forked from microsoft/TSS.MSR
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Tpm2.h
4915 lines (4482 loc) · 268 KB
/
Tpm2.h
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
/*
* Copyright (c) Microsoft Corporation. All rights reserved.
* Licensed under the MIT License. See the LICENSE file in the project root for full license information.
*/
/*
* NOTE: this file is partially auto generated!
*
* All code after the point marked with the '// <<AUTOGEN_BEGIN>>' comment
* is autogenerated from the TPM 2.0 Specification docs.
*
* DO NOT EDIT AUTOGENERATED PART - all manual changes will be lost!
*/
#pragma once
#define NEW_MARSHAL 1
#include "fdefs.h"
#include "TpmMarshal.h"
#include "TpmDevice.h"
#include "Helpers.h"
#include "Tss.h"
_TPMCPP_BEGIN
/// <summary> Function type for user-installable callback </summary>
typedef void(*TpmResponseCallbackHandler)(const ByteVec& tpmCommand,
const ByteVec& tpmResponse, void *context);
/// <summary> Tpm2 provides methods to communicate with an underlying TPM2.0 device. Async-
/// methods are provided via tpm.Async.*, and methods that change how Tpm2 behaves, or
/// fetches Tpm2 state are prefaced with an underscore, e.g. tpm._GetLastResponseCode(). </summary>
class _DLLEXP_ Tpm2
{
public:
/// <summary> Create a Tpm2 object without an underlying TPM-device.
/// This can be used for obtaining CpHashes, etc. </summary>
Tpm2();
/// <summary> Connect this Tpm2 object to an underlying TpmDevice
/// (e.g. TpmTcpDevice, or TpmTbsDevice). </summary>
Tpm2(class TpmDevice& _device);
~Tpm2() {}
bool _HasDevice() const { return device != nullptr; }
/// <summary> Set or replace the underlying TPM device. </summary>
void _SetDevice(class TpmDevice& dev) { device = &dev; };
/// <summary> Obtain the underlying TpmDevice. </summary>
TpmDevice& _GetDevice() { return *device; }
const TpmDevice& _GetDevice() const { return *device; }
/// <summary> If h referes to a hierarchy handle (Owner, Endorsement, Platform
/// or Lockout), sets its associated auth value to the value tracked by the
/// corresponding _AdminXxx handle </summary>
void _SetRhAuthValue(TPM_HANDLE& h) const;
// Sessions: Note the 3-forms for associating sessions with the Tpm2-context.
/// <summary> Invoke the next command with the session(s) provided. Either omit
/// explicit sessions or use AUTH_SESSION::PWAP() to use a PWAP session with
/// the auth-value in the associated handle. </summary>
Tpm2& _Sessions(AUTH_SESSION& s);
/// <summary> Invoke the next command with the session(s) provided. Either omit
/// explicit sessions or use AUTH_SESSION::PWAP() to use a PWAP session with
/// the auth-value in the associated handle. </summary>
Tpm2& _Sessions(AUTH_SESSION& s1, AUTH_SESSION& s2);
/// <summary> Invoke the next command with the session(s) provided. Either omit
/// explicit sessions or use AUTH_SESSION::PWAP() to use a PWAP session with
/// the auth-value in the associated handle. </summary>
Tpm2& _Sessions(AUTH_SESSION& s1, AUTH_SESSION& s2, AUTH_SESSION& s3);
/// <summary> Invoke the next command with the session(s) provided. Either omit
/// explicit sessions or use AUTH_SESSION::PWAP() to use a PWAP session with
/// the auth-value in the associated handle. </summary>
Tpm2& _Sessions(const vector<AUTH_SESSION*>& sessions);
/// <summary> Invoke the next command with the given session. Either omit
/// explicit sessions or use AUTH_SESSION::PWAP() to use a PWAP session with
/// the auth-value in the associated handle. </summary>
Tpm2& operator()(AUTH_SESSION& s)
{
return _Sessions(s);
}
Tpm2& operator[](AUTH_SESSION& s)
{
return _Sessions(s);
}
/// <summary> Invoke the next command with the session(s) provided. Either omit
/// explicit sessions or use AUTH_SESSION::PWAP() to use a PWAP session with
/// the auth-value in the associated handle. </summary>
Tpm2& operator()(AUTH_SESSION& s1, AUTH_SESSION& s2)
{
return _Sessions(s1, s2);
}
/// <summary> Invoke the next command with the session(s) provided. Either omit
/// explicit sessions or use AUTH_SESSION::PWAP() to use a PWAP session with
/// the auth-value in the associated handle. </summary>
Tpm2& operator()(AUTH_SESSION& s1, AUTH_SESSION& s2, AUTH_SESSION& s3)
{
return _Sessions(s1, s2, s3);
}
// Error-handling
/// <summary> Strips the parameter-error info from the command code to give a
/// "bare" error code. </summary>
static TPM_RC ResponseCodeFromTpmError(TPM_RC _decoratedReponseCode);
/// <summary> The next TPM command may succeed or fail without an exception being generated.
/// Use _LastCommandSucceeded() or _GetLastResponseCode() to check the actual result. </summary>
Tpm2& _AllowErrors()
{
AllowErrors = true;
return *this;
}
/// <summary> The next operation is expected to fail with a specific error: an
/// exception is thrown if the command succeeds, or an unexpected error is seen. </summary>
Tpm2& _ExpectError(TPM_RC expectedError)
{
ExpectedError = expectedError;
return *this;
}
/// <summary> An exception is thrown if the next operation succeeds. </summary>
Tpm2& _DemandError()
{
DemandError = true;
return *this;
}
/// <summary> Did the last TPM command succeed? </summary>
bool _LastCommandSucceeded() const { return LastResponseCode == TPM_RC::SUCCESS; }
/// <summary> Get the response code for the last command (TPM_RC::SUCCESS or any of the error codes). </summary>
TPM_RC _GetLastResponseCode() const { return LastResponseCode; }
[[deprecated("Use EnumToStr() with the result of _GetLastResponseCode() instead")]]
string _GetLastResponseCodeAsString() const { return EnumToStr(LastResponseCode); }
[[deprecated("Use _GetLastResponseCode() instead")]]
TPM_RC _GetLastError() const { return LastResponseCode; }
[[deprecated("Use _LastCommandSucceeded() instead")]]
bool _LastOperationSucceeded() const { return LastResponseCode == TPM_RC::SUCCESS; }
/// <summary> Get random bytes from NON-TPM rng (this is *not* tpm.GetRandom()).
/// Fetches data from the default or programmer-installed SW-RNG. </summary>
[[deprecated("Use Helpers::RandomBytes() instead")]]
ByteVec _GetRandLocal(UINT32 numBytes) { return Helpers::RandomBytes(numBytes); }
/// <summary> Install a callback to be invoked after the TPM command has been submitted
/// and the response received. Set to NULL to disable callbacks. </summary>
void _SetResponseCallback(TpmResponseCallbackHandler handler, void *context)
{
responseCallback = handler;
responseCallbackContext = context;
}
//
// cpHash computation
//
/// <summary> The cpHash of the next command is placed in *hashToGet. Note that a valid hash
/// algorithm must be set in hashToGet, and the next command will NOT be sent to the TPM. </summary>
Tpm2& _GetCpHash(TPM_HASH *hashToGet)
{
CpHash = hashToGet;
return *this;
}
//
// Audit support
//
/// <summary> Sets the hash-alg and starting value to be used in _Audit(). </summary>
Tpm2& _StartAudit(const TPM_HASH& startVal)
{
CommandAuditHash = startVal;
return *this;
}
/// <summary> Stops this Tpm2 instance from maintaining the command audit hash. </summary>
Tpm2& _EndAudit()
{
CommandAuditHash.hashAlg = TPM_ALG_NULL;
AuditCommand = false;
return *this;
}
/// <summary> Instructs Tpm2 to add the hash of this command to the local log.
/// The local log will typically be compared to a TPM generated log to ensure
/// that a command sequence was executed as intended. </summary>
Tpm2& _Audit()
{
AuditCommand = true;
return *this;
}
/// <summary> Get the audit hash that includes all commands tagged with _Audit()
/// since the last _StartAudit() call. </summary>
TPM_HASH _GetAuditHash() const;
/// <summary> The _Admin handles are initialized to the relevant TPM-defined
/// platform handles. The programmer (or ports of this library) may also set
/// the associated auth-value for these handles. Note the association of the
/// admin-handles to a Tpm2-instance: this allows an application program to
/// talk to multiple remote/local TPMs with different auth-values </summary>
TPM_HANDLE _AdminOwner,
_AdminEndorsement,
_AdminPlatform,
_AdminLockout;
protected:
void Init();
void Dispatch(TPM_CC cmdCode, ReqStructure& req, RespStructure& resp);
void Dispatch(TPM_CC cmdCode, ReqStructure& req)
{
RespStructure resp;
Dispatch(cmdCode, req, resp);
}
void Dispatch(TPM_CC cmdCode, RespStructure& resp)
{
ReqStructure req;
Dispatch(cmdCode, req, resp);
}
bool DispatchOut(TPM_CC cmdCode, ReqStructure& req);
bool DispatchOut(TPM_CC cmdCode)
{
ReqStructure req;
return DispatchOut(cmdCode, req);
}
bool DispatchIn(TPM_CC cmdCode, RespStructure& resp);
bool DispatchIn(TPM_CC cmdCode)
{
RespStructure resp;
return DispatchIn(cmdCode, resp);
}
/// <summary> Builds byte buffer for cpHash computation </summary>
/// <remarks> Note that InHandles class member must contain the command handles, and session based
/// encryption must have been already applied to the cmdParams contents. </remarks>
/// <returns> Byte buffer with cpHash data </returns>
ByteVec GetCpHashData(TPM_CC cmdCode, const ByteVec& cmdParams) const;
/// <summary> Builds auth sessions for the current command and marshals them to the TPM command buffer </summary>
/// <remarks> Note that InHandles class member must contain the command handles, and session based
/// encryption must have been already applied to the cmdParams contents. </remarks>
/// <returns> If any of the command sessions requires HMAC computation, returns the result of GetCpHashData()
/// invocation that can be used for cpHash and command audit. Otherwise returns an empty byte buffer.
/// </returns>
ByteVec ProcessAuthSessions(TpmBuffer& cmdBuf, TPM_CC cmdCode, size_t numAuthHandles,
const ByteVec& cmdParams);
static ByteVec GetRpHash(TPM_ALG_ID hashAlg, TpmBuffer& respBuf, TPM_CC cmdCode,
size_t respParamsPos, size_t respParamsSize, bool rpReady);
bool ProcessRespSessions(TpmBuffer& respBuf, TPM_CC cmdCode,
size_t respParamsPos, size_t respParamsSize);
void RollNonces();
void DoParmEncryption(const CmdStructure& cmdInfo, TpmBuffer& paramBuf, size_t startPos, bool request);
void DebugPrint(const string& message);
/// <summary> Automatically set the name and AuthVal in the calling programs handles </summary>
void UpdateRequestHandles(TPM_CC cc, ReqStructure& req);
void CompleteUpdateRequestHandles(TPM_CC cc);
void UpdateRespHandle(TPM_CC cc, RespStructure& resp);
// Encrypting session stuff
void PrepareParmEncryptionSessions();
ByteVec NonceTpmDec, NonceTpmEnc;
//
// Per-invocation state
//
bool AllowErrors = false,
DemandError = false,
AuditCommand = false;
TPM_RC ExpectedError = TPM_RC::SUCCESS;
vector<AUTH_SESSION*> Sessions;
TPM_HASH *CpHash = NULL;
AUTH_SESSION *EncSession = NULL,
*DecSession = NULL;
void ClearInvocationState();
//
// State passed from DispatchOut to DispatchIn for async command processing
//
TPM_CC PendingCommand = 0;
ByteVec LastCommandBuf;
TPM_ST SessTag;
// Command input handles. *Note* the handle must survive until the command is
// complete so that we can apply the new name and authVal (certain commands).
vector<TPM_HANDLE> InHandles;
// The following are calculated from the input parms. If the command
// succeeds then the name and auth are applied to the handle.
ByteVec objectInName;
ByteVec objectInAuth;
//
// State persistent across commands
//
TpmDevice *device;
TPM_RC LastResponseCode = TPM_RC::SUCCESS;
TPM_HASH CommandAuditHash;
TPM_HASH AuditCpHash;
TpmResponseCallbackHandler responseCallback = NULL;
void* responseCallbackContext = NULL;
public:
// Overloaded TPM commands
/// <summary>This overloaded TPM-command is used to start an unseeded and unbound
/// HMAC or policy authorization session. </summary>
AUTH_SESSION StartAuthSession(TPM_SE sessionType, TPM_ALG_ID authHash);
/// <summary> Start a TPM auth-session for a non-bound, non-seeded session. </summary>
AUTH_SESSION StartAuthSession(TPM_SE sessionType, TPM_ALG_ID authHash,
TPMA_SESSION sessAttributes, const TPMT_SYM_DEF& symmAlg);
/// <summary> Start a TPM auth-session returning an AUTH_SESSION object (all options). </summary>
AUTH_SESSION StartAuthSession(TPM_HANDLE saltKey, TPM_HANDLE bindKey,
TPM_SE sessionType, TPM_ALG_ID authHash,
TPMA_SESSION sessAttributes, const TPMT_SYM_DEF& symDef,
const ByteVec& salt, const ByteVec& encryptedSalt);
// <<AUTOGEN_BEGIN>>
// ------------------------------------------------------------------------------------------------
// DO NOT REMOVE the <<AUTOGEN_BEGIN>> comment!
// DO NOT MODIFY any code below this point - all manual changes will be lost!
// ------------------------------------------------------------------------------------------------
/// <summary> TPM2_Startup() is always preceded by _TPM_Init, which is the physical indication
/// that TPM initialization is necessary because of a system-wide reset. TPM2_Startup() is
/// only valid after _TPM_Init. Additional TPM2_Startup() commands are not allowed after it
/// has completed successfully. If a TPM requires TPM2_Startup() and another command is
/// received, or if the TPM receives TPM2_Startup() when it is not required, the TPM shall
/// return TPM_RC_INITIALIZE. </summary>
/// <param name = "startupType"> TPM_SU_CLEAR or TPM_SU_STATE </param>
void Startup(TPM_SU startupType);
/// <summary> This command is used to prepare the TPM for a power cycle. The shutdownType
/// parameter indicates how the subsequent TPM2_Startup() will be processed. </summary>
/// <param name = "shutdownType"> TPM_SU_CLEAR or TPM_SU_STATE </param>
void Shutdown(TPM_SU shutdownType);
/// <summary> This command causes the TPM to perform a test of its capabilities. If the
/// fullTest is YES, the TPM will test all functions. If fullTest = NO, the TPM will only test
/// those functions that have not previously been tested. </summary>
/// <param name = "fullTest"> YES if full test to be performed
/// NO if only test of untested functions required </param>
void SelfTest(BYTE fullTest);
/// <summary> This command causes the TPM to perform a test of the selected algorithms. </summary>
/// <param name = "toTest"> List of algorithms that should be tested </param>
/// <returns> toDoList - List of algorithms that need testing </returns>
vector<TPM_ALG_ID> IncrementalSelfTest(const vector<TPM_ALG_ID>& toTest);
/// <summary> This command returns manufacturer-specific information regarding the results of
/// a self-test and an indication of the test status. </summary>
/// <returns> outData - Test result data
/// contains manufacturer-specific information
/// testResult - TBD </returns>
GetTestResultResponse GetTestResult();
/// <summary> This command is used to start an authorization session using alternative methods
/// of establishing the session key (sessionKey). The session key is then used to derive
/// values used for authorization and for encrypting parameters. </summary>
/// <param name = "tpmKey"> Handle of a loaded decrypt key used to encrypt salt
/// may be TPM_RH_NULL
/// Auth Index: None </param>
/// <param name = "bind"> Entity providing the authValue
/// may be TPM_RH_NULL
/// Auth Index: None </param>
/// <param name = "nonceCaller"> Initial nonceCaller, sets nonceTPM size for the session
/// shall be at least 16 octets </param>
/// <param name = "encryptedSalt"> Value encrypted according to the type of tpmKey
/// If tpmKey is TPM_RH_NULL, this shall be the Empty Buffer. </param>
/// <param name = "sessionType"> Indicates the type of the session; simple HMAC or policy
/// (including a trial policy) </param>
/// <param name = "symmetric"> The algorithm and key size for parameter encryption
/// may select TPM_ALG_NULL </param>
/// <param name = "authHash"> Hash algorithm to use for the session
/// Shall be a hash algorithm supported by the TPM and not TPM_ALG_NULL </param>
/// <returns> handle - Handle for the newly created session
/// nonceTPM - The initial nonce from the TPM, used in the computation of the sessionKey </returns>
StartAuthSessionResponse StartAuthSession
(
const TPM_HANDLE& tpmKey,
const TPM_HANDLE& bind,
const ByteVec& nonceCaller,
const ByteVec& encryptedSalt,
TPM_SE sessionType,
const TPMT_SYM_DEF& symmetric,
TPM_ALG_ID authHash
);
/// <summary> This command allows a policy authorization session to be returned to its initial
/// state. This command is used after the TPM returns TPM_RC_PCR_CHANGED. That response code
/// indicates that a policy will fail because the PCR have changed after TPM2_PolicyPCR() was
/// executed. Restarting the session allows the authorizations to be replayed because the
/// session restarts with the same nonceTPM. If the PCR are valid for the policy, the policy
/// may then succeed. </summary>
/// <param name = "sessionHandle"> The handle for the policy session </param>
void PolicyRestart(const TPM_HANDLE& sessionHandle);
/// <summary> This command is used to create an object that can be loaded into a TPM using
