Crate wolftpm 

Safe Rust bindings for wolfTPM, the portable TPM 2.0 library.

The raw FFI lives in sys; everything else wraps it in a safe API that turns TPM return codes into Result, manages device and key handle lifetimes with RAII, and keeps all unsafe confined to this crate.

Backend availability (swtpm socket, fwTPM HAL, sealing, NV, RNG, …) is detected from the linked C library at build time via cfg flags emitted by build.rs, so the surface reflects how libwolftpm was actually configured.

Safety

Device boxes its WOLFTPM2_DEV in an UnsafeCell, so the C struct stays at a stable heap address even when the Rust Device value moves. This is required because WOLFTPM2_DEV can contain a pointer to one of its own fields. Key and KeyBlob may move; pointers to their UnsafeCell-wrapped C structs are borrowed only for individual FFI calls and are not retained by wolfTPM. C structs passed to FFI are zero-initialized with core::mem::zeroed() first — valid for these C plain-old-data types — and then filled by the callee; buffer copies into fixed C arrays are bounds- checked beforehand so they cannot overflow. Union fields are read only after the code that set the matching selector (an is_ecc/scheme flag) ran immediately before. Zeroization always receives live, initialized storage through an exclusive mutable borrow.

Modules

sys

Raw FFI layer: bindgen output for wolfTPM’s public headers.

Structs

Attestation

A TPM attestation: the signed certifyInfo (a TPMS_ATTEST) plus the signature over it, which a verifier checks against the AIK’s public key.

Caps

A subset of the TPM’s reported capabilities.

Credential

A credential protected to a TPM’s EK: the encrypted credential_blob and the wrapped secret, both produced by Device::make_credential and consumed by Device::activate_credential.

Device

An initialized wolfTPM device.

EcdhResult

An ephemeral ECDH public point (x || y, each the curve’s field size) and the derived shared secret Z, from Key::ecdh_gen.

Key

A loaded TPM key. Its handle is unloaded from the TPM when dropped.

KeyBlob

A created-but-not-loaded key: the wrapped pub/priv blob that can be serialized for persistence and later loaded.

NvSlot

A defined NV index. NV state persists in the TPM until Device::nv_delete.

Secret

An owned secret byte buffer that scrubs its heap allocation when dropped.

Session

A salted HMAC session with AES-CFB parameter encryption, registered at auth slot 1 for its whole lifetime. Once started, the secret-bearing operations have their sensitive command/response parameters encrypted automatically. Only one is allowed at a time; it is closed and its slot released on drop.

Template

A TPM public-area key template.

TpmError

A wolfTPM operation that failed, carrying the raw TPM return code.

Enums

HashAlg

Hash algorithm selector (PCR banks, schemes, OAEP label hash).

Hierarchy

TPM authorization hierarchy a primary key is created under.

KeyAlg

Asymmetric algorithm for a key template.

Type Aliases

Result

Result of a wolfTPM operation.