Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Create private key in TPM and use it without password prompt #2901

Open
raihav opened this issue Sep 25, 2024 · 0 comments
Open

Create private key in TPM and use it without password prompt #2901

raihav opened this issue Sep 25, 2024 · 0 comments

Comments

@raihav
Copy link

raihav commented Sep 25, 2024

Expected Behavior
I want to start openssl server with tpm2tss engine that uses a private key stored in TPM without prompt for password.
Hint: The prompt should have been supressed by: Enable emptyAuth detection for noda persistent keys #55
Please can you tell me how I shall create a key to avoid password prompt by tpm2tss engine?

Test
I have created the key with NODA and stored in TPM with handle 0x81010101
tpm2_create -C primary.ctx -G rsa -u key.pub -r key.priv -a "decrypt|sign|fixedtpm|fixedparent|sensitivedataorigin|userwithauth|noda"

With tpm2tss engine, the server starts and asks for password.
openssl s_server -cert secrets/localhost.crt -key 0x81010101 -keyform engine -engine tpm2tss -accept 4443

For comparison with tpm2 provider, the server starts without prompt.
openssl s_server -provider tpm2 -provider default -propquery ?provider=tpm2 -accept 4443 -www -key handle:0x81010101 -cert secrets/localhost.crt

Context
gRPC supports OpenSSL engine only and the password prompt is not implemented in gRPC code.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant