trustedjava-support — Trusted Java General Support

[Trustedjava-support] Problem with registerkey

[Ronald P. <ron...@un...>]

Hi,

when I try to register a new key I get the following error message:

Exception in thread "main" iaik.tc.tss.api.exceptions.tcs.TcTcsException: 
TSS Error:
error layer:                0x3000 (TSP)
error code (without layer): 0x02
error code (full):          0x3002
error message: An internal error has been detected, but the source is unknown. (TCS_E_FAIL)
additional info: System persistent storage not properly initialized.

	at iaik.tc.tss.impl.java.tcs.tcsi.TcTcsi.TcsiRegisterKey(TcTcsi.java:416)
	at iaik.tc.tss.impl.java.tsp.tcsbinding.local.TcTcsBindingLocal.TcsiRegisterKey(TcTcsBindingLocal.java:57)
	at iaik.tc.tss.impl.java.tsp.TcContext.registerKey(TcContext.java:953)

I used the proper settings for the ini-files but now there seems to be some problem with the system persistent storage. The code worked before I had to re-install my operating system (Debian), though... All the other TPM functionality works properly. 

Does anyone have an idea about this? Thanks a lot in advance and best regards,
Ronald

Re: [Trustedjava-support] Privacy CA Remote Host Problem

[FADY F. <fad...@ya...>]

Hi




________________________________
From: Martin Pirker <Mar...@ia...>
To: FADY FADY <fad...@ya...>
Cc: tru...@li...
Sent: Fri, August 27, 2010 3:37:27 PM
Subject: Re: [Trustedjava-support] Privacy CA Remote Host Problem

Hi

FADY FADY wrote:
> I use openSuse 11.3 on Lenovo T500 and Dell latitude E5500 to run Privacy CA 
> Server and Client.
> 
> If I use the same machine as server and client, it works fine
> but when I use one of them as server and the other as client, I have the error
> java.net.ConnectException: Connection refused
> Java Result: 1
> 
> Although I change the ini file in the client side
> useremotehost=false To true
> remotehost=http://127.0.0.1 To my lab IP
> 
> So what is may be the reason for that?
> I Really appreciate your help.

Our experimental PrivacyCA client does not need any .ini file as remote
destination address can be passed via command line switches (see --host
and --port options) and the PrivacyCA server side configuration only
requires a "port=..." definition in the server.config file.

?

HTH,
Martin


I stop using the command line, I use instead a small subroutine to pass the 
command from the the application itself.
Also I use nearly the same software as server and client, the difference is only 
in one file. 

All these and as I stop my experiments with trusted computing to some while, I 
forget this is small fact, So thank you for your time and support.

I pass the host option and it works fine.


Really Thank you for your Respond,
Thanks, Fady



      

Re: [Trustedjava-support] Privacy CA Remote Host Problem

[Martin P. <Mar...@ia...>]

Hi

FADY FADY wrote:
> I use openSuse 11.3 on Lenovo T500 and Dell latitude E5500 to run Privacy CA 
> Server and Client.
> 
> If I use the same machine as server and client, it works fine
> but when I use one of them as server and the other as client, I have the error
> java.net.ConnectException: Connection refused
> Java Result: 1
> 
> Although I change the ini file in the client side
> useremotehost=false To true
> remotehost=http://127.0.0.1 To my lab IP
> 
> So what is may be the reason for that?
> I Really appreciate your help.

Our experimental PrivacyCA client does not need any .ini file as remote
destination address can be passed via command line switches (see --host
and --port options) and the PrivacyCA server side configuration only
requires a "port=..." definition in the server.config file.

?

HTH,
Martin

[Trustedjava-support] Privacy CA Remote Host Problem

[FADY F. <fad...@ya...>]

Dear Trusted Java Team

I use openSuse 11.3 on Lenovo T500 and Dell latitude E5500 to run Privacy CA 
Server and Client.

If I use the same machine as server and client, it works fine
but when I use one of them as server and the other as client, I have the error

java.net.ConnectException: Connection refused
Java Result: 1

Although I change the ini file in the client side
useremotehost=false To true
remotehost=http://127.0.0.1 To my lab IP

So what is may be the reason for that?
I Really appreciate your help.

Thanks



      

Re: [Trustedjava-support] Quotation verification

[Martin P. <Mar...@ia...>]

On 08/03/10 17:59, Ronald Petrlic wrote:
> The only thing is that I need a TPM for the verification as
> well If I get this right...

You can use the service methods of jTSS without actively connecting
the Context object to a TPM. Thus, for example APKI server and client
should be able to run on the same machine as long as only one side is
using the TPM. For quoting, the server side needs the TPM, of course,
for verifying the quote the client side doesn't.

If you don't want it this way, well, examine the jTSS source code
itself for what is being done.

HTH,
Martin

Re: [Trustedjava-support] Quotation verification

[Ronald P. <ron...@un...>]

Hi,

thanks a lot. The only thing is that I need a TPM for the verification as
well If I get this right...

Best regards,
Ronald


> -----Ursprüngliche Nachricht-----
> Von: Martin Pirker [mailto:Mar...@ia...]
> Gesendet: Dienstag, 3. August 2010 17:27
> An: Ronald Petrlic
> Cc: tru...@li...
> Betreff: Re: [Trustedjava-support] Quotation verification
> 
> Hi...
> 
> Ronald Petrlic wrote:
> > However, now I wonder how to best send this data to the server and how
> > to reconstruct and verify the signature at the server application?
> 
> See example code in TspQuote class from APKI package, methods doQuote
> and verifyQuote.
> 
> HTH,
> Martin

Re: [Trustedjava-support] Quotation verification

[Martin P. <Mar...@ia...>]

Hi...

Ronald Petrlic wrote:
> However, now I wonder how to best send this data to the server and how to
> reconstruct and verify the signature at the server application?

See example code in TspQuote class from APKI package, methods doQuote and verifyQuote.

HTH,
Martin

[Trustedjava-support] Quotation verification

[Ronald P. <ron...@un...>]

Dear jTSS-Users,

I have got the following problem with remote attestation: I can quote the PCR-20 state on my machine with the following code:

//AIK has been loaded
TcIPcrComposite pcrComposite = context.createPcrCompositeObject(TcTssConstants.TSS_PCRS_STRUCT_INFO_SHORT);
pcrComposite.selectPcrIndexEx(20, TcTssConstants.TSS_PCRS_DIRECTION_RELEASE);
pcrComposite.setPcrValue(20, tpm.pcrRead(20));

TcBlobData nonceBlob = TcBlobData.newStringASCII(nonce); //the nonce is provided by the server
TcTssValidation nonceValidation = new TcTssValidation();
nonceValidation.setExternalData(nonceBlob);

TcTssValidation quotationResult = new TcTssValidation();
quotationResult = tpm.quote(aik, pcrComposite, nonceValidation);

However, now I wonder how to best send this data to the server and how to reconstruct and verify the signature at the server application? I was thinking about using IAIK JCE.

Can I use
String quotedPCR = quotationResult.getData().toHexStringNoWrap();
  and
String signedQuotedPCR = quotationResult.getValidationData().toHexStringNoWrap();

at the client - send those data to the server and then provide the update- and verify function of the signature object with those data?

The error I get is a PKCS#1 bad padding error when I perform it that way...

Thanks a lot in advance and best regards,
Ronald

Re: [Trustedjava-support] Source package for actvsm platform - archive corrupt

[Andreas L. <and...@we...>]

  Thanks!

