Re: TPM2_Sign vs TPM2_RSA_Decrypt

["Jarkko Sakkinen" <jarkko@kernel.org>]

On Thu May 16, 2024 at 4:31 PM EEST, Jarkko Sakkinen wrote:
> On Thu May 16, 2024 at 4:05 PM EEST,  wrote:
> > > If someone could really put TPM2_Sign into nutshell that'd be awesome.
> >
> > Well, TPM2_Sign will perform a signing operation for you given the key.
> > You can set the scheme in the scheme parameter. That's about it...
>
> Right. What about the ticket? Can you imagine a use case for that?
>
> > > Maybe a dumb question but what I could possibly accomplish with TPM2_Sign that I could not accomplish with TPM2_RSA_Decrypt and appropraite ASN.1 heading and padding?
> >
> > Yes. If you set TPMA_OBJECT_SIGN but unset TPMA_OBJECT_DECRYPT. This
> > way you can make sure that only signing-padding can ever be executed
> > but never decrypt-based stuff. In order to use TPM2_RSA_Decrypt you
> > need to set TPMA_OBJECT_DECRYPT which is kind of weird.
>
> David, did you have a "framework" for deciding between these two
  ~~~~~  
  James

Ugh, sorry ;-)

BR, Jarkko