1

I have been playing around with the TPM 2.0 commands using the tools from https://github.com/tpm2-software/tpm2-tools on a fedora 29. I tried take ownership of the tpm by the example from the system integration test found in tpm2-tools branch 3.1.3. The test looks like the following and works as expected:


ownerPasswd=abc123
endorsePasswd=abc123
lockPasswd=abc123
new_ownerPasswd=newpswd
new_endorsePasswd=newpswd
new_lockPasswd=newpswd

onerror() {
    echo "$BASH_COMMAND on line ${BASH_LINENO[0]} failed: $?"
    exit 1
}
trap onerror ERR

tpm2_takeownership -c

tpm2_takeownership -o $ownerPasswd -e $endorsePasswd -l $lockPasswd

tpm2_takeownership -O $ownerPasswd -E $endorsePasswd -L $lockPasswd -o $new_ownerPasswd -e $new_endorsePasswd -l $new_lockPasswd

tpm2_takeownership -c -L $new_lockPasswd

But if I do this manually and try to use an invalid password to clear the ownership I get an error(This is from a clean re-manufactured state of the simulator tpm).

[laped@localhost system]$ tpm2_takeownership -o ownerpass -e endorsepass -l lockpass
[laped@localhost system]$ tpm2_takeownership -c -L lockpass
[laped@localhost system]$ tpm2_takeownership -o ownerpass -e endorsepass -l lockpass
[laped@localhost system]$ tpm2_takeownership -c -L lockpass2
ERROR: Clearing Failed! TPM error code: 0x98e
ERROR: Unable to run tpm2_takeownership
[laped@localhost system]$ tpm2_takeownership -c -L lockpass
ERROR: Clearing Failed! TPM error code: 0x921
ERROR: Unable to run tpm2_takeownership

My question is what happens and how to I clear the ownership? It seems like the error code 0x921 is a DA lockout protection. I tried using:

[laped@localhost system]$ tpm2_dictionarylockout -c -P lockpass
ERROR: 0x921 Error clearing dictionary lockout.
ERROR: Unable to run tpm2_dictionarylockout

So I can't figure out how to bring the TPM out of this state in order to clear the ownership. I find it wierd that one invalid command can bring me into this state. I'm pretty new in the TPM world so I'm hoping that someone could explain my simple mistake :)

  • Okay. I think I figured it out. As indicated it goes into lockdown on the first try and the default policy is about 2-3 hours before next try. Mainly i got confused since listing the variable-properties capabilities didn't reflect this lockdown. TPM_PT_LOCKOUT_COUNTER: 0x00000000 <---- Thought this would increase but didn't TPM_PT_MAX_AUTH_FAIL: 0x00000020 TPM_PT_LOCKOUT_INTERVAL: 0x00001c20 TPM_PT_LOCKOUT_RECOVERY: 0x00015180 – LarsP Jan 2 at 10:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy