| 18 Jul 2021 |
 @grahamc:nixos.org | [nix-shell:~]# tpm2 nvdefine -p str:lolol -s 1
nv-index: 0x1000000
for index 0x1000000 you'll need to present the lolol password to read or write it:
[nix-shell:~]# tpm2 nvwrite -i ./lol 0x1000000
WARNING:esys:src/tss2-esys/api/Esys_NV_Write.c:310:Esys_NV_Write_Finish() Received TPM Error
ERROR:esys:src/tss2-esys/api/Esys_NV_Write.c:110:Esys_NV_Write() Esys Finish ErrorCode (0x0000098e)
ERROR: Failed to write NV area at index 0x1000000
ERROR: Tss2_Sys_NV_Write(0x98E) - tpm:session(1):the authorization HMAC check failed and DA counter incremented
ERROR: Unable to run nvwrite
[nix-shell:~]# tpm2 nvwrite -i ./lol --auth str:lolol 0x1000000
[nix-shell:~]# tpm2 nvread 0x1000000
WARNING:esys:src/tss2-esys/api/Esys_NV_Read.c:315:Esys_NV_Read_Finish() Received TPM Error
ERROR:esys:src/tss2-esys/api/Esys_NV_Read.c:105:Esys_NV_Read() Esys Finish ErrorCode (0x0000098e)
ERROR: Esys_NV_Read(0x98E) - tpm:session(1):the authorization HMAC check failed and DA counter incremented
ERROR: Failed to read NVRAM area at index 0x1000000
ERROR: Unable to run nvread
[nix-shell:~]# tpm2 nvread 0x1000000 --auth str:lolol
h
| 00:42:14 |
| @grahamc:nixos.org | I don't know how you're supposed to remember the index | 00:43:45 |
 Mic92 | In reply to @grahamc:nixos.org
damn this file has a LOT of history Well there might be still a need in microcontrollers. | 03:15:37 |
 andi- | In reply to @grahamc:nixos.org
I don't know how you're supposed to remember the index But that is much better than expecting the applications to synchronize. If you look at that bash script from yesterday: They probably stuff it in their JSON blob? | 07:56:01 |
 manveru | https://github.com/NixOS/nixpkgs/pull/130568 if anyone wants to review | 17:00:57 |
| andi- | manveru: have you been using this on unstable with pkcs11 with e.g. OpenSSH? I've had to patch your tpm2-tss derivation to use pkcs11 | 17:02:29 |
| manveru | Not yet, I'm just getting started trying to use tpm :) | 17:03:36 |
| manveru | Pretty sure there's no tpm drv from me... | 17:04:02 |
| @grahamc:nixos.org | andi-: okay so you CAN specify an index when defining the region, but there are defined allocations https://trustedcomputinggroup.org/wp-content/uploads/RegistryOfReservedTPM2HandlesAndLocalities_v1p1_pub.pdf | 20:02:33 |
| @grahamc:nixos.org | [nix-shell:~]# tss2 getplatformcertificates
WARNING:fapi:src/tss2-fapi/ifapi_io.c:282:ifapi_io_check_create_dir() Directory /nix/store/cmkbhbf74dzy2kaxsamvkr2pbiqvhx89-tpm2-tss-3.0.3/var/run/tpm2-tss/eventlog/ does not exist, creating
WARNING:fapi:src/tss2-fapi/ifapi_io.c:282:ifapi_io_check_create_dir() Directory /root//.local/share/tpm2-tss/user/keystore does not exist, creating
WARNING:fapi:src/tss2-fapi/ifapi_io.c:282:ifapi_io_check_create_dir() Directory /nix/store/cmkbhbf74dzy2kaxsamvkr2pbiqvhx89-tpm2-tss-3.0.3/var/lib/tpm2-tss/system/keystore/policy does not exist, creating
sigh
| 20:19:05 |
| andi- | That is normal :d | 20:19:18 |
| andi- | I also get those and can still authenticate my SSH session | 20:19:30 |
| andi- | But yeah it is not optimal.. | 20:19:44 |
| andi- | I hope I'll have some time to read the TPM2.0 spec next week. Been not doing much since Thursday and the weekend was occupied otherwise | 20:20:31 |
| @grahamc:nixos.org | understandable | 20:21:00 |
| @grahamc:nixos.org | I wonder why getplatformcertificates is suddenly part of tss and not the tpm2 command | 20:21:23 |
| andi- | the developers of tss needed it before they started the tpm2 tool? | 20:22:09 |
| @grahamc:nixos.org | hm | 20:22:21 |
| 19 Jul 2021 |
| manveru | does anyonne know if there's some way to turn tpm emulation on for a nixos test? | 06:23:46 |
| andi- | The current VM infrastructure doesnt allow that. You have to run an additional daemon | 07:13:39 |
| Mic92 | Could you run two VMs for that? | 11:48:55 |
| andi- | No, you have to pass a socket to one of the daemons to QEMUs CLI. Forking off the software TPM before starting QEMU is probably good enough in a sandboxed test. For interactive testing you want more process control. | 11:49:44 |
| Mic92 | There is some bridging possible with vsockets, but I guess it would get hacky | 11:50:04 |
| Mic92 | Maybe socat? | 11:50:10 |
| andi- | Yeah, probably but not very elegant. Would be nicer to teach our test driver to take care of "sidecars" | 11:50:31 |
| Mic92 | vsocket also need root with qemu I just remeber | 11:51:07 |
| Mic92 | *remember | 11:51:12 |
| Mic92 | It would be also nice for virtiofsd to have qemu side cars | 11:51:38 |
| andi- | yeah but that also requires root access IIRC | 11:51:58 |
| Mic92 | Why because virtiofsd needs to change uids? | 11:53:58 |
