Hi everybody:
Currently I am learning the TPM on Linux, but one problem has troubled me for a
long time.
The problem is on the Token initialized and change the password.
I have made reference to the discussion of multiple mail list has also been
tested to all relevant recommendations, but the problem still can not solve.
The following are the steps I have tested
In my "Fedora core 12" environment packages are:
kernel : 2.6.31.9-174.fc12.i686.PAE
Trousers-0.3.1-19.fc2.i686
tpm-tools-1.3.3-2.fc12.i686
tpm-tools-pkcs11-1.3.3-2.fc12.i686
opencryptoki.i686 (2.11)
The following are testing steps of my procdure:
1. reboot pc
2. enter BIOS clear tpm , reboot pc
3. enter BIOS enable tpm , reboot pc
4. type `lsmod' the tpm_infineon.ko has been loaded
5. type `/etc/init.d/tcsd start' to start tcsd ==> success
6. type `pkcs11_startup'
7. type `/etc/init.d/pkcsslotd start' ==> success
8. type `tpm_version' get follwoing information:
TPM 1.2 Version Info:
Chip Version: 1.2.1.2
Spec Level: 2
Errata Revision: 0
TPM Vendor ID: IFX
TPM Version: 01010000
Manufacturer Info: 49465800
9. type `tpm_getpubek' get follwoing information:
Public Endorsement Key:
Version: 01010000
Usage: 0x0002 (Unknown)
Flags: 0x00000000 (!VOLATILE, !MIGRATABLE, !REDIRECTION)
AuthUsage: 0x00 (Never)
Algorithm: 0x00000020 (Unknown)
Encryption Scheme: 0x00000012 (Unknown)
Signature Scheme: 0x00000010 (Unknown)
Public Key:
d336af46 89ff475e ceed8a3e 36c0cd79 7a570a94 11dfdd4e 845ba9d9 6aa0cb92
1c9de41c f87f2d4c e1538207 9ab99be5 f02d6e81 91a4b2ae bd1cdb3c 46e16cf8
f3f378f1 74461fed 6c1885ed 9368cf37 4a0d9e81 89c74c47 524792ea 6c712857
382940d4 84075ce5 5a5e6231 613a8987 45e6db09 6d0ce049 fe5cb11c 329a68f9
631ae331 66b7f937 e22ad3fa a43dbffe df7132e0 55d80049 98dacc31 213842fd
1e43c79e a4d8dfef 5fa05e9d d6e22071 b278f695 cb6bf4b6 90430c98 e1bb6cb6
de9b21c2 f5c6edcf a26f0163 16ff8a68 44975c02 c9fe7e9e c3587cd0 43c4053a
e44c4871 c93e3ef5 83291fa4 3e38b3d5 25413e0a 5cb66c3d 671f4b47 5f051381
10. type `tpm_takeownership' to take owner of the tpm
Enter owner password: 123456
Confirm password: 123456
Enter SRK password: <enter> # set to null
Confirm password: <enter> # set to null
PS. In this step, I have also used `tpm_takeownership -z' and
`tpm_changeownerauth -s -r', but have the same problem.
11. type `pkcsconf -t'
Token #0 Info:
Label: IBM PKCS#11 TPM Token
Manufacturer: IBM Corp.
Model: TPM v1.1 Token
Serial Number: 123
Flags: 0x880445
(RNG|LOGIN_REQUIRED|CLOCK_ON_TOKEN|USER_PIN_TO_BE_CHANGED|SO_PIN_TO_BE_CHANGED)
Sessions: -1/-1
R/W Sessions: -1/-1
PIN Length: 6-127
Public Memory: 0xFFFFFFFF/0xFFFFFFFF
Private Memory: 0xFFFFFFFF/0xFFFFFFFF
Hardware Version: 1.0
Firmware Version: 1.0
Time: 03:54:11 PM
Token #1 Info:
Label: IBM OS PKCS#11
Manufacturer: IBM Corp.
