Skip to content

Latest commit

 

History

History
143 lines (90 loc) · 4.08 KB

tpm2_policysigned.1.md

File metadata and controls

143 lines (90 loc) · 4.08 KB

% tpm2_policysigned(1) tpm2-tools | General Commands Manual

NAME

tpm2_policysigned(1) - Enables policy authorization by verifying signature of optional TPM2 parameters. The signature is generated by a signing authority.

SYNOPSIS

tpm2_policysigned [OPTIONS]

DESCRIPTION

tpm2_policysigned(1) - Enables policy authorization by verifying signature of optional TPM2 parameters. The signature is generated by a signing authority. The optional TPM2 parameters being cpHashA, nonceTPM, policyRef and expiration.

OPTIONS

  • -L, --policy=FILE:

    File to save the compounded policy digest.

  • -S, --session=FILE:

    The policy session file generated via the -S option to tpm2_startauthsession(1).

  • -c, --key-context=OBJECT:

    Context object for the key context used for the operation. Either a file or a handle number. See section "Context Object Format".

  • -g, --hash-algorithm=ALGORITHM:

    The hash algorithm used to digest the message.

  • -s, --signature=FILE:

    The input signature file of the signature to be validated.

  • -f, --format=FORMAT:

    Set the input signature file to a specified format. The default is the tpm2.0 TPMT_SIGNATURE data format, however different schemes can be selected if the data came from an external source like OpenSSL. The tool currently supports rsassa and ecdsa.

  • -t, --expiration=NATURAL_NUMBER:

    Set the expiration time of the policy in seconds. In absence of nonceTPM the expiration time is the policy timeout value. If expiration is a negative value an authorization ticket is additionally returned. If expiration value is 0 then the policy does not have a time limit on the authorization.

  • --cphash-input=FILE:

    The command parameter hash (cpHash), enforcing the TPM command to be authorized as well as its handle and parameter values.

  • --ticket=FILE:

    The ticket file to record the authorization ticket structure.

  • --timeout=FILE:

    The file path to record the timeout structure returned.

  • -q, --qualification=FILE_OR_HEX_STR:

    Optional, the policy qualifier data that the signer can choose to include in the signature. Can be either a hex string or path.

  • -x, --nonce-tpm:

    Enable the comparison of the current session's nonceTPM to ensure the validity of the policy authorization is limited to the current session.

References

common options collection of common options that provide information many users may expect.

common tcti options collection of options used to configure the various known TCTI modules.

EXAMPLES

Authorize a TPM operation on an object whose authorization is bound to specific signing authority.

Create the signing authority

openssl genrsa -out private.pem 2048

openssl rsa -in private.pem -outform PEM -pubout -out public.pem

Generate signature with nonceTPM, cpHashA, policyRef and expiration set to 0

echo "00 00 00 00" | xxd -r -p | \
openssl dgst -sha256 -sign private.pem -out signature.dat

Load the verification key and Create the policysigned policy

tpm2_loadexternal -C o -G rsa -u public.pem -c signing_key.ctx

tpm2_startauthsession -S session.ctx

tpm2_policysigned -S session.ctx -g sha256 -s signature.dat -f rsassa \
-c signing_key.ctx -L policy.signed

tpm2_flushcontext session.ctx

Create a sealing object to use the policysigned

echo "plaintext" > secret.data

tpm2_createprimary -C o -c prim.ctx

tpm2_create -u key.pub -r sealing_key.priv -c sealing_key.ctx -C prim.ctx \
-i secret.data -L policy.signed

Satisfy the policy and unseal secret

tpm2_startauthsession -S session.ctx --policy-session

tpm2_policysigned -S session.ctx -g sha256 -s signature.dat -f rsassa \
-c signing_key.ctx -L policy.signed

tpm2_unseal -p session:session.ctx -c sealing_key.ctx

tpm2_flushcontext session.ctx

returns

limitations

footer