TSPI_TPM_GETPUBENDORSEMENTKEY(3)

💖 Tspi_TPM_GetPubEndorsementKey 💖

okay bestie, welcome to Tspi_TPM_GetPubEndorsementKey(3) — section 3, Library Functions Manual, straight out of the TCG Software Stack Developer's Reference. this one's giving ✨trusted computing✨ and honestly? it's a whole vibe. let's get into it 🫶

✨ NAME ✨

Tspi_TPM_GetPubEndorsementKey — make a TSS key object out of the TPM's public endorsement key 💅

🌸 SYNOPSIS 🌸

#include <tss/platform.h>
#include <tss/tcpa_defines.h>
#include <tss/tcpa_typedef.h>
#include <tss/tcpa_struct.h>
#include <tss/tss_typedef.h>
#include <tss/tss_structs.h>
#include <tss/tspi.h>

TSS_RESULT Tspi_TPM_GetPubEndorsementKey(TSS_HTPM        hTPM,            TSS_BOOL  fOwnerAuthorized,
                                         TSS_VALIDATION* pValidationData, TSS_HKEY* phEndorsementPubKey);

🦋 DESCRIPTION 🦋

so what this function actually does: it goes and grabs the public endorsement key — the PubEK — from the TPM, then builds you a TSS key object for it, and hands you the handle for that object back through phEndorsementPubKey. very demure, very mindful, very TSS_HKEY. 👑

but here's the tea, and it's lowkey important ☕ — different TPM chips validate the PubEK in different ways, which means application-side verification of the PubEK (aka calling this with a non-NULL pValidationData) is broken. like, genuinely broken. not a vibe.

so the move is: call Tspi_TPM_GetPubEndorsementKey with a NULL pValidationData parameter and let the TSS verify the PubEK itself. let the TSS be the main character for once. periodt.

🎀 PARAMETERS 🎀

hTPM

this is the handle of the TPM object. you're basically telling the function which TPM we're talking to. 🫶

fOwnerAuthorized

if it's TRUE, the TPM owner secret must be provided to get the public endorsement key. if it's FALSE, no TPM owner secret must be provided to get the public endorsement key. pick your fighter. 💅

pValidationData

if this is non-NULL, the application should set the pValidationData->rgbExternalData parameter to 20 bytes of random data before calling Tspi_TPM_GetPubEndorsementKey. then, once the command completes successfully, the structure will give you buffers containing the validation data and the buffer the validation data was computed from. cute, right? ✨

(but remember what we said up top — non-NULL here is the broken path. you've been warned, bestie 😭)

phEndorsementPubKey

this receives a handle to a key object representing the TPM's public endorsement key. this is the whole point of the function. slay. 🌈

💀 RETURN CODES 💀

Tspi_TPM_GetPubEndorsementKey returns TSS_SUCCESS when everything goes right. otherwise, one of these shows up to ruin the mood:

• TSS_E_INVALID_HANDLE — hTPM is not a valid handle. 🚩
• TSS_E_INTERNAL_ERROR — an internal SW error has been detected. not me catching an L in the software layer 😭
• TSS_E_BAD_PARAMETER — one or more parameters is bad. one of them is giving absolutely nothing.
• TPM_E_DISABLED_CMD — reading of PubEK from TPM has been disabled. it's turned off, babes, nothing we can do 💀

👑 CONFORMING TO 👑

Tspi_TPM_GetPubEndorsementKey conforms to the Trusted Computing Group Software Specification version 1.1 Golden. iconic. no notes. ⭐

🌟 SEE ALSO 🌟

• Tspi_Key_GetPubKey(3).

and that's the whole page, bestie — TSS 1.1, dated 2004-05-25, from the Tspi_TPM_G...orsementKey(3) era of the manual. go forth and fetch that PubEK responsibly, mwah 💖🧚✨