tpm2_setprimarypolicy(1) General Commands Manual tpm2_setprimarypolicy(1) (NAME) tpm2_setprimarypolicy - (lockoutPolicy) (platformPolicy) (ownerPolicy) (endorsementPolicy) (SYNOPSIS) tpm2_setprimarypolicy [OPTIONS] (DESCRIPTION) tpm2_setprimarypolicy(1) (lockoutPolicy) (platformPolicy) (ownerPolicy) (endorsementPolicy) . (OPTIONS) : o -C, --hierarchy=OBJECT: . o|p|e|l . o -P, --auth=AUTH: . o -L, --policy=FILE: . o -g, --hash-algorithm=ALGORITHM: (digest) . o --cphash=FILE . cpHash . : cpHash . (References) (Context Object Format) handle : o (transient object) TPM . o : o owner: (owner hierarchy) o platform: (platform hierarchy) o endorsement: (endorsement hierarchy) o lockout: (lockout control persistent object) o handle 0x81010013 ._OBJECT_. (Authorization Formatting) TPM2.0 : 1. (Password) 2. HMAC 3. (Sessions) : " EMPTY PASSWORD ". auth HMAC . . . HMAC (: tpm2_startauthsession(1))..SS (Passwords) . : . (String) "str:" ( ) . (EXAMPLES) foobar str:foobar (Hex-string) "hex:" . (EXAMPLE) hex:1122334455667788 (File) "file:" "-" stdin . . (EXAMPLES) # to use stdin and be prompted file:- # to use a file from a path file:path/to/password/file # to echo a password via stdin: echo foobar | tpm2_tool -p file:- # to use a bash here-string via stdin: tpm2_tool -p file:- <<< foobar (Sessions) (policy session) session . tpm2_startauthsession(1) . (authvalue) ( ) + (Passwords) . (EXAMPLES) (context) session.ctx: session:session.ctx session.ctx authvalue mypassword: session:session.ctx+mypassword session.ctx authvalue (HEX) 0x11223344: session:session.ctx+hex:11223344 PCR (PCR Authorizations) "pcr:" (minilanguage) PCR PCR . PCR : = PCR spec " PCR (PCR bank specifiers)" . raw-pcr-file PCR tpm2_pcrread(1) . PCR (PCR bank specifiers).SS " (EXAMPLES)" PCR sha256 0 1 2 3 : pcr:sha256:0,1,2,3 AUTH. (Algorithm Specifiers) "nice-names" . : . TPM . (Simple specifiers) . . " " . (Asymmetric) o rsa o ecc (Symmetric) o aes o camellia o sm4 (Hashing Algorithms) o sha1 o sha256 o sha384 o sha512 o sm3_256 o sha3_256 o sha3_384 o sha3_512 (Keyed Hash) o hmac o xor (Signing Schemes) o rsassa o rsapss o ecdsa o ecdaa o ecschnorr o sm2 (Asymmetric Encryption Schemes) o oaep o rsaes o ecdh (Modes) o ctr o ofb o cbc o cfb o ecb.SS " (Misc)" o null (Complex Specifiers) TPM . . : :: (Type Specifiers) . . o aes - AES: aes128 o aes128 - AES (ctr|ofb|cbc|cfb|ecb). null . o aes192 - aes128 . o aes256 - aes128 . o sm4 - SM4: sm4128 o sm4128 sm4_128 - SM4 (ctr|ofb|cbc|cfb|ecb). null . o ecc - ecc256. o ecc192 ecc_nist_p192 - ECC NIST o ecc224 ecc_nist_p224 - ECC NIST o ecc256 ecc_nist_p256 - ECC NIST o ecc384 ecc_nist_p384 - ECC NIST o ecc521 ecc_nist_p521 - ECC NIST o ecc_sm2 ecc_sm2_p256 - SM2 o rsa - RSA: rsa2048 o rsa1024 - RSA . o rsa2048 - RSA . o rsa3072 - RSA . o rsa4096 - RSA . (Scheme Specifiers) . . . sha256 . . (Hash Optional Scheme Specifiers) : oaep-sha256. o oaep o ecdh o rsassa o rsapss o ecdsa o ecschnorr o sm2.SS ( UINT16) (-) . * ecdaa ecdaa4-sha256. . . * rsaes type . Symmetric Type Specifiers . aes128cfb . (EXAMPLES) rsa2048 rsaes tpm2_create -C parent.ctx -G rsa2048:rsaes -u key.pub -r key.priv ecc256 ecdaa sha384 /tpm2_create -C parent.ctx -G ecc256:ecdaa4-sha384 -u key.pub -r key.priv ALGORITHM. (COMMON OPTIONS) . o -h --help=[man|no-man]: (manpage) . (manpager) . "man" "man" man stderr . "no-man" stdout . MANPATH man(1) . o -v --version: tcti . o -V --verbose: . . o -Q --quiet: stdout . o -Z --enable-errata: (errata fixups) . errata TPM . TPM2TOOLS_ENABLE_ERRATA . o -z --pwd-session: HMAC . (clear text) TPM . (unsalted) OpenSSL FIPS . auth . o -R --autoflush: (autoflush) . (context) . TPM2TOOLS_AUTOFLUSH yes true . . TCTI (TCTI Configuration) TCTI "Transmission Interface" TPM . TCTI TPM . TCTI : 1. -T --tcti 2. : TPM2TOOLS_TCTI. : . TCTI : o tabrmd - tabrmd . tabrmd abrmd tcti . o mssim - TPM . o device - TPM . o none - TPM . TPM ( off-tpm) TCTI . TCTI . "none" . : : ..SS TCTI TCTI TCTI dlopen(3) . TCTI tabrmd device mssim . -v TCTI . - "default-tcti" TCTI . TCTI TCTI TCTI . dlopen(3) tcti-name . dlopen(3) . TCTI (TCTI OPTIONS) TCTI : o device: TCTI (device TCTI) TPM TCTI . /dev/tpm0 . : -T device:/dev/tpm0 export TPM2TOOLS_TCTI="device:/dev/tpm0" o mssim: TCTI (mssim TCTI) IP . 127.0.0.1 2321 . : -T mssim:host=localhost,port=2321 export TPM2TOOLS_TCTI="mssim:host=localhost,port=2321" o abrmd: TCTI abrmd - <<,>> . <<=>> . o abrmd TCTI : 1. `bus_name' : tabrmd ( ). 2. `bus_type' : dbus ( ) `session' `system' . tabrmd tcti bus_name=com.example.FooBar: \--tcti=tabrmd:bus_name=com.example.FooBar tcti (abrmd) bus_type=session: \--tcti:bus_type=session : abrmd tabrmd . TCTI. (EXAMPLES) endorsement tpm2_setprimarypolicy -C e (RETURNS) : o 0 - . o 1 - . o 2 - . o 3 - . o 4 - TCTI. o 5 - . tpm2_testparams..SH " (BUGS)" Github Issues (HELP) (LICENSE) Creative Commons Attribution 4.0 (CC BY 4.0) . tpm2-tools tpm2_setprimarypolicy(1)