% tpm2_policysigned(1) tpm2-tools | General Commands Manual
NAME
tpm2_policysigned(1) - Enables policy authorization by verifying signature of optional TPM2 parameters. The signature is generated by a signing authority.
SYNOPSIS
tpm2_policysigned [OPTIONS]
DESCRIPTION
tpm2_policysigned(1) - Enables policy authorization by verifying signature of optional TPM2 parameters. The signature is generated by a signing authority. The optional TPM2 parameters being cpHashA, nonceTPM, policyRef and expiration.
OPTIONS
-
-L, --policy=FILE:
File to save the compounded policy digest.
-
-S, --session=FILE:
The policy session file generated via the -S option to tpm2_startauthsession(1).
-
-c, --key-context=OBJECT:
Context object for the key context used for the operation. Either a file or a handle number. See section "Context Object Format".
-
-g, --hash-algorithm=ALGORITHM:
The hash algorithm used to digest the message.
-
-s, --signature=FILE:
The input signature file of the signature to be validated.
-
-f, --format=FORMAT:
Set the input signature file to a specified format. The default is the tpm2.0 TPMT_SIGNATURE data format, however different schemes can be selected if the data came from an external source like OpenSSL. The tool currently supports rsassa and ecdsa.
-
-t, --expiration=NATURAL_NUMBER:
Set the expiration time of the policy in seconds. In absence of nonceTPM the expiration time is the policy timeout value. If expiration is a negative value an authorization ticket is additionally returned. If expiration value is 0 then the policy does not have a time limit on the authorization.
-
--cphash-input=FILE:
The command parameter hash (cpHash), enforcing the TPM command to be authorized as well as its handle and parameter values.
-
--ticket=FILE:
The ticket file to record the authorization ticket structure.
-
--timeout=FILE:
The file path to record the timeout structure returned.
-
-q, --qualification=FILE_OR_HEX_STR:
Optional, the policy qualifier data that the signer can choose to include in the signature. Can be either a hex string or path.
-
-x, --nonce-tpm:
Enable the comparison of the current session's nonceTPM to ensure the validity of the policy authorization is limited to the current session.
References
common options collection of common options that provide information many users may expect.
common tcti options collection of options used to configure the various known TCTI modules.
EXAMPLES
Authorize a TPM operation on an object whose authorization is bound to specific signing authority.
Create the signing authority
openssl genrsa -out private.pem 2048
openssl rsa -in private.pem -outform PEM -pubout -out public.pem
Generate signature with nonceTPM, cpHashA, policyRef and expiration set to 0
echo "00 00 00 00" | xxd -r -p | \
openssl dgst -sha256 -sign private.pem -out signature.dat
Load the verification key and Create the policysigned policy
tpm2_loadexternal -C o -G rsa -u public.pem -c signing_key.ctx
tpm2_startauthsession -S session.ctx
tpm2_policysigned -S session.ctx -g sha256 -s signature.dat -f rsassa \
-c signing_key.ctx -L policy.signed
tpm2_flushcontext session.ctx
Create a sealing object to use the policysigned
echo "plaintext" > secret.data
tpm2_createprimary -C o -c prim.ctx
tpm2_create -u key.pub -r sealing_key.priv -c sealing_key.ctx -C prim.ctx \
-i secret.data -L policy.signed
Satisfy the policy and unseal secret
tpm2_startauthsession -S session.ctx --policy-session
tpm2_policysigned -S session.ctx -g sha256 -s signature.dat -f rsassa \
-c signing_key.ctx -L policy.signed
tpm2_unseal -p session:session.ctx -c sealing_key.ctx
tpm2_flushcontext session.ctx