Using TPM Policies from TSS.CPP inside NCrypt Keys with "Platform Crypto Provider"

[teenccu]

Hello,

I want to set the policies created by TSS.CPP inside a nrcypt key before finalizing the key so that those policies are set for that ncrypt key.

As documented for "Platform Crypto Provider", I can retrieve the platform handle and Key handle from ncrypt apis i.e reading properties NCRYPT_PCP_PLATFORMHANDLE_PROPERTY and NCRYPT_PCP_PLATFORMHANDLE_PROPERTY and then I can use set those handles inside TSS.CPP implementation. This works well for existing Ncrypt keys.
However, I want to create keys with ncrypt apis , and then set the policy using TSS.CPP implementation for that key. I see there is a property NCRYPT_PCP_RAW_POLICYDIGEST_PROPERTY in ncrypt.h and I tried to set the policy digest (retrieved by TPM_HASH policyDigest = PolicyTree.GetPolicyDigest(TPM_ALG_ID::SHA1))
if (FAILED(status = HRESULT_FROM_WIN32(NCryptSetProperty(
hRsaKey,
NCRYPT_PCP_RAW_POLICYDIGEST_PROPERTY,
policyDigest.digest().data(),
policyDigest.digest().size(),
0))))
{
// goto Cleanup;
}

but then NcryptFinalizekey() returns error after that. Can anybody help me on achieving the same ?

[teenccu]

I found the error. The PolicyTree.GetPolicyDigest(TPM_ALG_ID::SHA1)) should be SH256.