cryptsetup luksAddKey failed

[andreasfuchstpm]

cryptsetup luksAddKey failed

[AndreasFuchsTPM]

The Warnings are normal given your setup with using /dev/tpm directly.

The error means that the NV slot inside the TPM is already defined. Probably from an earlier attempt ?
Have a look using tpm2_nvlist and then release it using tpm2_nvrelease.

A word fo caution, I'm in the process of rewriting this thing completely. So expect an update soon...

[AndreasFuchsTPM]

It seems like you cannot connect to the TPM. Do the tpm2-tools programs work on your system ?

What's the user/group of /dev/tpmrm0 or /dev/tpm0 ?
Are you a member of this group ?
Does running it under sudo solve the issue ?

[irn73]

Hi Andreas,

Sorry for the delay, I missed your reply.
I have made some progress since my last post.
Now, I get the following warnings when I try to run the command sudo cryptsetup luksAddKey --tpmnew=0x1bffffd --tpmpcr=0,1,2,3,5,7 /dev/sda3:

WARNING:esys:src/tss2-esys/esys_tcti_default.c:137:tcti_from_file()
Could not load TCTI file: libtss2-tcti-default.so
WARNING:esys:src/tss2-esys/esys_tcti_default.c:137:tcti_from_file()
Could not load TCTI file: libtss2-tcti-tabrmd.so

I have downloaded and compiled tpm2-tss.
I have configured cryptsetup-tpm-incubator as following:
./configure --prefix=/usr --libdir=/lib/x86_64-linux-gnu --sbindir=/sbin --mandir=/usr/share/man --enable-libargon2 --enable-shared --enable-cryptsetup-reencrypt --enable-tpm

The operation works only once.
When I try to run the command sudo cryptsetup luksAddKey... once again it fails:

WARNING:esys:src/tss2-esys/esys_tcti_default.c:137:tcti_from_file() Could not load TCTI file: libtss2-tcti-default.so

WARNING:esys:src/tss2-esys/esys_tcti_default.c:137:tcti_from_file() Could not load TCTI file: libtss2-tcti-tabrmd.so

WARNING:esys:src/tss2-esys/api/Esys_NV_DefineSpace.c:335:Esys_NV_DefineSpace_Finish() Received TPM Error

ERROR:esys:src/tss2-esys/api/Esys_NV_DefineSpace.c:120:Esys_NV_DefineSpace() Esys Finish ErrorCode (0x0000014c)

Why do I get this error when running the second time?
Why do I get the warnings? Is it normal behavior?

Thanks,
Ido

[irn73]

Thanks, I will wait for the next release

[AndreasFuchsTPM]

@irn73 Next release is here or on gitlab.
See https://gitlab.com/cryptsetup/cryptsetup/merge_requests/51
If you like to test it out...