Tags: deknos/tpm2-tools
Tags
tpm2-tools v4.2 2020-04-08 * Fix various issues reported by static analysis tools. * Add integration test for ECC based getekcertificate. * Fix for issue tpm2-software#1959 where ARM builds were failing. * Add a check in autotools to add "expect" as a package dependency for fapi tools. * tpm2_createek: Drop the unused -p or --ek-auth option * tpm2_policyor: List of policy files should be specified as an argument instead of -l option. The -l option is still retained for backwards compatibility. See issue#1894. * tpm2\_eventlog: add a tool for parsing and displaying the event log. * tpm2_createek: Fix an issue where the `template` option looked for args * tpm2_hierarchycontrol: Fixed bug where tool operation failed silently * tpm2_nvdefine: Fixed an issue where text output suggested failures as passes * tpm2_certify: Add an example usage in man page * tpm2_policyor: Fix a bug where tool failed silently when no input were given * tpm2_getekcertificate: Intel (R) PTT EK cert web portal is set as default address * tpm2_alg_util.c: Fix a bug where string rsa3072 was not parsed * .ci/download-deps.sh: Change tss dependency to 2.4.0 to acquire SAPI handles for cpHash calculations * tpm2_policycphash: Add a tool to implement enhanced authorization with cpHash of a command * Add options to tools to enable cpHash outputs: tpm2_nvsetbits, tpm2_nvextend, tpm2_nvincrement, tpm2_nvread, tpm2_nvreadlock, tpm2_writelock, tpm2_nvdefine, tpm2_nvundefine, tpm2_nvcertify, tpm2_policynv, tpm2_policyauthorizenv, tpm2_policysecret, tpm2_create, tpm2_load, tpm2_activatecredential, tpm2_unseal, tpm2_changeauth, tpm2_duplicate, tpm2_import, tpm2_rsadecrypt, tpm2_certify, tpm2_certifycreation, tpm2_hierarchycontrol, tpm2_setprimarypolicy, tpm2_clearcontrol, tpm2_dictionarylockout, tpm2_evictcontrol, tpm2_setclock, tpm2_clockrateadjust, tpm2_clear, tpm2_nvwrite, tpm2_encryptdecrypt, tpm2_hmac. * tpm2_import: Fix an issue where the imported key always required to have a policy * tpm2_policysecret: Fix an issue where authorization model was fixed to password only * Feature API (FAPI) tools added. These additional set of tools implement utilities using the FAPI which was added to the tpm2-tss v2.4.4: tss2_decrypt, tss2_encrypt, tss2_list, tss2_changeauth, tss2_delete, tss2_import, tss2_getinfo, tss2_createkey, tss2_createseal, tss2_exportkey, tss2_getcertificate, tss2_getplatformcertificates, tss2_gettpmblobs, tss2_getappdata, tss2_setappdata, tss2_setcertificate, tss2_sign, tss2_verifysignature, tss2_verifyquote, tss2_createnv, tss2_nvextend, tss2_nvincrement, tss2_nvread, tss2_nvsetbits, tss2_nvwrite, tss2_getdescription, tss2_setdescription, tss2_pcrextend, tss2_quote, tss2_pcrread, tss2_authorizepolicy, tss2_exportpolicy, tss2_import, tss2_provision, tss2_getrandom, tss2_unseal, tss2_writeauthorizenv * tpm2_policycountertimer: Fix an issue where operandB array was reversed causing faulty comparisons.
4.2-RC1 - 2020-04-01 * Fix various issues reported by static analysis tools. * Add integration test for ECC based getekcertificate. * Fix for issue tpm2-software#1959 where ARM builds were failing. * Add a check in autotools to add "expect" as a package dependency for fapi tools. * tpm2_createek: Drop the unused -p or --ek-auth option * tpm2_policyor: List of policy files should be specified as an argument instead of -l option. The -l option is still retained for backwards compatibility. See issue#1894. * tpm2\_eventlog: add a tool for parsing and displaying the event log. * tpm2_createek: Fix an issue where the `template` option looked for args * tpm2_hierarchycontrol: Fixed bug where tool operation failed silently * tpm2_nvdefine: Fixed an issue where text output suggested failures as passes * tpm2_certify: Add an example usage in man page * tpm2_policyor: Fix a bug where tool failed silently when no input were given * tpm2_getekcertificate: Intel (R) PTT EK cert web portal is set as default address * tpm2_alg_util.c: Fix a bug where string rsa3072 was not parsed * .ci/download-deps.sh: Change tss dependency to 2.4.0 to acquire SAPI handles for cpHash calculations * tpm2_policycphash: Add a tool to implement enhanced authorization with cpHash of a command * Add options to tools to enable cpHash outputs: tpm2_nvsetbits, tpm2_nvextend, tpm2_nvincrement, tpm2_nvread, tpm2_nvreadlock, tpm2_writelock, tpm2_nvdefine, tpm2_nvundefine, tpm2_nvcertify, tpm2_policynv, tpm2_policyauthorizenv, tpm2_policysecret, tpm2_create, tpm2_load, tpm2_activatecredential, tpm2_unseal, tpm2_changeauth, tpm2_duplicate, tpm2_import, tpm2_rsadecrypt, tpm2_certify, tpm2_certifycreation, tpm2_hierarchycontrol, tpm2_setprimarypolicy, tpm2_clearcontrol, tpm2_dictionarylockout, tpm2_evictcontrol, tpm2_setclock, tpm2_clockrateadjust, tpm2_clear, tpm2_nvwrite, tpm2_encryptdecrypt, tpm2_hmac. * tpm2_import: Fix an issue where the imported key always required to have a policy * tpm2_policysecret: Fix an issue where authorization model was fixed to password only * Feature API (FAPI) tools added. These additional set of tools implement utilities using the FAPI which was added to the tpm2-tss v2.4.4: tss2_decrypt, tss2_encrypt, tss2_list, tss2_changeauth, tss2_delete, tss2_import, tss2_getinfo, tss2_createkey, tss2_createseal, tss2_exportkey, tss2_getcertificate, tss2_getplatformcertificates, tss2_gettpmblobs, tss2_getappdata, tss2_setappdata, tss2_setcertificate, tss2_sign, tss2_verifysignature, tss2_verifyquote, tss2_createnv, tss2_nvextend, tss2_nvincrement, tss2_nvread, tss2_nvsetbits, tss2_nvwrite, tss2_getdescription, tss2_setdescription, tss2_pcrextend, tss2_quote, tss2_pcrread, tss2_authorizepolicy, tss2_exportpolicy, tss2_import, tss2_provision, tss2_getrandom, tss2_unseal, tss2_writeauthorizenv * tpm2_policycountertimer: Fix an issue where operandB array was reversed causing faulty comparisons.
4.2-RC0 - 2020-03-12 * tpm2_createek: Drop the unused -p or --ek-auth option * tpm2_policyor: List of policy files should be specified as an argument instead of -l option. The -l option is still retained for backwards compatibility. See issue#1894. * tpm2\_eventlog: add a tool for parsing and displaying the event log. * tpm2_createek: Fix an issue where the `template` option looked for args * tpm2_hierarchycontrol: Fixed bug where tool operation failed silently * tpm2_nvdefine: Fixed an issue where text output suggested failures as passes * tpm2_certify: Add an example usage in man page * tpm2_policyor: Fix a bug where tool failed silently when no input were given * tpm2_getekcertificate: Intel (R) PTT EK cert web portal is set as default address * tpm2_alg_util.c: Fix a bug where string rsa3072 was not parsed * .ci/download-deps.sh: Change tss dependency to 2.4.0 to acquire SAPI handles for cpHash calculations * tpm2_policycphash: Add a tool to implement enhanced authorization with cpHash of a command * Add options to tools to enable cpHash outputs: tpm2_nvsetbits, tpm2_nvextend, tpm2_nvincrement, tpm2_nvread, tpm2_nvreadlock, tpm2_writelock, tpm2_nvdefine, tpm2_nvundefine, tpm2_nvcertify, tpm2_policynv, tpm2_policyauthorizenv, tpm2_policysecret, tpm2_create, tpm2_load, tpm2_activatecredential, tpm2_unseal, tpm2_changeauth, tpm2_duplicate, tpm2_import, tpm2_rsadecrypt, tpm2_certify, tpm2_certifycreation, tpm2_hierarchycontrol, tpm2_setprimarypolicy, tpm2_clearcontrol, tpm2_dictionarylockout, tpm2_evictcontrol, tpm2_setclock, tpm2_clockrateadjust, tpm2_clear, tpm2_nvwrite, tpm2_encryptdecrypt, tpm2_hmac. * tpm2_import: Fix an issue where the imported key always required to have a policy * tpm2_policysecret: Fix an issue where authorization model was fixed to password only * Feature API (FAPI) tools added. These additional set of tools implement utilities using the FAPI which was added to the tpm2-tss v2.4.4: tss2_decrypt, tss2_encrypt, tss2_list, tss2_changeauth, tss2_delete, tss2_import, tss2_getinfo, tss2_createkey, tss2_createseal, tss2_exportkey, tss2_getcertificate, tss2_getplatformcertificates, tss2_gettpmblobs, tss2_getappdata, tss2_setappdata, tss2_setcertificate, tss2_sign, tss2_verifysignature, tss2_verifyquote, tss2_createnv, tss2_nvextend, tss2_nvincrement, tss2_nvread, tss2_nvsetbits, tss2_nvwrite, tss2_getdescription, tss2_setdescription, tss2_pcrextend, tss2_quote, tss2_pcrread, tss2_authorizepolicy, tss2_exportpolicy, tss2_import, tss2_provision, tss2_getrandom, tss2_unseal, tss2_writeauthorizenv * tpm2_policycountertimer: Fix an issue where operandB array was reversed causing faulty comparisons.
