TPM 2.0 simulator error DA lockout mode
I have been playing around with the TPM 2.0 commands using the tools from https://github.com/tpm2-software/tpm2-tools on a fedora 29. I tried take ownership of the tpm by the example from the system integration test found in tpm2-tools branch 3.1.3. The test looks like the following and works as expected:
ownerPasswd=abc123
endorsePasswd=abc123
lockPasswd=abc123
new_ownerPasswd=newpswd
new_endorsePasswd=newpswd
new_lockPasswd=newpswd
onerror() {
echo "$BASH_COMMAND on line ${BASH_LINENO[0]} failed: $?"
exit 1
}
trap onerror ERR
tpm2_takeownership -c
tpm2_takeownership -o $ownerPasswd -e $endorsePasswd -l $lockPasswd
tpm2_takeownership -O $ownerPasswd -E $endorsePasswd -L $lockPasswd -o $new_ownerPasswd -e $new_endorsePasswd -l $new_lockPasswd
tpm2_takeownership -c -L $new_lockPasswd
But if I do this manually and try to use an invalid password to clear the ownership I get an error(This is from a clean re-manufactured state of the simulator tpm).
[laped@localhost system]$ tpm2_takeownership -o ownerpass -e endorsepass -l lockpass
[laped@localhost system]$ tpm2_takeownership -c -L lockpass
[laped@localhost system]$ tpm2_takeownership -o ownerpass -e endorsepass -l lockpass
[laped@localhost system]$ tpm2_takeownership -c -L lockpass2
ERROR: Clearing Failed! TPM error code: 0x98e
ERROR: Unable to run tpm2_takeownership
[laped@localhost system]$ tpm2_takeownership -c -L lockpass
ERROR: Clearing Failed! TPM error code: 0x921
ERROR: Unable to run tpm2_takeownership
My question is what happens and how to I clear the ownership? It seems like the error code 0x921 is a DA lockout protection. I tried using:
[laped@localhost system]$ tpm2_dictionarylockout -c -P lockpass
ERROR: 0x921 Error clearing dictionary lockout.
ERROR: Unable to run tpm2_dictionarylockout
So I can't figure out how to bring the TPM out of this state in order to clear the ownership. I find it wierd that one invalid command can bring me into this state. I'm pretty new in the TPM world so I'm hoping that someone could explain my simple mistake :)
linux tpm
migrated from security.stackexchange.com Jan 8 at 9:00
This question came from our site for information security professionals.
add a comment |
I have been playing around with the TPM 2.0 commands using the tools from https://github.com/tpm2-software/tpm2-tools on a fedora 29. I tried take ownership of the tpm by the example from the system integration test found in tpm2-tools branch 3.1.3. The test looks like the following and works as expected:
ownerPasswd=abc123
endorsePasswd=abc123
lockPasswd=abc123
new_ownerPasswd=newpswd
new_endorsePasswd=newpswd
new_lockPasswd=newpswd
onerror() {
echo "$BASH_COMMAND on line ${BASH_LINENO[0]} failed: $?"
exit 1
}
trap onerror ERR
tpm2_takeownership -c
tpm2_takeownership -o $ownerPasswd -e $endorsePasswd -l $lockPasswd
tpm2_takeownership -O $ownerPasswd -E $endorsePasswd -L $lockPasswd -o $new_ownerPasswd -e $new_endorsePasswd -l $new_lockPasswd
tpm2_takeownership -c -L $new_lockPasswd
But if I do this manually and try to use an invalid password to clear the ownership I get an error(This is from a clean re-manufactured state of the simulator tpm).
[laped@localhost system]$ tpm2_takeownership -o ownerpass -e endorsepass -l lockpass
[laped@localhost system]$ tpm2_takeownership -c -L lockpass
[laped@localhost system]$ tpm2_takeownership -o ownerpass -e endorsepass -l lockpass
[laped@localhost system]$ tpm2_takeownership -c -L lockpass2
ERROR: Clearing Failed! TPM error code: 0x98e
ERROR: Unable to run tpm2_takeownership
[laped@localhost system]$ tpm2_takeownership -c -L lockpass
ERROR: Clearing Failed! TPM error code: 0x921
ERROR: Unable to run tpm2_takeownership
My question is what happens and how to I clear the ownership? It seems like the error code 0x921 is a DA lockout protection. I tried using:
[laped@localhost system]$ tpm2_dictionarylockout -c -P lockpass
ERROR: 0x921 Error clearing dictionary lockout.
