1tpm2_createpolicy(1)        General Commands Manual       tpm2_createpolicy(1)
2
3
4

NAME

6       tpm2_createpolicy(1)  - Creates simple assertion authorization policies
7       based on multiple PCR indices values across multiple enabled banks.
8

SYNOPSIS

10       tpm2_createpolicy [OPTIONS]
11

DESCRIPTION

13       tpm2_createpolicy(1) - Creates simple assertion authorization  policies
14       based on multiple PCR indices values across multiple enabled banks.  It
15       can then be used with object creation and or tools using the object.
16

OPTIONS

18       These options control creating the policy authorization session:
19
20-L, --policy=FILE:
21
22         The file to save the policy digest.
23
24--policy-pcr:
25
26         Identifies the PCR policy type for policy creation.
27
28-g, --policy-algorithm=ALGORITHM:
29
30         The hash algorithm used in computation of the policy digest.
31
32-l, --pcr-list=PCR:
33
34         The list of PCR banks and selected PCRs' ids for each bank.
35
36-f, --pcr=FILE:
37
38         Optional Path or Name of the file containing expected PCR values  for
39         the specified index.  Default is to read the current PCRs per the set
40         list.
41
42--policy-session:
43
44         Start  a  policy  session  of  type   TPM_SE_POLICY.    Defaults   to
45         TPM_SE_TRIAL if this option isn't specified.
46
47   References

Algorithm Specifiers

49       Options that take algorithms support "nice-names".
50
51       There  are two major algorithm specification string classes, simple and
52       complex.  Only certain algorithms will be accepted by the TPM, based on
53       usage and conditions.
54
55   Simple specifiers
56       These are strings with no additional specification data.  When creating
57       objects, non-specified portions of an object are assumed  to  defaults.
58       You can find the list of known "Simple Specifiers Below".
59
60   Asymmetric
61       • rsa
62
63       • ecc
64
65   Symmetric
66       • aes
67
68       • camellia
69
70   Hashing Algorithms
71       • sha1
72
73       • sha256
74
75       • sha384
76
77       • sha512
78
79       • sm3_256
80
81       • sha3_256
82
83       • sha3_384
84
85       • sha3_512
86
87   Keyed Hash
88       • hmac
89
90       • xor
91
92   Signing Schemes
93       • rsassa
94
95       • rsapss
96
97       • ecdsa
98
99       • ecdaa
100
101       • ecschnorr
102
103   Asymmetric Encryption Schemes
104       • oaep
105
106       • rsaes
107
108       • ecdh
109
110   Modes
111       • ctr
112
113       • ofb
114
115       • cbc
116
117       • cfb
118
119       • ecb
120
121   Misc
122       • null
123
124   Complex Specifiers
125       Objects,  when  specified  for creation by the TPM, have numerous algo‐
126       rithms to populate in the public data.  Things like  type,  scheme  and
127       asymmetric  details,  key  size,  etc.  Below is the general format for
128       specifying this data: <type>:<scheme>:<symmetric-details>
129
130   Type Specifiers
131       This portion of the complex algorithm specifier is required.   The  re‐
132       maining  scheme  and  symmetric  details will default based on the type
133       specified and the type of the object being created.
134
135       • aes - Default AES: aes128
136
137       • aes128<mode> - 128 bit AES with optional mode  (ctr|ofb|cbc|cfb|ecb).
138         If mode is not specified, defaults to null.
139
140       • aes192<mode> - Same as aes128<mode>, except for a 192 bit key size.
141
142       • aes256<mode> - Same as aes128<mode>, except for a 256 bit key size.
143
144       • ecc - Elliptical Curve, defaults to ecc256.
145
146       • ecc192 - 192 bit ECC
147
148       • ecc224 - 224 bit ECC
149
150       • ecc256 - 256 bit ECC
151
152       • ecc384 - 384 bit ECC
153
154       • ecc521 - 521 bit ECC
155
156       • rsa - Default RSA: rsa2048
157
158       • rsa1024 - RSA with 1024 bit keysize.
159
160       • rsa2048 - RSA with 2048 bit keysize.
161
162       • rsa4096 - RSA with 4096 bit keysize.
163
164   Scheme Specifiers
165       Next, is an optional field, it can be skipped.
166
167       Schemes  are  usually Signing Schemes or Asymmetric Encryption Schemes.
168       Most signing schemes take a hash algorithm directly following the sign‐
169       ing  scheme.   If the hash algorithm is missing, it defaults to sha256.
170       Some take no arguments, and some take multiple arguments.
171
172   Hash Optional Scheme Specifiers
173       These scheme specifiers are followed by a dash and a valid  hash  algo‐
174       rithm, For example: oaep-sha256.
175
176       • oaep
177
178       • ecdh
179
180       • rsassa
181
182       • rsapss
183
184       • ecdsa
185
186       • ecschnorr
187
188   Multiple Option Scheme Specifiers
189       This  scheme  specifier  is  followed by a count (max size UINT16) then
190       followed by a dash(-) and a valid hash algorithm.  * ecdaa For example,
191       ecdaa4-sha256.  If no count is specified, it defaults to 4.
192
193   No Option Scheme Specifiers
194       This scheme specifier takes NO arguments.  * rsaes
195
196   Symmetric Details Specifiers
197       This  field is optional, and defaults based on the type of object being
198       created and it's attributes.  Generally, any valid Symmetric  specifier
199       from  the Type Specifiers list should work.  If not specified, an asym‐
200       metric objects symmetric details defaults to aes128cfb.
201
202   Examples
203   Create an rsa2048 key with an rsaes asymmetric encryption scheme
204       tpm2_create -C parent.ctx -G rsa2048:rsaes -u key.pub -r key.priv
205
206   Create an ecc256 key with an ecdaa signing scheme with a count of 4
207       and sha384 hash
208
209       /tpm2_create -C parent.ctx -G ecc256:ec‐
210       daa4-sha384 -u key.pub -r key.priv cryptographic algorithms ALGORITHM.
211