On 26.07.2010 14:12, Martin Pirker wrote:
> Andreas Leicher wrote:
>> Could you please ping me an email, once the source package is fixed?
> re-uploaded
> for reference, the SHA1 is
> 357199c2751922feaf9d49512c9d64453e523996  actvsm-src.tar.gz
>
> Martin
>

Re: [Trustedjava-support] Source package for actvsm platform - archive corrupt

[Martin P. <Mar...@ia...>]

Andreas Leicher wrote:
> Could you please ping me an email, once the source package is fixed?

re-uploaded
for reference, the SHA1 is
357199c2751922feaf9d49512c9d64453e523996  actvsm-src.tar.gz

Martin

Re: [Trustedjava-support] Source package for actvsm platform - archive corrupt

[Andreas L. <and...@we...>]

  Hi,
no problem, enjoy the stay at the conference then :-)
Could you please ping me an email, once the source package is fixed?
Thanks,
Andreas

On 20.07.2010 09:41, Martin Pirker wrote:
> Andreas Leicher wrote:
>> the tar.gz archive for the acTvSM platform surce (actvsm-src.tar.gz)
>> seems to be broken,
> Hmmm.... yes - sorry about that.
>
>> Can you provide an updated version to that file?
> We are currently at conferences, so this will have to wait
> until we are back at the office. :-/
>
> Martin
>

Re: [Trustedjava-support] Source package for actvsm platform - archive corrupt

[Martin P. <Mar...@ia...>]

Andreas Leicher wrote:
> the tar.gz archive for the acTvSM platform surce (actvsm-src.tar.gz)
> seems to be broken,

Hmmm.... yes - sorry about that.

> Can you provide an updated version to that file?

We are currently at conferences, so this will have to wait
until we are back at the office. :-/

Martin

[Trustedjava-support] Source package for actvsm platform - archive corrupt

[Andreas L. <and...@we...>]

  Hi,

the tar.gz archive for the acTvSM platform surce (actvsm-src.tar.gz) 
seems to be broken, I tried downloading it multiple times (using 
different browsers) and it keeps telling me that the archive is corrupt.
Can you provide an updated version to that file?

Thanks,
Andreas Leicher

Re: [Trustedjava-support] Problems with tcsCryptopubEncrypt -unbind

[Britta S. <Io...@we...>]

Sorry for my last email, I've found the answer. 

The description in the mail of September 2009 works with

TcBlobData DataEncrypted = TcCrypto.pubEncryptRsaOaepSha1Mgf1(pubKey, toBind.getEncoded())


Greetings,
Britta









-----Ursprüngliche Nachricht-----
Von: "Britta Schätzke" <Io...@we...>
Gesendet: Jul 13, 2010 12:18:41 PM
An: tru...@li...
Betreff: Problems with tcsCryptopubEncrypt -unbind

