title: "Authentication failed" when creating a key using the TPM / TrouSerS API
body: <p>I'm attempting to sign some data using the TPM through the TrouSerS API. I have scoured the web for code examples and the only one I've come across is in slide #30 of <a href="https://www.trustedcomputinggroup.org/wp-content/uploads/Intro-to-Using-the-TSS-2005-11-07.pdf" rel="nofollow noreferrer">this PDF</a> (the TPM and Trousers have notoriously cryptic documentation, in my opinion).</p>
  
  <p>The code fails when I call the following function to create a signing key:</p>
  
  <blockquote>
    <p>Tspi_Key_CreateKey()</p>
  </blockquote>
  
  <p>The error code I obtain is "1", which when run through the <code>Trspi_Error_String()</code> function translates to the string "Authentication failed". Clearly, the call to create the signing key fails because it does not have the right authorization policy. </p>
  
  <p>In the code sample below you can see that I'm setting the default policy secret to be <code>TSS_WELL_KNOWN_SECRET</code>, which is twenty 0's if I recall correctly. I haven't been able to find good documentation on how policies operate and how to make sure my calls to the TPM are authorized. I need help understanding two things:</p>
  
  <ul>
  <li>How do policies work in TrouSerS and the TPM? </li>
  <li>How do I make sure that my call to <code>Tspi_Key_CreateKey()</code> is authorized?</li>
  </ul>
  
  <pre class="lang-cpp prettyprint-override"><code>TSS_HCONTEXT hContext;
  TSS_HKEY hSigningKey, hSRK;
  TSS_HPOLICY hPolicy;
  BYTE secret[] = TSS_WELL_KNOWN_SECRET;
  
  // Init context and connect to tcsd daemon
  Tspi_Context_Create(&amp;hContext);
  Tspi_Context_Connect(hContext, NULL);
  
  // Create object for Software Root Key
  Tspi_Context_CreateObject(hContext, TSS_OBJECT_TYPE_RSAKEY, TSS_KEY_TSP_SRK, &amp;hSRK);
  
  // Create object for signing key
  Tspi_Context_CreateObject(hContext, TSS_OBJECT_TYPE_RSAKEY,
                      TSS_KEY_TYPE_SIGNING |
                      TSS_KEY_SIZE_2048 |
                      TSS_KEY_AUTHORIZATION |
                      TSS_KEY_NOT_MIGRATABLE,
                      &amp;hSigningKey);
  
  // Set up the default policy, which applies to all objects
  Tspi_Context_GetDefaultPolicy(hContext, &amp;hPolicy);
  Tspi_Policy_SetSecret(hPolicy, TSS_SECRET_MODE_SHA1, 20, secret);
  
  // Load the SRK key
  TSS_UUID SRK_UUID = TSS_UUID_SRK;
  Tspi_Context_LoadKeyByUUID(hContext, TSS_PS_TYPE_SYSTEM, SRK_UUID, &amp;hSRK);
  
  // Create the signing key
  Tspi_Key_CreateKey(hSigningKey, hSRK, 0);
  if (result != TSS_SUCCESS) {
      LOG(ERROR) &lt;&lt; "Failed to create signing key " &lt;&lt; result;
      LOG(ERROR) &lt;&lt; Trspi_Error_String(result);
      return;
  }
  </code></pre>