4.1.1 - 2020-01-21
* tpm2\_certify: Fix output of attestation data including size field. Now outputs just bytes.
* tpm2\_certifycreation: Fix tool to match manpage where the code had the -C and -c options reversed.
* tpm2\_gettime: Fix output of attestation data including size field. Now outputs just bytes.
* tpm2\_nvcertify: Fix output of attestation data including size field. Now outputs just bytes.
* tpm2\_nvreadpublic: add name hash output.
* tpm2\_import: Support object policies when importing raw key material.
* Fix overflow in pcrs.h where sizeof() was used instead of ARRAY\_LEN().
* build:
- Fix compilation issue: lib/tpm2\_hash.c:17:19: note: 'left' was declared here.
* man:
- Fix manpage examples that have "sha" instead of "sha1"
- tpm2\_shutdown manpage was missing, add it to build.
- Fix manpage example for tpm2\_createak's tpm2\_evictcontrol example.
4.1.1-RC1 - 2020-01-13
* tpm2\_certify: Fix output of attestation data including size field. Now outputs just bytes.
* tpm2\_certifycreation: Fix tool to match manpage where the code had the -C and -c options reversed.
* tpm2\_gettime: Fix output of attestation data including size field. Now outputs just bytes.
* tpm2\_nvcertify: Fix output of attestation data including size field. Now outputs just bytes.
* tpm2\_nvreadpublic: add name hash output.
* tpm2\_import: Support object policies when importing raw key material.
* Fix overflow in pcrs.h where sizeof() was used instead of ARRAY\_LEN().
* build:
- Fix compilation inssue: lib/tpm2\_hash.c:17:19: note: 'left' was declared here.
* man:
- Fix manpage examples that have "sha" instead of "sha1"
- tpm2\_shutdown manpage was missing, add it to build.
- Fix manpage example for tpm2\_createak's tpm2\_evictcontrol example.
4.1.1-RC0 - 2019-12-23
* tpm2\_certify: Fix output of attestation data including size field. Now outputs just bytes.
* tpm2\_certifycreation: Fix tool to match manpage where the code had the -C and -c options reversed.
* tpm2\_gettime: Fix output of attestation data including size field. Now outputs just bytes.
* tpm2\_nvcertify: Fix output of attestation data including size field. Now outputs just bytes.
* tpm2\_nvreadpublic: add name hash output.
* tpm2\_import: Support object policies when importing raw key material.
* Fix overflow in pcrs.h where sizeof() was used instead of ARRAY_LEN().
* build:
- Fix compilation inssue: lib/tpm2_hash.c:17:19: note: 'left' was declared here.
* man:
- Fix manpage examples that have "sha" instead of "sha1"
- tpm2_shutdown manpage was missing, add it to build.
4.1 2019-11-25
* tpm2\_certifycreation: New tool enabling command TPM2\_CertifyCreation.
* tpm2\_checkquote:
- Fix YAML output bug.
- \-g option for specifying hash algorithm is optional and defaults to
sha256.
* tpm2\_changeeps: A new tool for changing the Endorsement hierarchy primary seed.
* tpm2\_changepps: A new tool for changing the Platform hierarchy primary seed.
* tpm2\_clockrateadjust: Add a new tool for modifying the period on the TPM.
* tpm2\_create: Add tool options for specifying output data for use in
certification
- \--creation-data to save the creation data
- \--creation-ticket or -t to save the creation ticket
- \--creation-hash or -d to save the creation hash
- \--template-data for saving the template data of the key
- \--outside-info or -q for specifying unique data to include in creation data.
- \--pcr-list or -l Add option to specify pcr list to add to creation data.
