Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

tpm2 and opensll have different hmac signature results when using the same key #3443

Open
Benson666 opened this issue Dec 13, 2024 · 1 comment

Comments

@Benson666
Copy link

I wanted to generate a hmac key by openssl, and then imported the hmac key into the tpm2.After that, I signed the same information using openssl and tpm2 respectively, but the signing results were different!
Here are my codes:

echo "Hello world!" > message.txt
openssl rand -out hmac_key.bin 32
tpm2_createprimary -C o -g sha256 -G rsa2048 -c primary.ctx
tpm2_evictcontrol -C o -c primary.ctx  0x81000001
tpm2_import -C primary.ctx -u hmac_pub.pem -r hmac_pri.pem -i hmac_key.bin -G hmac
tpm2_load -C primary.ctx -u hmac_pub.pem -r hmac_pri.pem -c hmac.ctx
tpm2_evictcontrol -C o -c hmac.ctx 0x81010002
tpm2_hmac -c hmac.ctx -g sha256 -o message_hmac_tpm.bin message.txt
openssl dgst -sha256 -mac HMAC -macopt key:"$(xxd -p hmac_key.bin)" -out message_hmac_openssl.bin -binary message.txt
cmp message_hmac_tpm.bin message_hmac_openssl.bin

The result is:

message_hmac_tpm.bin message_hmac_openssl.bin differ: byte 1, line 1

The two files have the same size:

-rw-r--r-- 1 root root 32 Dec 12 18:11 message_hmac_openssl.bin
-rw-rw---- 1 root root 32 Dec 12 18:11 message_hmac_tpm.bin

What went wrong?

@JuergenReppSIT
Copy link
Member

The files should be equal if you use:
openssl dgst -sha256 -mac hmac -macopt hexkey:$(xxd -p -c 256 < hmac_key.bin) -out message_hmac_openssl.bin -binary message.txt

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants