCredential.c:127:Esys_ActivateCred
ential() Esys Finish ErrorCode (0x0000098e) 

ERROR: Esys_ActivateCredential(0x98E) - tpm:session(1):the authorization
HMAC check failed and DA counter incremented

ERROR: Unable to run tpm2_activatecredential

 

Note that by not using an AK_AUTH (removing all of the  -P "akpw" code) that
this works, and this example used to work pre-ESAPI.  Is this no longer
supported?  Everything seems to work fine still with tpm2_quote. 

 

Best,

Charlie 

 


[-- Attachment #2: attachment.html --]
[-- Type: text/html, Size: 3952 bytes --]

[-- Attachment #3: smime.p7s --]
[-- Type: application/pkcs7-signature, Size: 5491 bytes --]