Our solution includes a Windows tool that creates/opens a persisted RSA key stored in the TPM and encrypts/decrypt data using it. This works flawlessly.
Now we need to decrypt that data but from a Linux OS on that same machine. Can it be done?
The windows code uses NCrypt API (error handling etc removed):
// Open TPM storage provider. NCryptOpenStorageProvider( &prov, MS_PLATFORM_CRYPTO_PROVIDER, //Identifies the TPM key storage provider that is provided by Microsoft. 0); // Create persisted key NCryptCreatePersistedKey( prov, &key, NCRYPT_RSA_ALGORITHM, "MyKeyName", 0, 0); // Finalize so can be used NCryptFinalizeKey(key, 0); // Encrypt NCryptEncrypt( key, (PBYTE)data, (DWORD)size, NULL, encryptedBuffer, encryptedBufferSize, &encryptedBufferSize, NCRYPT_PAD_PKCS1_FLAG);
What I'm going for is the Linux equivalent of
NCryptOpenKey(..., "MyKeyName", ...); NCryptDecrypt(...);
But couldn't find it.