TSPI_TPM_CMKSETRESTRICTIONS(3)

💅 Tspi_TPM_CMKSetRestrictions — ok so bestie, let's talk delegated CMK restrictions

so this is a page out of the TCG Software Stack Developer's Reference, and it's a library function manual for Tspi_TPM_CMKSetRestrictions(3). yes we're getting into TPM internals, and yes it's giving main character energy. buckle up 🎀

✨ NAME ✨

Tspi_TPM_CMKSetRestrictions — sets restrictions on the use of delegated Certified Migratable Keys. periodt.

🌸 SYNOPSIS 🌸

#include <tss/tspi.h>

TSS_RESULT Tspi_TPM_CMKSetRestrictions(TSS_HTPM hTPM, TSS_CMK_DELEGATE CmkDelegate);

🦋 DESCRIPTION 🦋

okay so here's the vibe: Tspi_TPM_CMKSetRestrictions is the function you call to set restrictions on the delegated use of Certified Migratable Keys, aka CMKs. you're basically telling the TPM "hey, when someone's operating under a delegated auth session, here's what they're allowed to do with these keys."

and lowkey important detail: use of this command itself cannot be delegated. like, you can't delegate the thing that sets up delegation. that's the rule. no cap. 🔥

💖 PARAMETERS 💖

hTPM

hTPM is the handle of the TPM object you're working with. specify it, and the TPM knows which one you mean. 💫

CmkDelegate

CmkDelegate is a bitmask describing the kinds of CMKs that can be used in a delegated auth session. every bit = one type of key. if the bit for a key type is set, that CMK can be used in a delegated authorization session. if it's not set? that key gets hit with a TPM_E_INVALID_KEYUSAGE return code straight from the TPM. rejected. not invited to the party. 💀

the possible values of CmkDelegate are any combination of these flags, logically OR'd together:

• TSS_CMK_DELEGATE_SIGNING — allow use of signing keys. ✍️
• TSS_CMK_DELEGATE_STORAGE — allow use of storage keys. 📦
• TSS_CMK_DELEGATE_BIND — allow use of binding keys. 🔗
• TSS_CMK_DELEGATE_LEGACY — allow use of legacy keys. 👵
• TSS_CMK_DELEGATE_MIGRATE — allow use of migratable keys. 🧳

🌈 RETURN CODES 🌈

Tspi_TPM_CMKSetRestrictions returns TSS_SUCCESS when everything goes off without a hitch 🫶. otherwise, one of these lil guys comes back at you:

• TSS_E_INVALID_HANDLE — hTPM is not a valid handle. bestie that handle is not it 🙈
• TSS_E_INTERNAL_ERROR — an internal SW error has been detected. software said "not today" 😭

👑 CONFORMING TO 👑

Tspi_TPM_CMKSetRestrictions conforms to the Trusted Computing Group Software Specification version 1.2 Errata A. iconic behavior, honestly. ⭐

🧚 SEE ALSO 🧚

• Tspi_TPM_CMKApproveMA(3)
• Tspi_TPM_CMKCreateTicket(3)
• Tspi_Key_CMKCreateBlob(3)

and that's the whole page, bestie 💜 go forth and set those restrictions responsibly

okay bye ily, this was TSS 1.2, dated 2007-12-13 — yes she's an elder but she still slays 💅✨