[Question] tpm2_encodeobject works only with persisted primarys?

[keros]

Hi

I'm on Debian 13 with tpm2-tools 5.7-1

Can someone please explain me why this works:

tpm2_createprimary -C o -G ecc -c primary.ctx
tpm2_evictcontrol -c primary.ctx 0x81110001
tpm2_create -C 0x81110001 -G ecc -u key.pub -r key.priv -p "super-secret"

tpm2_encodeobject -C 0x81110001 -u key.pub -r key.priv -o tpm.pem

openssl req -provider tpm2 -provider default -new -key tpm.pem -subj "/CN=server" -out server.csr -passin "pass:super-secret"

And this does not work:

tpm2_createprimary -C o -G ecc -c primary.ctx
tpm2_create -C primary.ctx -G ecc -u key.pub -r key.priv -p "super-secret"

tpm2_encodeobject -C primary.ctx -u key.pub -r key.priv -o tpm.pem

openssl req -provider tpm2 -provider default -new -key tpm.pem -subj "/CN=server" -out server.csr -passin "pass:super-secret"

I'm really sure there is a valid reason for this. If someone could explain this to me or point me to a documentation where this is explained I would be very happy.

Also a second question popped up.
The -p option on tpm2_encodeobject says:

...
-p, --key-auth:
Indicates if an authorization value is needed for the object specified by -r and -u.
...

https://www.mankier.com/1/tpm2_encodeobject

Is the description inverted? In my example above I use a password (super-secret) and don't need to set -p (If I set -p the example does not work).
But the same example without password needs the -p option to work.

[JuergenReppSIT]

If you get the error:
TSS2 DECODER LOAD parent: primary 0x40000001 WARNING:esys:src/tss2-esys/api/Esys_Load.c:314:Esys_Load_Finish() Received TPM Error
you have to use the latest version. The openssl provider has to create the primary which was used to create your key. There is a difference between the provider template and the template used by tpm2_createprimary: The provider sets additionly the noda flag. The following example should work (with -p for tpm2_encodeobject):

tpm2_createprimary -C o -G ecc -c primary.ctx \
    -a "noda|fixedtpm|fixedparent|sensitivedataorigin|userwithauth|restricted|decrypt"
tpm2_create -C primary.ctx -G ecc -u key.pub -r key.priv -p "super-secret"
tpm2_encodeobject -C primary.ctx -u key.pub -r key.priv -o tpm.pem -p
openssl req -provider tpm2 -provider default -new -key tpm.pem -subj "/CN=server" -out server.csr -passin "pass:super-secret"

As far as I know, the primary defaults for the tpm2-openssl provider itself are not clearly documented as stable CLI documentation. I would recommend using a persistent primary.