ibmtpm2.0tssapi.doc

IBM TPM 2.0 TSS API Ken Goldman IBM Research kgoldman@ December 19, 2016  1. Introduction 4 2. Features 5 3. API 6 3.1. TSS_Execute() 6 3.2. TSS_Create() 6 3.3. TSS_Delete() 7 3.4. Optional Customization 8 3.4.1. Property Example 8 3.4.2. Properties 8 3.4.3. TSS_SetProperty() 11 3.5. Extra Parameter 12 3.6. Other APIs and Headers 12 4. Application Notes 14 4.1. Parameter Encryption 14 4.2. Session Salt 14 4.3. Session Bind 14 4.4. NV 14 4.4.1. Rationale 14 4.4.2. NV Preprovisioning 15 4.5. TPM2_LoadExternal 16 4.6. Connecting to Resource Managers 16 4.7. Endorsement Key (EK Certificates) 17 4.7.1. Nuvoton 17 4.7.2. St Micro 17 4.7.3. Infineon 18 5. Example 19 6. Build 20 6.1. Directories 20 6.2. Linux 20 6.3. Windows 21 6.3.1. Windows Tbsi 22 6.3.2. Windows Visual Studio 23 6.3.3. Windows gcc 23 6.4. AIX 23 7. Fedora 25 7.1. Local Install 25 7.2. Alternative Local Install 25 7.3. Repository Install 26 7.4. Install Test 26 7.5. Source rpms 26 8. Status 28 8.1. Utilities 28 8.2. Bugs 28 8.3. Untested 28 9. Theading 29 Introduction The IBM TSS is designed for: ease of understanding ease of use ease of implementation maximum code reuse Features The TSS handles the following, completely hidden from the caller: HMAC, password and policy sessions Session and HMAC key calculations, including bind and salt sessions HMAC generation and verification (including cpHash and rpHash) Parameter encryption and decryption, XOR and AES Nonces and nonce rolling Session continue flag TPM 2.0 Name and bind session tracking Different session hash algorithms Marshaling, unmarshaling, and communication with the TPM and almost hidden from the caller: bind password API The API consists of the following calls: TSS_Execute() #include tss2/tss.h TPM_RC TSS_Execute(TSS_CONTEXT *tssContext, RESPONSE_PARAMETERS *out, COMMAND_PARAMETERS *in, EXTRA_PARAMETERS *extra, TPM_CC commandCode, ...); This is the primary TSS func