Struct TPMKey 

pub struct TPMKey {
    pub type: TPMKeyType,
    pub empty_auth: Option<bool>,
    pub policy: Option<SequenceOf<TPMPolicy>>,
    pub secret: Option<OctetString>,
    pub auth_policy: Option<SequenceOf<TPMAuthPolicy>>,
    pub description: Option<Utf8String>,
    pub rsa_parent: Option<bool>,
    pub parent: u32,
    pub pubkey: OctetString,
    pub privkey: OctetString,
}

The design of the TPMkey ASN.1 format is that it should have a distinguishing OID at the beginning so the DER form of the key can be easily recognized. In PEM form, the key MUST have the following PEM guards: “—–BEGIN TSS2 PRIVATE KEY—–” and “—–END TSS2 PRIVATE KEY—–”

All additional information that may be needed to load the key is specified as optional explicit elements, which can be extended by later specifications, which is why the TPMkey is not versioned.

Fields

type: TPMKeyType

A unique OID specifying the key type:

• TPMKEY_LOADABLE
• TPMKEY_IMPORTABLE
• TPMKEY_SEALED

empty_auth: Option<bool>

An implementation needs to know as it formulates the TPM2_Load/Import/Unseal command whether it must also send down an authorization. So this parameter gives that indication. emptyAuth MUST be true if authorization is NOT required and MUST be either false or absent if authorization is required.

Since this element has three states (one representing true and two representing false) it is RECOMMENDED that implementations emitting TPMkey representations use absence of the tag to represent false. However, implementations reading TPMKey MUST be able to process all three possible states.

policy: Option<SequenceOf<TPMPolicy>>

This MUST be present if the TPM key has a policy hash because it describes to the implementation how to construct the policy

secret: Option<OctetString>

secret contains the additional cryptographic secret used to specify the outer wrapping of an importable object. For keys, it MUST be present for key type id-importablekey and MUST NOT be present for key type id-loadablekey. For sealed data objects of type id-sealedkey, it MAY be present and if present indicates the object is importable.

Importable objects (designed to be processed by TPM2_Import) MUST have an unencrypted inner wrapper (symmetricAlg MUST be TPM_ALG_NULL and encryptionKey MUST be empty) and an outer wrapper encrypted to the parent key using inSymSeed. The secret parameter is the fully marshalled TPM2B_ENCRYPTED_SECRET form of inSymSeed.

auth_policy: Option<SequenceOf<TPMAuthPolicy>>

This SHOULD be present if the TPMkey policy contains a TPM2_PolicyAuthorize statement because it contains signed policies that could be used to satisfy the TPM key policy. If the TPM key has no policy hash then this MUST NOT be present.

description: Option<Utf8String>

An optional string description for the key which is only used for display purposes, MAY be used as a user visible mnemonic for the key.

rsa_parent: Option<bool>

This MUST be present and true if the parent is a permanent handle (MSO 0x40) and RSA 2048 is used for the primary key. If the parent is not a permanent handle then this MUST NOT be present. If the parent is a permanent handle and if P-256 is used for the primary then this MUST NOT be present. Given that P-256 primary keys are easier to generate, implementations SHOULD NOT set this flag.

parent: u32

This MUST be present for all keys and specifies the handle of the parent key. The parent key SHOULD be either a persistent handle (MSO 0x81) or a permanent handle (MSO 0x40). Since volatile handle numbering can change unexpectedly depending on key load order, the parent SHOULD NOT be a volatile handle (MSO 0x80). The parent MUST NOT have any other MSO.

pubkey: OctetString

This MUST be present and MUST correspond to the fully marshalled TPM2B_PUBLIC structure of the TPM Key.

privkey: OctetString

This MUST be present and MUST correspond to the fully marshalled TPM2B_PRIVATE structure of the TPM Key. For importable keys, this must be the duplicate parameter that would be input to TPM2_Import.

Implementations

impl TPMKey

pub fn try_from_pem(pem: &[u8]) -> Result<TPMKey, Error>

Examples found in repository

examples/printkeyfile.rs (line 6)

fn main() {
    let args: Vec<String> = std::env::args().collect();
    let pem: Vec<u8> = std::fs::read(&args[1]).unwrap();
    let key = TPMKey::try_from_pem(&pem).unwrap();
    println!("{key}");
}

pub fn try_to_pem(&self) -> Result<String, Error>

impl TPMKey

pub fn try_from_der(der: &[u8]) -> Result<TPMKey, Error>

pub fn try_to_der(&self) -> Result<Vec<u8>, Error>

pub fn new_loadable(parent: u32, pubkey: &[u8], privkey: &[u8]) -> Self

pub fn new_importable(parent: u32, pubkey: &[u8], privkey: &[u8]) -> Self

pub fn new_sealed(parent: u32, pubkey: &[u8], privkey: &[u8]) -> Self

pub fn is_loadable(&self) -> bool

pub fn is_importable(&self) -> bool

pub fn is_sealed(&self) -> bool

pub fn requires_auth(&self) -> bool

pub fn validate(&self) -> Result<(), Error>

Trait Implementations

impl AsnType for TPMKey

const TAG: Tag

The associated tag for the type.

