I have a DPE application and I am doing client.Sign of a message. This function returns a signature, a certificate from which we can get public key and other few things.
I have extracted the public key from this certificate and I found that that is of type ECDSA.
then I tried loading this public key into the TPM by using tpm2.loadexternal by forming tpm2.Public{} struct.
pubKey, err := x509.ParsePKIXPublicKey(publicKeyDer)
if err != nil {
fmt.Println("Failed to parse DER-encoded public key:", err)
os.Exit(1)
}
// Create a tpm2.Public structure from the parsed ECDSA public key
switch pubKey := pubKey.(type) {
case *ecdsa.PublicKey:
tpmPublic = tpm2.Public{
Type: tpm2.AlgECDSA, // ECDSA key type
NameAlg: tpm2.AlgSHA256,
//Attributes: tpm2.FlagSign | tpm2.FlagRestricted | tpm2.FlagDecrypt,
Attributes: tpm2.FlagSign | tpm2.FlagSensitiveDataOrigin | tpm2.FlagUserWithAuth,
ECCParameters: &tpm2.ECCParams{
Symmetric: &tpm2.SymScheme{
Alg: tpm2.AlgECDSA,
KeyBits: 2048,
Mode: tpm2.AlgSHA256,
},
Sign: &tpm2.SigScheme{
Alg: tpm2.AlgECDSA,
Hash: tpm2.AlgSHA256,
//Count: 0,
},
//CurveID: tpm2.EllipticCurve(0x0003), // You should adjust this based on your ECDSA curve
CurveID: tpm2.CurveNISTP256,
Point: tpm2.ECPoint{
XRaw: new(big.Int).SetBytes(pubKey.X.Bytes()).Bytes(),
YRaw: new(big.Int).SetBytes(pubKey.Y.Bytes()).Bytes(),
},
},
}
default:
fmt.Println("Unsupported public key type")
os.Exit(1)
}
fmt.Printf("TPM2 Public Key:\n%v\n", tpmPublic)
// private := tpm2.Private{
// Type: tpm2.AlgECC,
// //Sensitive: pk.D.Bytes(),
// }
_, _, err = tpm2.LoadExternal(rwc, tpmPublic, tpm2.Private{}, tpm2.HandleNull)
if err != nil {
fmt.Printf("Err : %v", err)
os.Exit(1)
}
for this loadExternal operation, I am getting below error,
Err : encoding RSAParameters, ECCParameters, SymCipherParameters or KeyedHash: unsupported type in TPMT_PUBLIC: 0x4543445341
exit status 1
if I change the type and Alg from ECDSA to ECC in all the places of the structure like,
Type: tpm2.AlgECC
Alg: tpm2.AlgECC
it throws,
Err : parameter 2, error code 0x16 : unsupported symmetric algorithm or key size, or not appropriate for instance
exit status 1
What am doing wrong here? first of all, Is the way I try to load a public key alone into the TPM correct? help me on this.
Note : I am not using real TPM instead I am using a TPM simulator by following (https://github.com/stefanberger/swtpm/wiki) and TPM related packages from (https://francislampayan.medium.com/how-to-setup-tpm-simulator-in-ubuntu-20-04-25ec673b88dc) this link.
Thanks..!
As indicated by your error (
unsupported symmetric algorithm): your symmetric crypto scheme is faulty.You might want to try to leave that empty (
tpm2.AlgNull):https://github.com/folbricht/tpmk/blob/87ef9183fb67bc1cd4da7269f2b332c8d0991084/key.go#L24-L27
Or use AES:
https://github.com/google/go-tpm-tools/blob/44e8925789363b77e38c23bb5cf00eeae94be296/client/template.go#L35-L39
Example of a working TPM2_LoadExternal call
How I got it:
Start TPM simulator in its own terminal:
Generate key:
Load key into TPM simulator and dump the traffic into
tpm2_log.pcap(requires tpm2-tss >= v3.1.0):Decode the TPM traffic: