RE: TPM2_Sign vs TPM2_RSA_Decrypt

[<Andreas.Fuchs@infineon.com>]

> If someone could really put TPM2_Sign into nutshell that'd be awesome.

Well, TPM2_Sign will perform a signing operation for you given the key.
You can set the scheme in the scheme parameter. That's about it...

> Maybe a dumb question but what I could possibly accomplish with TPM2_Sign that I could not accomplish with TPM2_RSA_Decrypt and appropraite ASN.1 heading and padding?

Yes. If you set TPMA_OBJECT_SIGN but unset TPMA_OBJECT_DECRYPT. This way you can make sure that only signing-padding can ever be executed but never decrypt-based stuff.
In order to use TPM2_RSA_Decrypt you need to set TPMA_OBJECT_DECRYPT which is kind of weird.

Also, if you want to use a restriced key (formally called Attestation Key) for regular signing operations, you need to have a TPMA_OBJECT_SIGN and must not have TPMA_OBJECT_DECRYPT set.

Those would be the reasons for preferring TPM2_Sign wherever possible IMHO.

Cheers,
Andreas

-----Original Message-----
From: Jarkko Sakkinen <jarkko@kernel.org> 
Sent: Donnerstag, 16. Mai 2024 14:52
To: Fuchs Andreas (SMD C3 EMEA TM) <Andreas.Fuchs@infineon.com>; tpm2@lists.linux.dev
Cc: James Prestwood <prestwoj@gmail.com>
Subject: Re: TPM2_Sign vs TPM2_RSA_Decrypt

Caution: This e-mail originated outside Infineon Technologies. Do not click on links or open attachments unless you validate it is safe<https://intranet-content.infineon.com/explore/aboutinfineon/rules/informationsecurity/ug/SocialEngineering/Pages/SocialEngineeringElements_en.aspx>.



On Thu May 16, 2024 at 3:01 PM EEST,  wrote:
> For the OpenSSL engines and also the GNU-TLS engine, we go ahead and 
> use TPM2_RSA_Decrypt for RSA Signing but TPM2_Sign for ECDSA signing.

Yeah we get simplest and most understandable and most compatible RSA because it is textbook style with no strings attached :-) You can fit it to any scheme.

I can admit after reading TPM2_Sign documentation, my head hurts and I still don't think I fully get the gist of it so better not to use something that you don't get, right? :-)

If someone could really put TPM2_Sign into nutshell that'd be awesome.

> The reason here was, that OpenSSL wants to perform SHA512 digests and 
> padding, whilst the TPM only supported SHA384. And an OpenSSL engine 
> could not tell the OpenSSL-TLS-module, which Hash-Algs are supported.
> If that restriction does not exist, I would also tend to use TPM2_Sign 
> for RSA signing.

Maybe a dumb question but what I could possibly accomplish with TPM2_Sign that I could not accomplish with TPM2_RSA_Decrypt and appropraite ASN.1 heading and padding?

This connects to the not understanding TPM2_Sign (obviously).

Just trying to make sure that we make exactly right call for kernel.

Thanks for responding!

>
> Cheers,
> Andreas

BR, Jarkko