>Hello, 
>
>I' started programming with jtss a month ago. Now I'm searching for a possibility 
>to bind a small amount of data with a public key on one machine and unbind it on 
>another, where the bindkey was generated. (Actually it is the same machine at the moment)
>I'm using a Tpm Version 1.2 and tried encrypting with TcCrypto.pubEncryptRsaEcbPcks1Padding (pubkey, data). 
>This went fine but unbinding lead to an exception (decryption process did not complete). 
>I've also tried with TcCrypto.pubEncryptRsaOaepSha1Mgf1, but that leads to an Exception too (The operation failed).
>In the archives of this mailing list I've found a description for a Tpm Version 1.1 but
>that doesn't work on a Tpm 1.2.
>
>
>Could you please tell me, where is my error in reasoning?
>
>Thank you,
>Britta
>
> Code:
>
>/*pubSignKey = public part
>of myBindingKey */
> TcTpmPubkey
>pubKey = new TcTpmPubkey (myBindingKey.getAttribData (TcTssConstants.TSS_TSPATTRIB_KEY_BLOB,
>                              TcTssConstants.TSS_TSPATTRIB_KEYBLOB_PUBLIC_KEY));
>
> String plaintext = "Daten";
>/*bind*/
> TcBlobData Data = TcBlobData.newByteArray(plaintext.getBytes("UTF_16LE"));
> System.out.println(Data.toString());
> TcBlobData DataEncrypted= TcCrypto.pubEncryptRsaEcbPkcs1Padding(pubKey, Data);
>System.out.println(DataEncrypted.toString());
>
> /*unbind*/
> TcIEncData remoteBoundData = context.createEncDataObject(TcTssConstants.TSS_ENCDATA_BIND);
> 
>remoteBoundData.setAttribData(TcTssConstants.TSS_TSPATTRIB_ENCDATA_BLOB,
>                          TcTssConstants.TSS_TSPATTRIB_ENCDATABLOB_BLOB, DataEncrypted);
> 
> TcBlobData unboundData = remoteBoundData.unbind(myBindingKey);
>
>
>
>Output:
>
>Daten
>ꉈ㍯⪀ꇝ쾢壝䕒䞭㤷书图꺶읽馈湧⽙ᅶଋ槽广ꝍ牷䏧쟬틄�쀌⡘方庪떰꓏ஔ獲䗖⤃夝죷梛闬ꋢ浤綃Λ䜞ꈅ㩈糵ﭳ獏ᑰ㐵㾫瘒䓖꧸嗥堟帩鐦陪͝쨎䎂㢪蝖宯낚쌐㜰䶉ૡ禚嗚ῤ䠀鲴ᨇᐟ㶜롗ꎩ庿䱯렷茛楍숮ꊸ聀醈䡱聛�ፕ腹ৠ樅ﺔⰁꯀ絇⑸ﲮ꿪ꫛ᰼忈⢪
>
>iaik.tc.tss.api.exceptions.tcs.TcTpmException:
>
>TSS Error:
>error layer:  0x00 (TPM)
>error code (without layer): 0x21
>error code (full):   0x21
>error message: The decryption process did not complete.
>
> at iaik.tc.tss.impl.java.tsp.tcsbinding.soapservice.ConvertRemoteExceptions.convertTcTpmException(ConvertRemoteExceptions.java:89)
> at iaik.tc.tss.impl.java.tsp.tcsbinding.soapservice.TcTcsBindingSoap.TcsipUnBind(TcTcsBindingSoap.java:1187)
> at iaik.tc.tss.impl.java.tsp.internal.TcTspInternal.TspUnBind_Internal(TcTspInternal.java:1766)
> at iaik.tc.tss.impl.java.tsp.TcEncData.unbind(TcEncData.java:221)
> at tpmmodule.tpmUtils.testEncryptWithPubKey(tpmUtils.java:365)
> at tpmmodule.Main.main(Main.java:149)
___________________________________________________________
Neu: GMX De-Mail - Einfach wie E-Mail, sicher wie ein Brief!  
Jetzt De-Mail-Adresse reservieren: http://portal.gmx.net/de/go/demail

[Trustedjava-support] Problems with tcsCryptopubEncrypt -unbind

[Britta S. <Io...@we...>]

Hello, 

I' started programming with jtss a month ago. Now I'm searching for a possibility 
to bind a small amount of data with a public key on one machine and unbind it on 
another, where the bindkey was generated. (Actually it is the same machine at the moment)
I'm using a Tpm Version 1.2 and tried encrypting with TcCrypto.pubEncryptRsaEcbPcks1Padding (pubkey, data). 
This went fine but unbinding lead to an exception (decryption process did not complete). 
I've also tried with TcCrypto.pubEncryptRsaOaepSha1Mgf1, but that leads to an Exception too (The operation failed).
In the archives of this mailing list I've found a description for a Tpm Version 1.1 but
that doesn't work on a Tpm 1.2.


Could you please tell me, where is my error in reasoning?

