trustedjava-support — Trusted Java General Support

[Trustedjava-support] Key Uuid

[Till B. <ti...@on...>]

Hello,

I create a new key with the following code based on the examples:

--
        TcIRsaKey signingKey = context.createRsaKeyObject(
TcTssConstants.TSS_KEY_SIZE_2048 | TcTssConstants.TSS_KEY_TYPE_SIGNING
                | TcTssConstants.TSS_KEY_MIGRATABLE);
        keyUsagePolicy.assignToObject(signingKey);
        keyMigrationPolicy.assignToObject(signingKey);
        signingKey.createKey(srk, null);
        signingKey.loadKey(srk);
--

This seems to work. But how can I make this key to appear in the list of
loaded keys of my TPM. Also this key always has the Uuid
00000000-0000-0000-0000-000000000000. Is that correct? It seems somehow
strange...
-- 
MfG
  Till

**********************************************
      Der Benutzer ist eine nicht zu
  tolerierende Quelle der Unsicherheit
**********************************************

Re: [Trustedjava-support] Problems with AIK creation

[Martin P. <Mar...@ia...>]

Till Bentz wrote:
> Thanks for your quick reply!

Our responsiveness depends on multiple factors. Sometimes there
are more resources/manpower available for this project, sometimes less.
Currently you appear to be lucky.

> On 7/19/07, Martin Pirker <Mar...@ia...> wrote:
>> Till Bentz wrote:
>> > I try to create an AIK. For this process I need an EK credential.
>> > Unfortunately my manufacturer did not deliver one. Can someone give me a
>> > hint on how I can create one myself?
>>
>> Use TCcert, or use JTpmTools to get one from our demo PrivacyCA setup
>> (mail me for authentication password)
>>
>> > I set up my own little Privacy CA using
>> > openssl and I think I have therefore the necessary Keys and certificates to
>> > create an EK cred.
>>
>> You implemented the additional Trusted Computing certificate
>> structures for OpenSSL?
> 
> I was not aware of the fact, that I need to implement additional Trusted
> Computing structures. I just set up a normal CA and use it to sign my
> client and server certificates.

You can of course use standard software to create CA certificates.
The functionality of TCcert to create CA like certificates is only
intended for quick testing.

> In other words is it
> possible to adjust the ini files in tccert so that I can use my own CA or
> are there any special requirements?

The .ini files should be self-explanatory, just fill in the filenames
of your own CA certificates + private keys, TCcert should be able to use them.


The EK, PE and AIK certificates contain new Trusted Computing specific
structures not (yet) available in standard software.
That's what TCcert is good for....


HTH

-- 
Martin Pirker
IAIK, TU Graz

Re: [Trustedjava-support] Problems with AIK creation

[Till B. <ti...@on...>]

Hello,

Thanks for your quick reply!

On 7/19/07, Martin Pirker <Mar...@ia...> wrote:
>
> Good morning...
>
> Till Bentz wrote:
> > I try to create an AIK. For this process I need an EK credential.
> > Unfortunately my manufacturer did not deliver one. Can someone give me a
> > hint on how I can create one myself?
>
> Use TCcert, or use JTpmTools to get one from our demo PrivacyCA setup
> (mail me for authentication password)
>
>
> > I set up my own little Privacy CA using
> > openssl and I think I have therefore the necessary Keys and certificates
> to
> > create an EK cred.
>
> You implemented the additional Trusted Computing certificate
> structures for OpenSSL?


I was not aware of the fact, that I need to implement additional Trusted
Computing structures. I just set up a normal CA and use it to sign my client
and server certificates.

Can I use that CA to sign EKcredentials as well? In other words is it
possible to adjust the ini files in tccert so that I can use my own CA or
are there any special requirements?

> I tried to use tccert with my CA but the process failed, even with the
> > included examples:
> [...]
> > generating CA certificates...
> > CAroot
> > iaik.utils.InternalErrorException
> >        at iaik.pkcs.pkcs8.EncryptedPrivateKeyInfo.encrypt(Unknown
> Source)
> >        at iaik.pkcs.pkcs8.EncryptedPrivateKeyInfo.encrypt(Unknown
> Source)
> >        at iaik.pkcs.pkcs8.EncryptedPrivateKeyInfo.encrypt(Unknown
> Source)
> >        at iaik.tc.cert.common.Common.writePrivateKeyToFile(Common.java
> :363)
> >        at iaik.tc.TCcert.generateCA(TCcert.java:247)
> >        at iaik.tc.TCcert.main(TCcert.java:118)
>
> Last time some had this problem...
>
> https://sourceforge.net/mailarchive/forum.php?thread_name=01D30BAC-8036-4A59-9BCC-2101B48ADBA3%40cs.rice.edu&forum_name=trustedjava-support
>
> ...he didn't used the signed version of IAIK-JCE.
>
>
> Are you sure you are using the _signed_ .jar version and not the
> _unsigned_ one?


It seems that I did not use the signed version. I downloaded a new version
and now it works.

