tss2 createkey failed

[DennisYurichev]

I tried to copy the command line from tests, but fail to run:

% tss2 createkey --path="HS/SRK/myRSACrypt" --type="noDa,decrypt"
New password:
Re-enter new password:
ERROR:fapi:src/tss2-fapi/ifapi_keystore.c:515:rel_path_to_abs_path() ErrorCode (0x00060034) FAPI not provisioned for path: P_ECCP256SHA256/HS/SRK.
ERROR:fapi:src/tss2-fapi/ifapi_keystore.c:582:ifapi_keystore_load_async() ErrorCode (0x00060034) Object P_ECCP256SHA256/HS/SRK not found.
ERROR:fapi:src/tss2-fapi/fapi_util.c:876:ifapi_load_primary_async() ErrorCode (0x00060034) Could not open: P_ECCP256SHA256/HS/SRK
ERROR:fapi:src/tss2-fapi/fapi_util.c:1370:ifapi_get_sessions_async() ErrorCode (0x00060034) Load EK
ERROR:fapi:src/tss2-fapi/fapi_util.c:3497:ifapi_key_create() ErrorCode (0x00060034) Create sessions
WARNING:esys:src/tss2-esys/api/Esys_FlushContext.c:234:Esys_FlushContext_Finish() Received TPM Error
ERROR:esys:src/tss2-esys/api/Esys_FlushContext.c:89:Esys_FlushContext() Esys Finish ErrorCode (0x000001c4)
ERROR:fapi:src/tss2-fapi/fapi_util.c:1211:ifapi_session_clean() Cleanup Policy Session  failed.
ERROR:fapi:src/tss2-fapi/api/Fapi_CreateKey.c:283:Fapi_CreateKey_Finish() Key create ErrorCode (0x00060034)
ERROR:fapi:src/tss2-fapi/api/Fapi_CreateKey.c:116:Fapi_CreateKey() ErrorCode (0x00060034) Key_Create
Fapi_CreateKey(0x60034) - fapi:Provisioning was not executed.

I run this against a real TPM 2.0 chip.
What path should be?

[JuergenReppSIT]

To create FAPI keys, FAPI must first be provisioned using tss2_provision.

The default profile is P_ECCP256SHA256. If you want to create an RSA key, you should use the P_RSA2048SHA256 profile instead.

FAPI can be configured either to switch to an RSA-based profile or to use multiple profiles. It also supports using different profiles in parallel by provisioning an additional profile.
When using multiple FAPI profiles in parallel, or when switching between different FAPI profiles such as RSA and ECC, care must be taken to ensure that the persistent TPM handle numbers assigned to the Storage Root Keys (SRKs) do not overlap.

From man page fapi-config:
If not otherwise specified during TSS installation, the default location for the exemplary profiles is /etc/tpm2-tss/fapi-profiles/
and /etc/tpm2-tss/ for the FAPI configuration file. The environment variable TSS2_FAPICONF can be used to set an alternative pathname for the FAPI configuration file.

Without performing FAPI provisioning, you can create an RSA key as follows:

tpm2_createprimary -C o -c primary.ctx
tpm2_create -C primary.ctx \
  -G rsa2048 \
  -c rsa_decrypt.ctx \
  -u rsa_decrypt.pub \
  -r rsa_decrypt.priv \
  -a "fixedtpm|fixedparent|sensitivedataorigin|userwithauth|decrypt"