/// TPM2_Load(). If the command completes successfully, the TPM will create the new object and
/// return the objects creation data (creationData), its public area (outPublic), and its
/// encrypted sensitive area (outPrivate). Preservation of the returned data is the
/// responsibility of the caller. The object will need to be loaded (TPM2_Load()) before it
/// may be used. The only difference between the inPublic TPMT_PUBLIC template and the
/// outPublic TPMT_PUBLIC object is in the unique field. </summary>
/// <param name = "parentHandle"> Handle of parent for new object
/// Auth Index: 1
/// Auth Role: USER </param>
/// <param name = "inSensitive"> The sensitive data </param>
/// <param name = "inPublic"> The public template </param>
/// <param name = "outsideInfo"> Data that will be included in the creation data for this
/// object to provide permanent, verifiable linkage between this object and some object
/// owner data </param>
/// <param name = "creationPCR"> PCR that will be used in creation data </param>
/// <returns> outPrivate - The private portion of the object
/// outPublic - The public portion of the created object
/// creationData - Contains a TPMS_CREATION_DATA
/// creationHash - Digest of creationData using nameAlg of outPublic
/// creationTicket - Ticket used by TPM2_CertifyCreation() to validate that the
/// creation data was produced by the TPM </returns>
CreateResponse Create
(
const TPM_HANDLE& parentHandle,
const TPMS_SENSITIVE_CREATE& inSensitive,
const TPMT_PUBLIC& inPublic,
const ByteVec& outsideInfo,
const vector<TPMS_PCR_SELECTION>& creationPCR
);
/// <summary> This command is used to load objects into the TPM. This command is used when
/// both a TPM2B_PUBLIC and TPM2B_PRIVATE are to be loaded. If only a TPM2B_PUBLIC is to be
/// loaded, the TPM2_LoadExternal command is used. </summary>
/// <param name = "parentHandle"> TPM handle of parent key; shall not be a reserved handle
/// Auth Index: 1
/// Auth Role: USER </param>
/// <param name = "inPrivate"> The private portion of the object </param>
/// <param name = "inPublic"> The public portion of the object </param>
/// <returns> handle - Handle of type TPM_HT_TRANSIENT for the loaded object
/// name - Name of the loaded object </returns>
TPM_HANDLE Load
(
const TPM_HANDLE& parentHandle,
const TPM2B_PRIVATE& inPrivate,
const TPMT_PUBLIC& inPublic
);
/// <summary> This command is used to load an object that is not a Protected Object into the
/// TPM. The command allows loading of a public area or both a public and sensitive area. </summary>
/// <param name = "inPrivate"> The sensitive portion of the object (optional) </param>
/// <param name = "inPublic"> The public portion of the object </param>
/// <param name = "hierarchy"> Hierarchy with which the object area is associated </param>
/// <returns> handle - Handle of type TPM_HT_TRANSIENT for the loaded object
/// name - Name of the loaded object </returns>
TPM_HANDLE LoadExternal
(
const TPMT_SENSITIVE& inPrivate,
const TPMT_PUBLIC& inPublic,
const TPM_HANDLE& hierarchy
);
/// <summary> This command allows access to the public area of a loaded object. </summary>
/// <param name = "objectHandle"> TPM handle of an object
/// Auth Index: None </param>
/// <returns> outPublic - Structure containing the public area of an object
/// name - Name of the object
/// qualifiedName - The Qualified Name of the object </returns>
ReadPublicResponse ReadPublic(const TPM_HANDLE& objectHandle);
/// <summary> This command enables the association of a credential with an object in a way
/// that ensures that the TPM has validated the parameters of the credentialed object. </summary>
/// <param name = "activateHandle"> Handle of the object associated with certificate in credentialBlob
/// Auth Index: 1
/// Auth Role: ADMIN </param>
/// <param name = "keyHandle"> Loaded key used to decrypt the TPMS_SENSITIVE in credentialBlob
/// Auth Index: 2
/// Auth Role: USER </param>
/// <param name = "credentialBlob"> The credential </param>
/// <param name = "secret"> KeyHandle algorithm-dependent encrypted seed that protects
/// credentialBlob </param>
/// <returns> certInfo - The decrypted certificate information
/// the data should be no larger than the size of the digest of the
/// nameAlg associated with keyHandle </returns>
ByteVec ActivateCredential
(
const TPM_HANDLE& activateHandle,
const TPM_HANDLE& keyHandle,
const TPMS_ID_OBJECT& credentialBlob,
const ByteVec& secret
);
/// <summary> This command allows the TPM to perform the actions required of a Certificate
/// Authority (CA) in creating a TPM2B_ID_OBJECT containing an activation credential. </summary>
/// <param name = "handle"> Loaded public area, used to encrypt the sensitive area containing
/// the credential key
/// Auth Index: None </param>
/// <param name = "credential"> The credential information </param>
/// <param name = "objectName"> Name of the object to which the credential applies </param>
/// <returns> credentialBlob - The credential
/// secret - Handle algorithm-dependent data that wraps the key that encrypts credentialBlob </returns>
MakeCredentialResponse MakeCredential
(
const TPM_HANDLE& handle,
const ByteVec& credential,
const ByteVec& objectName
);
/// <summary> This command returns the data in a loaded Sealed Data Object. </summary>
/// <param name = "itemHandle"> Handle of a loaded data object
/// Auth Index: 1
/// Auth Role: USER </param>
/// <returns> outData - Unsealed data
/// Size of outData is limited to be no more than 128 octets. </returns>
ByteVec Unseal(const TPM_HANDLE& itemHandle);
/// <summary> This command is used to change the authorization secret for a TPM-resident
/// object. </summary>
/// <param name = "objectHandle"> Handle of the object
/// Auth Index: 1
/// Auth Role: ADMIN </param>
/// <param name = "parentHandle"> Handle of the parent
/// Auth Index: None </param>
/// <param name = "newAuth"> New authorization value </param>
/// <returns> outPrivate - Private area containing the new authorization value </returns>
TPM2B_PRIVATE ObjectChangeAuth
(
const TPM_HANDLE& objectHandle,
const TPM_HANDLE& parentHandle,
const ByteVec& newAuth
);
/// <summary> This command creates an object and loads it in the TPM. This command allows
/// creation of any type of object (Primary, Ordinary, or Derived) depending on the type of
/// parentHandle. If parentHandle references a Primary Seed, then a Primary Object is created;
/// if parentHandle references a Storage Parent, then an Ordinary Object is created; and if
/// parentHandle references a Derivation Parent, then a Derived Object is generated. </summary>
/// <param name = "parentHandle"> Handle of a transient storage key, a persistent storage key,
/// TPM_RH_ENDORSEMENT, TPM_RH_OWNER, TPM_RH_PLATFORM+{PP}, or TPM_RH_NULL
/// Auth Index: 1
/// Auth Role: USER </param>
/// <param name = "inSensitive"> The sensitive data, see TPM 2.0 Part 1 Sensitive Values </param>
/// <param name = "inPublic"> The public template </param>
/// <returns> handle - Handle of type TPM_HT_TRANSIENT for created object
/// outPrivate - The sensitive area of the object (optional)
/// outPublic - The public portion of the created object
/// name - The name of the created object </returns>
CreateLoadedResponse CreateLoaded
(
const TPM_HANDLE& parentHandle,
const TPMS_SENSITIVE_CREATE& inSensitive,
const ByteVec& inPublic
);
/// <summary> This command duplicates a loaded object so that it may be used in a different
/// hierarchy. The new parent key for the duplicate may be on the same or different TPM or
/// TPM_RH_NULL. Only the public area of newParentHandle is required to be loaded. </summary>
/// <param name = "objectHandle"> Loaded object to duplicate
/// Auth Index: 1
/// Auth Role: DUP </param>
/// <param name = "newParentHandle"> Shall reference the public area of an asymmetric key
/// Auth Index: None </param>
/// <param name = "encryptionKeyIn"> Optional symmetric encryption key
/// The size for this key is set to zero when the TPM is to generate the key. This
/// parameter may be encrypted. </param>
/// <param name = "symmetricAlg"> Definition for the symmetric algorithm to be used for the
/// inner wrapper
/// may be TPM_ALG_NULL if no inner wrapper is applied </param>
/// <returns> encryptionKeyOut - If the caller provided an encryption key or if symmetricAlg
/// was TPM_ALG_NULL, then this will be the Empty Buffer;
/// otherwise, it shall contain the TPM-generated, symmetric
/// encryption key for the inner wrapper.
/// duplicate - Private area that may be encrypted by encryptionKeyIn; and may be
/// doubly encrypted
/// outSymSeed - Seed protected by the asymmetric algorithms of new parent (NP) </returns>
DuplicateResponse Duplicate
(
const TPM_HANDLE& objectHandle,
const TPM_HANDLE& newParentHandle,
const ByteVec& encryptionKeyIn,
const TPMT_SYM_DEF_OBJECT& symmetricAlg
);
/// <summary> This command allows the TPM to serve in the role as a Duplication Authority. If
/// proper authorization for use of the oldParent is provided, then an HMAC key and a
/// symmetric key are recovered from inSymSeed and used to integrity check and decrypt
/// inDuplicate. A new protection seed value is generated according to the methods appropriate
/// for newParent and the blob is re-encrypted and a new integrity value is computed. The
/// re-encrypted blob is returned in outDuplicate and the symmetric key returned in outSymKey.
/// </summary>
/// <param name = "oldParent"> Parent of object
/// Auth Index: 1
/// Auth Role: User </param>
/// <param name = "newParent"> New parent of the object
/// Auth Index: None </param>
/// <param name = "inDuplicate"> An object encrypted using symmetric key derived from
/// inSymSeed </param>
/// <param name = "name"> The Name of the object being rewrapped </param>
/// <param name = "inSymSeed"> The seed for the symmetric key and HMAC key
/// needs oldParent private key to recover the seed and generate the symmetric key </param>
/// <returns> outDuplicate - An object encrypted using symmetric key derived from outSymSeed
/// outSymSeed - Seed for a symmetric key protected by newParent asymmetric key </returns>
RewrapResponse Rewrap
(
const TPM_HANDLE& oldParent,
const TPM_HANDLE& newParent,
const TPM2B_PRIVATE& inDuplicate,
const ByteVec& name,
const ByteVec& inSymSeed
);
/// <summary> This command allows an object to be encrypted using the symmetric encryption
/// values of a Storage Key. After encryption, the object may be loaded and used in the new
/// hierarchy. The imported object (duplicate) may be singly encrypted, multiply encrypted, or
/// unencrypted. </summary>
/// <param name = "parentHandle"> The handle of the new parent for the object
/// Auth Index: 1
/// Auth Role: USER </param>
/// <param name = "encryptionKey"> The optional symmetric encryption key used as the inner
/// wrapper for duplicate
/// If symmetricAlg is TPM_ALG_NULL, then this parameter shall be the Empty Buffer. </param>
/// <param name = "objectPublic"> The public area of the object to be imported
/// This is provided so that the integrity value for duplicate and the object
/// attributes can be checked.
/// NOTE Even if the integrity value of the object is not checked on input, the object
/// Name is required to create the integrity value for the imported object. </param>
/// <param name = "duplicate"> The symmetrically encrypted duplicate object that may contain
/// an inner symmetric wrapper </param>
/// <param name = "inSymSeed"> The seed for the symmetric key and HMAC key
/// inSymSeed is encrypted/encoded using the algorithms of newParent. </param>
/// <param name = "symmetricAlg"> Definition for the symmetric algorithm to use for the inner wrapper
/// If this algorithm is TPM_ALG_NULL, no inner wrapper is present and encryptionKey
/// shall be the Empty Buffer. </param>
/// <returns> outPrivate - The sensitive area encrypted with the symmetric key of parentHandle </returns>
TPM2B_PRIVATE Import
(
const TPM_HANDLE& parentHandle,
const ByteVec& encryptionKey,
const TPMT_PUBLIC& objectPublic,
const TPM2B_PRIVATE& duplicate,
const ByteVec& inSymSeed,
const TPMT_SYM_DEF_OBJECT& symmetricAlg
);
/// <summary> This command performs RSA encryption using the indicated padding scheme
/// according to IETF RFC 8017. If the scheme of keyHandle is TPM_ALG_NULL, then the caller
/// may use inScheme to specify the padding scheme. If scheme of keyHandle is not
/// TPM_ALG_NULL, then inScheme shall either be TPM_ALG_NULL or be the same as scheme
/// (TPM_RC_SCHEME). </summary>
/// <param name = "keyHandle"> Reference to public portion of RSA key to use for encryption
/// Auth Index: None </param>
/// <param name = "message"> Message to be encrypted
/// NOTE 1 The data type was chosen because it limits the overall size of the input to
/// no greater than the size of the largest RSA public key. This may be larger than
/// allowed for keyHandle. </param>
/// <param name = "inScheme"> The padding scheme to use if scheme associated with keyHandle is
/// TPM_ALG_NULL
/// One of: TPMS_KEY_SCHEME_ECDH, TPMS_KEY_SCHEME_ECMQV, TPMS_SIG_SCHEME_RSASSA,
/// TPMS_SIG_SCHEME_RSAPSS, TPMS_SIG_SCHEME_ECDSA, TPMS_SIG_SCHEME_ECDAA,
/// TPMS_SIG_SCHEME_SM2, TPMS_SIG_SCHEME_ECSCHNORR, TPMS_ENC_SCHEME_RSAES,
/// TPMS_ENC_SCHEME_OAEP, TPMS_SCHEME_HASH, TPMS_NULL_ASYM_SCHEME. </param>
/// <param name = "label"> Optional label L to be associated with the message
/// Size of the buffer is zero if no label is present
/// NOTE 2 See description of label above. </param>
/// <returns> outData - Encrypted output </returns>
ByteVec RSA_Encrypt
(
const TPM_HANDLE& keyHandle,
const ByteVec& message,
const TPMU_ASYM_SCHEME& inScheme,
const ByteVec& label
);
/// <summary> This command performs RSA decryption using the indicated padding scheme
/// according to IETF RFC 8017 ((PKCS#1). </summary>
/// <param name = "keyHandle"> RSA key to use for decryption
/// Auth Index: 1
/// Auth Role: USER </param>
/// <param name = "cipherText"> Cipher text to be decrypted
/// NOTE An encrypted RSA data block is the size of the public modulus. </param>
/// <param name = "inScheme"> The padding scheme to use if scheme associated with keyHandle is
/// TPM_ALG_NULL
/// One of: TPMS_KEY_SCHEME_ECDH, TPMS_KEY_SCHEME_ECMQV, TPMS_SIG_SCHEME_RSASSA,
/// TPMS_SIG_SCHEME_RSAPSS, TPMS_SIG_SCHEME_ECDSA, TPMS_SIG_SCHEME_ECDAA,
/// TPMS_SIG_SCHEME_SM2, TPMS_SIG_SCHEME_ECSCHNORR, TPMS_ENC_SCHEME_RSAES,
/// TPMS_ENC_SCHEME_OAEP, TPMS_SCHEME_HASH, TPMS_NULL_ASYM_SCHEME. </param>
/// <param name = "label"> Label whose association with the message is to be verified </param>
/// <returns> message - Decrypted output </returns>
ByteVec RSA_Decrypt
(
const TPM_HANDLE& keyHandle,
const ByteVec& cipherText,
const TPMU_ASYM_SCHEME& inScheme,
const ByteVec& label
);
/// <summary> This command uses the TPM to generate an ephemeral key pair (de, Qe where Qe
/// [de]G). It uses the private ephemeral key and a loaded public key (QS) to compute the
/// shared secret value (P [hde]QS). </summary>
/// <param name = "keyHandle"> Handle of a loaded ECC key public area.
/// Auth Index: None </param>
/// <returns> zPoint - Results of P h[de]Qs
/// pubPoint - Generated ephemeral public point (Qe) </returns>
ECDH_KeyGenResponse ECDH_KeyGen(const TPM_HANDLE& keyHandle);
/// <summary> This command uses the TPM to recover the Z value from a public point (QB) and a
/// private key (ds). It will perform the multiplication of the provided inPoint (QB) with the
/// private key (ds) and return the coordinates of the resultant point (Z = (xZ , yZ) [hds]QB;
/// where h is the cofactor of the curve). </summary>
/// <param name = "keyHandle"> Handle of a loaded ECC key
/// Auth Index: 1
/// Auth Role: USER </param>
/// <param name = "inPoint"> A public key </param>
/// <returns> outPoint - X and Y coordinates of the product of the multiplication Z = (xZ ,
/// yZ) [hdS]QB </returns>
TPMS_ECC_POINT ECDH_ZGen
(
const TPM_HANDLE& keyHandle,
const TPMS_ECC_POINT& inPoint
);
/// <summary> This command returns the parameters of an ECC curve identified by its
/// TCG-assigned curveID. </summary>
/// <param name = "curveID"> Parameter set selector </param>
/// <returns> parameters - ECC parameters for the selected curve </returns>
TPMS_ALGORITHM_DETAIL_ECC ECC_Parameters(TPM_ECC_CURVE curveID);
/// <summary> This command supports two-phase key exchange protocols. The command is used in
/// combination with TPM2_EC_Ephemeral(). TPM2_EC_Ephemeral() generates an ephemeral key and
/// returns the public point of that ephemeral key along with a numeric value that allows the
/// TPM to regenerate the associated private key. </summary>
/// <param name = "keyA"> Handle of an unrestricted decryption key ECC
/// The private key referenced by this handle is used as dS,A
/// Auth Index: 1
/// Auth Role: USER </param>
/// <param name = "inQsB"> Other partys static public key (Qs,B = (Xs,B, Ys,B)) </param>
/// <param name = "inQeB"> Other party's ephemeral public key (Qe,B = (Xe,B, Ye,B)) </param>
/// <param name = "inScheme"> The key exchange scheme </param>
/// <param name = "counter"> Value returned by TPM2_EC_Ephemeral() </param>
/// <returns> outZ1 - X and Y coordinates of the computed value (scheme dependent)
/// outZ2 - X and Y coordinates of the second computed value (scheme dependent) </returns>
ZGen_2PhaseResponse ZGen_2Phase
(
const TPM_HANDLE& keyA,
const TPMS_ECC_POINT& inQsB,
const TPMS_ECC_POINT& inQeB,
TPM_ALG_ID inScheme,
UINT16 counter
);
/// <summary> This command performs ECC encryption as described in Part 1, Annex D. </summary>
/// <param name = "keyHandle"> Reference to public portion of ECC key to use for encryption
/// Auth Index: None </param>
/// <param name = "plainText"> Plaintext to be encrypted </param>
/// <param name = "inScheme"> The KDF to use if scheme associated with keyHandle is TPM_ALG_NULL
/// One of: TPMS_KDF_SCHEME_MGF1, TPMS_KDF_SCHEME_KDF1_SP800_56A, TPMS_KDF_SCHEME_KDF2,
/// TPMS_KDF_SCHEME_KDF1_SP800_108, TPMS_SCHEME_HASH, TPMS_NULL_KDF_SCHEME. </param>
/// <returns> C1 - The public ephemeral key used for ECDH
/// C2 - The data block produced by the XOR process
/// C3 - The integrity value </returns>
ECC_EncryptResponse ECC_Encrypt
(
const TPM_HANDLE& keyHandle,
const ByteVec& plainText,
const TPMU_KDF_SCHEME& inScheme
);
/// <summary> This command performs ECC decryption. </summary>
/// <param name = "keyHandle"> ECC key to use for decryption
/// Auth Index: 1
/// Auth Role: USER </param>
/// <param name = "C1"> The public ephemeral key used for ECDH </param>
/// <param name = "C2"> The data block produced by the XOR process </param>
/// <param name = "C3"> The integrity value </param>
/// <param name = "inScheme"> The KDF to use if scheme associated with keyHandle is TPM_ALG_NULL
/// One of: TPMS_KDF_SCHEME_MGF1, TPMS_KDF_SCHEME_KDF1_SP800_56A, TPMS_KDF_SCHEME_KDF2,
/// TPMS_KDF_SCHEME_KDF1_SP800_108, TPMS_SCHEME_HASH, TPMS_NULL_KDF_SCHEME. </param>
/// <returns> plainText - Decrypted output </returns>
ByteVec ECC_Decrypt
(
const TPM_HANDLE& keyHandle,
const TPMS_ECC_POINT& C1,
const ByteVec& C2,
const ByteVec& C3,
const TPMU_KDF_SCHEME& inScheme
);
/// <summary> NOTE 1 This command is deprecated, and TPM2_EncryptDecrypt2() is preferred. This
/// should be reflected in platform-specific specifications. </summary>
/// <param name = "keyHandle"> The symmetric key used for the operation
/// Auth Index: 1
/// Auth Role: USER </param>
/// <param name = "decrypt"> If YES, then the operation is decryption; if NO, the operation is
/// encryption </param>
/// <param name = "mode"> Symmetric encryption/decryption mode
/// this field shall match the default mode of the key or be TPM_ALG_NULL. </param>
/// <param name = "ivIn"> An initial value as required by the algorithm </param>
/// <param name = "inData"> The data to be encrypted/decrypted </param>
/// <returns> outData - Encrypted or decrypted output
/// ivOut - Chaining value to use for IV in next round </returns>
EncryptDecryptResponse EncryptDecrypt
(
const TPM_HANDLE& keyHandle,
BYTE decrypt,
TPM_ALG_ID mode,
const ByteVec& ivIn,
const ByteVec& inData
);
/// <summary> This command is identical to TPM2_EncryptDecrypt(), except that the inData
/// parameter is the first parameter. This permits inData to be parameter encrypted. </summary>
/// <param name = "keyHandle"> The symmetric key used for the operation
/// Auth Index: 1
/// Auth Role: USER </param>
/// <param name = "inData"> The data to be encrypted/decrypted </param>
/// <param name = "decrypt"> If YES, then the operation is decryption; if NO, the operation is
/// encryption </param>
/// <param name = "mode"> Symmetric mode
/// this field shall match the default mode of the key or be TPM_ALG_NULL. </param>
/// <param name = "ivIn"> An initial value as required by the algorithm </param>
/// <returns> outData - Encrypted or decrypted output
/// ivOut - Chaining value to use for IV in next round </returns>
EncryptDecrypt2Response EncryptDecrypt2
(
const TPM_HANDLE& keyHandle,
const ByteVec& inData,
BYTE decrypt,
TPM_ALG_ID mode,
const ByteVec& ivIn
);
/// <summary> This command performs a hash operation on a data buffer and returns the results.
