| tpm2_getsessionauditdigest(1) | General Commands Manual | tpm2_getsessionauditdigest(1) |
tpm2_getsessionauditdigest(1) - Retrieve the command audit attestation data from the TPM.
tpm2_getsessionauditdigest [OPTIONS]
tpm2_getsessionauditdigest(1) - Retrieve the session audit digest attestation data from the TPM. The attestation data includes the session audit digest and a signature over the session audit digest. The session itself is started with the tpm2_startauthsession command.
Specifies the authorization value for the endorsement hierarchy.
Context object for the signing key that signs the attestation data.
Specifies the authorization value for key specified by option -c.
Data given as a Hex string or binary file to qualify the quote, optional. This is typically used to add a nonce against replay attacks.
Signature output file, records the signature in the format specified via the -f option.
Message output file, records the quote message that makes up the data that is signed by the TPM. This is the command audit digest attestation data.
Format selection for the signature output file.
Hash algorithm for signature. Defaults to sha256.
The signing scheme used to sign the message. Optional. Signing schemes should follow the “formatting standards”, see section “Algorithm Specifiers”. Also, see section “Supported Signing Schemes” for a list of supported signature schemes. If specified, the signature scheme must match the key type. If left unspecified, a default signature scheme for the key type will be used.
The path of the session that enables and records the audit digests.
The type of a context object, whether it is a handle or file name, is determined according to the following logic in-order:
Authorization for use of an object in TPM2.0 can come in 3 different forms: 1. Password 2. HMAC 3. Sessions
NOTE: “Authorizations default to the EMPTY PASSWORD when not specified”.
Passwords are interpreted in the following forms below using prefix identifiers.
Note: By default passwords are assumed to be in the string form when they do not have a prefix.
A string password, specified by prefix “str:” or it’s absence (raw string without prefix) is not interpreted, and is directly used for authorization.
foobar
str:foobar
A hex-string password, specified by prefix “hex:” is converted from a hexidecimal form into a byte array form, thus allowing passwords with non-printable and/or terminal un-friendly characters.
hex:1122334455667788
A file based password, specified be prefix “file:” should be the path of a file containing the password to be read by the tool or a “-” to use stdin. Storing passwords in files prevents information leakage, passwords passed as options can be read from the process list or common shell history features.
# to use stdin and be prompted
file:-
# to use a file from a path
file:path/to/password/file
# to echo a password via stdin:
echo foobar | tpm2_tool -p file:-
# to use a bash here-string via stdin:
tpm2_tool -p file:- <<< foobar
When using a policy session to authorize the use of an object, prefix the option argument with the session keyword. Then indicate a path to a session file that was created with tpm2_startauthsession(1). Optionally, if the session requires an auth value to be sent with the session handle (eg policy password), then append a + and a string as described in the Passwords section.
To use a session context file called session.ctx.
session:session.ctx
To use a session context file called session.ctx AND send the authvalue mypassword.
session:session.ctx+mypassword
To use a session context file called session.ctx AND send the HEX authvalue 0x11223344.
session:session.ctx+hex:11223344
You can satisfy a PCR policy using the “pcr:” prefix and the PCR minilanguage. The PCR minilanguage is as follows: <pcr-spec>=<raw-pcr-file>
The PCR spec is documented in in the section “PCR bank specifiers”.
The raw-pcr-file is an optional argument that contains the output of the raw PCR contents as returned by tpm2_pcrread(1).
PCR bank specifiers
To satisfy a PCR policy of sha256 on banks 0, 1, 2 and 3 use a specifier of:
pcr:sha256:0,1,2,3
specifying AUTH.
Format selection for the signature output file. tss (the default) will output a binary blob according to the TPM 2.0 specification and any potential compiler padding. The option plain will output the plain signature data as defined by the used cryptographic algorithm. signature FORMAT.
This collection of options are common to many programs and provide information that many users may expect.
To successfully use the manpages feature requires the manpages to be installed or on MANPATH, See man(1) for more details.
The TCTI or “Transmission Interface” is the communication mechanism with the TPM. TCTIs can be changed for communication with TPMs across different mediums.
To control the TCTI, the tools respect:
Note: The command line option always overrides the environment variable.
The current known TCTIs are:
The arguments to either the command line option or the environment variable are in the form:
<tcti-name>:<tcti-option-config>
Specifying an empty string for either the <tcti-name> or <tcti-option-config> results in the default being used for that portion respectively.
When a TCTI is not specified, the default TCTI is searched for using dlopen(3) semantics. The tools will search for tabrmd, device and mssim TCTIs IN THAT ORDER and USE THE FIRST ONE FOUND. You can query what TCTI will be chosen as the default by using the -v option to print the version information. The “default-tcti” key-value pair will indicate which of the aforementioned TCTIs is the default.
Any TCTI that implements the dynamic TCTI interface can be loaded. The tools internally use dlopen(3), and the raw tcti-name value is used for the lookup. Thus, this could be a path to the shared library, or a library name as understood by dlopen(3) semantics.
This collection of options are used to configure the various known TCTI modules available:
Example: -T device:/dev/tpm0 or export TPM2TOOLS_TCTI=“device:/dev/tpm0”
Example: -T mssim:host=localhost,port=2321 or export TPM2TOOLS_TCTI=“mssim:host=localhost,port=2321”
Specify the tabrmd tcti name and a config string of bus_name=com.example.FooBar:
\--tcti=tabrmd:bus_name=com.example.FooBar
Specify the default (abrmd) tcti and a config string of bus_type=session:
\--tcti:bus_type=session
NOTE: abrmd and tabrmd are synonymous. the various known TCTI modules.
tpm2_createprimary -Q -C e -c prim.ctx
tpm2_create -Q -C prim.ctx -c signing_key.ctx -u signing_key.pub \
-r signing_key.priv
tpm2_startauthsession -S session.ctx --audit-session
tpm2_getrandom 8 -S session.ctx
tpm2_getsessionauditdigest -c signing_key.ctx -m att.data -s att.sig \
-S session.ctx
Tools can return any of the following codes:
Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
See the Mailing List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)
| tpm2-tools |