<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<br>
<div class="moz-cite-prefix">On 25/07/18 20:58, William Roberts
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:CAFftDdrsFG=bRUmsv4MJngtBKHkwhzTOrfqEjOCBtRnHYwyCWQ@mail.gmail.com">
<pre wrap="">On Tue, Jul 24, 2018 at 4:18 AM, Kaarthik Sivakumar
<a class="moz-txt-link-rfc2396E" href="mailto:kaarthik.sk@gmail.com"><kaarthik.sk@gmail.com></a> wrote:
</pre>
<blockquote type="cite">
<pre wrap="">Hello
I need to create a key pair using a TPM (proprietary) and build a CSR and
</pre>
</blockquote>
<pre wrap="">
What TPM Version?
If it's TPM 2.0, a new Engine project has emerged here:
<a class="moz-txt-link-freetext" href="https://github.com/tpm2-software/tpm2-tss-engine">https://github.com/tpm2-software/tpm2-tss-engine</a>
</pre>
</blockquote>
<br>
Yep 2.0.<br>
<br>
<blockquote type="cite"
cite="mid:CAFftDdrsFG=bRUmsv4MJngtBKHkwhzTOrfqEjOCBtRnHYwyCWQ@mail.gmail.com">
<pre wrap="">
This might be able to handle to just calling the create CSR routine. I
know back-in-
the-day the OpenSC engine with a PIV card could do it.
You can try to get ahold of the maintainer of that project (Andraes) through
a direct email or the project mailing list:
- <a class="moz-txt-link-freetext" href="https://lists.01.org/mailman/listinfo/tpm2">https://lists.01.org/mailman/listinfo/tpm2</a>
</pre>
</blockquote>
<br>
Ok, thanks for the info.<br>
<br>
-kaarthik-<br>
<br>
<blockquote type="cite"
cite="mid:CAFftDdrsFG=bRUmsv4MJngtBKHkwhzTOrfqEjOCBtRnHYwyCWQ@mail.gmail.com">
<pre wrap="">
</pre>
<blockquote type="cite">
<pre wrap="">sign it using it the TPM as well. Currently I dont have an engine interface
to talk to the TPM. I do the following:
1. generate key pair in the TPM. private key is kept private in the TPM and
public key can be obtained out of the TPM
2. use the public key to generate a CSR (X509_REQ_init(), etc)
3. Get the hash of the CSR (X509_REQ_digest())
4. Pass the digest to the TPM and get back signature
5. Add signature to the CSR - I dont see any way to do this. Is there an
openssl API to perform this step? I dont think I can use X509_REQ_sign()
since that will use the private key provided or if I have an engine
interface then it will call the engine to do the signing. Is there a way to
call sign() and make it call my function that can do the step 4 above?
Thanks!
-kaarthik-
--
openssl-users mailing list
To unsubscribe: <a class="moz-txt-link-freetext" href="https://mta.openssl.org/mailman/listinfo/openssl-users">https://mta.openssl.org/mailman/listinfo/openssl-users</a>
</pre>
</blockquote>
</blockquote>
<br>
</body>
</html>