HTH
>
> --
> Martin Pirker
> IAIK, TU Graz
>
>


-- 
MfG
  Till

**********************************************
      Der Benutzer ist eine nicht zu
  tolerierende Quelle der Unsicherheit
**********************************************

Re: [Trustedjava-support] Problems with AIK creation

[Martin P. <Mar...@ia...>]

Good morning...

Till Bentz wrote:
> I try to create an AIK. For this process I need an EK credential.
> Unfortunately my manufacturer did not deliver one. Can someone give me a
> hint on how I can create one myself?

Use TCcert, or use JTpmTools to get one from our demo PrivacyCA setup
(mail me for authentication password)


> I set up my own little Privacy CA using
> openssl and I think I have therefore the necessary Keys and certificates to
> create an EK cred.

You implemented the additional Trusted Computing certificate
structures for OpenSSL?


> I tried to use tccert with my CA but the process failed, even with the
> included examples:
[...]
> generating CA certificates...
> CAroot
> iaik.utils.InternalErrorException
>        at iaik.pkcs.pkcs8.EncryptedPrivateKeyInfo.encrypt(Unknown Source)
>        at iaik.pkcs.pkcs8.EncryptedPrivateKeyInfo.encrypt(Unknown Source)
>        at iaik.pkcs.pkcs8.EncryptedPrivateKeyInfo.encrypt(Unknown Source)
>        at iaik.tc.cert.common.Common.writePrivateKeyToFile(Common.java:363)
>        at iaik.tc.TCcert.generateCA(TCcert.java:247)
>        at iaik.tc.TCcert.main(TCcert.java:118)

Last time some had this problem...
 https://sourceforge.net/mailarchive/forum.php?thread_name=01D30BAC-8036-4A59-9BCC-2101B48ADBA3%40cs.rice.edu&forum_name=trustedjava-support

...he didn't used the signed version of IAIK-JCE.


Are you sure you are using the _signed_ .jar version and not the _unsigned_ one?



HTH

-- 
Martin Pirker
IAIK, TU Graz

[Trustedjava-support] Problems with AIK creation

[Till B. <ti...@on...>]

Hello,
I try to create an AIK. For this process I need an EK credential.
Unfortunately my manufacturer did not deliver one. Can someone give me a
hint on how I can create one myself? I set up my own little Privacy CA using
openssl and I think I have therefore the necessary Keys and certificates to
create an EK cred.

I tried to use tccert with my CA but the process failed, even with the
included examples:
---
$ sh tccert.sh ca ca.ini
***
***
***                    Welcome to the IAIK JCE Library
***
***
***
*** This version of IAIK JCE is licensed for educational and research use
***
*** and evaluation only. Commercial use of this software is prohibited.
***
*** For details please see http://jcewww.iaik.at/sales/licences/.
***
*** This message does not appear in the registered commercial version.
***
***
***

generating CA certificates...
CAroot
iaik.utils.InternalErrorException
        at iaik.pkcs.pkcs8.EncryptedPrivateKeyInfo.encrypt(Unknown Source)
        at iaik.pkcs.pkcs8.EncryptedPrivateKeyInfo.encrypt(Unknown Source)
        at iaik.pkcs.pkcs8.EncryptedPrivateKeyInfo.encrypt(Unknown Source)
        at iaik.tc.cert.common.Common.writePrivateKeyToFile(Common.java:363)
        at iaik.tc.TCcert.generateCA(TCcert.java:247)
        at iaik.tc.TCcert.main(TCcert.java:118)
Exception in thread "main" iaik.utils.InternalErrorException
        at iaik.pkcs.pkcs8.EncryptedPrivateKeyInfo.encrypt(Unknown Source)
        at iaik.pkcs.pkcs8.EncryptedPrivateKeyInfo.encrypt(Unknown Source)
        at iaik.pkcs.pkcs8.EncryptedPrivateKeyInfo.encrypt(Unknown Source)
        at iaik.tc.cert.common.Common.writePrivateKeyToFile(Common.java:363)
        at iaik.tc.TCcert.generateCA(TCcert.java:247)
        at iaik.tc.TCcert.main(TCcert.java:118)
---


Thanks for your help!


-- 
MfG
  Till

**********************************************
      Der Benutzer ist eine nicht zu
  tolerierende Quelle der Unsicherheit
**********************************************

Re: [Trustedjava-support] Error calling TcITpm.collateIdentityRequest

[Saurabh A. <tan...@gm...>]

Hi

On 7/16/07, Till Bentz <ti...@on...> wrote:
> Hello,
>
> I am using jTss with the wrapper for TrouSerS on with an STM TPM. I want to
> create an AIK for a remote attestation procedure. I set up the TPM using
> TrouSerS and tpm_takeownership. During that process I had to set the owner
> password as well as the SRK password.

it is always gud to cross check your previous step by using
"tpm_changeownerauth -s".

