Conversation
ansasaki
force-pushed
the
fix-ak-salted-sessions
branch
from
September 1, 2026 09:00
e4c51bb to
6406573
Compare
Unsalted policy sessions with encrypt/decrypt attributes hit a broken code path in tpm2-tss >= 4.2.0 (commit 9f1f612), causing TPM_RC_SIZE (0x000001d5) errors. Pass the parent EK handle as tpmKey to start_auth_session so sessions are salted, which avoids the bug and also improves security by deriving encryption keys from an RSA-encrypted salt rather than plaintext nonces alone. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>
ansasaki
force-pushed
the
fix-ak-salted-sessions
branch
from
September 2, 2026 14:26
6406573 to
a894b43
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
load_ak()andcreate_ak()to use salted policy sessions bypassing the parent EK handle as
tpmKeytostart_auth_sessionTPM_RC_SIZE(0x000001d5) errors with tpm2-tss >= 4.2.0, whichintroduced a regression in ESAPI parameter encryption for unsalted sessions
shared secret (RSA-encrypted salt or ECDH) rather than plaintext nonces
tpm2-toolsbehavior (e.g.tpm2_createakalready uses saltedsessions)
Fixes #681
Test plan
cargo checkpasses cleanlyThis PR was created with the help of AI (Claude Code by Anthropic).