Verifying with openssl dgst command

[GrafWaldemar]

The openssl dgst command currently does not work for the verification of a signature and prints out an error. This problem occurs regardless of the type of key in use (ecdsa / rsa or public / private). You can find below the commands used and the verification error (identical for all types of keys).

sudo tpm2tss-genkey -a ecdsa mykey
openssl ec -engine tpm2tss -inform engine -in mykey -pubout -outform pem -out mykey.pub
 
sudo openssl dgst -engine tpm2tss -keyform engine -sha256 -sign mykey -out mydatasig mydata
 
sudo openssl dgst -engine tpm2tss -keyform engine -sha256 -verify mykey -signature mydatasig mydata
sudo openssl dgst -engine tpm2tss -keyform engine -sha256 -verify mykey.pub -signature mydatasig mydata
 
engine "tpm2tss" set.
cannot load key file from engine
139991405261248:error:2609707D:engine routines:ENGINE_load_public_key:no load function:../crypto/engine/eng_pkey.c:102:
unable to load key file```

[AndreasFuchsTPM]

would you run openssl dgst -sha256 -keyform pem -verify mykey.pub -signature mydatasig mydata ? the mykey.pub is not a tpm-key anymore, but just a regular pem key.

Could you also tell me, if the openssl dgst -engine tpm2tss -keyform engine -sha256 -verify mykey.pub -signature mydatasig mydata worked or not ?

[GrafWaldemar]

Your first command is working fine, but the second command has still the same error as mentioned above:

cannot load key file from engine
139991405261248:error:2609707D:engine routines:ENGINE_load_public_key:no load function:../crypto/engine/eng_pkey.c:102:
unable to load key file```

[AndreasFuchsTPM]

Oh, sorry, I copied the wrong one... Does openssl dgst -engine tpm2tss -keyform engine -sha256 -verify mykey -signature mydatasig mydata work ?

[GrafWaldemar]

No, same error again.

[AndreasFuchsTPM]

Could you compile the engine with --enable-debug and run the command again ?

[GrafWaldemar]

Sure. Unfortunately only Initializing is printed before the error from above.

[AndreasFuchsTPM]

Ok, so this seems do be related to dgst requiring the PKEY functions as implemented in #89 This will be part of the 1.1.0 release after 1.0.0 is out the door.

If you could test that branch, that would already help.

Until then, you will have to use the pkeyutl of openssl that does not hash on the fly:

$ openssl pkeyutl -keyform engine -engine tpm2tss -inkey mykey -sign -in mydata -out mysig
$ openssl pkeyutl -keyform engine -engine tpm2tss -inkey mykey -verify -in mydata -sigfile mysig

So mydata is already the digest of whatever your actual payload data is.

Hope this helps for now and sorry for not supporting it yet. Hoping for you testing...