> In my Java application I try to load
> the SRK and it seems to work. After I created an empty aik I try to issue a
> collateIdentityRequest and encounter the following error:
>
> ----
> iaik.tc.tss.api.exceptions.tcs.TcTpmException:
>
> TSS Error:
> error layer:                0x00 (TPM)
> error code (without layer): 0x01
> error code (full):          0x01
> error message: Authentication failed
>
>     at
> iaik.tc.tss.impl.jni.tsp.TcBaseObject.handleRetCode(TcBaseObject.java:104)
>     at
> iaik.tc.tss.impl.jni.tsp.TcTpm.collateIdentityRequest(TcTpm.java:1071)
>     at tc.Client.collateIdentityRequest(Client.java :176)
>     at test.trustedJava.TestQuote.main(TestQuote.java:22)
> ----
>

seems to be a incorrect input (null, encoding) of srk/owner secret.
can you post the code where you feed the srk, owner secret.

best
Tanish

Re: [Trustedjava-support] Error calling TcITpm.collateIdentityRequest

[Martin P. <Mar...@ia...>]

Till Bentz wrote:
> I think I found the error. It was the encoding of the used passwords. I
> guess if the password is set via tpm_takeownership the encoding is ASCII
> whereas jTSS expects UTF-16LE.

jTSS takes whatever the client passes in.

See JTpmTools optional parameters:
  -e encoding    ... encoding for password strings (legal values: ASCII, UTF-16,
                     UTF-16BE, UTF-16LE) (default: UTF-16LE)
  -n             ... append null termination to password strings


There is/was confusion about encoding of passwords in the 1.1 vs 1.2 spec
vs. "reality" of various Windows stack vendors.
In order to offer the user the choice, JTpmTools supports above flags to allow
maximum compatibility (see source code how to handle the cases).

I hope this is also your "Authentication" issue in your mail of 2007-07-04 18:44.

HTH

-- 
Martin Pirker
IAIK, TU Graz

Re: [Trustedjava-support] Error calling TcITpm.collateIdentityRequest

[Till B. <ti...@on...>]

I think I found the error. It was the encoding of the used passwords. I
guess if the password is set via tpm_takeownership the encoding is ASCII
whereas jTSS expects UTF-16LE.

On 7/16/07, Till Bentz <ti...@on...> wrote:
>
> Hello,
>
> I am using jTss with the wrapper for TrouSerS on with an STM TPM. I want
> to create an AIK for a remote attestation procedure. I set up the TPM using
> TrouSerS and tpm_takeownership. During that process I had to set the owner
> password as well as the SRK password. In my Java application I try to load
> the SRK and it seems to work. After I created an empty aik I try to issue a
> collateIdentityRequest and encounter the following error:
>
> ----
> iaik.tc.tss.api.exceptions.tcs.TcTpmException:
>
> TSS Error:
> error layer:                0x00 (TPM)
> error code (without layer): 0x01
> error code (full):          0x01
> error message: Authentication failed
>
>     at iaik.tc.tss.impl.jni.tsp.TcBaseObject.handleRetCode(
> TcBaseObject.java:104)
>     at iaik.tc.tss.impl.jni.tsp.TcTpm.collateIdentityRequest(TcTpm.java
> :1071)
>     at tc.Client.collateIdentityRequest(Client.java :176)
>     at test.trustedJava.TestQuote.main(TestQuote.java:22)
> ----
>
> I looked in the sources and it seems to be an "TcTssErrors.TSS_LAYER_TPM"
> error.
>
> Any help is appreciated. Thanks a lot
> --
> MfG
>   Till
>
> **********************************************
>       Der Benutzer ist eine nicht zu
>   tolerierende Quelle der Unsicherheit
> **********************************************




-- 
MfG
  Till

**********************************************
      Der Benutzer ist eine nicht zu
  tolerierende Quelle der Unsicherheit
**********************************************

[Trustedjava-support] Error calling TcITpm.collateIdentityRequest

[Till B. <ti...@on...>]

Hello,

I am using jTss with the wrapper for TrouSerS on with an STM TPM. I want to
create an AIK for a remote attestation procedure. I set up the TPM using
TrouSerS and tpm_takeownership. During that process I had to set the owner
password as well as the SRK password. In my Java application I try to load
the SRK and it seems to work. After I created an empty aik I try to issue a
collateIdentityRequest and encounter the following error:

----
iaik.tc.tss.api.exceptions.tcs.TcTpmException:

TSS Error:
error layer:                0x00 (TPM)
error code (without layer): 0x01
error code (full):          0x01
error message: Authentication failed

    at iaik.tc.tss.impl.jni.tsp.TcBaseObject.handleRetCode(TcBaseObject.java
:104)
    at iaik.tc.tss.impl.jni.tsp.TcTpm.collateIdentityRequest(TcTpm.java
:1071)
    at tc.Client.collateIdentityRequest(Client.java:176)
    at test.trustedJava.TestQuote.main(TestQuote.java:22)
----

I looked in the sources and it seems to be an "TcTssErrors.TSS_LAYER_TPM"
error.

Any help is appreciated. Thanks a lot
-- 
MfG
  Till

**********************************************
      Der Benutzer ist eine nicht zu
  tolerierende Quelle der Unsicherheit
**********************************************

Re: [Trustedjava-support] Recompute PRC based on SML and TPM_Quote problem

[Martin P. <Mar...@ia...>]

Krzysztof Kostienko wrote:
> Hello everyone,

Hi...

>  First I am not sure how the
> PRCExtend is implemented.

For single PCR extension see TPM Emulator implementation,
tpm_integrity.c, function TPM_Extend.