ERROR: Unable to run tpm2_dictionarylockout
So I can't figure out how to bring the TPM out of this state in order to clear the ownership. I find it wierd that one invalid command can bring me into this state. I'm pretty new in the TPM world so I'm hoping that someone could explain my simple mistake :)
linux tpm
migrated from security.stackexchange.com Jan 8 at 9:00
This question came from our site for information security professionals.
Okay. I think I figured it out. As indicated it goes into lockdown on the first try and the default policy is about 2-3 hours before next try. Mainly i got confused since listing the variable-properties capabilities didn't reflect this lockdown. TPM_PT_LOCKOUT_COUNTER: 0x00000000 <---- Thought this would increase but didn't TPM_PT_MAX_AUTH_FAIL: 0x00000020 TPM_PT_LOCKOUT_INTERVAL: 0x00001c20 TPM_PT_LOCKOUT_RECOVERY: 0x00015180
– LarsP
Jan 2 at 10:00
add a comment |
I have been playing around with the TPM 2.0 commands using the tools from https://github.com/tpm2-software/tpm2-tools on a fedora 29. I tried take ownership of the tpm by the example from the system integration test found in tpm2-tools branch 3.1.3. The test looks like the following and works as expected:
ownerPasswd=abc123
endorsePasswd=abc123
lockPasswd=abc123
new_ownerPasswd=newpswd
new_endorsePasswd=newpswd
new_lockPasswd=newpswd
onerror() {
echo "$BASH_COMMAND on line ${BASH_LINENO[0]} failed: $?"
exit 1
}
trap onerror ERR
tpm2_takeownership -c
tpm2_takeownership -o $ownerPasswd -e $endorsePasswd -l $lockPasswd
tpm2_takeownership -O $ownerPasswd -E $endorsePasswd -L $lockPasswd -o $new_ownerPasswd -e $new_endorsePasswd -l $new_lockPasswd
tpm2_takeownership -c -L $new_lockPasswd
But if I do this manually and try to use an invalid password to clear the ownership I get an error(This is from a clean re-manufactured state of the simulator tpm).
[laped@localhost system]$ tpm2_takeownership -o ownerpass -e endorsepass -l lockpass
[laped@localhost system]$ tpm2_takeownership -c -L lockpass
[laped@localhost system]$ tpm2_takeownership -o ownerpass -e endorsepass -l lockpass
[laped@localhost system]$ tpm2_takeownership -c -L lockpass2
ERROR: Clearing Failed! TPM error code: 0x98e
ERROR: Unable to run tpm2_takeownership
[laped@localhost system]$ tpm2_takeownership -c -L lockpass
ERROR: Clearing Failed! TPM error code: 0x921
ERROR: Unable to run tpm2_takeownership
My question is what happens and how to I clear the ownership? It seems like the error code 0x921 is a DA lockout protection. I tried using:
[laped@localhost system]$ tpm2_dictionarylockout -c -P lockpass
ERROR: 0x921 Error clearing dictionary lockout.
ERROR: Unable to run tpm2_dictionarylockout
So I can't figure out how to bring the TPM out of this state in order to clear the ownership. I find it wierd that one invalid command can bring me into this state. I'm pretty new in the TPM world so I'm hoping that someone could explain my simple mistake :)
linux tpm
I have been playing around with the TPM 2.0 commands using the tools from https://github.com/tpm2-software/tpm2-tools on a fedora 29. I tried take ownership of the tpm by the example from the system integration test found in tpm2-tools branch 3.1.3. The test looks like the following and works as expected:
ownerPasswd=abc123
endorsePasswd=abc123
lockPasswd=abc123
new_ownerPasswd=newpswd
new_endorsePasswd=newpswd
new_lockPasswd=newpswd
onerror() {
echo "$BASH_COMMAND on line ${BASH_LINENO[0]} failed: $?"
exit 1
}
trap onerror ERR
tpm2_takeownership -c
tpm2_takeownership -o $ownerPasswd -e $endorsePasswd -l $lockPasswd
tpm2_takeownership -O $ownerPasswd -E $endorsePasswd -L $lockPasswd -o $new_ownerPasswd -e $new_endorsePasswd -l $new_lockPasswd
tpm2_takeownership -c -L $new_lockPasswd
But if I do this manually and try to use an invalid password to clear the ownership I get an error(This is from a clean re-manufactured state of the simulator tpm).
