tpm2_policyauthorizenv(1) General Commands Manual tpm2_policyauthorizenv(1) (NAME) tpm2_policyauthorizenv - NV (SYNOPSIS) tpm2_policyauthorizenv [] [] (DESCRIPTION) tpm2_policyauthorizenv(1) - (authorization policy) NV . NV (trial session) . NV "TPM2_HR_NV_INDEX" . (OPTIONS) o -C, --hierarchy=: . : o o TPM_RH_OWNER o p TPM_RH_PLATFORM o nv . -C . -p tpm2_nvdefine(1) . o -P, --auth=_: (authorization value) . o -L, --policy=: (policy digest). o -S, --session=: -S tpm2_startauthsession(1) . o --cphash= . cpHash . : cpHash . (References) (COMMON OPTIONS) . o -h, --help=[man|no-man]: . (manpager) . "man" "man" man (stderr) . "no-man" man (stdout) . manpages MANPATH man(1) . o -v, --version: TCTI . o -V, --verbose: . . o -Q, --quiet: (stdout). o -Z, --enable-errata: (errata fixups). errata TPM . TPM2TOOLS_ENABLE_ERRATA . o -z, --pwd-session: HMAC . (clear text) TPM . (unsalted) OpenSSL FIPS . (auth values) (salted) . o -R, --autoflush: (autoflush) . . TPM2TOOLS_AUTOFLUSH yes true . TCTI (TCTI CONFIGURATION) TCTI (Transmission Interface) TPM . TCTI TPM . TCTI : 1. -T --tcti 2. : TPM2TOOLS_TCTI. : . TCTI : o tabrmd - tabrmd . tabrmd abrmd tcti . o mssim - TPM . o device - TPM . o none - TPM . TPM (off-tpm) TCTI . TCTI . "none" . : : . TCTI (TCTI Defaults) TCTI TCTI dlopen(3) . TCTI tabrmd device mssim . -v TCTI . - "default-tcti" TCTI . TCTI (Custom TCTIs) TCTI TCTI . dlopen(3) tcti-name . dlopen(3) . TCTI (TCTI OPTIONS) TCTI : o device: TCTI (device) (character device) TPM TCTI . /dev/tpm0 . : -T device:/dev/tpm0 export TPM2TOOLS_TCTI="device:/dev/tpm0" o mssim: TCTI mssim IP (port) . 127.0.0.1 2321 . : -T mssim:host=localhost,port=2321 export TPM2TOOLS_TCTI="mssim:host=localhost,port=2321" o abrmd: TCTI abrmd - `,' . `=' . o TCTI abrmd : 1. `bus_name' : tabrmd ( ). 2. `bus_type' : dbus ( ) `session' `system' . tcti tabrmd bus_name=com.example.FooBar: \--tcti=tabrmd:bus_name=com.example.FooBar tcti (abrmd) bus_type=session: \--tcti:bus_type=session : abrmd tabrmd . (EXAMPLES) policypassword (policy digest) NV . policyauthorizenv NV (trial) . . NV . policyauthorizenv . NV (Define the test NV Index to store the auth policy) nv_test_index=0x01500001 tpm2_nvdefine -C o -p nvpass $nv_test_index -a "authread|authwrite" -s 34 (Define the auth policy) tpm2_startauthsession -S session.ctx tpm2_policypassword -S session.ctx -L policy.pass tpm2_flushcontext session.ctx NV (Write the auth policy to the NV Index) echo "000b" | xxd -p -r | cat - policy.pass | \ tpm2_nvwrite -C $nv_test_index -P nvpass $nv_test_index -i- policyauthorizenv (Define the policyauthorizenv) tpm2_startauthsession -S session.ctx tpm2_policyauthorizenv -S session.ctx -C $nv_test_index -P nvpass \ -L policyauthorizenv.1500001 $nv_test_index tpm2_flushcontext session.ctx = policyauthorizenv (Create and load a sealing object with auth policy = policyauthorizenv) tpm2_createprimary -C o -c prim.ctx echo "secretdata" | \ tpm2_create -C prim.ctx -u key.pub -r key.priv \ -a "fixedtpm|fixedparent|adminwithpolicy" -L policyauthorizenv.1500001 -i- tpm2_load -C prim.ctx -u key.pub -r key.priv -c key.ctx NV policyauthorizenv (Satisfy the auth policy stored in the NV Index and thus policyauthorizenv) tpm2_startauthsession -S session.ctx --policy-session tpm2_policypassword -S session.ctx tpm2_policyauthorizenv -S session.ctx -C $nv_test_index -P nvpass $nv_test_index tpm2_unseal -c key.ctx -p session:session.ctx tpm2_flushcontext session.ctx (RETURNS) : o 0 - . o 1 - . o 2 - . o 3 - . o 4 - TCTI. o 5 - (Non supported scheme). tpm2_testparams. (LIMITATIONS) tpm2_startauthsession(1) : o o tpm2-abrmd. . (BUGS) (Github Issues) (HELP) (Mailing List) (LICENSE) . (CC BY 4.0) . tpm2-tools tpm2_policyauthorizenv(1)