> Unfortunately I do not know
> how in TPM_Quote operation the value of PCRs is calculated(if we choose
> e.g.
> PCR[0], PCR[1] and PCR[2] their values are somehow connected and then hash
> value calculated).

For PCR composite calculation see TPM Emulator implementation,
tpm_integrity.c, function tpm_compute_pcr_digest.



However, C may not be nice for/to everyone, see attached 2 scripts
which replicate the calculation and some examples in Ruby.
Try them and play with JTpmTools to understand it.


HTH

-- 
Martin Pirker
IAIK, TU Graz

Re: [Trustedjava-support] Problems with Credentials

[Martin P. <Mar...@ia...>]

Thomas Winkler wrote:
>Till Bentz wrote:
>>I tried to create an AIK using the examples as a base. I succeeded in
>>creating TcTpmIdentityProof. But it seems that none of the credentials is
>>inside that proof.
>>I have a STM TPM which is supposed to be 1.2.
>>
>>Does anyone knows, if that chip delivers the above mentioned credentials?
>>Or did I just miss some important point?

> The only TPM manufacturer that I'm aware of that delivers EK credentials for 
> its TPMs is Infineon. All the other manufacturers currently do not deliver EK 
> certificates.

To be more specific, IFX TPM 1.1 and TPM 1.2 contain a TPM Endorsement Key (EK)
certificate on-chip. For 1.1 an IFX specific extraction method is needed,
for 1.2 it is standardised how to extract certificate(s) from
non-volatile ram.
Both are supported by JTss.

If you use JTssWrapper you have to manually tell TrouSerS via tcsd.conf which
credentials to use.

I don't know of any (OEM) manufacturer shipping platform endorsement or
conformance credentials.


HTH

-- 
Martin Pirker
IAIK, TU Graz

Re: [Trustedjava-support] Problems with Credentials

[Thomas W. <tc...@to...>]

Hello,

> I tried to create an AIK using the examples as a base. I succeeded in
> creating TcTpmIdentityProof. But it seems that none of the credentials is
> inside that proof.
> I have a STM TPM which is supposed to be 1.2.
>
> Does anyone knows, if that chip delivers the above mentioned credentials?
> Or did I just miss some important point?

The only TPM manufacturer that I'm aware of that delivers EK credentials for 
its TPMs is Infineon. All the other manufacturers currently do not deliver EK 
certificates.

Bye,
-- 
Thomas Winkler
e-mail: tc...@to...

[Trustedjava-support] Problems with Credentials

[Till B. <ti...@on...>]

Hello,
I tried to create an AIK using the examples as a base. I succeeded in
creating TcTpmIdentityProof. But it seems that none of the credentials is
inside that proof.
I have a STM TPM which is supposed to be 1.2.

Does anyone knows, if that chip delivers the above mentioned credentials? Or
did I just miss some important point?

Thanks a lot!

-- 
MfG
  Till

**********************************************
      Der Benutzer ist eine nicht zu
  tolerierende Quelle der Unsicherheit
**********************************************

[Trustedjava-support] Recompute PRC based on SML and TPM_Quote problem

[Krzysztof K. <kko...@gm...>]

Hello everyone,

I have not found an post with similar problem to mine on this mailing list.

I am trying to create distributed client/server application that will uses
TPM for a remote attestation and integrity check. Instead of Jtss wrapper
and TrouSerS C stack, I am using Jtss_0.1. So the idea is that client will
execute TPM_Quete command on the platform and the result of this operation
together with SML values will be sent to Server over Internet. On the server
site, based on the SML I am going to recalculate values of PCR in order to
check if these values match.

So fare I have managed to execute TPM_Quote and also to read value of SML
log. I have two problems at the moment. First I am not sure how the
PRCExtend is implemented. Please correct me if I am wrong, in order to
compute value of new PCR we take old concatenate it with a measured hash of
some data and then apply SHA-1 algorithm to this concatenated message.
Unfortunately it did work in my application(below is code). I have simply
tried to connect two strings(old PRC+new Hash) and calculate its hash(it
would be to easy):

TcBlobData newMeasurement = (TcBlobData.newString("foobar").sha1()) ;
TcBlobData pcrOld = tpm.pcrRead(16) ;
TcBlobData pcrNew = TcBlobData.newString((pcrOld.toHexString() +
newMeasurement.toHexString())).sha1();


The second problem which I have not solved yet is related to TPM_Quote. The
result of this operation consists of validation data (2048 bits), signed
value of chosen PRCs and External supplied data. Unfortunately I do not know
how in TPM_Quote operation the value of PCRs is calculated(if we choose e.g.
PCR[0], PCR[1] and PCR[2] their values are somehow connected and then hash
value calculated). In order to validate value of PCR sent by client, I need
to recompute it based on SML. Since I do not know how TPM_Quote creates
signed PCRs' value I am unable to check it.

Maybe somebody have had similar problem in the past, I would be glad for any
sort of advice.

