search

tpm2-software / tpm2-tss-engine

OpenSSL Engine for TPM2 devices
https://tpm2-software.github.io
BSD 3-Clause "New" or "Revised" License
148 stars 97 forks source link

How to use tpm2-tss-engine to sign firmware and verify on device with a TPM? Are there already examples? Perhaps good to add some? #191

Closed capiman2 closed 4 years ago

capiman2 commented 4 years ago

I have successfully used the following commands on a device which has a TPM: (taken from other issues of this repo)

1) sudo tpm2tss-genkey -a ecdsa mykey 2) openssl ec -engine tpm2tss -inform engine -in mykey -pubout -outform pem -out mykey.pub 3) sudo openssl dgst -engine tpm2tss -keyform engine -sha256 -sign mykey -out mydatasig mydata 4) openssl dgst -sha256 -keyform pem -verify mykey.pub -signature mydatasig mydata

But thinking about it, I think it is not exactly what I need. The above case shows a case where something is signed on a device with a TPM. But in my case I need the webserver generate the signature, sent the firmware together with the signature file to the device with TPM and verify it on the device with TPM connected.

So I assume step 3 must work without -engine and public key? And step 4 must use -engine and use private key?

I tried step 3 but it tells me it needs the private key. How to change this? Or is my sequence completely wrong?

AndreasFuchsTPM commented 4 years ago

In your usecase, you want to "verify a signature on the device" ? That step does not include a private key (which is what the TPM protects) and thus yes, your use case does not fit the TPM. If you're usecase is to store the public key on the device such that it cannot be altered, you want to call tpm2_nvdefinespace/nvwrite/nvread to store the public key PEM file and use openssl without the engine. The engine is for generating signatures with a private key protected by the TPM.

If you need any more consultancy on TPM concepts (since this seems less of a software-bug-helping matter) feel free to contact me via email.

funkcjonusz commented 3 years ago

The first command ( tpm2tss-genkey -a ecdsa mykey) generates a private key and save it to file mykey. The first line of the file mykey confirm it. $ cat mykey -----BEGIN TSS2 PRIVATE KEY----- ..........

But in the answer @AndreasFuchsSIT said: " .. private key (which is what the TPM protects) .. "

How private key is protected by TPM if it is available in the file "mykey" ?

AndreasFuchsTPM commented 3 years ago

The contained private key of that file is encryted using a key only known to the TPM.