Thank you,
Britta

 Code:

/*pubSignKey = public part
of myBindingKey */
 TcTpmPubkey
pubKey = new TcTpmPubkey (myBindingKey.getAttribData (TcTssConstants.TSS_TSPATTRIB_KEY_BLOB,
                              TcTssConstants.TSS_TSPATTRIB_KEYBLOB_PUBLIC_KEY));

 String plaintext = "Daten";
/*bind*/
 TcBlobData Data = TcBlobData.newByteArray(plaintext.getBytes("UTF_16LE"));
 System.out.println(Data.toString());
 TcBlobData DataEncrypted= TcCrypto.pubEncryptRsaEcbPkcs1Padding(pubKey, Data);
System.out.println(DataEncrypted.toString());

 /*unbind*/
 TcIEncData remoteBoundData = context.createEncDataObject(TcTssConstants.TSS_ENCDATA_BIND);
 
remoteBoundData.setAttribData(TcTssConstants.TSS_TSPATTRIB_ENCDATA_BLOB,
                          TcTssConstants.TSS_TSPATTRIB_ENCDATABLOB_BLOB, DataEncrypted);
 
 TcBlobData unboundData = remoteBoundData.unbind(myBindingKey);



Output:

Daten
ꉈ㍯⪀ꇝ쾢壝䕒䞭㤷书图꺶읽馈湧⽙ᅶଋ槽广ꝍ牷䏧쟬틄�쀌⡘方庪떰꓏ஔ獲䗖⤃夝죷梛闬ꋢ浤綃Λ䜞ꈅ㩈糵ﭳ獏ᑰ㐵㾫瘒䓖꧸嗥堟帩鐦陪͝쨎䎂㢪蝖宯낚쌐㜰䶉ૡ禚嗚ῤ䠀鲴ᨇᐟ㶜롗ꎩ庿䱯렷茛楍숮ꊸ聀醈䡱聛�ፕ腹ৠ樅ﺔⰁꯀ絇⑸ﲮ꿪ꫛ᰼忈⢪

iaik.tc.tss.api.exceptions.tcs.TcTpmException:

TSS Error:
error layer:  0x00 (TPM)
error code (without layer): 0x21
error code (full):   0x21
error message: The decryption process did not complete.

 at iaik.tc.tss.impl.java.tsp.tcsbinding.soapservice.ConvertRemoteExceptions.convertTcTpmException(ConvertRemoteExceptions.java:89)
 at iaik.tc.tss.impl.java.tsp.tcsbinding.soapservice.TcTcsBindingSoap.TcsipUnBind(TcTcsBindingSoap.java:1187)
 at iaik.tc.tss.impl.java.tsp.internal.TcTspInternal.TspUnBind_Internal(TcTspInternal.java:1766)
 at iaik.tc.tss.impl.java.tsp.TcEncData.unbind(TcEncData.java:221)
 at tpmmodule.tpmUtils.testEncryptWithPubKey(tpmUtils.java:365)
 at tpmmodule.Main.main(Main.java:149)
___________________________________________________________
Neu: GMX De-Mail - Einfach wie E-Mail, sicher wie ein Brief!  
Jetzt De-Mail-Adresse reservieren: http://portal.gmx.net/de/go/demail

Re: [Trustedjava-support] APKI test error!

[Martin P. <Mar...@ia...>]

On 06/16/10 15:02, 国玮 wrote:
> I followed instruction, start server, and then run test_test.sh, I got
> following out:
> guowei@guowei-laptop:~/Desktop/exp-tpm/privacyca/apki-0.2$ sudo sh
> run_tests.sh ./client.sh ekcert_create --ekfile ek.tpm -o opentc
> 20:51:46:998 [ERROR] TcTssContextFactory::newContextObject (64):   
> Error! No TSP-TCS binding could be initalized. Both jTSS Wrapper and
> jTSS were tried. Check the TSP configuration file.

[...]

> Can anyone tell me how to handle it?

As the error message says, the client cannot connect to the jTSS.

So there appears to be an error in your TSP/TCS configuration/setup.

HTH,
Martin

[Trustedjava-support] APKI test error!

