Closed YaHosoda closed 6 years ago
This is a pretty complicated scenario. Can you link to your code?
Even better, can you provide a debug trace dump that gives all the command and response byte streams to/from the TPM and the debug prints related to HMAC and session key calculations?
Will Arthur
From: Philip Tricca [mailto:notifications@github.com] Sent: Wednesday, June 14, 2017 12:15 PM To: 01org/TPM2.0-TSS TPM2.0-TSS@noreply.github.com Cc: Subscribed subscribed@noreply.github.com Subject: Re: [01org/TPM2.0-TSS] PolicySecret sometimes fails with 0x98e (#425)
This is a pretty complicated scenario. Can you link to your code?
— You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub https://github.com/01org/TPM2.0-TSS/issues/425#issuecomment-308481760 , or mute the thread https://github.com/notifications/unsubscribe-auth/AEdleJE07vKkeom3LYZeIx_0S49vKVIVks5sEAbugaJpZM4N3JFr . https://github.com/notifications/beacon/AEdleI0QycYZgbjDLY8gZlFKf2IhAjr1ks5sEAbugaJpZM4N3JFr.gif
Thank you for your responses. I am sorry to say that I cannot directly link my source here. But, I just identified two problems.
1 If I do not flush the at the end of each policy session , instead I try to flush them at the end of my program like this; Tss2_Sys_GetCapability (sysContext, 0, TPM_CAP_HANDLES, LOADED_SESSION_FIRST, 20, &moreData, &capabilityData, 0); CheckPassed (rval); printf ("Loaded session handles: %d\n", capabilityData.data.handles.count); for (i = 0; i < capabilityData.data.handles.count; i++) { DebugPrintf (NO_PREFIX, "0x%8x, \n", capabilityData.data.handles.handle[i]); rval = Tss2_Sys_FlushContext (sysContext, capabilityData.data.handles.handle[i]); CheckPassed (rval); } Next, I re-run the program, I encounter the 0x98e problem after PolicySecret with HMAC.
2 I start a HMAC sessions, call several TSS APIs without using this session handle, then I flush this session and continue my program, I encounter the 0x98e next time I call PolicySecret with HMAC.
Any advice would be appreciated
Decoding that response code is usually the first step. We have a tool over at the tpm2.0-tools project for doing this (tpm2_rc_decode). We could really use an strerror
like function / library to allow folks to do this programmatically.
You need to enable tracing with debug messages and the HMAC calculation messages turned on.
That’s the only way you’re ever going to be able to debug this.
From: YaHosoda [mailto:notifications@github.com] Sent: Thursday, June 15, 2017 11:08 AM To: 01org/TPM2.0-TSS TPM2.0-TSS@noreply.github.com Cc: wcarthur1 warthur@sigovs.com; Comment comment@noreply.github.com Subject: Re: [01org/TPM2.0-TSS] PolicySecret sometimes fails with 0x98e (#425)
Thank you for your responses. I am sorry to say that I cannot directly link my source here. But, I just identified two problems.
1 If I do not flush the at the end of each policy session , instead I try to flush them at the end of my program like this; Tss2_Sys_GetCapability (sysContext, 0, TPM_CAP_HANDLES, LOADED_SESSION_FIRST, 20, &moreData, &capabilityData, 0); CheckPassed (rval); printf ("Loaded session handles: %d\n", capabilityData.data.handles.count); for (i = 0; i < capabilityData.data.handles.count; i++) { DebugPrintf (NO_PREFIX, "0x%8x, \n", capabilityData.data.handles.handle[i]); rval = Tss2_Sys_FlushContext (sysContext, capabilityData.data.handles.handle[i]); CheckPassed (rval); } Next, I re-run the program, I encounter the 0x98e problem after PolicySecret with HMAC.
2 I start a HMAC sessions, call several TSS APIs without using this session handle, then I flush this session and continue my program, I encounter the 0x98e next time I call PolicySecret with HMAC.
Any advice would be appreciated
— You are receiving this because you commented. Reply to this email directly, view it on GitHub https://github.com/01org/TPM2.0-TSS/issues/425#issuecomment-308765689 , or mute the thread https://github.com/notifications/unsubscribe-auth/AEdleCVuT7O7EjcALfQxZ1SSIBb-Bxa9ks5sEUjqgaJpZM4N3JFr .
Thank you for your device. I set the DEBUG flag in TpmCalcPHash.c SessionHmac.c and re-compile. Below is the excerpt from the program and the execution log. Still, I can't find problems.
