LetsTrust-TPM2Go issues

[mlario]

Hi,

Sorry if my question appears ignorant, I'm new to the whole topic

I'm trying to use TPM2Go usb drive to automatically decrypt luks root drive on fedora 41 (arm version) on Rockrpo64 single board computer

systemd cryptenroll does not detect this tpm:

systemd-cryptenroll --tpm2-device=list
No suitable TPM2 devices found.

Then I tried following your guide: https://github.com/tpm2-software/tpm2-tss/blob/master/doc/tcti-spi-ltt2go.md

dmesg detects it:

[ 1700.748528] usb 3-1: USB disconnect, device number 2
[ 2501.483518] usb 3-1: new full-speed USB device number 3 using ohci-platform
[ 2501.698942] usb 3-1: New USB device found, idVendor=365d, idProduct=1337, bcdDevice= 0.00
[ 2501.708263] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 2501.716360] usb 3-1: Product: LetsTrust-TPM2Go
[ 2501.721424] usb 3-1: Manufacturer: www.pi3g.com
[ 2501.726622] usb 3-1: SerialNumber: XXXXXXXXXXXXX

But

sudo -u tss tpm2_startup -Tspi-ltt2go -c
ERROR:tcti:src/tss2-tcti/tctildr.c:477:tctildr_init_context_data() Failed to instantiate TCTI 
ERROR: Could not load tcti, got: "spi-ltt2go"

System has those packages installed:
tpm2-tools-5.7-2.fc41.aarch64
tpm2-tss-4.1.3-3.fc41.aarch64
tpm2-abrmd-3.0.0-6.fc41.aarch64

systemd service tpm2-abrmd cannot start, here is error output:

sudo systemctl start tpm2-abrmd
A dependency job for tpm2-abrmd.service failed. See 'journalctl -xe' for details.

journalctl -xe

Dec 12 00:47:49 server systemd[1]: Expecting device dev-tpm0.device - /dev/tpm0...
░░ Subject: A start job for unit dev-tpm0.device has begun execution
░░ Defined-By: systemd
░░ Support: https://lists.freedesktop.org/mailman/listinfo/systemd-devel
░░ 
░░ A start job for unit dev-tpm0.device has begun execution.
░░ 
░░ The job identifier is 3766.
Dec 12 00:49:19 server systemd[1]: dev-tpm0.device: Job dev-tpm0.device/start timed out.
Dec 12 00:49:19 server systemd[1]: Timed out waiting for device dev-tpm0.device - /dev/tpm0.
░░ Subject: A start job for unit dev-tpm0.device has failed
░░ Defined-By: systemd
░░ Support: https://lists.freedesktop.org/mailman/listinfo/systemd-devel
░░ 
░░ A start job for unit dev-tpm0.device has finished with a failure.
░░ 
░░ The job identifier is 3766 and the job result is timeout.
Dec 12 00:49:19 server systemd[1]: Dependency failed for tpm2-abrmd.service - TPM2 Access Broker and Resource Management Daemon.
░░ Subject: A start job for unit tpm2-abrmd.service has failed
░░ Defined-By: systemd
░░ Support: https://lists.freedesktop.org/mailman/listinfo/systemd-devel
░░ 
░░ A start job for unit tpm2-abrmd.service has finished with a failure.
░░ 
░░ The job identifier is 3765 and the job result is dependency.
Dec 12 00:49:19 server systemd[1]: tpm2-abrmd.service: Job tpm2-abrmd.service/start failed with result 'dependency'.
Dec 12 00:49:19 server systemd[1]: dev-tpm0.device: Job dev-tpm0.device/start failed with result 'timeout'.

Could you please suggest how to use this TPM and whether it can be used with systemd cryptenroll for luks root decryption?

Many Thanks!

[joholl]

I strongly suspect that the necessary TCTI library to communicate with the TPM2Go usb drive is not installed. What you need is a library called libtss2-tcti-spi-ltt2go.so. The package tpm2-tss-4.1.3-3.fc41.aarch64 does not seem to provide that.

In fact, that library seems not to be packaged at all.

Unless you find a package that installes this library on your system, you will have to build from source and run make install to install the tpm2-tss manually (or alternatively copy only the TCTI library to a path where the dynamic linking loader will find it).