tpm2_startauthsession(1) General Commands Manual tpm2_startauthsession(1) (NAME) tpm2_startauthsession - TPM. (SYNOPSIS) tpm2_startauthsession [OPTIONS] (DESCRIPTION) tpm2_startauthsession(1) - TPM . (trial) -a . . . (RM) tpm2-abrmd RM IPC (session handles) (flush) . RM session gapping TCTI (command TCTI) . (socket listener) tpm2_send : mknod "$HOME/backpipe" p while [ 1 ]; do tpm2_send 0<"$HOME/backpipe" | nc -lU "$HOME/sock" 1>"$HOME/backpipe"; done; TCTI netcat (nc) . tpm2_startauthsession --tcti="cmd:nc -q 0 -U $HOME/sock" (kill ). TCTI (transient handles) . (flush) : tpm2_flushcontext --tcti="cmd:nc -q 0 -U $HOME/sock" -t : UNIX . (localhost) . TPM ContextSave ContextLoad . (OPTIONS) o --policy-session: TPM_SE_POLICY . TPM_SE_TRIAL . : (trial) (policy) . o --audit-session: HMAC (audit session) . TPM2_SE_TRIAL . o --hmac-session: HMAC TPM_SE_HMAC . TPM2_SE_TRIAL . o -g, --hash-algorithm=ALGORITHM: () (policy digest). o -G, --key-algorithm=ALGORITHM: / . o -c, --key-context=OBJECT: tpmkey bind . . . / AES-CFB . o -S, --session=FILE: . o --bind-context=FILE: bind . . tpm2_sessionconfig . . tpm2_sessionconfig . / AES-CFB . o --bind-auth=AUTH: (authorization value) bind . o --tpmkey-context=FILE: tpmkey . . tpm2_sessionconfig . . tpm2_sessionconfig . / AES-CFB . o -n, --name=FILE name -n tpm2_readpublic(1). name (persistent handle) --tpmkey-context -c --key-context . 0x81000000 (man-in-the-middle) . (Context Object Format) (handle) : o (transient) TPM . o : o owner: (owner) o platform: (platform) o endorsement: (endorsement) o lockout: (lockout) o ( 0x81010013) . (Authorization Formatting) TPM2.0 : 1. (Password) 2. HMAC 3. (Sessions) : " ". auth HMAC . . . HMAC (: tpm2_startauthsession(1)). (Passwords) . : . (String) "str:" ( ) . (Examples) foobar str:foobar (Hex-string) "hex:" () / . (Example) hex:1122334455667788 (File) "file:" "-" stdin . . (Examples) # stdin : file:- # : file:path/to/password/file # echo stdin: echo foobar | tpm2_tool -p file:- # bash here-string stdin: tpm2_tool -p file:- <<< foobar (policy session) session . tpm2_startauthsession(1) . (auth value) ( ) + (Passwords) . (Examples) (session context) session.ctx: session:session.ctx session.ctx authvalue mypassword: session:session.ctx+mypassword session.ctx authvalue (HEX) 0x11223344: session:session.ctx+hex:11223344 PCR (PCR Authorizations) PCR "pcr:" (minilanguage) PCR . PCR : = PCR " PCR (PCR bank specifiers)" . raw-pcr-file PCR tpm2_pcrread(1) . PCR (Examples) PCR sha256 0 1 2 3 : pcr:sha256:0,1,2,3 AUTH. (COMMON OPTIONS) . o -h --help=[man|no-man]: (manpage) . (manpager) . "man" "man" man stderr . "no-man" manpager stdout . MANPATH man(1) . o -v --version: tcti . o -V --verbose: . . o -Q --quiet: stdout. o -Z --enable-errata: (errata fixups). errata TPM . TPM2TOOLS_ENABLE_ERRATA . o -z --pwd-session: HMAC . (clear text) TPM . (unsalted) OpenSSL FIPS . auth (salted session) . o -R --autoflush: (autoflush) (transient) . (flush) . TPM2TOOLS_AUTOFLUSH yes true . ..SH " TCTI (TCTI Configuration)" TCTI "Transmission Interface" TPM . TCTI TPM . TCTI : 1. -T --tcti 2. : TPM2TOOLS_TCTI. : . TCTI : o tabrmd - tabrmd . tabrmd abrmd tcti . o mssim - TPM . o device - TPM . o none - TPM ( ). TPM (off-tpm) TCTI . TCTI . "none" . : : . TCTI (TCTI Defaults) TCTI TCTI dlopen(3) . TCTI tabrmd device mssim . -v TCTI . - "default-tcti" TCTI . TCTI (Custom TCTIs) TCTI TCTI . dlopen(3) tcti-name . dlopen(3) . TCTI (TCTI OPTIONS) TCTI : o device: TCTI device TPM . /dev/tpm0 . : -T device:/dev/tpm0 export TPM2TOOLS_TCTI="device:/dev/tpm0" o mssim: TCTI mssim IP . 127.0.0.1 2321 . : -T mssim:host=localhost,port=2321 export TPM2TOOLS_TCTI="mssim:host=localhost,port=2321" o abrmd: TCTI abrmd - `,' . `=' . o TCTI abrmd : 1. `bus_name' : tabrmd ( ). 2. `bus_type' : dbus ( ) `session' `system' . tabrmd tcti bus_name=com.example.FooBar: \--tcti=tabrmd:bus_name=com.example.FooBar tcti (abrmd) bus_type=session: \--tcti:bus_type=session : abrmd tabrmd . TCTI. hmac . ( ) : tpm2_createprimary -c prim.ctx tpm2_startauthsession -S enc_session.ctx --hmac-session --key-context prim.ctx tpm2_create -C prim.ctx -c key.ctx -S enc_session.ctx -p password : tpm2_startauthsession -S enc_session.ctx --hmac-session tpm2_sessionconfig enc_session.ctx --enable-decrypt tpm2_create -C prim.ctx -c key.ctx -S enc_session.ctx -p password -enable-encrypt : tpm2_startauthsession -S enc_session.ctx --hmac-session tpm2_sessionconfig enc_session.ctx --enable-encrypt tpm2_getrandom -S enc_session.ctx -o rand trial tpm2_startauthsession -S mysession.ctx policy tpm2_startauthsession --policy-session -S mysession.ctx policy tpm2_createprimary -c primary.ctx tpm2_startauthsession --policy-session -c primary.ctx -S mysession.ctx (EXIT STATUS) : o 0 - . o 1 - . o 2 - . o 3 - . o 4 - TCTI. o 5 - . tpm2_testparams. (BUGS) (Github Issues) (HELP) (LICENSE) (CC BY 4.0) . tpm2-tools tpm2_startauthsession(1)