[tpm2] using existing key with tpm2-tss-engine

[tpm2] using existing key with tpm2-tss-engine

[Roberts, William C]

[-- Attachment #1: Type: text/plain, Size: 365 bytes --]

Is there a way to use an existing key with the engine? Ie existing key to pem file?

I am not seeing a mechanism for this.

My use case:
I need to solve issue:
https://github.com/tpm2-software/tpm2-pkcs11/issues/16

So I can store the X509 certificate for a key in the attributes.

Looks like cert creation is tested a bit in:
test/sserver.sh


Bill

Re: [tpm2] using existing key with tpm2-tss-engine

[Fuchs, Andreas]

[-- Attachment #1: Type: text/plain, Size: 901 bytes --]

Yes, X509 certificate creation works.

"Importing an existing key" however is in the backlog:
https://github.com/tpm2-software/tpm2-tss-engine/issues/39

Workaround for the moment could be to temporarily evictControl the key to persistent.

Otherwise sorry to keep you waiting for the moment.
________________________________________
From: Roberts, William C [william.c.roberts(a)intel.com]
Sent: Thursday, March 07, 2019 19:26
To: tpm2(a)lists.01.org
Cc: Fuchs, Andreas
Subject: using existing key with tpm2-tss-engine

Is there a way to use an existing key with the engine? Ie existing key to pem file?

I am not seeing a mechanism for this.

My use case:
I need to solve issue:
https://github.com/tpm2-software/tpm2-pkcs11/issues/16

So I can store the X509 certificate for a key in the attributes.

Looks like cert creation is tested a bit in:
test/sserver.sh


Bill

Re: [tpm2] using existing key with tpm2-tss-engine

[David Woodhouse]

[-- Attachment #1: Type: text/plain, Size: 0 bytes --]



[-- Attachment #2: attachment.html --]
[-- Type: text/html, Size: 1719 bytes --]

Re: [tpm2] using existing key with tpm2-tss-engine

[Roberts, William C]

[-- Attachment #1: Type: text/plain, Size: 1798 bytes --]

I guess I could just use openssl-to-pkcs11 engine and load up my pkcs11 module...

> -----Original Message-----
> From: David Woodhouse [mailto:dwmw2(a)infradead.org]
> Sent: Thursday, March 7, 2019 10:57 AM
> To: Fuchs, Andreas <andreas.fuchs(a)sit.fraunhofer.de>
> Cc: Roberts, William C <william.c.roberts(a)intel.com>; tpm2(a)lists.01.org
> Subject: Re: [tpm2] using existing key with tpm2-tss-engine
> 
> The other workaround is to import with James Bottomley's
> openssl_tpm2_engine and then use it with tpm2-tss-engine.
> 
> --
> dwmw2
> 
> On 7 Mar 2019 18:31, "Fuchs, Andreas" <andreas.fuchs(a)sit.fraunhofer.de>
> wrote:
> 
> 
> 	Yes, X509 certificate creation works.
> 
> 	"Importing an existing key" however is in the backlog:
> 	https://github.com/tpm2-software/tpm2-tss-engine/issues/39
> 
> 	Workaround for the moment could be to temporarily evictControl the
> key to persistent.
> 
> 	Otherwise sorry to keep you waiting for the moment.
> 	________________________________________
> 	From: Roberts, William C [william.c.roberts(a)intel.com]
> 	Sent: Thursday, March 07, 2019 19:26
> 	To: tpm2(a)lists.01.org
> 	Cc: Fuchs, Andreas
> 	Subject: using existing key with tpm2-tss-engine
> 
> 	Is there a way to use an existing key with the engine? Ie existing key to
> pem file?
> 
> 	I am not seeing a mechanism for this.
> 
> 	My use case:
> 	I need to solve issue:
> 	https://github.com/tpm2-software/tpm2-pkcs11/issues/16
> 
> 	So I can store the X509 certificate for a key in the attributes.
> 
> 	Looks like cert creation is tested a bit in:
> 	test/sserver.sh
> 
> 
> 	Bill
> 	_______________________________________________
> 	tpm2 mailing list
> 	tpm2(a)lists.01.org
> 	https://lists.01.org/mailman/listinfo/tpm2
> 
> 

Re: [tpm2] using existing key with tpm2-tss-engine

[David Woodhouse]

[-- Attachment #1: Type: text/plain, Size: 431 bytes --]

On Wed, 2019-03-13 at 13:41 +0000, Roberts, William C wrote:
> I guess I could just use openssl-to-pkcs11 engine and load up my
> pkcs11 module...

It would be nice if the PKCS#11 token worked in such a way that you
could just export an object from its storage to a PEM file, but I don't
think that's true at the moment, is it? The way the keys are wrapped by
the PKCS#11 token is different to the way the engines do it.


[-- Attachment #2: smime.p7s --]
[-- Type: application/x-pkcs7-signature, Size: 5174 bytes --]