[Bug 1958439] [NEW] tpm2-tss: builds against OpenSSL 3.0, but fails on execution

[Launchpad Bug Tracker]

You have been subscribed to a public bug by Simon Chopin (schopin):

In Ubuntu 22.04 the current tpm2-tools are not working correctly because
of an OpenSSL HMAC error (in Ubuntu 20.04 and 21.10 the problem does not
exist):

rire at rire-ThinkPad-T14-Gen-2a:~$ sudo tpm2_createprimary -C o -c prim.ctx
ERROR:esys_crypto:src/tss2-esys/esys_crypto_ossl.c:327:iesys_cryptossl_hmac_start() ErrorCode (0x00070001) EVP_PKEY_new_mac_key
ERROR:esys_crypto:src/tss2-esys/esys_crypto.c:185:iesys_crypto_authHmac() Error ErrorCode (0x00070001)
ERROR:esys:src/tss2-esys/esys_iutil.c:1244:iesys_compute_hmac() HMAC error ErrorCode (0x00070001)
ERROR:esys:src/tss2-esys/esys_iutil.c:1354:iesys_gen_auths() Error while computing hmacs ErrorCode (0x00070001)
ERROR:esys:src/tss2-esys/api/Esys_CreatePrimary.c:244:Esys_CreatePrimary_Async() Error in computation of auth values ErrorCode (0x00070001)
ERROR:esys:src/tss2-esys/api/Esys_CreatePrimary.c:110:Esys_CreatePrimary() Error in async function ErrorCode (0x00070001)
ERROR: Esys_CreatePrimary(0x70001) - esapi:Catch all for all errors not otherwise specified
ERROR: Unable to run tpm2_createprimary

rire at rire-ThinkPad-T14-Gen-2a:~$ sudo tpm2_clear
ERROR:esys_crypto:src/tss2-esys/esys_crypto_ossl.c:327:iesys_cryptossl_hmac_start() ErrorCode (0x00070001) EVP_PKEY_new_mac_key
ERROR:esys_crypto:src/tss2-esys/esys_crypto.c:185:iesys_crypto_authHmac() Error ErrorCode (0x00070001)
ERROR:esys:src/tss2-esys/esys_iutil.c:1244:iesys_compute_hmac() HMAC error ErrorCode (0x00070001)
ERROR:esys:src/tss2-esys/esys_iutil.c:1354:iesys_gen_auths() Error while computing hmacs ErrorCode (0x00070001)
ERROR:esys:src/tss2-esys/api/Esys_Clear.c:188:Esys_Clear_Async() Error in computation of auth values ErrorCode (0x00070001)
ERROR:esys:src/tss2-esys/api/Esys_Clear.c:74:Esys_Clear() Error in async function ErrorCode (0x00070001)
ERROR: Esys_Clear(0x70001) - esapi:Catch all for all errors not otherwise specified
ERROR: Unable to run tpm2_clear

There is a bugreport in Red Hat which seems related:
https://bugzilla.redhat.com/show_bug.cgi?id=1989321

A workaround is possible by compiling tpm2-tss, the dependency of tpm2-tools, with mbedTLS instead of OpenSSL and without FAPI (which I don't need actually):
~/dev/tpm2-tss-3.1.0$ ./configure --with-crypto=mbed --disable-fapi --prefix=/usr

It seems also to be fixed in current master branch of tpm2-tss already.

** Affects: tpm2-tools (Ubuntu)
     Importance: Undecided
         Status: New

** Affects: tpm2-tss (Ubuntu)
     Importance: Undecided
         Status: In Progress


** Tags: fr-2032 transition-openssl3-jj
-- 
tpm2-tss: builds against OpenSSL 3.0, but fails on execution
https://bugs.launchpad.net/bugs/1958439
You received this bug notification because you are a member of Ubuntu Sponsors Team, which is subscribed to the bug report.