aws / aws/NitroTPM-Tools

Unable to Generate Attestation Document - Response code value: 0x2d5

Open
#7 7 comments 1 reaction 0 assignees View on GitHub
Dominant language
HTML
Stars
7
Forks
6
PR merge metrics
No merged PRs in 30d

Description

Hi,

I'm unable to generate a Nitro TPM attestation document using nitro-tpm-attest in any configuration I've tried. The attempts result in a TPM error indicating "structure is the wrong size" (error code 0x2d5).

**Environment:**
- OS: Amazon Linux 2023 (with kernel: 6.1.155-176.282.amzn2023.x86_64)
- Instance type: t3.small
- AMI: NitroTPM-enabled AMI created following [this aws tutorial](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/enable-nitrotpm-support-on-ami.html)

After launching the instance, I can see the tpm devices.
```bash
$ ls /dev | grep tpm
tpm0
tpmrm0
```

**Setting 1: using pre-installed binary in Amazon Linux 2023**
- without sudo (permission denied)
```bash
$ /usr/bin/nitro-tpm-attest
ERROR:tcti:src/tss2-tcti/tcti-device.c:454:Tss2_Tcti_Device_Init() Failed to open specified TCTI device file /dev/tpm0: Permission denied
ERROR:tcti:src/tss2-tcti/tctildr-dl.c:169:tcti_from_file() Could not initialize TCTI file: device
ERROR:tcti:src/tss2-tcti/tctildr.c:430:Tss2_TctiLdr_Initialize_Ex() Failed to instantiate TCTI
Error: response code not recognized

Caused by:
0: response code not recognized
1: Response code value: 0xa000a
```
- with sudo (tpm error, structure size error)
```bash
$ sudo /usr/bin/nitro-tpm-attest
WARNING:esys:src/tss2-esys/api/Esys_NV_DefineSpace.c:345:Esys_NV_DefineSpace_Finish() Received TPM Error
ERROR:esys:src/tss2-esys/api/Esys_NV_DefineSpace.c:121:Esys_NV_DefineSpace() Esys Finish ErrorCode (0x000002d5)
Error: structure is the wrong size (associated with parameter number 2)

Caused by:
0: structure is the wrong size (associated with parameter number 2)
1: Response code value: 0x2d5
```

**Setting 2: using this repository and cargo**
```bash
$ git clone
$ cd NitroTPM-Tools/nitro-tpm-attest
$ cargo build --release
$ sudo ./target/release/nitro-tpm-attest
WARNING:esys:src/tss2-esys/api/Esys_NV_DefineSpace.c:345:Esys_NV_DefineSpace_Finish() Received TPM Error
ERROR:esys:src/tss2-esys/api/Esys_NV_DefineSpace.c:121:Esys_NV_DefineSpace() Esys Finish ErrorCode (0x000002d5)
Error: structure is the wrong size (associated with parameter number 2)

Caused by:
0: structure is the wrong size (associated with parameter number 2)
1: Response code value: 0x2d5
```

Note that the same 0x2d5 error occurs when adding options like `--public-key`, `--nonce`, or `--user-data`.

I appreciate any guidance on resolving this issue or clarifying the expected setup.

Thanks in advance!

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.