[Bug 1958439] Re: tpm2-tss: builds against OpenSSL 3.0, but fails on execution

[Lukas Märdian]

Thank you. This is upstream 3.2.0 and the changes to debian/ are
overseeable. LGTM!

-- 
You received this bug notification because you are a member of Ubuntu
Sponsors Team, which is subscribed to the bug report.
https://bugs.launchpad.net/bugs/1958439

Title:
  tpm2-tss: builds against OpenSSL 3.0, but fails on execution

Status in tpm2-tools package in Ubuntu:
  New
Status in tpm2-tss package in Ubuntu:
  In Progress

Bug description:
  In Ubuntu 22.04 the current tpm2-tools are not working correctly
  because of an OpenSSL HMAC error (in Ubuntu 20.04 and 21.10 the
  problem does not exist):

  rire at rire-ThinkPad-T14-Gen-2a:~$ sudo tpm2_createprimary -C o -c prim.ctx
  ERROR:esys_crypto:src/tss2-esys/esys_crypto_ossl.c:327:iesys_cryptossl_hmac_start() ErrorCode (0x00070001) EVP_PKEY_new_mac_key
  ERROR:esys_crypto:src/tss2-esys/esys_crypto.c:185:iesys_crypto_authHmac() Error ErrorCode (0x00070001)
  ERROR:esys:src/tss2-esys/esys_iutil.c:1244:iesys_compute_hmac() HMAC error ErrorCode (0x00070001)
  ERROR:esys:src/tss2-esys/esys_iutil.c:1354:iesys_gen_auths() Error while computing hmacs ErrorCode (0x00070001)
  ERROR:esys:src/tss2-esys/api/Esys_CreatePrimary.c:244:Esys_CreatePrimary_Async() Error in computation of auth values ErrorCode (0x00070001)
  ERROR:esys:src/tss2-esys/api/Esys_CreatePrimary.c:110:Esys_CreatePrimary() Error in async function ErrorCode (0x00070001)
  ERROR: Esys_CreatePrimary(0x70001) - esapi:Catch all for all errors not otherwise specified
  ERROR: Unable to run tpm2_createprimary

  rire at rire-ThinkPad-T14-Gen-2a:~$ sudo tpm2_clear
  ERROR:esys_crypto:src/tss2-esys/esys_crypto_ossl.c:327:iesys_cryptossl_hmac_start() ErrorCode (0x00070001) EVP_PKEY_new_mac_key
  ERROR:esys_crypto:src/tss2-esys/esys_crypto.c:185:iesys_crypto_authHmac() Error ErrorCode (0x00070001)
  ERROR:esys:src/tss2-esys/esys_iutil.c:1244:iesys_compute_hmac() HMAC error ErrorCode (0x00070001)
  ERROR:esys:src/tss2-esys/esys_iutil.c:1354:iesys_gen_auths() Error while computing hmacs ErrorCode (0x00070001)
  ERROR:esys:src/tss2-esys/api/Esys_Clear.c:188:Esys_Clear_Async() Error in computation of auth values ErrorCode (0x00070001)
  ERROR:esys:src/tss2-esys/api/Esys_Clear.c:74:Esys_Clear() Error in async function ErrorCode (0x00070001)
  ERROR: Esys_Clear(0x70001) - esapi:Catch all for all errors not otherwise specified
  ERROR: Unable to run tpm2_clear

  There is a bugreport in Red Hat which seems related:
  https://bugzilla.redhat.com/show_bug.cgi?id=1989321

  A workaround is possible by compiling tpm2-tss, the dependency of tpm2-tools, with mbedTLS instead of OpenSSL and without FAPI (which I don't need actually):
  ~/dev/tpm2-tss-3.1.0$ ./configure --with-crypto=mbed --disable-fapi --prefix=/usr

  It seems also to be fixed in current master branch of tpm2-tss
  already.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/tpm2-tools/+bug/1958439/+subscriptions