TPM2 Software Stack Rust Wrapper

This is the high-level, Rust idiomatic wrapper crate that exposes an interface to TSS.

This crate depends on the tss-esapi-sys crate for its FFI interface. By default, pre-generated bindings are used. If you'd like the bindings to be generated at build time, please enable either the generate-bindings feature - the FFI bindings will then be generated at build time using the headers identified on the system.

Our end-goal is to achieve a fully Rust-native interface that offers strong safety and security guarantees. Check out our documentation for an overview of our code safety approach.

Integration Tests

See the integration tests

Cargo Features

The crate currently offers the following features:

• generate-bindings - forces the underlying tss-esapi-sys crate to regenerate the FFI bindings on each build, using the TSS libraries available on the build machine.
• abstraction (enabled by default) - provides a set of abstracted primitives on top of the basic Rust-native ESAPI API provided by the crate. This feature can be turned off to reduce the number of dependencies built.
• serde - enable serde Serialize/Deserialize traits for types.
• rustcrypto-full (disabled by default) - provides conversion from all supported elliptic curves, rsa or hashes. Support for individual hash, rsa or curves can be pulled individually.
• bundled - Downloads, builds and dynamically links against the tpm2-tss libraries. This means that the executable using the crate needs to have the tpm2-tss shared libraries available to the executable. This can be achieved by copying the shared libraries to the same folder as the executable or by adding the path to them to the appropriate environmental variable e.g. LD_LIBRARY_PATH, DYLD_FALLBACK_LIBRARY_PATH or PATH.

Cross compiling

For more information on cross-compiling the tss-esapi crate, please see the README of the tss-esapi-sys crate.

Building against libtss2

The TSS library can be installed from Debian, RPM, or other packaging manager. It will install a pkg-config definition to indicate how to compile and link against the library. When it is installed via source, and/or if it has been edited (such as to debug things), then the version number will be marked with the git commit (and dirty flag). The resulting version string is unfortunately not compatible with the semver parser/comparing mechanism, and it can be rejected. Setting the environment variable TPM2_TSS_VERSION_IGNORE_PRERELEASE to a non-empty string will cause the build system to ignore this pre-release information.

Copyright 2021 Contributors to the Parsec project.