Oh, how exciting :-p     Why are we doing hashing with the TPM? If we're in an OpenSSL provider cant we just use software provided hashing routines? I see hashing is configurable, but I would imagine off be default is what you want. Do we use validation tickets or anything like that or just the resulting digest? If all we use are the digests, I would make TPM not hash and make that option a nop.   It does seem that way, but TPM commands only ever need 3 objects alive at once, so that's likely why that was chosen. https://github.com/torvalds/linux/commit/6c4e79d99e6f42b79040f1a33cd4018f... Does CMP key really need all 4 of those things in the TPM at once, because currently today that's not actually happening as abrmd is just swapping them in and out. Also, doesn't CMP use public objects (x509 certs) for some of it? Looking at the code here: - https://github.com/tpm2-software/tpm2-openssl/blob/34c62521a359455b6c4c2b... Are public key operations implemented in software? In tpm2-pkcs11 we implement them in software and hash in software and I have yet to have someone hit a limit but perhaps they are all using abrmd but I thought some were using in-kernel RM. It's something the RM should do, but the in-kernel RM will always be tightly constrained by the amount of kernel memory space it can swap to. I wonder if we could give it a real swap space :-p     Petr ______________________________________________________________ Thats: tpm2_rc_decode 0x00000902 tpm:warn(2.0): out of memory for object contexts Are you running against a resource manager? You should probably either use /dev/tpmrm0 or tpm2-abrmd. You can set the TCTI via the TPM2OPENSSL_TCTI which AFAICT takes strings like tpm2-tools, so something like: "device:/dev/tpmrm0" or "abrmd". This also might be a bug, the provider is pretty new. Petr any other ideas I am missing? Bill From: Chris Newman <chris(a)mode51.software&gt; Sent: Sunday, October 3, 2021 6:40 PM To: tpm2(a)lists.01.org <tpm2(a)lists.01.org&gt; Subject: [tpm2] CMP error: cannot duplicate context:2306 tpm:warn(2.0): out of memory for object contexts   Hi, I create an EK and AK using tpm2_createek, tpm2_createak and tpm2_evictcontrol to persist the AK in 0x81010002. The I use the following command with DigiCert's CMPv2 server: openssl cmp -config /opt/sdk/openssl/current/ssl/openssl.cnf -provider tpm2 -provider default -propquery ?provider=tpm2,tpm2.digest!=yes -cmd ir -server https://demo.one.digicert.com/iot/api/v1/cmp/IOT_1234 -ref 1234 -secret pass:1234 -recipient "/CN=mode51.software" -key handle:0x81010002 -subject "/CN=TestTest" -cacertsout ./capubs.pem -certout ./cl_cert.pem -tls_used -verbosity 8 I get the following error: DIGEST NEW DIGEST INIT DIGEST UPDATE DIGEST DUP DIGEST FINAL DIGEST FREE DIGEST NEW DIGEST INIT DIGEST UPDATE DIGEST NEW DIGEST INIT DIGEST UPDATE DIGEST DUP WARNING:esys:src/tss2-esys/api/Esys_ContextLoad.c:279:Esys_ContextLoad_Finish() Received TPM Error ERROR:esys:src/tss2-esys/api/Esys_ContextLoad.c:93:Esys_ContextLoad() Esys Finish ErrorCode (0x00000902) DIGEST FREE DIGEST FREE DIGEST FREE CMP DEBUG: disconnected from CMP server CMP error: cannot duplicate context:2306 tpm:warn(2.0): out of memory for object contexts CMP error: not able to copy ctx CMP error: internal error CMP error: error sending CMP error: shutdown while in init CMP error: transfer error:request sent: IR, expected response: IP RSA FREE RAND FREE RAND FREE RAND FREE PROVIDER TEARDOWN   I've tried tpm2_flushcontext -t. I recompiled tpm2-openssl with the following option and that appears to have worked around the issue: --disable-op-digest Is this what "?provider=tpm2,tpm2.digest!=yes" should effectively do?   -- Chris Newman https://mode51.software @mode51software