* tpm2\_createprimary: Add tool options for specifying output data for use
in certification
- \--creation-data to save the creation data
- \--creation-ticket or -t to save the creation ticket
- \--creation-hash or -d to save the creation hash
- \--template-data for saving the template data of the key
- \--outside-info or -q for specifying unique data to include in creation data.
- \--pcr-list or -l Add option to specify pcr list to add to creation data.
* tpm2\_evictcontrol:
- Fix bug in automatic persistent handle selection when
hierarchy is platform.
- Fix bug in YAML key action where action was wrong when using ESYS\_TR.
* tpm2\_getcap: clean up remanenats of -c option in manpages and tool output.
* tpm2\_gettime: Add a new tool for retrieving a signed timestamp from a TPM.
* tpm2\_nvcertify: Add a new tool for certifying the contents of an NV index.
* tpm2\_nvdefine:
- Support default set of attributes so -a is not mandatory.
- Support searching for free index if an index isn't specified.
* tpm2\_nvextend: Add a new tool for extending an NV index similair to a PCR.
* tpm2\_nvreadpublic:
- Support specifying nv index to read public data from as argument.
* tpm2\_nvsetbits: Add a new tool for setting the values of PCR with type
"bits".
* tpm2\_nvundefine: Add support for deleting NV indices with attribute
`TPMA_NV_POLICY_DELETE` set using NV Undefine Special command.
* tpm2\_nvwritelock: Add a new tool for setting a write lock on an NV index
or globally locking nv indices with TPMA\_NV\_GLOBALLOCK.
* tpm2\_policyauthorizenv: New tool enabling signed, revocable policies.
* tpm2\_policyauthvalue: New tool enabling authorization to be bound to the
authorization of another object.
* tpm2\_policycountertimer: Add a new tool for enabling policy bound to TPM
clock or timer values.
* tpm2\_policynamehash: Add a new tool for specifying policy based on object
name.
* tpm2\_policynv: Add a new tool for specifying policy based on NV contents.
* tpm2\_nvwritten: Add a new tool for specifying policy based on whether or not
an NV index was written to.
* tpm2\_policysecret: Add tool options for specifying
- \--expiration or -t
- \--ticket
- \--timeout
- \--nonce-tpm or -x
- \--qualification or -q
* tpm2\_policysigned: New tool enabling policy command TPM2\_PolicySigned.
* tpm2\_policytemplate: New tool enabling policy command TPM2\_PolicyTemplate.
* tpm2\_policyticket: New tool enabling policy command TPM2\_PolicyTicket.
* tpm2\_readclock: Add a new tool for reading the TPM clock.
* tpm2\_setclock: Add a new tool for setting the TPM clock.
* tpm2\_setprimarypolicy: New tool setting policy on hierarchies.
* tpm2\_shutdown: Add a new tool for issuing a TPM shutdown command.
* misc:
- Support "tpmt" as a public key output format that only saves the TPMT
structure.
- Qualifying data or extra data in many tools can be hex array string or
binary file.
- Add support for specifying NV index type when specifying NV attributes.
- Support added for tools to run on FreeBSD.
- Skip and notify of action that man pages will not install if the package
pandoc is missing.
- Fix precedence issue with bitwise operator order int tpm2_getcap
- travis: bump abrmd version 2.3.0
- tpm2_util.c: Fix an issue int variable size was checked against uint
- pcr.c: Fix buffer length issue to support all defined hash algorithm
4.1-rc1 11-18-2019 * New tools added to support commands: TPM2_CertifyCreation, TPM2_ChangeEPS, TPM2_ChangePPS, TPM2_ClockRateAdjust, TPM2_GetTime, TPM2_NV_Certify, TPM2_NV_Extend, TPM2_NV_Setbits, TPM2_NV_UndefineSpaceSpecial, TPM2_NV_Writelock, TPM2_PolicyAuthorizeNV, TPM2_PolicyAuthValue, TPM2_PolicyCounterTimer, TPM2_PolicyNameHash, TPM2_PolicyNV, TPM2_NV_Written, TPM2_PolicySigned, TPM2_PolicyTemplate, TPM2_PolicyTicket, TPM2_ReadClock, TPM2_ClockSet, TPM2_SetPrimaryPolicy, TPM2_Shutdown. * Bug fixes and additional options to existing tools. 1. tpm2_checkquote: Fix YAML bug 2. tpm2_policysecret: Add options to specify expiration, ticket, timeout, qualification data. 3. tpm2_create/ tpm2_createprimary: Add options to specify creation-data, creation-ticket, creation-hash, outside-info, pcr-list 4. Skip/notify of action that man pages will not install if pandoc is missing. 5. Support "tpmt" as public key output format that saves the TPMT structure. 6. Add support for specifying NV index type when specifying NV attributes. 7. Fixed routine files_load_bytes_from_buffer_or_file_or_stdin where it can read one short of a UINT16 and overflow when buffer isn't a UINT16. 8. Fix precedence issue with bitwise operator order int tpm2_getcap 9. tpm2_util.c: Fix an issue int variable size was checked against uint 10. pcr.c: Fix buffer length issue to support all defined hash algorithm
4.1-rc0 2019-11-05
* tpm2\_certifycreation: New tool enabling command TPM2\_CertifyCreation.
