2

Our solution includes a Windows tool that creates/opens a persisted RSA key stored in the TPM and encrypts/decrypt data using it. This works flawlessly.

Now we need to decrypt that data but from a Linux OS on that same machine. Can it be done?

The windows code uses NCrypt API (error handling etc removed):

// Open TPM storage provider.
NCryptOpenStorageProvider(
    &prov,
    MS_PLATFORM_CRYPTO_PROVIDER, //Identifies the TPM key storage provider that is provided by Microsoft. 
    0);
    
// Create persisted key
NCryptCreatePersistedKey(
    prov,
    &key,
    NCRYPT_RSA_ALGORITHM,
    "MyKeyName",
    0,
    0);

// Finalize so can be used
NCryptFinalizeKey(key, 0);
// Encrypt
NCryptEncrypt(
    key,
    (PBYTE)data,
    (DWORD)size,
    NULL,
    encryptedBuffer,
    encryptedBufferSize,
    &encryptedBufferSize,
    NCRYPT_PAD_PKCS1_FLAG);

What I'm going for is the Linux equivalent of

NCryptOpenKey(..., "MyKeyName", ...);

NCryptDecrypt(...);

But couldn't find it.

Thanks.

1

Interesting question.

I don't have a direct answer for you or a piece of code that translates yours into Linux land, but I am convinced TPM chips are usable as PKCS11 providers on Linux today. Please see the resources below

Please report back your experience, it would be interesting to find out how you got on.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.