trustedjava-support

[Trustedjava-support] Vista TBS

[Maksim D. <dk...@bf...>]

Hi!

I currently have the following problem when trying to use jTSS with 
Vista. When I try to

context_.connect();

I receive the exception:

Exception in thread "main" java.lang.NoClassDefFoundError: 
iaik/tss/api/exceptions/tcs/TcTddlException
    at iaik.tc.tss.impl.java.tddl.TcTddlVista.tbsContextCreate(Native 
Method)
    at iaik.tc.tss.impl.java.tddl.TcTddlVista.open(Unknown Source)
    at iaik.tc.tss.impl.java.tddl.TcTddl.getInstance(Unknown Source)
    at iaik.tc.tss.impl.java.tcs.TcTcsCommon.isOrdinalSupported(Unknown 
Source)
    at iaik.tc.tss.impl.java.tcs.tcsi.TcTcsi.<clinit>(Unknown Source)
    at 
iaik.tc.tss.impl.java.tsp.tcsbinding.local.TcTcsBindingLocal.TcsiOpenContext(Unknown 
Source)
    at 
iaik.tc.tss.impl.java.tsp.internal.TcTspInternal.TspContextOpen_Internal(Unknown 
Source)
    at iaik.tc.tss.impl.java.tsp.TcContext.connect(Unknown Source)
    at iaik.tc.tss.impl.java.tsp.TcContext.connect(Unknown Source)
    at TPMCommon.setUp(TPMCommon.java:58)
    at clientTPM.setUp(clientTPM.java:42)
    at clientTPMTest.main(clientTPMTest.java:16)
Vista TBS error received but unable to throw proper exception!Vista TBS 
Error (0x80284001): An internal software error occurred (One possible 
reason: Insufficient permissions to access TPM).



This the full code example:

import iaik.tc.tss.api.constants.tsp.TcTssConstants;
import iaik.tc.tss.api.structs.common.TcBlobData;
import iaik.tc.tss.api.tspi.TcIPolicy;
import iaik.tc.tss.api.exceptions.common.TcTssException;
//import iaik.tc.tss.api.structs.tsp.TcTssVersion;
import iaik.tc.tss.api.structs.tsp.TcUuidFactory;
import iaik.tc.tss.api.tspi.TcIContext;
import iaik.tc.tss.api.tspi.TcIRsaKey;
import iaik.tc.tss.impl.java.tsp.TcTssLocalCallFactory;

public class TPMCommon {

    // UNICODE (UTF-16LE) String without NULL termination
    public static final TcBlobData OWNER_SECRET = 
TcBlobData.newString("tpmsecret");
    //public static final TcBlobData OWNER_SECRET = 
TcBlobData.newString("hugoowner");
   
    // The TSS_WELL_KNOWN_SECRET goes in "as is".
    public static final TcBlobData SRK_SECRET = 
TcBlobData.newByteArray(TcTssConstants.TSS_WELL_KNOWN_SECRET);
    //public static final TcBlobData 
SRK_SECRET=TcBlobData.newString("srk"); //Remember to change the 
SRK_SECRET_MODE as well

    public static final long OWNER_SECRET_MODE = 
TcTssConstants.TSS_SECRET_MODE_PLAIN;
    public static final long SRK_SECRET_MODE = 
TcTssConstants.TSS_SECRET_MODE_SHA1;
//    public static final long SRK_SECRET_MODE = 
TcTssConstants.TSS_SECRET_MODE_PLAIN;
   
    public static TcIPolicy tpmPolicy = null;
    public static TcIPolicy srkPolicy = null;
   

    public TcIContext context_ = null;
    public TcIRsaKey srk_ = null;
   
    public void setUp() throws Exception
    {
        //super.setUp();
       
        context_ = new TcTssLocalCallFactory().newContextObject();    
       
        context_.connect();


Could you help me please? I have no idea where the problem is. The TPM 
itself is initialized, active and owned.

Thank you!

Re: [Trustedjava-support] Vista TBS

[<ron...@ia...>]

Maksim Djackov wrote:

Hello Maksim,

> I currently have the following problem when trying to use jTSS with 
> Vista.

 > The TPM
 > itself is initialized, active and owned.
So the lower layers appear to be ok.


> Vista TBS error received but unable to throw proper exception!Vista TBS 
> Error (0x80284001): An internal software error occurred (One possible 
> reason: Insufficient permissions to access TPM).

Currently, we need administrator rights to access the TPM from Java. As 
a workaround start the JVM (or indeed Eclipse.. :-/ ) from a "command 
prompt with Administrator rights".