[国玮 <zg...@ya...>]

Hi,
I followed instruction, start server, and then run test_test.sh, I got following out: 
guowei@guowei-laptop:~/Desktop/exp-tpm/privacyca/apki-0.2$ sudo sh run_tests.sh ./client.sh ekcert_create --ekfile ek.tpm -o opentc
20:51:46:998 [ERROR] TcTssContextFactory::newContextObject (64):    Error! No TSP-TCS binding could be initalized. Both jTSS Wrapper and jTSS were tried. Check the TSP configuration file.
Could not access TSS: java.lang.IllegalArgumentException
20:51:47:001 [ERROR] TcTssContextFactory::newContextObject (64):    Error! No TSP-TCS binding could be initalized. Both jTSS Wrapper and jTSS were tried. Check the TSP configuration file.
Exception in thread "main" java.lang.RuntimeException: java.lang.IllegalArgumentException
    at iaik.tc.tss.api.tspi.TcTssContextFactory.newContextObject(TcTssContextFactory.java:65)
    at iaik.tc.apki.common.tss.TspUtil.getEk(TspUtil.java:55)
    at iaik.tc.apki.client.cmd.CmdEkcertCreate.getEkKey(CmdEkcertCreate.java:30)
    at iaik.tc.apki.client.CmdParser.action_cmd_ekcert_create(CmdParser.java:972)
    at iaik.tc.apki.client.CmdParser.parse(CmdParser.java:804)
    at iaik.tc.apki.APKIC.main(APKIC.java:36)
Caused by: java.lang.IllegalArgumentException
    at iaik.tc.utils.properties.Properties.getProperty(Properties.java:256)
    at iaik.tc.tss.api.tspi.TcTssContextFactory.newContextObject(TcTssContextFactory.java:49)
    ... 5 more

Can anyone tell me how to handle it?
Thanks a lot.


 Zou GuoweiTsinghua University,Master of Software EngineerTel 010-62778736, Cell Phone 15120004264


      

[Trustedjava-support] acTvSM platform released!

[Ronald T. <ron...@ia...>]

Dear TrustedJava users!

We are proud to announces the first public release of the acTvSM trusted 
virtualization platform.

For engineering a trusted application the current main challenge is to 
maintain a known-good software configuration. acTvSM is designed to 
provide this on commodity hardware for commodity software.

The IAIK acTvSM Platform is a prototype integration of Intel Trusted 
Execution Technology into an off-the-shelf Linux operating system. The 
Linux boot process is modified so that the acTvSM platform offers 
TPM-based guarantees for base system integrity. Further, on top of the 
base system, virtualized applications can be executed. A set of tools 
and operational procedures allow flexible configuration management and 
updates.

The initial version of the platform is available under a license free 
for research purposes at the Trusted Computing for the Java Platform 
[http://trustedjava.sourceforge.net/] website .  Development of this 
package is supported by the Austrian FIT-IT Trust in IT Systems 
programme, project acTvSM 
[http://www.iaik.tugraz.at/content/research/trusted_computing/actvsm/].

We are looking forward to your experience reports!

Ronald

-- 
Dipl.-Ing. Ronald Tögl          phone +43 316/873-5502
Trusted Computing Labs          fax   +43 316/873-5520
IAIK                            ron...@ia...
Graz University of Technology   http://www.iaik.tugraz.at

Re: [Trustedjava-support] APKI and openssl

[Martin P. <Mar...@ia...>]

Hi...

Simon Mittelberger wrote:
> and then i try to display the public key of EKTest.der:
> openssl x509 -inform pem -in EKTest.pem -noout -pubkey
> error:
> Error getting public key
> 13852:error:0D09B0A3:asn1 encoding routines:d2i_PublicKey:unknown public key type:d2i_pu.c:125:
> 13852:error:0B077066:x509 certificate routines:X509_PUBKEY_get:err asn1 lib:x_pubkey.c:366:

I can reproduce this here - but I do not have enough experience
with openssl to know why is that..... :-/

Martin

Re: [Trustedjava-support] APKI and openssl

[Simon M. <sim...@in...>]

Hi,

thank you for your reply.

