The Null seed fails as a parent for any session based operation #1993

jejb · 2021-02-25T21:24:00Z

Trying to do any session based operation on something with the NULL seed as a parent results in authentication errors. This is a trace from trying to do TPM2_CreatePrimary with the NULL seed as a primaryHandle:

WARNING:esys:src/tss2-esys/api/Esys_CreatePrimary.c:393:Esys_CreatePrimary_Finish() Received TPM Error
ERROR:esys:src/tss2-esys/api/Esys_CreatePrimary.c:135:Esys_CreatePrimary() Esys Finish ErrorCode (0x000009a2)
TSS_CreatePrimary failed with 2466
tpm:session(1):authorization failure without DA implications

The session that's failing was created as a bound session on the NULL permanent handle, so it's not like this has security implications, but it's something that should work.

If you do the same operation with TPM_RS_PW instead of a real authentication session, everything works, so I think something is wrong in the HMAC routines when the NULL seed is specified either for binding or as a parent.

If ESYS_TR_RH_NULL was used as bind parameter for Esys_StartAuthSession the wrong HMAC was computed, because the session was not treated as unbound session. It will be checked whether no tpm key is passed and ESYS_TR_RH_NULL is used as bind parameter to skip KDF computation of the session key. Signed-off-by: Juergen Repp <juergen.repp@sit.fraunhofer.de>

JuergenReppSIT mentioned this issue Feb 26, 2021

ESYS: Fix binding of ESYS_TR_RH_NULL (Fixes #1993) #1996

Merged

AndreasFuchsTPM closed this as completed in 7cbf81a Mar 1, 2021

JuergenReppSIT mentioned this issue Mar 3, 2021

ESYS: Fix binding of ESYS_TR_RH_NULL 2.4.x #1999

Merged

The Null seed fails as a parent for any session based operation #1993

The Null seed fails as a parent for any session based operation #1993

Comments

jejb commented Feb 25, 2021