|
NAMEtpm2_policysigned(1) - Enables policy authorization by verifying signature of optional TPM2 parameters. The signature is generated by a signing authority.SYNOPSIStpm2_policysigned [OPTIONS]DESCRIPTIONtpm2_policysigned(1) - Enables policy authorization by verifying signature of optional TPM2 parameters. The signature is generated by a signing authority. The optional TPM2 parameters being cpHashA, nonceTPM, policyRef and expiration.OPTIONS
File to save the compounded policy digest.
The policy session file generated via the -S option to tpm2_startauthsession(1).
Context object for the key context used for the operation. Either a file or a handle number. See section “Context Object Format”.
The hash algorithm used to digest the message.
The input signature file of the signature to be validated.
Set the input signature file to a specified format. The default is the tpm2.0 TPMT_SIGNATURE data format, however different schemes can be selected if the data came from an external source like OpenSSL. The tool currently supports rsassa and ecdsa.
Set the expiration time of the policy in seconds. In absence of nonceTPM the expiration time is the policy timeout value. If expiration is a negative value an authorization ticket is additionally returned. If expiration value is 0 then the policy does not have a time limit on the authorization.
The command parameter hash (cpHash), enforcing the TPM command to be authorized as well as its handle and parameter values.
The ticket file to record the authorization ticket structure.
The file path to record the timeout structure returned.
Optional, the policy qualifier data that the signer can choose to include in the signature. Can be either a hex string or path.
Enable the comparison of the current session’s nonceTPM to ensure the validity of the policy authorization is limited to the current session. ReferencesCOMMON OPTIONSThis collection of options are common to many programs and provide information that many users may expect.
To successfully use the manpages feature requires the manpages to be installed or on MANPATH, See man(1) for more details.
TCTI ConfigurationThe TCTI or “Transmission Interface” is the communication mechanism with the TPM. TCTIs can be changed for communication with TPMs across different mediums.To control the TCTI, the tools respect:
Note: The command line option always overrides the environment variable. The current known TCTIs are:
The arguments to either the command line option or the environment variable are in the form: <tcti-name>:<tcti-option-config> Specifying an empty string for either the <tcti-name> or <tcti-option-config> results in the default being used for that portion respectively. TCTI DefaultsWhen a TCTI is not specified, the default TCTI is searched for using dlopen(3) semantics. The tools will search for tabrmd, device and mssim TCTIs IN THAT ORDER and USE THE FIRST ONE FOUND. You can query what TCTI will be chosen as the default by using the -v option to print the version information. The “default-tcti” key-value pair will indicate which of the aforementioned TCTIs is the default.Custom TCTIsAny TCTI that implements the dynamic TCTI interface can be loaded. The tools internally use dlopen(3), and the raw tcti-name value is used for the lookup. Thus, this could be a path to the shared library, or a library name as understood by dlopen(3) semantics.TCTI OPTIONSThis collection of options are used to configure the various known TCTI modules available:
Example: -T device:/dev/tpm0 or export TPM2TOOLS_TCTI=“device:/dev/tpm0”
Example: -T mssim:host=localhost,port=2321 or export TPM2TOOLS_TCTI=“mssim:host=localhost,port=2321”
Specify the tabrmd tcti name and a config string of bus_name=com.example.FooBar:
Specify the default (abrmd) tcti and a config string of bus_type=session:
NOTE: abrmd and tabrmd are synonymous. the various known TCTI modules. EXAMPLESAuthorize a TPM operation on an object whose authorization is bound to specific signing authority.Create the signing authority
Generate signature with nonceTPM, cpHashA, policyRef and expiration set to 0
Load the verification key and Create the policysigned policy
Create a sealing object to use the policysigned
Satisfy the policy and unseal secret
ReturnsTools can return any of the following codes:
LimitationsIt expects a session to be already established via tpm2_startauthsession(1) and requires one of the following:
Without it, most resource managers will not save session state between command invocations. BUGSGithub Issues (https://github.com/tpm2-software/tpm2-tools/issues)HELPSee the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
Visit the GSP FreeBSD Man Page Interface. |