Source //loadedSha1KeyHandle_SK is a handle of a loaded signning key //nvAuth is the authValue of that key rval = AddEntity (loadedSha1KeyHandle_SK, &nvAuth); //nvSession_P is a policy session structure rval =
Tss2_Sys_PolicySecret_Prepare (sysContext, loadedSha1KeyHandle_SK, nvSession_P->sessionHandle, 0, 0, 0, 0); CheckPassed (rval); //nvSession is a HMAC session structure sessionData.sessionHandle = nvSession->sessionHandle; sessionData.hmac.t.size = 0; sessionData.nonce.t.size = 1; sessionData.nonce.t.buffer[0] = 0xa5; ((UINT32 ) (&sessionAttributes)) = 0; sessionData.sessionAttributes = sessionAttributes; sessionData.sessionAttributes.continueSession = 1;
// Roll nonces for command RollNonces (nvSession, &sessionData.nonce);
// Complete command authorization area, by computing
// HMAC and setting it in sessionsData.
rval = ComputeCommandHmacs (sysContext, loadedSha1KeyHandle_SK,
nvSession_P->sessionHandle, &sessionsData,
TPM_RC_FAILURE);
CheckPassed (rval);
rval =
Tss2_Sys_PolicySecret (sysContext, loadedSha1KeyHandle_SK,
nvSession_P->sessionHandle, &sessionsData, 0, 0, 0,
0, 0, 0, &sessionsDataOut);
CheckPassed (rval);
RollNonces (nvSession, &sessionDataOut.nonce);
Good (First time) In GetSessionStruct
NAME1 = 00 0b ad a4 97 a0 ae 29 d1 52 73 3b c5 6c 9c 69 8d e0 80 61 d2 3a 1d 06 d0 57 76 82 ab 2c a9 53 6d 30
NAME2 = 03 00 00 01
PHASH input bytes= 00 00 01 51 00 0b ad a4 97 a0 ae 29 d1 52 73 3b c5 6c 9c 69 8d e0 80 61 d2 3a 1d 06 d0 57 76 82 ab 2c a9 53 6d 30 03 00 00 01 00 00 00 00 00 00 00 00 00 00
PHASH = 26 ed 16 11 dd 5b f0 62 97 f5 88 b5 13 aa de 6d e5 96 12 4d 6e 2b 3e 44 4e 62 b9 c3 aa 08 f5 c6
hmacKey = 4e 56 5f 50 61 73 73 77 6f 72 64 5f 6f 72 67 69 6e 61 6c 31 32 33 34 35 36 37 38 39 30 61 62 63
bufferlist[0]: 26 ed 16 11 dd 5b f0 62 97 f5 88 b5 13 aa de 6d e5 96 12 4d 6e 2b 3e 44 4e 62 b9 c3 aa 08 f5 c6
bufferlist[1]: a5
bufferlist[2]: 72 ac c5 6a b0 fe 81 20 d4 9f fd b4 94 e2 22 7c e4 d8 95 42
bufferlist[3]:
bufferlist[5]: 01 passing case: PASSED!
Second Time (Error) aIn GetSessionStruct
NAME1 = 00 0b b9 d6 a1 85 47 79 ab 83 46 72 66 cf 94 67 d2 cd 39 97 5b 02 63 88 9d 26 b1 a7 96 d2 53 5c 1f 8f
NAME2 = 03 00 00 00
PHASH input bytes= 00 00 01 51 00 0b b9 d6 a1 85 47 79 ab 83 46 72 66 cf 94 67 d2 cd 39 97 5b 02 63 88 9d 26 b1 a7 96 d2 53 5c 1f 8f 03 00 00 00 00 00 00 00 00 00 00 00 00 00
PHASH = 6a 60 75 02 4c 29 00 de 0d bb da 41 22 fd 3d ef f0 37 5f 14 6b b7 f8 7c 69 88 1f 52 fe ca a9 cd
hmacKey = 4e 56 5f 50 61 73 73 77 6f 72 64 5f 6f 72 67 69 6e 61 6c 31 32 33 34 35 36 37 38 39 30 61 62 63
bufferlist[0]: 6a 60 75 02 4c 29 00 de 0d bb da 41 22 fd 3d ef f0 37 5f 14 6b b7 f8 7c 69 88 1f 52 fe ca a9 cd
bufferlist[1]: a5
bufferlist[2]: aa 2d f1 c2 35 18 34 1b c5 60 3c 3a e7 27 5e cb 1e 99 3d aa
bufferlist[3]:
bufferlist[4]:
bufferlist[5]: 01 passing case: PASSED!
passing case: FAILED! TPM Error: 0x98e
Hi At first, I create several keys. 1 CreatePrimary with EK parameters. 2 Create(MK) under EK, policy Session. 3 Create(SK) under MK, HMAC Session.
Then, 4 Load SK, Hamdle is loadedSK 5 StartAuthSession with HMAC, the handle is Hsession 6 StartAuthSession with Policy, the handle is Psession 7 Compute HMAC with Hsession 8 PolicySecret(, Psession, HMAC ,...)
PolicySecret somtimes fails with 0x98e (Auth Fail)
IF I Do Create(SK) without HMAC Session of No.3. or IF I run the whole sequence, and re-run, without restarting the resource manager
Any suggestions?