How to load external key into tpm example

[sin-sch]

We noticed that tpm2-tools provides a convenient way to load external keys into the TPM using the tpm2_loadexternal command .

When trying to achieve the same with the tss-esapi crate, it seems that one first needs to load the key into the NULL hierarchy and then duplicate it into another hierarchy. If we understand this correctly, this two-step process is necessary to load a key into a non-NULL hierarchy.

It would be really helpful if the repository included an example demonstrating this workflow. We started implementing the first step (loading the key into the NULL hierarchy) but encountered the following error:
WARNING:esys:src/tss2-esys/api/Esys_LoadExternal.c:314:Esys_LoadExternal_Finish() Received TPM Error
ERROR:esys:src/tss2-esys/api/Esys_LoadExternal.c:108:Esys_LoadExternal() Esys Finish ErrorCode (0x000001ca)
Error: Tss2Error(FormatOne(FormatOneResponseCode { .0: 458, error_number: 10, parameter: true, format_selector: true, number: 1 }))

Decoding 0x000001ca using tpm2_rc_decode gives:

tpm:parameter(1): the type of the value is not appropriate for the use.

For repoducing a minimal Rust example can be found in this gist.

For comparison, the equivalent step using the tpm2-tools CLI would be something like:
tpm2_import
-C "primary.ctx"
-G hmac
-i "key.txt"
-u "imported_key.pub"
-r "imported_key.priv"
-a "sign|sensitivedataorigin|userwithauth"

If there’s interest from the maintainers, we’d be happy to contribute an example or add a small convenience function for this - but we’re currently stuck at the loading step mentioned above.

[Superhepper]

Yes, absolutely!
It is actually kind of stupid that the load_external Context method takes a Hierarchy as argument when there is actually only one option for it, but my guess is that it is done that way so that the API of the context methods mirrors the API of Esys function.

[sin-sch]

Sounds good! We'd like to contribute an example. Do you have any hints on how to approach the problem described above?