unsupported hash algorithm: 18

[uhthomas]

Bug Report

Description

I'm trying to install Talos fresh with system disk encryption and seeing the error unsupported hash algorithm: 18.

  systemDiskEncryption:
    ephemeral:
      keys:
        - tpm: {}
          slot: 0
    state:
      keys:
        - tpm: {}
          slot: 0

Logs

Environment

• Talos version: v1.5.3
• Kubernetes version: N/A
• Platform: bare metal

[frezbo]

it seems the tpm doesn;t support sha256?

Could you provide the dmesg?

[uhthomas]

It's a modern motherboard with a 13600K, the TPM definitely supports SHA256. I am not sure I can get the full dmesg output as there doesn't seem to be an --insecure flag for it.

❯ talosctl -e 192.168.1.78 -n 192.168.1.78 dmesg
error getting dmesg: rpc error: code = Unavailable desc = connection error: desc = "transport: Error while dialing: dial tcp 192.168.1.78:50000: connect: connection refused"

[uhthomas]

18 seems to be BLAKE2b-384?

https://go.dev/play/p/zXQHvXE22p2

[frezbo]

it seems the tpm supports BLAKE2b-384 as a has alg, and the tpm library used doesn't support that

[frezbo]

i'll think of a fix for next week

[uhthomas]

@frezbo I am confused as to where the value is coming from, as the TPM package does not seem to even recognise blake2b-384 at all and should have returned an error, which should have been handled correctly.

https://github.com/google/go-tpm/blob/5a514e64d1ed5d986ccfd38b958d2d5c038dcccd/tpm2/structures.go#L431

talos/internal/pkg/secureboot/tpm2/pcr.go

Line 169 in 0bd1bdd

return fmt.Errorf("failed to parse hash algorithm: %v", err)

[frezbo]

@frezbo I am confused as to where the value is coming from, as the TPM package does not seem to even recognise blake2b-384 at all and should have returned an error, which should have been handled correctly.

https://github.com/google/go-tpm/blob/5a514e64d1ed5d986ccfd38b958d2d5c038dcccd/tpm2/structures.go#L431

talos/internal/pkg/secureboot/tpm2/pcr.go

Line 169 in 0bd1bdd

return fmt.Errorf("failed to parse hash algorithm: %v", err)

yes, we reutrn the error as is since we don;t support BLAKE at all

[uhthomas]

You're right, I misread the error. Thank you, it looks like that is the issue.

Any suggestions for how to work around this? I guess I may be able to disable blake in the bios. Let me check.

[frezbo]

Any suggestions for how to work around this?

I hate parsing error messages, since it's flaky, probably can maybe the code in pcr to be a little different

[uhthomas]

I don't see an obvious way to disable that - it's telling me there are only sha256 banks.

[uhthomas]

Also apologies @frezbo, the value of 18 (0x0012) is actually TPMAlgSM3256.

[uhthomas]

@frezbo What do you think of #7811?

[frezbo]

that looks good, thank you 👍