@@ -41,16 +41,20 @@ static void usage(void)
4141{
4242 printf ("Expected usage:\n" );
4343 printf ("./examples/seal/unseal [filename] [inkey_filename]\n" );
44- printf ("* filename - File contaning a TPM seal key\n" );
44+ printf ("* -aes/xor: Use Parameter Encryption\n" );
45+ printf ("* filename: Output for unsealed data (default: unseal.bin)\n" );
46+ printf ("* inkey_filename: File with sealed keyed hashed object (keyblob.bin)\n" );
4547 printf ("Demo usage, without arguments, uses keyblob.bin file input.\n" );
4648}
4749
4850int TPM2_Unseal_Example (void * userCtx , int argc , char * argv [])
4951{
5052 int rc ;
5153 WOLFTPM2_DEV dev ;
52- WOLFTPM2_KEY key ;
53- TPM2B_AUTH auth ;
54+ WOLFTPM2_KEYBLOB newKey ;
55+ WOLFTPM2_KEY storage ; /* SRK */
56+ TPM_ALG_ID paramEncAlg = TPM_ALG_NULL ;
57+ WOLFTPM2_SESSION tpmSession ;
5458 const char * filename = "unseal.bin" ;
5559 const char * inkeyfilename = "keyblob.bin" ;
5660#if !defined(NO_FILESYSTEM ) && !defined(NO_WRITE_TEMP_FILES )
@@ -60,14 +64,11 @@ int TPM2_Unseal_Example(void* userCtx, int argc, char *argv[])
6064 Unseal_In cmdIn_unseal ;
6165 Unseal_Out cmdOut_unseal ;
6266
63- WOLFTPM2_KEYBLOB newKey ;
64- WOLFTPM2_KEY storage ; /* SRK */
65-
66-
67+ XMEMSET (& storage , 0 , sizeof (storage ));
68+ XMEMSET (& tpmSession , 0 , sizeof (tpmSession ));
6769 XMEMSET (& cmdIn_unseal , 0 , sizeof (cmdIn_unseal ));
6870 XMEMSET (& cmdOut_unseal , 0 , sizeof (cmdOut_unseal ));
69- XMEMSET (& key , 0 , sizeof (key ));
70- XMEMSET (& auth , 0 , sizeof (auth ));
71+ XMEMSET (& newKey , 0 , sizeof (newKey ));
7172
7273 if (argc >= 2 ) {
7374 if (XSTRCMP (argv [1 ], "-?" ) == 0 ||
@@ -85,6 +86,23 @@ int TPM2_Unseal_Example(void* userCtx, int argc, char *argv[])
8586 inkeyfilename = argv [2 ];
8687 }
8788 }
89+ while (argc > 1 ) {
90+ if (XSTRCMP (argv [argc - 1 ], "-aes" ) == 0 ) {
91+ paramEncAlg = TPM_ALG_CFB ;
92+ }
93+ else if (XSTRCMP (argv [argc - 1 ], "-xor" ) == 0 ) {
94+ paramEncAlg = TPM_ALG_XOR ;
95+ }
96+ else if (argv [argc - 1 ][0 ] == '-' ) {
97+ printf ("Warning: Unrecognized option: %s\n" , argv [argc - 1 ]);
98+ }
99+ argc -- ;
100+ }
101+
102+ printf ("TPM2.0 Simple Unseal example\n" );
103+ printf ("\tKey Blob: %s\n" , inkeyfilename );
104+ printf ("\tUse Parameter Encryption: %s\n" , TPM2_GetAlgName (paramEncAlg ));
105+
88106
89107 printf ("Example how to unseal data using TPM2.0\n" );
90108 rc = wolfTPM2_Init (& dev , TPM2_IoCb , userCtx );
@@ -97,6 +115,21 @@ int TPM2_Unseal_Example(void* userCtx, int argc, char *argv[])
97115 rc = getPrimaryStoragekey (& dev , & storage , TPM_ALG_RSA );
98116 if (rc != 0 ) goto exit ;
99117
118+ if (paramEncAlg != TPM_ALG_NULL ) {
119+ /* Start an authenticated session (salted / unbound) with parameter encryption */
120+ rc = wolfTPM2_StartSession (& dev , & tpmSession , & storage , NULL ,
121+ TPM_SE_HMAC , paramEncAlg );
122+ if (rc != 0 ) goto exit ;
123+ printf ("TPM2_StartAuthSession: sessionHandle 0x%x\n" ,
124+ (word32 )tpmSession .handle .hndl );
125+
126+ /* set session for authorization of the storage key */
127+ rc = wolfTPM2_SetAuthSession (& dev , 1 , & tpmSession ,
128+ (TPMA_SESSION_decrypt | TPMA_SESSION_encrypt | TPMA_SESSION_continueSession ));
129+ if (rc != 0 ) goto exit ;
130+
131+ }
132+
100133 rc = readKeyBlob (inkeyfilename , & newKey );
101134 if (rc != 0 ) goto exit ;
102135
@@ -109,9 +142,9 @@ int TPM2_Unseal_Example(void* userCtx, int argc, char *argv[])
109142 (word32 )newKey .handle .hndl );
110143
111144 /* Set authorization for using the seal key */
112- auth .size = (int )sizeof (gKeyAuth ) - 1 ;
113- XMEMCPY (auth .buffer , gKeyAuth , auth .size );
114- wolfTPM2_SetAuthPassword (& dev , 0 , & auth );
145+ newKey . handle . auth .size = (int )sizeof (gKeyAuth ) - 1 ;
146+ XMEMCPY (newKey . handle . auth .buffer , gKeyAuth , newKey . handle . auth .size );
147+ wolfTPM2_SetAuthHandle (& dev , 0 , & newKey . handle );
115148
116149 cmdIn_unseal .itemHandle = newKey .handle .hndl ;
117150
@@ -146,12 +179,13 @@ int TPM2_Unseal_Example(void* userCtx, int argc, char *argv[])
146179 (void )filename ;
147180#endif
148181
149- /* Remove the loaded TPM seal object */
150- wolfTPM2_SetAuthPassword (& dev , 0 , NULL );
182+ /* Remove the auth for loaded TPM seal object */
183+ wolfTPM2_UnsetAuth (& dev , 0 );
151184
152185exit :
153186 wolfTPM2_UnloadHandle (& dev , & storage .handle );
154187 wolfTPM2_UnloadHandle (& dev , & newKey .handle );
188+ wolfTPM2_UnloadHandle (& dev , & tpmSession .handle );
155189
156190 wolfTPM2_Cleanup (& dev );
157191 return rc ;
0 commit comments