Thanks a lot,

Krzysztof

Re: [Trustedjava-support] Integrity Measurement and Remote Attestation

[<ron...@ia...>]

Hello Carl,

It is good to hear that the wrapper tests are running.
I'm not sure what causes the problem you encounter, so I will repeat the 
relevant steps to take and will sprinkle some versions numbers over it:

Before using the jTpmTools 0.3, be sure to start the tpmd_dev kernel 
module for the emulator (V0.5).
Of course, for the jTSS Wrapper 0.3 to run you need to start the tcsd 
with root privileges first. Are you using TrouSerS version  0.2.9.1?

The message you encounter is not an error, but rather informative: There 
is some problem with trousers, and it will try to use jTSS 0.1 instead.
If there is no other error message, jTSS will be used: then we know at 
least, that the TPM emulator is still up and running correctly.

Please check again, that those libs are indeed contained in ext_libs 
(list taken from the documentation) and also check that you have the 
most recent versions. Check if you have a Java5 VM running.


jTSS

    ext_libs/iaik_jtss_tsp.jar - V0.1
    ext_libs/iaik_jtss_tcs.jar - V0.1

JTss Wrapper

    ext_libs/iaik_jtss_wrapper.jar - V0.3
    ext_libs/iaik_jtss_wrapper_swig.jar - V0.3
    ext_libs/libtspiwrapper.so - V0.3

IAIK JCE

    ext_libs/iaik_jce.jar

IAIK XSECT

    ext_libs/iaik_xsect.jar

IAIK XKMS

    ext_libs/iaik_xkms.jar

IAIK TCcert

    ext_libs/iaik_tccert.jar

JAXB - Version 2.05

    ext_libs/jaxb/activation.jar
    ext_libs/jaxb/jaxb-api.jar
    ext_libs/jaxb/jaxb-impl.jar
    ext_libs/jaxb/jsr173_1.0_api.jar



hth,

-- 
Ronald Toegl
IAIK, TU Graz

Re: [Trustedjava-support] Integrity Measurement and Remote Attestation

[Carl N. <car...@go...>]

Hi All,

Thanks for the reply, but I need to clear some points.

1) I can run the jTssWrapper_0.3 tests successfully.
2) Additional libraries iaik_jtss_wrapper.jar, iaik_jtss_wrapper_swig.jar
and libtspiwrapper.so are located in the ext_lib of the jTpm-Tools.

So is there any other sources of problem that could lead to this error.
-----------------------------------------------------------------------------------------------------------
23:34:47:240 [INFO] CommonSettings::getTssFactory (39): TrouSerS and/or jTSS
Wrapper not found. Trying IAIK jTSS.
-----------------------------------------------------------------------------------------------------------
In addition I would like to add that during the tests I have to enable
TrouSerS Daemon (tcsd).

Regards, Carl

Re: [Trustedjava-support] Integrity Measurement and Remote Attestation

[Thomas W. <tc...@to...>]

Hello,

> The only hitch is that its hard to debug or "dwell"
> into the code because of the native interface and trousers link and
> the support frm mailing list is not very supportive. 

This list should also be seen as a "users help users" list. According to the 
SF download numbers there are some users for the TC libraries. But either 
they have no problems at all or they are not on this list for some other 
reason....

> and I am not sure of this .. whether persistent storage has to do with
> TPM emulator not supporting it ??

This has nothing to do with the emulator or the TPM. The persistent storage is 
a pure software thing which simply is not implemented in the current release 
of jTSS (but TrouSerS via jTSS Wrapper provides a persistent storage).
Maybe the IAIK guys are already working on a persistent sotrage implementation 
for jTSS. But this is not a trivial thing if you want to get it right (I only 
say thread safety and proper synchronization, key hierarchies, ...).

Bye,
-- 
Thomas Winkler
e-mail: tc...@to...

Re: [Trustedjava-support] Integrity Measurement and Remote Attestation

[Thomas W. <tc...@to...>]

Hello,

> If I start the Trusted Core Services Daemon tcsd of the TrouSerS TSS, I get
> another error message.
> -----------------------------------------------------------
> 23:50:18:338 [INFO] CommonSettings::getTssFactory (39): TrouSerS and/or
> jTSS Wrapper not found. Trying IAIK jTSS.
> 23:50:18:406 [WARN] TcTddlLinux::open (-1):     Unable to open TPM device
> file /dev/tpm.
> Reason: /dev/tpm (Device or resource busy)
>
> 23:50:18:407 [ERROR] TcTcsi::<clinit> (-1):     TCS startup failed.
>[...]
> additional info: Unable to open TPM device file /dev/tpm.
> Reason: /dev/tpm (Device or resource busy)

If you are running TrouSerS (tcsd), it exclusively opens the TPM device file. 
Therefore jTSS (full Java TSS) can not access the device and you get the TCS 
startup error message.

By default, jTpmTools first try to use TrouSerS via jTSS Wrapper. If that 
fails (as in the case above) it falls back to jTSS (which in turn fails 
because TrouSerS Daemon (tcsd) is blocking the TPM device).

So far so good. Question now is why jTSS Wrapper does not work for you. 
jTpmTools documentation says:

"The jTpmTools expect the additional
IAIK/OpenTC jTSS Wrapper libraries to be located in the ext_libs
subfolder. jTpmTools requires a IAIK/OpenTC jTSS Wrapper of the 0.3.x
series, the 0.2.x series is not compatible!"

