From eea8741248c278dac928035d79f052e11e2d08b4 Mon Sep 17 00:00:00 2001 From: Aidan Garske Date: Fri, 24 Apr 2026 22:28:25 +0100 Subject: [PATCH] examples/nvram: pick SRK algorithm from stored key type nvram/read hardcoded the RSA SRK, so an ECC child key retrieved from NV would be loaded under the RSA parent and fail with TPM_RC_INTEGRITY. Switch the SRK selection to mirror the approach already used in keygen/keyload: inspect keyBlob.pub.publicArea.type and load the matching RSA or ECC SRK. --- examples/nvram/read.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/examples/nvram/read.c b/examples/nvram/read.c index 773d5d7c..f3e57cc3 100644 --- a/examples/nvram/read.c +++ b/examples/nvram/read.c @@ -267,8 +267,12 @@ int TPM2_NVRAM_Read_Example(void* userCtx, int argc, char *argv[]) nvIndex); if (!nvExtend && !partialRead) { - /* get SRK */ - rc = getPrimaryStoragekey(&dev, &storage, TPM_ALG_RSA); + /* Select the SRK algorithm based on the stored key's type so an + * ECC child isn't loaded under an RSA parent (or vice versa). */ + TPMI_ALG_PUBLIC srkAlg = + (keyBlob.pub.publicArea.type == TPM_ALG_ECC) + ? TPM_ALG_ECC : TPM_ALG_RSA; + rc = getPrimaryStoragekey(&dev, &storage, srkAlg); if (rc != 0) goto exit; printf("Trying to load the key extracted from NVRAM\n");