tss-keyfile 0.1.5

Decoding of TPM 2.0 TSS Keyfiles from PEM/DER/(ASN.1)
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63

//! All TPM 2.0 keys consist of two binary pieces, a public part, which can be parsed
//! according to the TPM specification for TPM2B_PUBLIC [TPM2.0] and a private part,
//! which is cryptographically sealed in such a way as to be only readable on the TPM
//! that created it.

#![cfg_attr(not(test), no_std)]
extern crate alloc;

use alloc::{string::String, vec::Vec};

#[cfg(feature = "pem")]
pub use pem_rfc7468::Error as PemError;

pub use rasn::error::DecodeError as RasnDecodeError;
pub use rasn::error::EncodeError as RasnEncodeError;

// modules
mod tpmkey;
pub use tpmkey::OID_TPMKEY_IMPORTABLE;
pub use tpmkey::OID_TPMKEY_LOADABLE;
pub use tpmkey::OID_TPMKEY_SEALED;
pub use tpmkey::TPMAuthPolicy;
pub use tpmkey::TPMKey;
pub use tpmkey::TPMKeyType;
pub use tpmkey::TPMPolicy;

#[derive(thiserror::Error, Debug)]
pub enum Error {
    #[error("Missing a secret")]
    MissingSecret,
    #[error("Should not have a secret")]
    UnexpectedSecret,
    #[error("DER decoding error: {0}")]
    DerDecodeError(#[from] RasnDecodeError),
    #[error("DER encoding error: {0}")]
    DerEncodeError(#[from] RasnEncodeError),
    #[error("OID is not a TSS2 PRIVATE KEY")]
    NoTss2PrivateKey,
    #[error("Key has an invalid parent handle: 0x{0}")]
    InvalidParentHandle(String),
    #[cfg(feature = "pem")]
    #[error("PEM decoding error: {0}")]
    PemDecodeError(pem_rfc7468::Error),
    #[error("PEM data is not a TSS2 PRIVATE KEY")]
    PemNoTss2PrivateKey,
}

#[cfg(feature = "pem")]
impl From<PemError> for Error {
    fn from(err: PemError) -> Self {
        Self::PemDecodeError(err)
    }
}

/// decode PEM, check label, return copy as DER
pub fn checked_pem_to_der(pem: &[u8]) -> Result<Vec<u8>, crate::Error> {
    let (label, der) = pem_rfc7468::decode_vec(pem)?;

    if label != "TSS2 PRIVATE KEY" {
        return Err(crate::Error::PemNoTss2PrivateKey);
    }
    Ok(der)
}