TPM: (TSS.MSR) Can't perform RSA encryption/decryption with persistent key, using encryption session

Alex Nemkovich 1 Reputation point
2022-01-28T22:37:24.363+00:00

Description of the situation by steps:

  1. I start encryption/decryption sessions
  2. I create primary RSA key
  3. I make key object persistent
  4. I try to encrypt data, using persistent key handle Sample of my code below

ByteVec dataToEncrypt = TPM_HASH::FromHashOfString(TPM_ALG_ID::SHA1, "secret");
cout << "Data to encrypt: " << dataToEncrypt << endl;

// 1) Starting decryption / encryption sessions

AUTH_SESSION sess = tpm.StartAuthSession(TPM_SE::HMAC, TPM_ALG_ID::SHA256,
TPMA_SESSION::continueSession | TPMA_SESSION::decrypt,
TPMT_SYM_DEF(TPM_ALG_ID::AES, 128, TPM_ALG_ID::CFB));

AUTH_SESSION encSess = tpm.StartAuthSession(TPM_SE::HMAC, TPM_ALG_ID::SHA1,
TPMA_SESSION::continueSession | TPMA_SESSION::encrypt,
TPMT_SYM_DEF(TPM_ALG_ID::AES, 128, TPM_ALG_ID::CFB));

// 2) Creating primary RSA key

TPMT_PUBLIC primTempl(TPM_ALG_ID::SHA1,
TPMA_OBJECT::decrypt | TPMA_OBJECT::userWithAuth | TPMA_OBJECT::sensitiveDataOrigin,
null, // No policy
TPMS_RSA_PARMS(null, TPMS_SCHEME_OAEP(TPM_ALG_ID::SHA1), 2048, 65537),
TPM2B_PUBLIC_KEY_RSA());

auto storagePrimary = tpm[sess].CreatePrimary(TPM_RH::OWNER, null, primTempl, null, null);

// 3) Making this key object persistent

TPM_HANDLE& keyHandle = storagePrimary.handle;

TPM_HANDLE persistentHandle = TPM_HANDLE::Persistent(1000);

ByteVec name = { 1, 2, 3, 4 };
persistentHandle.SetName(name);

tpm._AllowErrors().EvictControl(TPM_RH::OWNER, persistentHandle, persistentHandle);

tpm.EvictControl(TPM_RH::OWNER, storagePrimary.handle, persistentHandle);

tpm.FlushContext(storagePrimary.handle);

// 4) Trying to encrypt data with persistent RSA key

auto enc = tpm[sess].RSA_Encrypt(persistentHandle, dataToEncrypt, TPMS_NULL_ASYM_SCHEME(), null);
cout << "RSA-encrypted data: " << enc << endl;`

This row leads to error BAD_AUTH. What am I doing wrong?

auto enc = tpm[sess].RSA_Encrypt(persistentHandle, dataToEncrypt, TPMS_NULL_ASYM_SCHEME(), null);

When I perform encryption with not persistent key handle, using encryption session, everything works fine.

auto enc = tpm[sess].RSA_Encrypt(keyHandle, dataToEncrypt, TPMS_NULL_ASYM_SCHEME(), null);

C++
C++
A high-level, general-purpose programming language, created as an extension of the C programming language, that has object-oriented, generic, and functional features in addition to facilities for low-level memory manipulation.
3,548 questions
Windows 10 Security
Windows 10 Security
Windows 10: A Microsoft operating system that runs on personal computers and tablets.Security: The precautions taken to guard against crime, attack, sabotage, espionage, or another threat.
2,770 questions
{count} votes