tpm2_verifysignature(1) General Commands Manual tpm2_verifysignature(1) (NAME) tpm2_verifysignature(1) - TPM. (SYNOPSIS) tpm2_verifysignature [OPTIONS] (DESCRIPTION) tpm2_verifysignature(1) - () TPM . TPM TPMT_TK_VERIFIED . TPM TPM_RC_SIGNATURE . . . (OPTIONS) o -c, --key-context=OBJECT: . (handle) . "Context Object Format" . o -g, --hash-algorithm=ALGORITHM: . " " "Algorithm Specifiers" . "Supported Hash Algorithms" . o -m, --message=FILE: (digest) . o -d, --digest=FILE: . (-m) (-g) . o -s, --signature=FILE: . o -f, --scheme=SCHEME: (signing scheme) . tss openssl . "Signature format specifiers" . tss . " " "Algorithm Specifiers" . o --format=SCHEME: . --scheme. o -t, --ticket=FILE: (ticket) . (References) (Context Object Format) (handle) : o (transient object) TPM . o (prefix match) : o owner: (owner hierarchy) o platform: (platform hierarchy) o endorsement: (endorsement hierarchy) o lockout: (lockout control persistent object) o (handle) 0x81010013 ._OBJECT_. (Algorithm Specifiers) " (nice-names)" . : . TPM . (Simple specifiers) . . " " . (Asymmetric) o rsa o ecc.SS " (Symmetric)" o aes o camellia o sm4 (Hashing Algorithms) o sha1 o sha256 o sha384 o sha512 o sm3_256 o sha3_256 o sha3_384 o sha3_512 (Keyed Hash) o hmac o xor (Signing Schemes) o rsassa o rsapss o ecdsa o ecdaa o ecschnorr o sm2 (Asymmetric Encryption Schemes) o oaep o rsaes o ecdh (Modes) o ctr o ofb o cbc o cfb o ecb (Misc) o null (Complex Specifiers) TPM (type) (scheme) . : :: (Type Specifiers) . . o aes - AES: aes128 o aes128 - AES (ctr|ofb|cbc|cfb|ecb). null . o aes192 - aes128 . o aes256 - aes128 . o sm4 - SM4: sm4128 o sm4128 sm4_128 - SM4 (ctr|ofb|cbc|cfb|ecb). null . o ecc - (Elliptical Curve) ecc256. o ecc192 ecc_nist_p192 - NIST ECC o ecc224 ecc_nist_p224 - NIST ECC o ecc256 ecc_nist_p256 - NIST ECC o ecc384 ecc_nist_p384 - NIST ECC o ecc521 ecc_nist_p521 - NIST ECC o ecc_sm2 ecc_sm2_p256 - SM2 o rsa - RSA: rsa2048 o rsa1024 - RSA . o rsa2048 - RSA . o rsa3072 - RSA . o rsa4096 - RSA . (Scheme Specifiers) . (Signing Schemes) (Asymmetric Encryption Schemes) . . sha256 . ..SS (Hash Optional Scheme Specifiers) : oaep-sha256. o oaep o ecdh o rsassa o rsapss o ecdsa o ecschnorr o sm2 (Multiple Option Scheme Specifiers) ( UINT16) (-) . * ecdaa ecdaa4-sha256. . (No Option Scheme Specifiers) . * rsaes (Symmetric Details Specifiers) type . Symmetric Type Specifiers . aes128cfb . (EXAMPLES) rsa2048 rsaes tpm2_create -C parent.ctx -G rsa2048:rsaes -u key.pub -r key.priv ecc256 ecdaa sha384 /tpm2_create -C parent.ctx -G ecc256:ecdaa4-sha384 -u key.pub -r key.priv ALGORITHM. (COMMON OPTIONS) . o -h --help=[man|no-man]: (manpage) . manpager . "man" "man" man stderr . "no-man" manpager stdout . MANPATH man(1) . o -v --version: tcti . o -V --verbose: . . o -Q --quiet: stdout. o -Z --enable-errata: (errata fixups). TPM . TPM2TOOLS_ENABLE_ERRATA . o -z --pwd-session: HMAC . TPM . (unsalted) OpenSSL FIPS . auth (salted) . o -R --autoflush: (autoflush) (transient) . . TPM2TOOLS_AUTOFLUSH yes true . . TCTI (TCTI CONFIGURATION) TCTI " " (Transmission Interface) TPM . TCTI TPM . TCTI : 1. -T --tcti 2. : TPM2TOOLS_TCTI. : . TCTI : o tabrmd - tabrmd . tabrmd abrmd tcti . o mssim - TPM . o device - TPM . o none - TPM . TPM (off-tpm) TCTI . TCTI . "none" . : : ..SS TCTI TCTI TCTI dlopen(3) . TCTI tabrmd device mssim . -v TCTI . - "default-tcti" TCTI . TCTI TCTI TCTI . dlopen(3) tcti-name . dlopen(3) . TCTI (TCTI OPTIONS) TCTI : o device: TCTI device TPM TCTI . /dev/tpm0 . : -T device:/dev/tpm0 export TPM2TOOLS_TCTI="device:/dev/tpm0" o mssim: TCTI mssim IP () . 127.0.0.1 2321 . : -T mssim:host=localhost,port=2321 export TPM2TOOLS_TCTI="mssim:host=localhost,port=2321" o abrmd: TCTI abrmd - `,' . `=' . o TCTI abrmd : 1. `bus_name' : tabrmd ( ). 2. `bus_type' : dbus ( ) `session' `system' . tabrmd tcti bus_name=com.example.FooBar: \--tcti=tabrmd:bus_name=com.example.FooBar tcti (abrmd) bus_type=session: \--tcti:bus_type=session : abrmd tabrmd . TCTI . (SIGNATURE FORMAT SPECIFIERS) . tss () (binary blob) TPM 2.0 (compiler padding) . plain . (EXAMPLES) TPM endorsement tpm2_createprimary -C e -c primary.ctx tpm2_create -G rsa -u rsa.pub -r rsa.priv -C primary.ctx tpm2_load -C primary.ctx -u rsa.pub -r rsa.priv -c rsa.ctx echo "my message" > message.dat tpm2_sign -c rsa.ctx -g sha256 -s sig.rssa message.dat tpm2_verifysignature -c rsa.ctx -g sha256 -m message.dat -s sig.rssa openssl TPM # Generate an ECC key openssl ecparam -name prime256v1 -genkey -noout -out private.ecc.pem openssl ec -in private.ecc.pem -out public.ecc.pem -pubout # Generate a hash to sign (OSSL needs the hash of the message) echo "data to sign" > data.in.raw sha256sum data.in.raw | awk '{ print "000000 " $1 }' | \ xxd -r -c 32 > data.in.digest # Load the private key for signing tpm2_loadexternal -Q -G ecc -r private.ecc.pem -c key.ctx # Sign in the TPM and verify with OSSL tpm2_sign -Q -c key.ctx -g sha256 -d data.in.digest -f plain -s data.out.signed openssl dgst -verify public.ecc.pem -keyform pem -sha256 \ -signature data.out.signed data.in.raw # Sign with openssl and verify with TPM openssl dgst -sha256 -sign private.ecc.pem -out data.out.signed data.in.raw tpm2_verifysignature -Q -c key.ctx -g sha256 -m data.in.raw -f ecdsa \ -s data.out.signed : o 0 - . o 1 - . o 2 - . o 3 - . o 4 - TCTI. o 5 - . tpm2_testparams. (BUGS) (Github Issues) (HELP) . (LICENSE) . (CC BY 4.0) . tpm2-tools tpm2_verifysignature(1)