<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
<html lang="en">
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
<title>
GitLab
</title>
<style>img {
max-width: 100%; height: auto;
}
</style>
</head>
<body>
<div class="content">
<div></div>
<p dir="auto">tpmtool currently requires that a user has a TPM 1.2 SRK password set since it doesn't support the 'well known' SRK password of 20 zero bytes. So if one sets the TPM 1.2 SRK password to a 'string' password, certtool will cause unnecessary authentication failures when trying to talk to the TPM via the tcsd since it will be using the well know SRK password of 20 zero bytes first (certtool seems to support this). The problem with the TPM 1.2 is that it locks down after too many authentication failures and the owner has to send a command to reset it. While we cannot prevent the lock-down entirely (user can always pass a wrong password), we could at least try to minimize the number of failures. So at the moment certtool seems to first try the 'well known' password (which causes an authentication failure) and then prompt the user for the SRK password.</p>
<p dir="auto">Suggestion for forcing certtool to use the SRK password given by user:</p>
<p dir="auto">GNUTLS_SRK_PASSWORD=foo certtool ... # use foo as SRK password on first try</p>
<p dir="auto">For reference, I posted a patch to the TPM 1.2 Trousers mailing list here that describes the issue and fixes a similar issue in tcsd client: <a href="https://sourceforge.net/p/trousers/mailman/message/36444514/" rel="nofollow noreferrer noopener" target="_blank">https://sourceforge.net/p/trousers/mailman/message/36444514/</a></p>
</div>
<div class="footer" style="margin-top: 10px;">
<p style="font-size: small; color: #777777;">
—
<br>
Reply to this email directly or <a href="https://gitlab.com/gnutls/gnutls/issues/601">view it on GitLab</a>.
<br>
You're receiving this email because of your account on gitlab.com.
If you'd like to receive fewer emails, you can
<a href="https://gitlab.com/sent_notifications/554a96e83b685c979bb11266a43a592d/unsubscribe">unsubscribe</a>
from this thread or
adjust your notification settings.
<script type="application/ld+json">{"@context":"http://schema.org","@type":"EmailMessage","action":{"@type":"ViewAction","name":"View Issue","url":"https://gitlab.com/gnutls/gnutls/issues/601"}}</script>
</p>
</div>
</body>
</html>