How do I use RSA TPM 2.0 private key with hardware providing incorrect RSA PSS signature padding for the TLS v1.3 PSS signing requirement?

Question: How do I use RSA TPM2 Private key with HW providing incorrect PSS signature padding with TLS 1.3 negotiation?

Answer: TLS 1.3 mandates using of RSA-PSS signing scheme when using RSA keys, requiring the salt length to be the same as hash length. Some TPM2 firmware do not support the above salt length requirements and use the maximum salt length while creating the signature. TAP library extended signing capability allows data to be correctly padded in software and uses the HW SMP module to decrypt the pre-padded data. The TrustCore SDK Crypto Interface library provides a MACRO to enable the above functionality when using a TAP key.

The flag __ENABLE_MOCANA_CRYPTO_INTERFACE_TAP_HYBRID_ASYM_SIGN__ may be enabled using the build option --tap-hybrid-sign when building Crypto Interface library.