| 17 Jul 2021 |
 @grahamc:nixos.org |
Corrected a problem which generated improper hash values on 16 bit machines
| 23:34:21 |
| @grahamc:nixos.org | damn this file has a LOT of history | 23:34:58 |
| 18 Jul 2021 |
| @grahamc:nixos.org | okay andi- I was maybe predictable wrong about the rvram | 00:40:08 |
| @grahamc:nixos.org | to r/w space you have to preallocate a chunk with nvdefine, and it gives you an "NV Index" in response: | 00:40:49 |
| @grahamc:nixos.org | [nix-shell:~]# tpm2 nvdefine -s 1
nv-index: 0x1000000
| 00:40:50 |
| @grahamc:nixos.org | (-s 1 means 1 byte) | 00:41:04 |
| @grahamc:nixos.org | [nix-shell:~]# tpm2 nvdefine -p str:lolol -s 1
nv-index: 0x1000000
for index 0x1000000 you'll need to present the lolol password to read or write it:
[nix-shell:~]# tpm2 nvwrite -i ./lol 0x1000000
WARNING:esys:src/tss2-esys/api/Esys_NV_Write.c:310:Esys_NV_Write_Finish() Received TPM Error
ERROR:esys:src/tss2-esys/api/Esys_NV_Write.c:110:Esys_NV_Write() Esys Finish ErrorCode (0x0000098e)
ERROR: Failed to write NV area at index 0x1000000
ERROR: Tss2_Sys_NV_Write(0x98E) - tpm:session(1):the authorization HMAC check failed and DA counter incremented
ERROR: Unable to run nvwrite
[nix-shell:~]# tpm2 nvwrite -i ./lol --auth str:lolol 0x1000000
[nix-shell:~]# tpm2 nvread 0x1000000
WARNING:esys:src/tss2-esys/api/Esys_NV_Read.c:315:Esys_NV_Read_Finish() Received TPM Error
ERROR:esys:src/tss2-esys/api/Esys_NV_Read.c:105:Esys_NV_Read() Esys Finish ErrorCode (0x0000098e)
ERROR: Esys_NV_Read(0x98E) - tpm:session(1):the authorization HMAC check failed and DA counter incremented
ERROR: Failed to read NVRAM area at index 0x1000000
ERROR: Unable to run nvread
[nix-shell:~]# tpm2 nvread 0x1000000 --auth str:lolol
h
| 00:42:14 |
| @grahamc:nixos.org | I don't know how you're supposed to remember the index | 00:43:45 |
 Mic92 | In reply to @grahamc:nixos.org
damn this file has a LOT of history Well there might be still a need in microcontrollers. | 03:15:37 |
 andi- | In reply to @grahamc:nixos.org
I don't know how you're supposed to remember the index But that is much better than expecting the applications to synchronize. If you look at that bash script from yesterday: They probably stuff it in their JSON blob? | 07:56:01 |
 manveru | https://github.com/NixOS/nixpkgs/pull/130568 if anyone wants to review | 17:00:57 |
| andi- | manveru: have you been using this on unstable with pkcs11 with e.g. OpenSSH? I've had to patch your tpm2-tss derivation to use pkcs11 | 17:02:29 |
| manveru | Not yet, I'm just getting started trying to use tpm :) | 17:03:36 |