COMMON OPTIONS

213       This  collection of options are common to many programs and provide in‐
214       formation that many users may expect.
215
216-h, --help=[man|no-man]: Display the tools manpage.  By  default,  it
217         attempts  to  invoke  the  manpager for the tool, however, on failure
218         will output a short tool summary.  This is the same behavior  if  the
219         "man"  option argument is specified, however if explicit "man" is re‐
220         quested, the tool will provide errors from man  on  stderr.   If  the
221         "no-man"  option  if  specified, or the manpager fails, the short op‐
222         tions will be output to stdout.
223
224         To successfully use the manpages feature requires the manpages to  be
225         installed or on MANPATH, See man(1) for more details.
226
227-v,  --version:  Display version information for this tool, supported
228         tctis and exit.
229
230-V, --verbose: Increase the information that the tool prints  to  the
231         console  during  its  execution.  When using this option the file and
232         line number are printed.
233
234-Q, --quiet: Silence normal tool output to stdout.
235
236-Z, --enable-errata: Enable the application of errata fixups.  Useful
237         if  an  errata fixup needs to be applied to commands sent to the TPM.
238         Defining  the  environment  TPM2TOOLS_ENABLE_ERRATA  is   equivalent.
239         bank/algorithm PCR.
240

COMMON OPTIONS

242       This  collection of options are common to many programs and provide in‐
243       formation that many users may expect.
244
245-h, --help=[man|no-man]: Display the tools manpage.  By  default,  it
246         attempts  to  invoke  the  manpager for the tool, however, on failure
247         will output a short tool summary.  This is the same behavior  if  the
248         "man"  option argument is specified, however if explicit "man" is re‐
249         quested, the tool will provide errors from man  on  stderr.   If  the
250         "no-man"  option  if  specified, or the manpager fails, the short op‐
251         tions will be output to stdout.
252
253         To successfully use the manpages feature requires the manpages to  be
254         installed or on MANPATH, See man(1) for more details.
255
256-v,  --version:  Display version information for this tool, supported
257         tctis and exit.
258
259-V, --verbose: Increase the information that the tool prints  to  the
260         console  during  its  execution.  When using this option the file and
261         line number are printed.
262
263-Q, --quiet: Silence normal tool output to stdout.
264
265-Z, --enable-errata: Enable the application of errata fixups.  Useful
266         if  an  errata fixup needs to be applied to commands sent to the TPM.
267         Defining the environment TPM2TOOLS_ENABLE_ERRATA is equivalent.   in‐
268         formation many users may expect.
269