Please check again, that you have unblocked the TPM commands.
http://technet.microsoft.com/en-us/windowsvista/aa905092.aspx#BKMK_S3


hth,
Ronald

Re: [Trustedjava-support] Vista TBS

[Maksim D. <dk...@bf...>]

This is strangely enough, but I am the local administrator and the 
commands (not all of them) are enabled. I can't enable all of them since 
this is the Vista Home edition and I don't have the policy group editor, 
but I suppose the jTSS suppose to create and connect the context_ at the 
very least?

Regards,

Maksim.


Ronald Tögl wrote:
> Maksim Djackov wrote:
>
> Hello Maksim,
>
>> I currently have the following problem when trying to use jTSS with 
>> Vista.
>
> > The TPM
> > itself is initialized, active and owned.
> So the lower layers appear to be ok.
>
>
>> Vista TBS error received but unable to throw proper exception!Vista 
>> TBS Error (0x80284001): An internal software error occurred (One 
>> possible reason: Insufficient permissions to access TPM).
>
> Currently, we need administrator rights to access the TPM from Java. 
> As a workaround start the JVM (or indeed Eclipse.. :-/ ) from a 
> "command prompt with Administrator rights".
>
> Please check again, that you have unblocked the TPM commands.
> http://technet.microsoft.com/en-us/windowsvista/aa905092.aspx#BKMK_S3
>
>
> hth,
> Ronald
>

Re: [Trustedjava-support] Vista TBS

[<ron...@ia...>]

Maksim Djackov wrote:
> This is strangely enough, but I am the local administrator and the 
> commands (not all of them) are enabled.
Note that being Administrator does not mean that the command shell will 
run with this privilege, unless you open it in the special elevated mode.
See for instance
http://computerbits.wordpress.com/2007/02/14/vista-elevated-command-prompt/

> I can't enable all of them since 
> this is the Vista Home edition and I don't have the policy group editor,
Currently, we do not have Vista Home available on a TPM equipped PC so 
we did not test it. Which commands are inactive & cannot be enabled?

> but I suppose the jTSS suppose to create and connect the context_ at the 
> very least?
Yes, I guess so.

Regards, Ronald

Re: [Trustedjava-support] Vista TBS

[Maksim D. <dk...@bf...>]

Sometimes I think programming embedded systems is  much easier even 
though I don't have so much layers of software and hardware sitting on 
top of the devices. I have currently moved to TPM emulator and will try 
the real hardware TPM later. I certainly appreciate the elevated command 
prompt link and will try it later.

I have attached the (default) list of blocked and allowed commands in my 
instance of Vista as the .txt file. Basically I can't enable a single 
one of them and I think this is because I run "tpm.msc" from the not 
elevated command prompt.

Regards,

Maksim.



Ronald Tögl wrote:
> Maksim Djackov wrote:
>> This is strangely enough, but I am the local administrator and the 
>> commands (not all of them) are enabled.
> Note that being Administrator does not mean that the command shell 
> will run with this privilege, unless you open it in the special 
> elevated mode.
> See for instance
> http://computerbits.wordpress.com/2007/02/14/vista-elevated-command-prompt/ 
>
>
>> I can't enable all of them since this is the Vista Home edition and I 
>> don't have the policy group editor,
> Currently, we do not have Vista Home available on a TPM equipped PC so 
> we did not test it. Which commands are inactive & cannot be enabled?
>
>> but I suppose the jTSS suppose to create and connect the context_ at 
>> the very least?
> Yes, I guess so.
>
> Regards, Ronald

Re: [Trustedjava-support] Vista TBS (with attachment)

[Maksim D. <dk...@bf...>]

Sometimes I think programming embedded systems is  much easier even
though I don't have so much layers of software and hardware sitting on
top of the devices. I have currently moved to TPM emulator and will try
the real hardware TPM later. I certainly appreciate the elevated command
prompt link and will try it later.

I have attached the (default) list of blocked and allowed commands in my
instance of Vista as the .txt file. Basically I can't enable a single
one of them and I think this is because I run "tpm.msc" from the not
elevated command prompt.

Regards,

Maksim.



Ronald Tögl wrote:
> Maksim Djackov wrote:
>> This is strangely enough, but I am the local administrator and the 
>> commands (not all of them) are enabled.
> Note that being Administrator does not mean that the command shell 
> will run with this privilege, unless you open it in the special 
> elevated mode.
> See for instance
> http://computerbits.wordpress.com/2007/02/14/vista-elevated-command-prompt/ 
>
>
>> I can't enable all of them since this is the Vista Home edition and I 
>> don't have the policy group editor,
> Currently, we do not have Vista Home available on a TPM equipped PC so 
> we did not test it. Which commands are inactive & cannot be enabled?
>
>> but I suppose the jTSS suppose to create and connect the context_ at 
>> the very least?
> Yes, I guess so.
>
> Regards, Ronald