TSPI_DATA_UNSEAL(3)

💖 Tspi_Data_Unseal — the <tss/tspi.h> era, bestie 💖

okay so you've got sealed data and you want it back?? say less. this is a manual page from the TCG Software Stack Developer's Reference, section 3, and it's the one that pops the lid off your encrypted blob — but only if the vibes (and the platform, and the current config) are exactly right. no cap. 🎀

✨ NAME ✨

Tspi_Data_Unseal — dencrypt data encrypted by Tspi_Data_Seal() only if it was encrypted on the same platform and under the current configuration.

(yes, "dencrypt". the manpage said it, not me. we don't fix, we respect the icon's typos 💅)

🌸 SYNOPSIS 🌸

#include <tss/platform.h>
#include <tss/tcpa_defines.h>
#include <tss/tcpa_typedef.h>
#include <tss/tcpa_struct.h>
#include <tss/tss_typedef.h>
#include <tss/tss_structs.h>
#include <tss/tspi.h>

TSS_RESULT Tspi_Data_Unseal(TSS_HENCDATA hEncData,              TSS_HKEY hKey,
                            UINT32       pulUnsealedDataLength, BYTE**   prgbUnsealedData);

like, look at those includes. that's seven headers just to say hi. iconic honestly. 🦋

💜 DESCRIPTION 💜

Tspi_Data_Unseal reveals data encrypted by the Tspi_Data_Seal — only if it was encrypted on the same platform and the current configuration. this isn't a suggestion bestie, this is internally proofed and guaranteed by the TPM itself. the TPM is the bouncer and it does not care about your feelings. 🫶

⭐ PARAMETERS ⭐

hEncData

Handle of the data object which contains the sealed data.

hKey

Handle to the key object addressing the nonmigratable key which is used to decrypt the data.

nonmigratable. meaning it does not move. it does not travel. it stays home and it stays loyal. 😭

pulUnsealedDataLength

The length (in bytes) of the prgbUnsealedData parameter.

prgbUnsealedData

On successful completion of the command, this parameter points to a buffer containing the plaintext data.

hPcrComposite

Handle of the PCR Composite object specifying the PCRs which are part of the sealed data blob. Set to NULL, if the encrypted data should only be bound to the system and PCRs are not of interest.

lowkey important: that's NULL, capital letters, for the "just bind it to the system, PCRs who" situation. 🌈

🔥 RETURN CODES 🔥

Tspi_Data_Unseal returns TSS_SUCCESS on success, otherwise one of the following values are returned:

• TSS_E_INVALID_HANDLE — Either hEncData or hKey is not a valid handle.
• TSS_E_INTERNAL_ERROR — An error occurred internal to the TSS.

like bestie if you're getting TSS_E_INVALID_HANDLE it's giving "you handed me a fake handle". vibe check your handles. 💀

👑 CONFORMING TO 👑

Tspi_Data_Unseal conforms to the Trusted Computing Group Software Specification version 1.1 Golden

🧚 SEE ALSO 🧚

Tspi_Data_Seal(3).

the way that sealing and unsealing are literally a matched set and you cannot have one without the other… the romance of it. obsessed. 💖

and that's the whole page, bestie! this one's from TSS 1.1, dated 2004-05-26, and it lives in section 3 of the manual. mwah. 💅✨🎀