* tpm2\_checkquote:
- Fix YAML output bug.
- \-g option for specifying hash algorithm is optional and defaults to
sha256.
* tpm2_\changeeps: A new tool for changing the Endorsement hierarchy primary seed.
* tpm2_\changepps: A new tool for changing the Platform hierarchy primary seed.
* tpm2\_clockrateadjust: Add a new tool for modifying the period on the TPM.
* tpm2\_create: Add tool options for specifying output data for use in
certification
- \--creation-data to save the creation data
- \--creation-ticket or -t to save the creation ticket
- \--creation-hash or -d to save the creation hash
- \--template-data for saving the template data of the key
- \--outside-info or -q for specifying unique data to include in creation data.
- \--pcr-list or -l Add option to specify pcr list to add to creation data.
* tpm2\_createprimary: Add tool options for specifying output data for use
in certification
- \--creation-data to save the creation data
- \--creation-ticket or -t to save the creation ticket
- \--creation-hash or -d to save the creation hash
- \--template-data for saving the template data of the key
- \--outside-info or -q for specifying unique data to include in creation data.
- \--pcr-list or -l Add option to specify pcr list to add to creation data.
* tpm2\_evictcontrol:
- Fix bug in automatic persistent handle selection when
hierarchy is platform.
- Fix bug in YAML key action where action was wrong when using ESYS\_TR.
* tpm2_getcap: clean up remanenats of -c option in manpages and tool output.
* tpm2\_gettime: Add a new tool for retrieving a signed timestamp from a TPM.
* tpm2\_nvcertify: Add a new tool for certifying the contents of an NV index.
* tpm2\_nvdefine:
- Support default set of attributes so -a is not mandatory.
- Support searching for free index if an index isn't specified.
* tpm2\_nvextend: Add a new tool for extending an NV index similair to a PCR.
* tpm2\_nvreadpublic:
- Support specifying nv index to read public data from as argument.
* tpm2\_nvsetbits: Add a new tool for setting the values of PCR with type
"bits".
* tpm2\_nvundefine: Add support for deleting NV indices with attribute
`TPMA_NV_POLICY_DELETE` set using NV Undefine Special command.
* tpm2\_nvwritelock: Add a new tool for setting a write lock on an NV index
or globally locking nv indices with TPMA\_NV\_GLOBALLOCK.
* tpm2\_policyauthorizenv: New tool enabling signed, revocable policies.
* tpm2\_policyauthvalue: New tool enabling authorization to be bound to the
authorization of another object.
* tpm2\_policycountertimer: Add a new tool for enabling policy bound to TPM
clock or timer values.
* tpm2\_policynamehash: Add a new tool for specifying policy based on object
name.
* tpm2\_policynv: Add a new tool for specifying policy based on NV contents.
* tpm2\_nvwritten: Add a new tool for specifying policy based on whether or not
an NV index was written to.
* tpm2\_policysecret: Add tool options for specifying
- \--expiration or -t
- \--ticket
- \--timeout
- \--nonce-tpm or -x
- \--qualification or -q
* tpm2\_policysigned: New tool enabling policy command TPM2\_PolicySigned.
* tpm2\_policytemplate: New tool enabling policy command TPM2\_PolicyTemplate.
* tpm2\_policyticket: New tool enabling policy command TPM2\_PolicyTicket.
* tpm2\_readclock: Add a new tool for reading the TPM clock.
* tpm2\_setclock: Add a new tool for setting the TPM clock.
* tpm2\_setprimarypolicy: New tool setting policy on hierarchies.
* tpm2\_shutdown: Add a new tool for issuing a TPM shutdown command.
* misc:
- Support "tpmt" as a public key output format that only saves the TPMT
structure.
- Qualifying data or extra data in many tools can be hex array string or
binary file.
- Add support for specifying NV index type when specifying NV attributes.
- Support added for tools to run on FreeBSD.
- Skip and notify of action that man pages will not install if the package
pandoc is missing.
PreviousNext