Creating TSS2 keys

[JustAnotherSwCoderAndTester]

So far I used tpm2tss-genkey to generate TPM protected keys stored on disk since TPM has limited key storage. This has a dependency on the tpm2tss openssl engine. Since openssl 3.x deprecated engines and switched to providers and I now use tpm2 provider. This works fine in our application and we can also use TSS2 key files with the tpm2 provider.

However, can we also use openssl and the tpm2 provider without the old engine to generate TSS2 keys? I looked into docu and examples and did not find anything on it. Or is there another tool within tpm2-tools that achieves this without a dependeny on tpm2tss engine?

[casaroli]

There are examples here: https://github.com/tpm2-software/tpm2-openssl/blob/master/docs/keys.md

But I tried them and they do not seem to store the private key as TSS2 PRIVATE KEY even that the documentation tells it does.

After openssl genpkey -provider tpm2 -algorithm RSA -out private.pem I get in the file:

-----BEGIN PRIVATE KEY-----
...
-----END PRIVATE KEY-----

I expected to see -----BEGIN TSS2 PRIVATE KEY-----, instead.