M1 mac: Unable to load shared library 'bcrypt.dll' or one of its dependencies when using SecurityProviderTpmHsm

[tdesmet]

Context

• OS, version, SKU and CPU architecture used: macOS Monterey 12.3.1 (M1 Mac)
• Application's .NET Target Framework : .NET 6.0
• Device: Macbook PRO 2021 (M1 Pro)
• SDK version used: 6.0.202

<PackageReference Include="Microsoft.Azure.Devices.Client" Version="1.40.0" />
<PackageReference Include="Microsoft.Azure.Devices.Provisioning.Client" Version="1.19.1" />
<PackageReference Include="Microsoft.Azure.Devices.Provisioning.Security.Tpm" Version="1.14.1" />
<PackageReference Include="Microsoft.Azure.Devices.Provisioning.Transport.Amqp" Version="1.16.1" />

Description of the issue

I'm trying to simulate an iot device using the Microsoft.Azure.Devices packages.
When I try to create the SecurityProviderTpmHsm I get an error Unable to load shared library 'bcrypt.dll' or one of its dependencies.
The code works on windows but not on my macbook (M1 cpu).

I have compiled the tpm2 simulator from https://github.com/microsoft/ms-tpm-20-ref/ and it is running.

Code sample exhibiting the issue

    var tpmDevice = new TcpTpmDevice("127.0.0.1", 2321);
    tpmDevice.Connect();
    tpmDevice.PowerCycle();
    using (var tpm2 = new Tpm2(tpmDevice))
    {
      tpm2.Startup(Su.Clear);
    }
    new SecurityProviderTpmHsm(GetRegistrationID(), tpmDevice);

Console log of the issue

Unable to load shared library 'bcrypt.dll' or one of its dependencies. In order to help diagnose loading problems, consider setting the DYLD_PRINT_LIBRARIES environment variable: dlopen(libbcrypt.dll, 0x0001): tried: 'libbcrypt.dll' (no such file), '/usr/local/lib/libbcrypt.dll' (no such file), '/usr/lib/libbcrypt.dll' (no such file), '/Users/tom/Documents/GitHub/Geras.Cloud/src/Geras.DataGenerator/bin/Debug/net6.0/libbcrypt.dll' (no such file)
   at Tpm2Lib.Native.BCryptOpenAlgorithmProvider(UIntPtr& AlgProvider, String AlgId, String Implementation, UInt32 Flags)
   at Tpm2Lib.BCryptAlgorithm.Open(String algName, UInt32 flags)
   at Tpm2Lib.BCryptAlgorithm..ctor(String algName, UInt32 flags)
   at Tpm2Lib.CryptoLib.Hmac(TpmAlgId hashAlgId, Byte[] key, Byte[] data)
   at Tpm2Lib.KDF.KDFa(TpmAlgId hmacHash, Byte[] hmacKey, String label, Byte[] contextU, Byte[] contextV, Int32 numBitsRequired)
   at Tpm2Lib.PRNG.FillRandBuf()
   at Tpm2Lib.PRNG.SetRngRandomSeed()
   at Tpm2Lib.PRNG.GetRandomBytes(Int32 numBytes)
   at Tpm2Lib.Tpm2.CancelSafeStartAuthSession(TpmSe sessionType, TpmAlgId authHash, Int32 nonceCallerSize)
   at Tpm2Lib.Tpm2.PrepareRequestSessions(CommandInfo commandInfo, TpmHandle[] inHandles)
   at Tpm2Lib.Tpm2.DispatchMethod(TpmCc ordinal, TpmStructureBase inParms, Type expectedResponseType, TpmStructureBase& outParms, Int32 numInHandlesNotUsed, Int32 numOutHandlesNotUsed)
   at Tpm2Lib.Tpm2.CreatePrimary(TpmHandle primaryHandle, SensitiveCreate inSensitive, TpmPublic inPublic, Byte[] outsideInfo, PcrSelection[] creationPCR, TpmPublic& outPublic, CreationData& creationData, Byte[]& creationHash, TkCreation& creationTicket)
   at Microsoft.Azure.Devices.Provisioning.Security.SecurityProviderTpmHsm.ReadOrCreatePersistedKey(TpmHandle persHandle, TpmHandle hierarchy, TpmPublic template)
   at Microsoft.Azure.Devices.Provisioning.Security.SecurityProviderTpmHsm.CacheEkAndSrk()
   at Microsoft.Azure.Devices.Provisioning.Security.SecurityProviderTpmHsm..ctor(String registrationId, Tpm2Device tpm)

[drwill-ms]

It appears that the TPM library the SDK uses is tied to Windows as it expects this 'bcrypt.dll' file which ships on Windows.

[drwill-ms]

@tdesmet
Did you follow the Mac-specific instructions in the TPM simulator?

[drwill-ms]

Possibly relevant: microsoft/TSS.MSR#71.

[tdesmet]

@tdesmet Did you follow the Mac-specific instructions in the TPM simulator?

Yes I was able to build and run the simulator.

The problem is that Tpm2Lib uses bcrypt. I was looking at the source code and it seems the dependency for bcrypt has been removed in microsoft/TSS.MSR#105 along with some other work to make the library cross platform compatible.
But no new nuget package has been released.

I'll make an issue in that project to see if they want to release a new nuget package.

[drwill-ms]

That is correct. I'm glad you also hit them up on their project site. When a new version is released, you should be able to privately add a new version reference. We'll also update ours when it is available and release an update on our usual cadence.

[drwill-ms]

I've moved this issue to a discussion so Tom and other customers who are impacted can track the progress, or add their support to the request.

@RamIoTMalhotra will be tracking.

[tdesmet]

So I created the issue microsoft/TSS.MSR#147 but I am not receiving any response. Looking at other issues there seems to be no interaction by the maintainers on issues.

Since these are both official microsoft projects is there a way for you guys to communicate with the other team internally and get them to give some feedback on when a new nuget release can be expected?

[drwill-ms]

is there a way for you guys to communicate with the other team internally and get them to give some feedback on when a new nuget release can be expected?

Yep, we've done that. @RamIoTMalhotra is in contact with that team and tracking it. Last we heard they said they were scheduling the work.

[tdesmet]

Thank you for the feedback.

[tdesmet]

Any update on this?

[LuKePicci]

I confirm the same happens on FreeBSD and Linux using the latest but ancient nuget package 2.1.1 of TSS.Net.. We managed to workaround this by ProjectReferencing the HEAD version of TSS.Net.csproj and Microsoft.Azure.Devices.Provisioning.Security.Tpm.csproj in chain from our device project and dropping both nuget packages for them.