[laped@localhost system]$ tpm2_takeownership -o ownerpass -e endorsepass -l lockpass
[laped@localhost system]$ tpm2_takeownership -c -L lockpass
[laped@localhost system]$ tpm2_takeownership -o ownerpass -e endorsepass -l lockpass
[laped@localhost system]$ tpm2_takeownership -c -L lockpass2
ERROR: Clearing Failed! TPM error code: 0x98e
ERROR: Unable to run tpm2_takeownership
[laped@localhost system]$ tpm2_takeownership -c -L lockpass
ERROR: Clearing Failed! TPM error code: 0x921
ERROR: Unable to run tpm2_takeownership
My question is what happens and how to I clear the ownership? It seems like the error code 0x921 is a DA lockout protection. I tried using:
[laped@localhost system]$ tpm2_dictionarylockout -c -P lockpass
ERROR: 0x921 Error clearing dictionary lockout.
ERROR: Unable to run tpm2_dictionarylockout
So I can't figure out how to bring the TPM out of this state in order to clear the ownership. I find it wierd that one invalid command can bring me into this state. I'm pretty new in the TPM world so I'm hoping that someone could explain my simple mistake :)
linux tpm
linux tpm
asked Dec 18 '18 at 10:09
LarsP
migrated from security.stackexchange.com Jan 8 at 9:00
This question came from our site for information security professionals.
migrated from security.stackexchange.com Jan 8 at 9:00
This question came from our site for information security professionals.
Okay. I think I figured it out. As indicated it goes into lockdown on the first try and the default policy is about 2-3 hours before next try. Mainly i got confused since listing the variable-properties capabilities didn't reflect this lockdown. TPM_PT_LOCKOUT_COUNTER: 0x00000000 <---- Thought this would increase but didn't TPM_PT_MAX_AUTH_FAIL: 0x00000020 TPM_PT_LOCKOUT_INTERVAL: 0x00001c20 TPM_PT_LOCKOUT_RECOVERY: 0x00015180
– LarsP
Jan 2 at 10:00
add a comment |
Okay. I think I figured it out. As indicated it goes into lockdown on the first try and the default policy is about 2-3 hours before next try. Mainly i got confused since listing the variable-properties capabilities didn't reflect this lockdown. TPM_PT_LOCKOUT_COUNTER: 0x00000000 <---- Thought this would increase but didn't TPM_PT_MAX_AUTH_FAIL: 0x00000020 TPM_PT_LOCKOUT_INTERVAL: 0x00001c20 TPM_PT_LOCKOUT_RECOVERY: 0x00015180
– LarsP
Jan 2 at 10:00
Okay. I think I figured it out. As indicated it goes into lockdown on the first try and the default policy is about 2-3 hours before next try. Mainly i got confused since listing the variable-properties capabilities didn't reflect this lockdown. TPM_PT_LOCKOUT_COUNTER: 0x00000000 <---- Thought this would increase but didn't TPM_PT_MAX_AUTH_FAIL: 0x00000020 TPM_PT_LOCKOUT_INTERVAL: 0x00001c20 TPM_PT_LOCKOUT_RECOVERY: 0x00015180
– LarsP
Jan 2 at 10:00
Okay. I think I figured it out. As indicated it goes into lockdown on the first try and the default policy is about 2-3 hours before next try. Mainly i got confused since listing the variable-properties capabilities didn't reflect this lockdown. TPM_PT_LOCKOUT_COUNTER: 0x00000000 <---- Thought this would increase but didn't TPM_PT_MAX_AUTH_FAIL: 0x00000020 TPM_PT_LOCKOUT_INTERVAL: 0x00001c20 TPM_PT_LOCKOUT_RECOVERY: 0x00015180
– LarsP
Jan 2 at 10:00
add a comment |
0
active
oldest
votes
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "3"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1391801%2ftpm-2-0-simulator-error-da-lockout-mode%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
0
active
oldest
votes
0
active
oldest
votes
active
oldest
votes
active
oldest
votes
Thanks for contributing an answer to Super User!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1391801%2ftpm-2-0-simulator-error-da-lockout-mode%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Okay. I think I figured it out. As indicated it goes into lockdown on the first try and the default policy is about 2-3 hours before next try. Mainly i got confused since listing the variable-properties capabilities didn't reflect this lockdown. TPM_PT_LOCKOUT_COUNTER: 0x00000000 <---- Thought this would increase but didn't TPM_PT_MAX_AUTH_FAIL: 0x00000020 TPM_PT_LOCKOUT_INTERVAL: 0x00001c20 TPM_PT_LOCKOUT_RECOVERY: 0x00015180
– LarsP
Jan 2 at 10:00