In other words you have to copy (or symlink) iaik_jtss_wrapper.jar, 
iaik_jtss_wrapper_swig.jar and libtspiwrapper.so into the ext_libs folder.


> In addition when using the jTSS I am not able to create AIK key I get the
> following Exception.
> [...]
> Exception in thread "main" java.lang.NoClassDefFoundError:
> iaik/x509/X509ExtensionException
>         at iaik.tc.apps.jtt.aik.AikCreate.execute(AikCreate.java:258)
>         at iaik.tc.utils.cmdline.SubCommand.run (SubCommand.java:69)
>         at iaik.tc.utils.cmdline.SubCommandParser.parse(
> SubCommandParser.java:41)
>         at iaik.tc.apps.JTpmTools.main(JTpmTools.java:110)

Please double check that you have IAIK JCE, TcCert and friends installed 
correctly.

Regards,
-- 
Thomas Winkler
e-mail: tc...@to...

Re: [Trustedjava-support] Integrity Measurement and Remote Attestation

[Saurabh A. <tan...@gm...>]

Hi

On 7/12/07, Carl Nickelson <car...@go...> wrote:
> Hello All,
>
> I am new to the Linux world and need some help to implement an integrity
> measurement for couple of files as a demonstration.
> I am using a TPM Emulator for all these tests and have successfully took
> ownership of it through the jTSS (which does not enable persistent storage)
>
> First from my understanding there are 2 ways to get the jTPM-Tools working.
> 1) Either through TrouSerS and the jTpm-Wrapper0.3
> 2) OR using the jTSS

I also implemented a remote attestation demo sometime back and I used
Trousers and jTssWrapper 025. It worked good on my HP dc7600 with
broadcom 1.2 TPM. The only hitch is that its hard to debug or "dwell"
into the code because of the native interface and trousers link and
the support frm mailing list is not very supportive. on the other
hand, jTSS has complete source code on platter.

>
> I have installed the TrouSerS and the jTpm-Wrapper0.3 (and 0.2.5) and run
> the 52 tests successfully in both distributions, however when trying through
> the jTPM-Tools I get the following error messages.
>
> ------------------------------
> ---------------------
> 23:34:47:240 [INFO] CommonSettings::getTssFactory (39): TrouSerS and/or jTSS
> Wrapper not found. Trying IAIK jTSS.
> 23:34:47:327 [INFO] TcTcsi::<clinit> (-1):      Unable to open TCS
> configuration file for system persistent storage information. Disabling
> system persistent storage.
> ---------------------------------------------------
>
> Therefore I installed jTSS works, but I noticed that persistent storage is
> not working and that there's additional commands which are available through
> the TSS and Wrapper, which I probably need them in my tests. So is there any
> helpful comments to get them working.
>
> If I start the Trusted Core Services Daemon tcsd of the TrouSerS TSS, I get
> another error message.
> -----------------------------------------------------------
> 23:50:18:338 [INFO] CommonSettings::getTssFactory (39): TrouSerS and/or jTSS
> Wrapper not found. Trying IAIK jTSS.
> 23:50:18:406 [WARN] TcTddlLinux::open (-1):     Unable to open TPM device
> file /dev/tpm.
> Reason: /dev/tpm (Device or resource busy)
>
> 23:50:18:407 [ERROR] TcTcsi::<clinit> (-1):     TCS startup failed.
>  23:50:18:407 [ERROR] TcTcsi::<clinit> (-1):
> TSS Error:
> error layer:                0x1000 (TDDL)
> error code (without layer): 0x87
> error code (full):          0x1087
> error message: The request could not be performed because of an IO device
> error.
> additional info: Unable to open TPM device file /dev/tpm.
> Reason: /dev/tpm (Device or resource busy)
>
> iaik.tc.tss.api.exceptions.tcs.TcTddlException:
> TSS Error:
> error layer:                0x1000 (TDDL)
> error code (without layer): 0x87
> error code (full):          0x1087
> error message: The request could not be performed because of an IO device
> error.
> additional info: Unable to open TPM device file /dev/tpm.
>  Reason: /dev/tpm (Device or resource busy)
> -----------------------------------------------------------

if you will run Trousers daemon, you will not be able to use with
jTSS. resource will be blocked by trousers daemon and hence the error.
you can use trousers here only with the jtsswrapper.

and I am not sure of this .. whether persistent storage has to do with
TPM emulator not supporting it ??

best
Tanish

[Trustedjava-support] Integrity Measurement and Remote Attestation

[Carl N. <car...@go...>]

Hello All,

I am new to the Linux world and need some help to implement an integrity
measurement for couple of files as a demonstration.
I am using a TPM Emulator for all these tests and have successfully took
ownership of it through the jTSS (which does not enable persistent storage)

First from my understanding there are 2 ways to get the jTPM-Tools working.
1) Either through TrouSerS and the jTpm-Wrapper0.3
2) OR using the jTSS

I have installed the TrouSerS and the jTpm-Wrapper0.3 (and 0.2.5) and run
the 52 tests successfully in both distributions, however when trying through
the jTPM-Tools I get the following error messages.

