SIGNED_TPM2_POLICY(1)

signed_tpm2_policy(1) — User Commands 💅✨

okay so this is signed_tpm2_policy(1), a User Commands girlie who adds, removes, and lists signed policies. the TPM is TPM-ing, the policy is policy-ing, and we are seated. 🎀

🌸 NAME 🌸

signed_tpm2_policy — add, remove and list signed policies.

🦋 SYNOPSIS 🦋

signed_tpm2_policy <cmd> [options] <tpmkey> [<arg>]

bestie, that's the whole shape of it. 🫶

🎀 DESCRIPTION 🎀

<cmd> is one of add, rm or ls. and [arg] is the private key for the add command or the policy number for the rm command. that's the map, periodt. 💅

✨ OPTIONS ✨

here's the first pass of the options, with every flag accounted for:

• -a, --auth — require a password for the key; default [NO] 💖
• -h, --help — print this help message
• -c, --key-policy <pubkey> — specify a policy for the TPM key
• -i, --import <pubkey> — create an importable key with the outer wrapper encrypted to <pubkey>
• -x, --pcr-lock <pcrs> — lock the created key to the specified PCRs by current value; see PCR VALUES for details about formatting
• --locality <loc> — can only be used in a set of localities described by the <loc> bitmap
• --signed-policy <key> — add a signed policy directive that allows policies signed by the specified public <key> to authorize use of the key
• --secret <handle> — tie authorization of the key to the Authorization of a different object identified by <handle>
• -n, --policy-name <name> — optional name to annotate the policy with

the original page literally repeats this whole block, so here it is again. not a glitch, bestie — twice the slay, same facts. 🫶

• -a, --auth — require a password for the key; default [NO] 💖
• -h, --help — print this help message
• -c, --key-policy <pubkey> — specify a policy for the TPM key
• -i, --import <pubkey> — create an importable key with the outer wrapper encrypted to <pubkey>
• -x, --pcr-lock <pcrs> — lock the created key to the specified PCRs by current value; see PCR VALUES for details about formatting
• --locality <loc> — can only be used in a set of localities described by the <loc> bitmap
• --signed-policy <key> — add a signed policy directive that allows policies signed by the specified public <key> to authorize use of the key
• --secret <handle> — tie authorization of the key to the Authorization of a different object identified by <handle>
• -n, --policy-name <name> — optional name to annotate the policy with

🧚 PCR VALUES 🧚

the PCR values are specified as:

<bank>:<list>

<bank> is any supported PCR hash bank, and the list specifies the PCRs to lock the key to — both as comma separated individual values and as comma separated ranges. so:

• sha256:1,3 means PCRs 1 and 3 in the sha256 bank
• sha512:1,3-5 means PCRs 1, 3, 4 and 5 in the sha512 bank

💜 SECRETS IN OTHER OBJECTS 💜

when the option --secrets <handle> is used, it creates a key whose authorization password is conditioned on the password of a different object identified by <handle>. usually this is a permanent NV index, but could be any object. the design of this policy is to allow the password to be changed without updating the key — simply by changing the authorization of the other object. because OpenSSL can only request a single password, keys with a --secret policy may not additionally have an --auth option to also require passing in the password embedded in the key.

🚨 that last bit is a hard caveat, not a vibe suggestion: no extra --auth on top of a --secret policy. periodt. 💀

🍓 EXAMPLES 🍓

list all signed policies:

signed_tpm2_policy ls key.tpm

the output is a numbered list of policies (with optional names). 🌸

remove the first policy:

signed_tpm2_policy rm key.tpm 1

add a new policy with name 'thispolicy' locked to pcr16 using the private policy.key:

signed_tpm2_policy add --name thispolicy --pcr-lock sha256:16 key.tmp policy.key

copy those exactly, bestie. key.tmp is literally what the page says. 🙈

💀 REPORTING BUGS 💀

• Report bugs to <openssl-tpm2-engine@groups.io>
• Report bugs to <openssl-tpm2-engine@groups.io>

yes, it appears twice in the original, so it appears twice here. no cap. 💀

🌈 SEE ALSO 🌈

go see create_tpm2_key(1). 👑

---

mwah 💖 okay that's the page. the footer's source/version bit is Usage: ./signed_tpm2_policy <c... and the date is August 2024. stay signed, stay policy-ing, and remember: the ... is literally there. 🎀✨