tpm2_policysigned(1) | General Commands Manual | tpm2_policysigned(1) |
tpm2_policysigned(1) - Enables policy authorization by verifying signature of optional TPM2 parameters. The signature is generated by a signing authority.
tpm2_policysigned [OPTIONS]
tpm2_policysigned(1) - Enables policy authorization by verifying signature of optional TPM2 parameters. The signature is generated by a signing authority. The optional TPM2 parameters being cpHashA, nonceTPM, policyRef and expiration.
File to save the compounded policy digest.
The policy session file generated via the -S option to tpm2_startauthsession(1).
Context object for the key context used for the operation. Either a file or a handle number. See section “Context Object Format”.
The hash algorithm used to digest the message.
The input signature file of the signature to be validated.
Set the input signature file to a specified format. The default is the tpm2.0 TPMT_SIGNATURE data format, however different schemes can be selected if the data came from an external source like OpenSSL. The tool currently supports rsassa and ecdsa.
Set the expiration time of the policy in seconds. In absence of nonceTPM the expiration time is the policy timeout value. If expiration is a negative value an authorization ticket is additionally returned. If expiration value is 0 then the policy does not have a time limit on the authorization.
The command parameter hash (cpHash), enforcing the TPM command to be authorized as well as its handle and parameter values.
The ticket file to record the authorization ticket structure.
The file path to record the timeout structure returned.
Optional, the policy qualifier data that the signer can choose to include in the signature. Can be either a hex string or path.
Enable the comparison of the current session’s nonceTPM to ensure the validity of the policy authorization is limited to the current session.
This collection of options are common to many programs and provide information that many users may expect.
To successfully use the manpages feature requires the manpages to be installed or on MANPATH, See man(1) for more details.
The TCTI or “Transmission Interface” is the communication mechanism with the TPM. TCTIs can be changed for communication with TPMs across different mediums.
To control the TCTI, the tools respect:
Note: The command line option always overrides the environment variable.
The current known TCTIs are:
The arguments to either the command line option or the environment variable are in the form:
<tcti-name>:<tcti-option-config>
Specifying an empty string for either the <tcti-name> or <tcti-option-config> results in the default being used for that portion respectively.
When a TCTI is not specified, the default TCTI is searched for using dlopen(3) semantics. The tools will search for tabrmd, device and mssim TCTIs IN THAT ORDER and USE THE FIRST ONE FOUND. You can query what TCTI will be chosen as the default by using the -v option to print the version information. The “default-tcti” key-value pair will indicate which of the aforementioned TCTIs is the default.
Any TCTI that implements the dynamic TCTI interface can be loaded. The tools internally use dlopen(3), and the raw tcti-name value is used for the lookup. Thus, this could be a path to the shared library, or a library name as understood by dlopen(3) semantics.
This collection of options are used to configure the various known TCTI modules available:
Example: -T device:/dev/tpm0 or export TPM2TOOLS_TCTI=“device:/dev/tpm0”
Example: -T mssim:host=localhost,port=2321 or export TPM2TOOLS_TCTI=“mssim:host=localhost,port=2321”
Specify the tabrmd tcti name and a config string of bus_name=com.example.FooBar:
\--tcti=tabrmd:bus_name=com.example.FooBar
Specify the default (abrmd) tcti and a config string of bus_type=session:
\--tcti:bus_type=session
NOTE: abrmd and tabrmd are synonymous. the various known TCTI modules.
Authorize a TPM operation on an object whose authorization is bound to specific signing authority.
openssl genrsa -out private.pem 2048 openssl rsa -in private.pem -outform PEM -pubout -out public.pem
echo "00 00 00 00" | xxd -r -p | \ openssl dgst -sha256 -sign private.pem -out signature.dat
tpm2_loadexternal -C o -G rsa -u public.pem -c signing_key.ctx tpm2_startauthsession -S session.ctx tpm2_policysigned -S session.ctx -g sha256 -s signature.dat -f rsassa \ -c signing_key.ctx -L policy.signed tpm2_flushcontext session.ctx
echo "plaintext" > secret.data tpm2_createprimary -C o -c prim.ctx tpm2_create -u key.pub -r sealing_key.priv -c sealing_key.ctx -C prim.ctx \ -i secret.data -L policy.signed
tpm2_startauthsession -S session.ctx --policy-session tpm2_policysigned -S session.ctx -g sha256 -s signature.dat -f rsassa \ -c signing_key.ctx -L policy.signed tpm2_unseal -p session:session.ctx -c sealing_key.ctx tpm2_flushcontext session.ctx
Tools can return any of the following codes:
It expects a session to be already established via tpm2_startauthsession(1) and requires one of the following:
Without it, most resource managers will not save session state between command invocations.
Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
See the Mailing List (https://lists.linuxfoundation.org/mailman/listinfo/tpm2)
tpm2-tools |