TCTI Configuration

271       The  TCTI  or  "Transmission  Interface" is the communication mechanism
272       with the TPM.  TCTIs can be changed for communication with TPMs  across
273       different mediums.
274
275       To control the TCTI, the tools respect:
276
277       1. The command line option -T or --tcti
278
279       2. The environment variable: TPM2TOOLS_TCTI.
280
281       Note:  The  command  line option always overrides the environment vari‐
282       able.
283
284       The current known TCTIs are:
285
286       • tabrmd     -     The     resource     manager,     called      tabrmd
287         (https://github.com/tpm2-software/tpm2-abrmd).   Note that tabrmd and
288         abrmd as a tcti name are synonymous.
289
290       • mssim - Typically used for communicating to the TPM software  simula‐
291         tor.
292
293       • device - Used when talking directly to a TPM device file.
294
295       • none  - Do not initalize a connection with the TPM.  Some tools allow
296         for off-tpm options and thus support not using a TCTI.  Tools that do
297         not  support  it  will error when attempted to be used without a TCTI
298         connection.  Does not support ANY options and MUST  BE  presented  as
299         the exact text of "none".
300
301       The  arguments  to  either  the  command line option or the environment
302       variable are in the form:
303
304       <tcti-name>:<tcti-option-config>
305
306       Specifying an empty string for  either  the  <tcti-name>  or  <tcti-op‐
307       tion-config> results in the default being used for that portion respec‐
308       tively.
309
310   TCTI Defaults
311       When a TCTI is not specified, the default TCTI is  searched  for  using
312       dlopen(3)  semantics.   The  tools  will  search for tabrmd, device and
313       mssim TCTIs IN THAT ORDER and USE THE FIRST ONE FOUND.  You  can  query
314       what TCTI will be chosen as the default by using the -v option to print
315       the version information.  The "default-tcti" key-value pair will  indi‐
316       cate which of the aforementioned TCTIs is the default.
317
318   Custom TCTIs
319       Any TCTI that implements the dynamic TCTI interface can be loaded.  The
320       tools internally use dlopen(3), and the raw tcti-name value is used for
321       the lookup.  Thus, this could be a path to the shared library, or a li‐
322       brary name as understood by dlopen(3) semantics.
323

TCTI OPTIONS

325       This collection of options are used to configure the various known TCTI
326       modules available:
327
328device: For the device TCTI, the TPM character device file for use by
329         the device TCTI can be specified.  The default is /dev/tpm0.
330
331         Example:   -T   device:/dev/tpm0   or   export    TPM2TOOLS_TCTI="de‐
332         vice:/dev/tpm0"
333
334        mssim:  For  the  mssim  TCTI, the domain name or IP address and port
335         number used by the simulator  can  be  specified.   The  default  are
336         127.0.0.1 and 2321.
337
338         Example:  -T  mssim:host=localhost,port=2321  or export TPM2TOOLS_TC‐
339         TI="mssim:host=localhost,port=2321"
340
341        abrmd: For the abrmd TCTI, the configuration string format is  a  se‐
342         ries  of  simple  key value pairs separated by a ',' character.  Each
343         key and value string are separated by a '=' character.
344
345         • TCTI abrmd supports two keys:
346
347           1. 'bus_name' : The name of  the  tabrmd  service  on  the  bus  (a
348              string).
349
350           2. 'bus_type' : The type of the dbus instance (a string) limited to
351              'session' and 'system'.
352
353         Specify the tabrmd tcti name and a config string of  bus_name=com.ex‐
354         ample.FooBar:
355
356         \--tcti=tabrmd:bus_name=com.example.FooBar
357
358         Specify the default (abrmd) tcti and a config string of bus_type=ses‐
359         sion:
360
361         \--tcti:bus_type=session
362
363         NOTE: abrmd and tabrmd are synonymous.  the various known  TCTI  mod‐
364         ules.
365

EXAMPLES

367   Create a authorization policy tied to a specific PCR index
368              tpm2_createpolicy \--policy-pcr -l 0x4:0 -L policy.file -f pcr0.bin
369

Returns

371       Tools can return any of the following codes:
372
373       • 0 - Success.
374
375       • 1 - General non-specific error.
376
377       • 2 - Options handling error.
378
379       • 3 - Authentication error.
380
381       • 4 - TCTI related error.
382
383       • 5 - Non supported scheme.  Applicable to tpm2_testparams.
384

BUGS

386       Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
387

HELP

389       See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
390
391
392
393tpm2-tools                                                tpm2_createpolicy(1)
Impressum