Struct TpmProvider 

pub struct TpmProvider { /* private fields */ }

TPM 2.0 provider (stub implementation).

This provides the interface for TPM 2.0 integration. A full implementation would use the tss-esapi crate.

TPM benefits:

• Hardware-bound keys (non-extractable)
• Platform attestation
• Secure boot integration
• Available on most modern systems

Implementations

impl TpmProvider

pub fn new(config: TpmConfig) -> Self

Create a new TPM provider.

pub fn initialize(&mut self) -> HsmResult<()>

Initialize the TPM session.

In a real implementation, this would:

1. Connect to the TPM via TCTI
2. Create an ESYS context
3. Start an authorization session

pub fn finalize(&mut self) -> HsmResult<()>

Close the TPM session.

Trait Implementations

impl SigningProvider for TpmProvider

fn name(&self) -> &str

Get the provider name.

fn is_available(&self) -> bool

Check if the provider is available and initialized.

fn generate_key(&self, label: &str) -> HsmResult<KeyId>

Generate a new key pair and return its identifier.

fn import_key(&self, label: &str, _secret_key: &SecretKey) -> HsmResult<KeyId>

Import an existing secret key.

fn get_public_key(&self, key_id: &KeyId) -> HsmResult<PublicKey>

Get the public key for a key identifier.

fn sign(&self, key_id: &KeyId, _message: &[u8]) -> HsmResult<SignatureBytes>

Sign a message using the specified key.

fn list_keys(&self) -> HsmResult<Vec<KeyMetadata>>

List all key identifiers.

fn delete_key(&self, key_id: &KeyId) -> HsmResult<()>

Delete a key.

fn key_exists(&self, _key_id: &KeyId) -> bool

Check if a key exists.

fn verify( &self, public_key: &PublicKey, message: &[u8], signature: &SignatureBytes, ) -> HsmResult<()>

Verify a signature (can use public key directly).

fn export_key(&self, key_id: &KeyId) -> HsmResult<SecretKey>

Export secret key (if allowed by key policy).

fn get_key_metadata(&self, key_id: &KeyId) -> HsmResult<KeyMetadata>

Get key metadata including lifecycle state and usage stats.

fn update_key_state( &self, key_id: &KeyId, state: KeyLifecycleState, ) -> HsmResult<()>

Update key lifecycle state.

fn health_check(&self) -> HsmResult<HealthStatus>

Perform health check and return status.

fn batch_sign( &self, key_id: &KeyId, messages: &[&[u8]], ) -> HsmResult<Vec<SignatureBytes>>

Batch sign multiple messages.

fn get_audit_log(&self, limit: usize) -> HsmResult<Vec<AuditEntry>>

Get audit log entries (if supported).

fn rotate_key(&self, key_id: &KeyId, new_label: &str) -> HsmResult<KeyId>

Rotate a key (generate new version while archiving old one).