tpm2_policycphash(1) General Commands Manual tpm2_policycphash(1) (NAME) tpm2_policycphash - (SYNOPSIS) tpm2_policycphash [] (DESCRIPTION) tpm2_policycphash(1) (policy) . (deferred assertion) TPM . (OPTIONS) o -L --policy=FILE: (compounded policy digest). o -S --session=FILE: -S tpm2_startauthsession(1). o --cphash-input=FILE: (command parameter hash). o --cphash=FILE: -cphash-input . (References) (COMMON OPTIONS) . o -h --help=[man|no-man]: (manpage) . (manpager) . "man" "man" man stderr . "no-man" stdout . MANPATH man(1) . o -v --version: TCTI . o -V --verbose: . . o -Q --quiet: stdout. o -Z --enable-errata: (errata fixups). errata TPM . TPM2TOOLS_ENABLE_ERRATA . o -z --pwd-session: HMAC . (clear text) TPM . (unsalted) OpenSSL FIPS . auth (salted) . o -R --autoflush: (autoflush) . . TPM2TOOLS_AUTOFLUSH yes true . TCTI (TCTI Configuration) TCTI "Transmission Interface" TPM . TCTI TPM . TCTI : 1. -T --tcti 2. : TPM2TOOLS_TCTI. : . TCTI : o tabrmd - tabrmd . tabrmd abrmd tcti . o mssim - TPM . o device - TPM . o none - TPM . TPM (off-tpm) TCTI . TCTI . "none" . : : . TCTI (TCTI Defaults) TCTI TCTI dlopen(3) . TCTI tabrmd device mssim . -v TCTI . - "default-tcti" TCTI . TCTI (Custom TCTIs) TCTI TCTI . dlopen(3) tcti-name . dlopen(3) . TCTI (TCTI OPTIONS) TCTI : o device: TCTI (device) (character device) TPM TCTI . /dev/tpm0 . : -T device:/dev/tpm0 export TPM2TOOLS_TCTI="device:/dev/tpm0" o mssim: TCTI mssim IP () . 127.0.0.1 2321 . : -T mssim:host=localhost,port=2321 export TPM2TOOLS_TCTI="mssim:host=localhost,port=2321" o abrmd: TCTI abrmd - `,' . `=' . o TCTI abrmd : 1. `bus_name' : tabrmd ( ). 2. `bus_type' : dbus ( ) `session' `system'. tcti tabrmd bus_name=com.example.FooBar: \--tcti=tabrmd:bus_name=com.example.FooBar tcti (abrmd) bus_type=session: \--tcti:bus_type=session : abrmd tabrmd . (EXAMPLES) tpm2_nvsetbits . NV (Define NV index object with authorized policy) openssl genrsa -out signing_key_private.pem 2048 openssl rsa -in signing_key_private.pem -out signing_key_public.pem -pubout tpm2_loadexternal -G rsa -C o -u signing_key_public.pem -c signing_key.ctx \ -n signing_key.name tpm2_startauthsession -S session.ctx -g sha256 tpm2_policyauthorize -S session.ctx -L authorized.policy -n signing_key.name tpm2_flushcontext session.ctx tpm2_nvdefine 1 -a "policywrite|authwrite|ownerread|nt=bits" -L authorized.policy policycphash (Create policycphash) tpm2_nvsetbits 1 -i 1 --cphash cp.hash tpm2_startauthsession -S session.ctx -g sha256 tpm2_policycphash -S session.ctx -L policy.cphash --cphash cp.hash tpm2_flushcontext session.ctx policycphash (Sign and verify policycphash) openssl dgst -sha256 -sign signing_key_private.pem \ -out policycphash.signature policy.cphash tpm2_verifysignature -c signing_key.ctx -g sha256 -m policy.cphash \ -s policycphash.signature -t verification.tkt -f rsassa policycphash nvsetbits (Satisfy policycphash and execute nvsetbits) tpm2_startauthsession -S session.ctx --policy-session -g sha256 tpm2_policycphash -S session.ctx --cphash cp.hash tpm2_policyauthorize -S session.ctx -i policy.cphash -n signing_key.name \ -t verification.tkt tpm2_nvsetbits 1 -i 1 -P "session:session.ctx" tpm2_flushcontext session.ctx (RETURNS) : o 0 - . o 1 - . o 2 - . o 3 - . o 4 - TCTI. o 5 - . tpm2_testparams. (LIMITATIONS) tpm2_startauthsession(1) : o o tpm2-abrmd. . (BUGS) (Github Issues) (HELP) (Mailing List) (LICENSE) Creative Commons Attribution 4.0 (CC BY 4.0) . tpm2-tools tpm2_policycphash(1)