linux-kernel - Re: [PATCH RFC v2 0/5] Asymmetric TPM2 key type

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <D1DMTJYL7TFC.3J3FM36K06ECD@kernel.org>
Date: Sun, 19 May 2024 15:49:28 +0300
From: "Jarkko Sakkinen" <jarkko@...nel.org>
To: "Jarkko Sakkinen" <jarkko@...nel.org>, "Herbert Xu"
 <herbert@...dor.apana.org.au>
Cc: <linux-integrity@...r.kernel.org>, <keyrings@...r.kernel.org>,
 <Andreas.Fuchs@...ineon.com>, "James Prestwood" <prestwoj@...il.com>,
 "David Woodhouse" <dwmw2@...radead.org>, "David Howells"
 <dhowells@...hat.com>, "David S. Miller" <davem@...emloft.net>, "Peter
 Huewe" <peterhuewe@....de>, "Jason Gunthorpe" <jgg@...pe.ca>, "James
 Bottomley" <James.Bottomley@...senPartnership.com>, "Stefan Berger"
 <stefanb@...ux.ibm.com>, "Ard Biesheuvel" <ardb@...nel.org>, "Mario
 Limonciello" <mario.limonciello@....com>, "open list:CRYPTO API"
 <linux-crypto@...r.kernel.org>, "open list" <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH RFC v2 0/5] Asymmetric TPM2 key type

On Sun May 19, 2024 at 3:25 AM EEST, Jarkko Sakkinen wrote:
> ## Overview
>
> Introduce tpm2_key_rsa implementing asymmetric TPM RSA key.
>
> I submit this first as RFC as I could not execute the keyctl padd in the
> following sequence (returns EBADF):
>
> tpm2_createprimary --hierarchy o -G rsa2048 -c owner.txt
> tpm2_evictcontrol -c owner.txt 0x81000001
> tpm2_getcap handles-persistent
> openssl genrsa -out private.pem 2048
> tpm2_import -C 0x81000001 -G rsa -i private.pem -u key.pub -r key.priv
> tpm2_encodeobject -C 0x81000001 -u key.pub -r key.priv -o key.priv.pem
> openssl asn1parse -inform pem -in key.priv.pem -noout -out key.priv.der
> key_serial=`cat key.priv.der | keyctl padd asymmetric tpm @u`

After v2 changes it ends up to -EINVAL and:

OID is "2.23.133.10.1.3" which is not TPMSealedData

which makes total sense. James' old patch set has already TPMLoadableKey
parsing PoC'd so I use that as the reference.

After the sequence above successfully completes keyctl public key ops
are accesible by using $key_serial as the serial.

BR, Jarkko