** Description changed:

  [Impact]
  
  On OpenSSL 3.0.14+ ssl_util_attrs_to_evp() → get_RSA_evp_pubkey() fails
  during C_SignInit / C_VerifyInit on RSA objects whenever an OpenSSL
  ENGINE (e.g. libp11's engine_pkcs11, loaded via -engine pkcs11) is
  registered as the process-wide default handler for RSA EVP_PKEY_METHOD.
  The observed error is:
  
  EVP_PKEY_fromdata_init: error:03000096:digital envelope
  routines::operation not supported for this keytype
  
  which propagates up through EVP_DigestSignFinal() /
  EVP_DigestVerifyFinal() and ultimately surfaces to callers as a fatal
  Host memory error / CKR_GENERAL_ERROR from tpm2-pkcs11, breaking TLS
  client authentication (e.g. wpa_supplicant EAP-TLS/PEAP with a
  TPM2-backed smartcard, using engine_pkcs11 in front of
  libtpm2_pkcs11.so).
  
  This regressed between OpenSSL 3.0.13 (working) and 3.0.14/3.5.5
  (broken).
  
- 
  [Test Plan]
  
  This can be tested with the included synthetic reproducer: swtpm +
  tpm2-abrmd + tpm2-pkcs11 + libp11's  engine_pkcs11 , performing a real
  TLS 1.2 mutual-auth handshake (client  CertificateVerify  signed via the
  TPM-backed key) with OpenSSL 3.5.5 and  -engine pkcs11  (mirroring
  wpa_supplicant's smartcard/EAP-TLS configuration):
  
-     Before the patch: handshake fails with  EVP_PKEY_fromdata_init: ... 
operation not supported for this keytype  during  C_SignInit.
-     After the patch (rebuilt as a package and installed): handshake completes 
successfully ( Verify return code: 0 (ok) ), with the old error line only 
appearing as a benign, recovered-from diagnostic before the fallback succeeds.
+ Before the patch: handshake fails with  EVP_PKEY_fromdata_init: ...
+ operation not supported for this keytype  during  C_SignInit.
+ 
+ After the patch (rebuilt as a package and installed): handshake
+ completes successfully ( Verify return code: 0 (ok) ), with the old
+ error line only appearing as a benign, recovered-from diagnostic before
+ the fallback succeeds.
  
  [Where problems could occur]
  
+ The added code runs when the standard path fails so it should not affect
+ any use case that is working now.
+ 
  [Other Info]
+ 
+ I have created a PR upstream where one of the maintainers confirmed the bug 
[1]
+ The PR has not been accepted but upstream is working on a fix. Once that 
lands we cant remove this patch and add theirs.
+ 
+ [1]
+ https://github.com/tpm2-software/tpm2-pkcs11/pull/948#issuecomment-5693440184

** Description changed:

  [Impact]
  
  On OpenSSL 3.0.14+ ssl_util_attrs_to_evp() → get_RSA_evp_pubkey() fails
  during C_SignInit / C_VerifyInit on RSA objects whenever an OpenSSL
  ENGINE (e.g. libp11's engine_pkcs11, loaded via -engine pkcs11) is
  registered as the process-wide default handler for RSA EVP_PKEY_METHOD.
  The observed error is:
  
  EVP_PKEY_fromdata_init: error:03000096:digital envelope
  routines::operation not supported for this keytype
  
  which propagates up through EVP_DigestSignFinal() /
  EVP_DigestVerifyFinal() and ultimately surfaces to callers as a fatal
  Host memory error / CKR_GENERAL_ERROR from tpm2-pkcs11, breaking TLS
  client authentication (e.g. wpa_supplicant EAP-TLS/PEAP with a
  TPM2-backed smartcard, using engine_pkcs11 in front of
  libtpm2_pkcs11.so).
  
  This regressed between OpenSSL 3.0.13 (working) and 3.0.14/3.5.5
  (broken).
  
  [Test Plan]
  
  This can be tested with the included synthetic reproducer: swtpm +
  tpm2-abrmd + tpm2-pkcs11 + libp11's  engine_pkcs11 , performing a real
  TLS 1.2 mutual-auth handshake (client  CertificateVerify  signed via the
  TPM-backed key) with OpenSSL 3.5.5 and  -engine pkcs11  (mirroring
  wpa_supplicant's smartcard/EAP-TLS configuration):
  
  Before the patch: handshake fails with  EVP_PKEY_fromdata_init: ...
  operation not supported for this keytype  during  C_SignInit.
  
  After the patch (rebuilt as a package and installed): handshake
  completes successfully ( Verify return code: 0 (ok) ), with the old
  error line only appearing as a benign, recovered-from diagnostic before
  the fallback succeeds.
  
  [Where problems could occur]
  
  The added code runs when the standard path fails so it should not affect
  any use case that is working now.
  
  [Other Info]
  
  I have created a PR upstream where one of the maintainers confirmed the bug 
[1]
- The PR has not been accepted but upstream is working on a fix. Once that 
lands we cant remove this patch and add theirs.
+ The PR has not been accepted but upstream is working on a fix. Once that 
lands we can remove this patch and add theirs.
  
  [1]
  https://github.com/tpm2-software/tpm2-pkcs11/pull/948#issuecomment-5693440184

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2167891

Title:
  "Host memory error" when using tpm with wpa_supplicant

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/tpm2-pkcs11/+bug/2167891/+subscriptions


-- 
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

Reply via email to