const IDENTIFIER: Identifier

Identifier of an ASN.1 type as specified in the original specification if not identical with the identifier of Self

const TAG_TREE: TagTree = _

The root of this type’s tree of tag’s if it a CHOICE type, otherwise its Leaf that points Self::TAG.

const CONSTRAINTS: Constraints = Constraints::NONE

The set of constraints for values of the given type.

const IS_CHOICE: bool = false

Whether the type is choice type. PER/OER encoding rules require this knowledge.

fn is_present(&self) -> bool

Whether the type is present with value. OPTIONAL fields are common in SEQUENCE or SET.

impl Clone for TPMKey

fn clone(&self) -> TPMKey

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Constructed<10> for TPMKey

const FIELDS: Fields<10usize>

Fields contained in the “root component list”.

const IS_EXTENSIBLE: bool = false

Whether the type is extensible.

const EXTENDED_FIELDS: Option<Fields<0usize>> = None

Fields contained in the list of extensions.

impl Debug for TPMKey

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Decode for TPMKey

fn decode_with_tag_and_constraints<D: Decoder>( decoder: &mut D, tag: Tag, constraints: Constraints, ) -> Result<Self, D::Error>

Decode this value implicitly tagged with tag from a given ASN.1 decoder with a set of constraints on what values of that type are allowed.

fn decode<D>(decoder: &mut D) -> Result<Self, <D as Decoder>::Error>

where D: Decoder,

Decode this value from a given ASN.1 decoder.

fn decode_with_tag<D>( decoder: &mut D, tag: Tag, ) -> Result<Self, <D as Decoder>::Error>

where D: Decoder,

Decode this value implicitly tagged with tag from a given ASN.1 decoder.

fn decode_with_constraints<D>( decoder: &mut D, constraints: Constraints, ) -> Result<Self, <D as Decoder>::Error>

where D: Decoder,

Decode this value from a given ASN.1 decoder with a set of constraints on what values of that type are allowed.

impl Display for TPMKey

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Encode for TPMKey

fn encode_with_tag_and_constraints<'encoder, EN: Encoder<'encoder>>( &self, encoder: &mut EN, tag: Tag, constraints: Constraints, identifier: Identifier, ) -> Result<(), EN::Error>

Encode this value with tag into the given crate::Encoder with the constraints the values this is allowed to encode into.

fn encode<'b, E>( &self, encoder: &mut E, ) -> Result<(), <E as Encoder<'b>>::Error>

where E: Encoder<'b>,

Encodes self’s data into the given crate::Encoder.

fn encode_with_tag<'b, E>( &self, encoder: &mut E, tag: Tag, ) -> Result<(), <E as Encoder<'b>>::Error>

where E: Encoder<'b>,

Encode this value with tag into the given crate::Encoder.

fn encode_with_identifier<'b, E>( &self, encoder: &mut E, identifier: Identifier, ) -> Result<(), <E as Encoder<'b>>::Error>

where E: Encoder<'b>,

Encode this value with identifier into the given crate::Encoder.

fn encode_with_tag_and_identifier<'b, E>( &self, encoder: &mut E, tag: Tag, identifier: Identifier, ) -> Result<(), <E as Encoder<'b>>::Error>

where E: Encoder<'b>,

Encode this value with tag and identifier into the given crate::Encoder.

fn encode_with_constraints<'b, E>( &self, encoder: &mut E, constraints: Constraints, ) -> Result<(), <E as Encoder<'b>>::Error>

where E: Encoder<'b>,

Encode this value into the given crate::Encoder with the constraints the values this is allowed to encode into.

fn encode_with_constraints_and_identifier<'b, E>( &self, encoder: &mut E, constraints: Constraints, identifier: Identifier, ) -> Result<(), <E as Encoder<'b>>::Error>

where E: Encoder<'b>,

Encode this value into the given crate::Encoder with identifier and the constraints the values this is allowed to encode into.

impl Eq for TPMKey

impl Hash for TPMKey

fn hash<__H: Hasher>(&self, state: &mut __H)

Feeds this value into the given Hasher.

fn hash_slice<H>(data: &[Self], state: &mut H)

where H: Hasher, Self: Sized,

Feeds a slice of this type into the given Hasher.

impl PartialEq for TPMKey

fn eq(&self, other: &TPMKey) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for TPMKey