---------------------------------------------------
23:34:47:240 [INFO] CommonSettings::getTssFactory (39): TrouSerS and/or jTSS
Wrapper not found. Trying IAIK jTSS.
23:34:47:327 [INFO] TcTcsi::<clinit> (-1):      Unable to open TCS
configuration file for system persistent storage information. Disabling
system persistent storage.
---------------------------------------------------

Therefore I installed jTSS works, but I noticed that persistent storage is
not working and that there's additional commands which are available through
the TSS and Wrapper, which I probably need them in my tests. So is there any
helpful comments to get them working.

If I start the Trusted Core Services Daemon tcsd of the TrouSerS TSS, I get
another error message.
-----------------------------------------------------------
23:50:18:338 [INFO] CommonSettings::getTssFactory (39): TrouSerS and/or jTSS
Wrapper not found. Trying IAIK jTSS.
23:50:18:406 [WARN] TcTddlLinux::open (-1):     Unable to open TPM device
file /dev/tpm.
Reason: /dev/tpm (Device or resource busy)

23:50:18:407 [ERROR] TcTcsi::<clinit> (-1):     TCS startup failed.
23:50:18:407 [ERROR] TcTcsi::<clinit> (-1):
TSS Error:
error layer:                0x1000 (TDDL)
error code (without layer): 0x87
error code (full):          0x1087
error message: The request could not be performed because of an IO device
error.
additional info: Unable to open TPM device file /dev/tpm.
Reason: /dev/tpm (Device or resource busy)

iaik.tc.tss.api.exceptions.tcs.TcTddlException:
TSS Error:
error layer:                0x1000 (TDDL)
error code (without layer): 0x87
error code (full):          0x1087
error message: The request could not be performed because of an IO device
error.
additional info: Unable to open TPM device file /dev/tpm.
Reason: /dev/tpm (Device or resource busy)
-----------------------------------------------------------

In addition when using the jTSS I am not able to create AIK key I get the
following Exception.
-----------------------------------------------------------------------------

00:20:25:506 [INFO] TcTcsi::<clinit> (-1):      Unable to open TCS
configuration file for system persistent storage information. Disabling
system persistent storage.
00:20:25:525 [INFO] CommonSettings::getTssFactory (47): IAIK jTSS found.
Using local bindings...
Exception in thread "main" java.lang.NoClassDefFoundError:
iaik/x509/X509ExtensionException
        at iaik.tc.apps.jtt.aik.AikCreate.execute(AikCreate.java:258)
        at iaik.tc.utils.cmdline.SubCommand.run (SubCommand.java:69)
        at iaik.tc.utils.cmdline.SubCommandParser.parse(
SubCommandParser.java:41)
        at iaik.tc.apps.JTpmTools.main(JTpmTools.java:110)
-------------------------------------------------------------------------------------


Thank you in advance for your help.

Regards, Carl

Re: [Trustedjava-support] Problems running JUnit Tests

[Martin P. <Mar...@ia...>]

Hi..

Nektarios Ioannides wrote:
> I have been away from the Trusted Computing scene for a couple of months
> now due to exams, laziness etc...so nice to be back!

Just right in time for the summer break... ;-)

> [root@MonsterDesktop jTssWrapperPBuilt_0.2.5]# make run_tests
> LD_LIBRARY_PATH= output/lib CLASSPATH=output/jars/internal_jtss_wrapper.jar:output/jars/iaik_jtss_wrapper.jar:output/jars/iaik_jtss_wrapper_test.jar:/home/inectarios/Environment_Installations/java/junit4.1/junit.jar \
>                /opt/jdk1.6.0_02/jre/bin/java iaik.tss.test.junit.TestMain
> /bin/sh: output/lib: is a directory
> make: *** [run_tests] Error 126

If you look into the Makefile you see that the "run_tests" target is not very complex,
in fact it is just one line.

The command should start like
 LD_LIBRARY_PATH=output/lib CLASSPATH......
so without that space after the equal sign.

Either you have an extra space somewhere, or your build environment is somehow different...


HTH

-- 
Martin Pirker
IAIK, TU Graz

[Trustedjava-support] Problems running JUnit Tests (follow-up)

[Nektarios I. <ine...@gm...>]

P.S TCSD and the TPM Emulator load up and run perfectly fine.

[Trustedjava-support] Problems running JUnit Tests

[Nektarios I. <ine...@gm...>]

Hello everyone,

I have been away from the Trusted Computing scene for a couple of months now
due to exams, laziness etc...so nice to be back!

I have been working on a new PC lately and trying to set up a similar TPM
environment under Fedora Core 6 as I had done a few months ago on my laptop.

Thankfully, setup and the like were muuuuch faster than the first time!
Although I am quite certain I followed the right steps (since I've been
closely looking at my previous setup) this time I am  bumping onto this
error (126) when I try to run the jUnit tests from jtssWrapper. This is what
I get on the terminal:


[root@MonsterDesktop jTssWrapperPBuilt_0.2.5]# make run_tests
LD_LIBRARY_PATH= output/lib
CLASSPATH=output/jars/internal_jtss_wrapper.jar:output/jars/iaik_jtss_wrapper.jar:output/jars/iaik_jtss_wrapper_test.jar:/home/inectarios/Environment_Installations/java/junit4.1/junit.jar
\
                /opt/jdk1.6.0_02/jre/bin/java iaik.tss.test.junit.TestMain
/bin/sh: output/lib: is a directory
make: *** [run_tests] Error 126

I looked up the forum for a post of someone that had a similar error but
couldn't find anything so I am posting one now. Any ideas?