The asn1parse works fine also on my part.

But I would like to verify the issued EKCertificate through openssl:

I first run:
sh client.sh ekcert_create --ekfile EKTest.der -o owner --host 
privacyca.iaik.tugraz.at --port 10011
then i download the EK issueing certificate 
http://opentc.iaik.tugraz.at/certs/caek.cert

convert them to pem:
openssl x509 -inform der -in caek.cert -outform pem -out CAEK.pem
openssl x509 -inform der -in EKTest.der -outform pem -out EKTest.pem

and then i try to display the public key of EKTest.der:
openssl x509 -inform pem -in EKTest.pem -noout -pubkey
error:
Error getting public key
13852:error:0D09B0A3:asn1 encoding routines:d2i_PublicKey:unknown public 
key type:d2i_pu.c:125:
13852:error:0B077066:x509 certificate routines:X509_PUBKEY_get:err asn1 
lib:x_pubkey.c:366:

or to verify the certifiacte chain:
openssl verify -CAfile CAEK.pem EKTest.pem
error:
EKTest.pem:
error 20 at 0 depth lookup:unable to get local issuer certificate
13850:error:0D09B0A3:asn1 encoding routines:d2i_PublicKey:unknown public 
key type:d2i_pu.c:125:
13850:error:0B077066:x509 certificate routines:X509_PUBKEY_get:err asn1 
lib:x_pubkey.c:366:
13850:error:0B06E06C:x509 certificate 
routines:X509_get_pubkey_parameters:unable to get certs public 
key:x509_vfy.c:1152:

Martin, unfortunately the verify command of openssl does only accept PEM 
encoded certificates. But the error in the x509 command happens also 
with der encoded certificates.

Maybe I am doing that the wrong way. Is there another possibility to 
verify this chain with openssl?
I tried also to verify the same certificates through a small JAVA 
program, using the JCE library, which works fine. So it is just a matter 
of formatting the public key, when it is written to the file?

Thank you in advance!

Kind regards,
Simon


Martin Pirker wrote:
> Hi...
>
> Simon Mittelberger wrote:
> [...]
>   
>> When I execute the following openssl command i get an error:
>> openssl -inform PEM -in cert.pem -noout -modulus
>>     
>
> The actual openssl command is missing in this example?
>
> [...]
>   
>> It looks like the public key isn't encoded in the right manner.
>>
>> Has anyone a suggestion?
>>     
>
> Is this only happening with PEM encoding?
>
> I tried decoding a DER encoded EK certificate with the standalone dumpasn1
> utility and via "openssl asn1parse -inform DER -in ek.cert"
> This works fine.
>
> HTH,
> Martin
>   

Re: [Trustedjava-support] APKI and openssl

[Martin P. <Mar...@ia...>]

Hi...

Simon Mittelberger wrote:
[...]
> When I execute the following openssl command i get an error:
> openssl -inform PEM -in cert.pem -noout -modulus

The actual openssl command is missing in this example?

[...]
> It looks like the public key isn't encoded in the right manner.
> 
> Has anyone a suggestion?

Is this only happening with PEM encoding?

I tried decoding a DER encoded EK certificate with the standalone dumpasn1
utility and via "openssl asn1parse -inform DER -in ek.cert"
This works fine.

HTH,
Martin

[Trustedjava-support] APKI and openssl

[Simon M. <sim...@in...>]

Dear all,

I am trying to process the EK Certificate created through the APKI PCA 
implementation through openssl.

The creation of the certificate works fine and i am able to output the 
pubic key through the java code.

When I execute the following openssl command i get an error:
openssl -inform PEM -in cert.pem -noout -modulus

The error is:
Modulus=unavailable
4716:error:0D09B0A3:asn1 encoding routines:d2i_PublicKey:unknown public 
key type:d2i_pu.c:125:
4716:error:0B077066:x509 certificate routines:X509_PUBKEY_get:err asn1 
lib:x_pubkey.c:366:

The JAVA code which stores the certificate in the file is:
FileOutputStream fo = new FileOutputStream(filename);
fo.write(iaik.utils.Util.toPemString(cert).getBytes());
fo.close();

It looks like the public key isn't encoded in the right manner.

