WolfSSL
/
wolfTPM
mirror of https://github.com/wolfSSL/wolfTPM.git
1
0
Fork 0
Code Issues Releases Wiki Activity

examples/keygen: pick SRK algorithm from stored key type 

keyload defaulted srkAlg = TPM_ALG_ECC and only switched to RSA
  for TPM_ALG_RSA keys. A sealed KEYEDHASH blob (produced by
  examples/seal, which always uses the RSA SRK) therefore tried to
  load under the ECC SRK and failed with TPM_RC_INTEGRITY. SYMCIPHER
  blobs had the same issue.

  Invert the default to RSA (matching seal.c) and only switch to the
  ECC SRK when the stored key itself is ECC.
pull/494/head
Aidan Garske 2026-04-24 22:45:00 +01:00
parent eea8741248
commit 34108a865c
1 changed files with 6 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
examples/keygen/keyload.c
View File

@ -67,7 +67,7 @@ int TPM2_Keyload_Example(void* userCtx, int argc, char *argv[])
WOLFTPM2_KEYBLOB newKey;
WOLFTPM2_KEY persistKey;
TPM_ALG_ID alg;
TPMI_ALG_PUBLIC srkAlg = TPM_ALG_ECC; /* prefer ECC, but allow RSA */
TPMI_ALG_PUBLIC srkAlg = TPM_ALG_RSA; /* default matches seal.c */
TPM_ALG_ID paramEncAlg = TPM_ALG_NULL;
WOLFTPM2_SESSION tpmSession;
const char* inputFile = "keyblob.bin";
@ -133,8 +133,11 @@ int TPM2_Keyload_Example(void* userCtx, int argc, char *argv[])
#endif
alg = newKey.pub.publicArea.type;
if (alg == TPM_ALG_RSA)
srkAlg = TPM_ALG_RSA;
/* Only switch to the ECC SRK when the stored key itself is ECC; other
* child types (RSA, KEYEDHASH from seal, SYMCIPHER) stay on the RSA SRK
* so the parent algorithm matches how those keys were created. */
if (alg == TPM_ALG_ECC)
srkAlg = TPM_ALG_ECC;
printf("Loading %s key\n", TPM2_GetAlgName(alg));
if (endorseKey) {