Public bug reported:
[Impact]
On OpenSSL 3.0.14+ ssl_util_attrs_to_evp() → get_RSA_evp_pubkey() fails
during C_SignInit / C_VerifyInit on RSA objects whenever an OpenSSL
ENGINE (e.g. libp11's engine_pkcs11, loaded via -engine pkcs11) is
registered as the process-wide default handler for RSA EVP_PKEY_METHOD.
The observed error is:
EVP_PKEY_fromdata_init: error:03000096:digital envelope
routines::operation not supported for this keytype
which propagates up through EVP_DigestSignFinal() /
EVP_DigestVerifyFinal() and ultimately surfaces to callers as a fatal
Host memory error / CKR_GENERAL_ERROR from tpm2-pkcs11, breaking TLS
client authentication (e.g. wpa_supplicant EAP-TLS/PEAP with a
TPM2-backed smartcard, using engine_pkcs11 in front of
libtpm2_pkcs11.so).
This regressed between OpenSSL 3.0.13 (working) and 3.0.14/3.5.5
(broken).
[Test Plan]
This can be tested with the included synthetic reproducer: swtpm +
tpm2-abrmd + tpm2-pkcs11 + libp11's engine_pkcs11 , performing a real
TLS 1.2 mutual-auth handshake (client CertificateVerify signed via the
TPM-backed key) with OpenSSL 3.5.5 and -engine pkcs11 (mirroring
wpa_supplicant's smartcard/EAP-TLS configuration):
Before the patch: handshake fails with EVP_PKEY_fromdata_init: ...
operation not supported for this keytype during C_SignInit.
After the patch (rebuilt as a package and installed): handshake completes
successfully ( Verify return code: 0 (ok) ), with the old error line only
appearing as a benign, recovered-from diagnostic before the fallback succeeds.
[Where problems could occur]
[Other Info]
** Affects: tpm2-pkcs11 (Ubuntu)
Importance: Undecided
Status: New
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2167891
Title:
"Host memory error" when using tpm with wpa_supplicant
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/tpm2-pkcs11/+bug/2167891/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