Has anyone a suggestion?
Thank you in advance!

Kind regards,
Simon Mittelberger

Re: [Trustedjava-support] Problems using IAIK jTSS

[Ronald T. <ron...@ia...>]

Hi Melvin,

Welcome to the world of TC programming. :-)

ad 1) The run_tests suite uses a hardcoded owner password "opentc". It 
will fail with another one.

ad 2) To use the SRK, you need to set the authentication to the 
TSS_WELL_KNOWN_SECRET in the usage policy.

ad 3) I'm confused. You do not need to change the JVM. Also the patch 
you mention contains fixes for a dated version of a Linux library. You 
do not need it under Windows.

hth,
Ronald


Melvin Sim wrote:
> This is my first time coding with jtss or doing tpm related stuff.  I 
> have several issues with jtss.
>
> Currently using a IFX tpm with 1.2 specification running on windows 7.
>
> Issues
>
> 1) I have attempted to install jtss onto my computer with 
> administrative rights. I have tried running the run_tests_simple, it 
> is successful and could show the manufacturer details. If i attempt to 
> run the run_tests, i have encountered errors such as the ones in the 
> txt file.
>
> 2) I have also created a new project using netbeans with local binding 
> and the libraries associated to the project, each time i run till 
> hKey.createKey(hSRK, null) the following message is prompt.
>
> TSS Error:
> error layer:                0x00 (TPM)
> error code (without layer): 0x01
> error code (full):          0x01
> error message: Authentication failed
>
> 3) I understand for local binding some changes is needed for the jvm, 
> where could i find it and how to do it? Or must i also patch the 
> infineon patch for jtss wrapper for my tpm as well?
>
> I am sorry for the noobness of the questions.
>
> Regards,
> TPM noob


-- 
Dipl.-Ing. Ronald Tögl          phone +43 316/873-5502
Trusted Computing Labs          fax   +43 316/873-5520
IAIK                            ron...@ia...
Graz University of Technology   http://www.iaik.tugraz.at

Re: [Trustedjava-support] Load key from persistent storage

[Ronald P. <rpe...@ma...>]

  Solved it... TcIRsaKey aik = context.getKeyByUuid(TcTssConstants.TSS_PS_TYPE_SYSTEM, uuid); works...

Ronald

________________________________
Von: Ronald Petrlic [rpe...@ma...]
Gesendet: Donnerstag, 22. April 2010 00:32
An: tru...@li...
Betreff: [Trustedjava-support] Load key from persistent storage

Hi,

I've created a key and registered it using the persistent system storage (wrapped with the SRK). However, when I try to load that key with "TcIRsaKey aik = context.loadKeyByUuidFromSystem(uuid);" I get the following error:

iaik.tc.tss.api.exceptions.tsp.TcTspException:

TSS Error:
error layer:                0x3000 (TSP)
error code (without layer): 0x06
error code (full):          0x3006
error message: Not implemented.

I don't think that the function loadKeyByUuidFromSystem is not implemented...?

Best Regards,
Ronald

[Trustedjava-support] Load key from persistent storage

[Ronald P. <rpe...@ma...>]

Hi,

I've created a key and registered it using the persistent system storage (wrapped with the SRK). However, when I try to load that key with "TcIRsaKey aik = context.loadKeyByUuidFromSystem(uuid);" I get the following error:

iaik.tc.tss.api.exceptions.tsp.TcTspException:

TSS Error:
error layer:                0x3000 (TSP)
error code (without layer): 0x06
error code (full):          0x3006
error message: Not implemented.

I don't think that the function loadKeyByUuidFromSystem is not implemented...?

Best Regards,
Ronald