Best Regards,

Nektarios

Re: [Trustedjava-support] Problems with jTpmTools and/or JTSS

[Martin P. <Mar...@ia...>]

Till Bentz wrote:
> I am new to this list so fist a hello to everyone.

Hi, welcome to the world of Trusted Computing :-)

> Now my problem. :)

JTpmTools can work with both pure JTss and the JTssWrapper.
On startup JTpmTools tries to be smart and autodetect which variant to use.

If "iaik_jtss_wrapper.jar", "iaik_jtss_wrapper_swig.jar" and
"libtspiwrapper.so" and a running TrouSerS are present, it will use
the JTssWrapper, otherwise it will fall back to pure JTss.

Both options have advantages and disadvantages: the wrapper maps to
TrouSerS and thus is pretty 1.1 feature complete, but introduces the
fragility/complexity of the JNI mapping (e.g. 64bit support hasn't
received much testing). JTss offers some 1.2 things like access to
the on-chip certificates, while still lacking implementation even for
fundamental things like key persistant storage.

Summarizing, it's all "under construction", wear a hard hat while
venturing :-)


> LOG_DEBUG TSPI ../tcsd_api/clntside.c:102 Sending TSP packet to host localhost.
> LOG_DEBUG TSPI ../tcsd_api/clntside.c:118 Connecting to 127.0.0.1
> LOG_ERR TSPI ../tcsd_api/clntside.c:121 ERROR: connect: Connection refused
> LOG_ERR TSPI ../tcsd_api/tcstp.c:247 ERROR: Failed to send packet

This appears to be a problem with your TrouSerS setup...


> 18:18:04:207 [INFO] CommonSettings::getTssFactory (39): TrouSerS and/or
> jTSS Wrapper not found. Trying IAIK jTSS.

...so the fallback to JTss is tried instead


> I just installed JTSS, jTpmTools and the wrapper. I then took ownership of
> my TPM, which is a STM 1.2 on a Dell Optiplex GX620, using the following
> command:

ST got the least testing, but it was tested on ST before release and
it worked AFAIR.
Hm.
Sorry, can't help right now why JTss isn't working on ST.


HTH

-- 
Martin Pirker
IAIK, TU Graz

Re: [Trustedjava-support] Problems with jTpmTools and/or JTSS

[Till B. <ti...@on...>]

Hello,

I just tried using the wrapper and TrouSerS and now it works. So I guess
there is a problem inside JTSS or something like that...

On 7/4/07, Thomas Winkler <tc...@to...> wrote:
>
> Hello,
>
> >  $ sh jtt.sh take_owner -o till
> [...]
> > LOG_DEBUG TSPI ../tcsd_api/clntside.c:102 Sending TSP packet to host
> > localhost.
> > LOG_DEBUG TSPI ../tcsd_api/clntside.c:118 Connecting to 127.0.0.1
> > LOG_ERR TSPI ../tcsd_api/clntside.c:121 ERROR: connect: Connection
> refused
> > LOG_ERR TSPI ../tcsd_api/tcstp.c:247 ERROR: Failed to send packet
> > 18:18:04:207 [INFO] CommonSettings::getTssFactory (39): TrouSerS and/or
> > jTSS Wrapper not found. Trying IAIK jTSS.
> > 18:18:04:405 [INFO] TcTcsi::<clinit> (-1):      Unable to open TCS
> > configuration file for system persistent storage information. Disabling
> > system persistent storage.
> > 18:18:04:453 [INFO] CommonSettings::getTssFactory (47): IAIK jTSS found.
> > Using local bindings...
> > 18:18:17:680 [INFO] TakeOwnership::execute (82):        TakeOwnership
> > succeeded
>
> The above trace is telling me that you are using the full jTSS and not the
> wrapper. Taking the ownership succeeded. So far so good.
>
>
>
> > $ sh jtt.sh read_pubek -o till
> [...]
> > 18:18:37:943 [INFO] CommonSettings::getTssFactory (47): IAIK jTSS found.
> > Using local bindings...
> > iaik.tc.tss.api.exceptions.tcs.TcTpmException:
> >
> > TSS Error:
> > error layer:                0x00 (TPM)
> > error code (without layer): 0x01
> > error code (full):          0x01
> > error message: Authentication failed
>
> This indeed is strange. Since you have supplied the same password as when
> taking ownership this should not fail. Back at the IAIK labs we had a
> machine
> with an STM 1.2 TPM and as far as I can recall everything worked as
> expected
> on that machine.
>
> bye,
> --
> Thomas Winkler
> e-mail: tc...@to...
>



-- 
Regards
  Till

**********************************************
      Der Benutzer ist eine nicht zu
  tolerierende Quelle der Unsicherheit
**********************************************