Model: IBM SoftTok
Serial Number: 123
Flags: 0x880045
(RNG|LOGIN_REQUIRED|CLOCK_ON_TOKEN|USER_PIN_TO_BE_CHANGED|SO_PIN_TO_BE_CHANGED)
Sessions: -1/-1
R/W Sessions: -1/-1
PIN Length: 4-8
Public Memory: 0xFFFFFFFF/0xFFFFFFFF
Private Memory: 0xFFFFFFFF/0xFFFFFFFF
Hardware Version: 1.0
Firmware Version: 1.0
Time: 03:54:11 PM
12. type `tpmtoken_init -k "IBM PKCS#11 TPM Token"'
Warning: The TPM token has already been initialized. Reinitializing the TPM
token will cause all TPM token data to be lost.
Clear the TPM token data? [y/N]: y
Enter the TPM security officer password:
A new TPM security officer password is needed. The password must be between 6
and 127 characters in length.
Enter new password: ******
Confirm password: ******
C_SetPIN failed: 0x00000006 (6)
or only type `tpmtoken_init' to init tpm but has same result.
13. Even I used the openCryptoki tool "pkcsconf" to init tpm and change SO/PIN,
there was same problem.
[r...@945gse ~]# pkcsconf -I -c 0
Enter the SO PIN: ********
Enter a unique token label: IBM PKCS#11 TPM Token
[r...@945gse ~]# pkcsconf -u -c 0
Enter the SO PIN: ********
Enter the new user PIN:
Re-enter the new user PIN:
[r...@945gse ~]# pkcsconf -P -c 0
Enter the SO PIN: ********
Enter the new SO PIN: ********
Re-enter the new SO PIN: ********
Error setting PIN: 0x6
14. The TOKEN_INITIALIZED, USER_PIN_INITIALIZED flags should be set. Also NO
USER_PIN_TO_BE_CHANGED or SO_PIN_TO_BE_CHANGED flags are set.
But I cannot change any SO/PIN.
[r...@945gse ~]# pkcsconf -t
Token #0 Info:
Label: IBM PKCS#11 TPM Token
Manufacturer: IBM Corp.
Model: TPM v1.1 Token
Serial Number: 123
Flags: 0x880445
(RNG|LOGIN_REQUIRED|CLOCK_ON_TOKEN|TOKEN_INITIALIZED|USER_PIN_TO_BE_CHANGED|SO_PIN_TO_BE_CHANGED)
Sessions: -1/-1
R/W Sessions: -1/-1
PIN Length: 6-127
Public Memory: 0xFFFFFFFF/0xFFFFFFFF
Private Memory: 0xFFFFFFFF/0xFFFFFFFF
Hardware Version: 1.0
Firmware Version: 1.0
Time: 04:13:25 PM
Token #1 Info:
Label: IBM OS PKCS#11
Manufacturer: IBM Corp.
Model: IBM SoftTok
Serial Number: 123
Flags: 0x880045
(RNG|LOGIN_REQUIRED|CLOCK_ON_TOKEN|USER_PIN_TO_BE_CHANGED|SO_PIN_TO_BE_CHANGED)
Sessions: -1/-1
R/W Sessions: -1/-1
PIN Length: 4-8
Public Memory: 0xFFFFFFFF/0xFFFFFFFF
Private Memory: 0xFFFFFFFF/0xFFFFFFFF
Hardware Version: 1.0
Firmware Version: 1.0
Time: 04:13:25 PM
Someone could give me some suggestions?
Best Regards,
Yung.
------------------------------------------------------------------------------
SOLARIS 10 is the OS for Data Centers - provides features such as DTrace,
Predictive Self Healing and Award Winning ZFS. Get Solaris 10 NOW
http://p.sf.net/sfu/solaris-dev2dev
_______________________________________________
TrouSerS-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/trousers-users