/// </summary>
/// <param name = "data"> Data to be hashed </param>
/// <param name = "hashAlg"> Algorithm for the hash being computed shall not be TPM_ALG_NULL </param>
/// <param name = "hierarchy"> Hierarchy to use for the ticket (TPM_RH_NULL allowed) </param>
/// <returns> outHash - Results
/// validation - Ticket indicating that the sequence of octets used to compute
/// outDigest did not start with TPM_GENERATED_VALUE
/// will be a NULL ticket if the digest may not be signed with a
/// restricted key </returns>
HashResponse Hash
(
const ByteVec& data,
TPM_ALG_ID hashAlg,
const TPM_HANDLE& hierarchy
);
/// <summary> This command performs an HMAC on the supplied data using the indicated hash
/// algorithm. </summary>
/// <param name = "handle"> Handle for the symmetric signing key providing the HMAC key
/// Auth Index: 1
/// Auth Role: USER </param>
/// <param name = "buffer"> HMAC data </param>
/// <param name = "hashAlg"> Algorithm to use for HMAC </param>
/// <returns> outHMAC - The returned HMAC in a sized buffer </returns>
ByteVec HMAC
(
const TPM_HANDLE& handle,
const ByteVec& buffer,
TPM_ALG_ID hashAlg
);
/// <summary> This command performs an HMAC or a block cipher MAC on the supplied data using
/// the indicated algorithm. </summary>
/// <param name = "handle"> Handle for the symmetric signing key providing the MAC key
/// Auth Index: 1
/// Auth Role: USER </param>
/// <param name = "buffer"> MAC data </param>
/// <param name = "inScheme"> Algorithm to use for MAC </param>
/// <returns> outMAC - The returned MAC in a sized buffer </returns>
ByteVec MAC
(
const TPM_HANDLE& handle,
const ByteVec& buffer,
TPM_ALG_ID inScheme
);
/// <summary> This command returns the next bytesRequested octets from the random number
/// generator (RNG). </summary>
/// <param name = "bytesRequested"> Number of octets to return </param>
/// <returns> randomBytes - The random octets </returns>
ByteVec GetRandom(UINT16 bytesRequested);
/// <summary> This command is used to add "additional information" to the RNG state. </summary>
/// <param name = "inData"> Additional information </param>
void StirRandom(const ByteVec& inData);
/// <summary> This command starts an HMAC sequence. The TPM will create and initialize an HMAC
/// sequence structure, assign a handle to the sequence, and set the authValue of the sequence
/// object to the value in auth. </summary>
/// <param name = "handle"> Handle of an HMAC key
/// Auth Index: 1
/// Auth Role: USER </param>
/// <param name = "auth"> Authorization value for subsequent use of the sequence </param>
/// <param name = "hashAlg"> The hash algorithm to use for the HMAC </param>
/// <returns> handle - A handle to reference the sequence </returns>
TPM_HANDLE HMAC_Start
(
const TPM_HANDLE& handle,
const ByteVec& auth,
TPM_ALG_ID hashAlg
);
/// <summary> This command starts a MAC sequence. The TPM will create and initialize a MAC
/// sequence structure, assign a handle to the sequence, and set the authValue of the sequence
/// object to the value in auth. </summary>
/// <param name = "handle"> Handle of a MAC key
/// Auth Index: 1
/// Auth Role: USER </param>
/// <param name = "auth"> Authorization value for subsequent use of the sequence </param>
/// <param name = "inScheme"> The algorithm to use for the MAC </param>
/// <returns> handle - A handle to reference the sequence </returns>
TPM_HANDLE MAC_Start
(
const TPM_HANDLE& handle,
const ByteVec& auth,
TPM_ALG_ID inScheme
);
/// <summary> This command starts a hash or an Event Sequence. If hashAlg is an implemented
/// hash, then a hash sequence is started. If hashAlg is TPM_ALG_NULL, then an Event Sequence
/// is started. If hashAlg is neither an implemented algorithm nor TPM_ALG_NULL, then the TPM
/// shall return TPM_RC_HASH. </summary>
/// <param name = "auth"> Authorization value for subsequent use of the sequence </param>
/// <param name = "hashAlg"> The hash algorithm to use for the hash sequence
/// An Event Sequence starts if this is TPM_ALG_NULL. </param>
/// <returns> handle - A handle to reference the sequence </returns>
TPM_HANDLE HashSequenceStart
(
const ByteVec& auth,
TPM_ALG_ID hashAlg
);
/// <summary> This command is used to add data to a hash or HMAC sequence. The amount of data
/// in buffer may be any size up to the limits of the TPM. </summary>
/// <param name = "sequenceHandle"> Handle for the sequence object
/// Auth Index: 1
/// Auth Role: USER </param>
/// <param name = "buffer"> Data to be added to hash </param>
void SequenceUpdate
(
const TPM_HANDLE& sequenceHandle,
const ByteVec& buffer
);
/// <summary> This command adds the last part of data, if any, to a hash/HMAC sequence and
/// returns the result. </summary>
/// <param name = "sequenceHandle"> Authorization for the sequence
/// Auth Index: 1
/// Auth Role: USER </param>
/// <param name = "buffer"> Data to be added to the hash/HMAC </param>
/// <param name = "hierarchy"> Hierarchy of the ticket for a hash </param>
/// <returns> result - The returned HMAC or digest in a sized buffer
/// validation - Ticket indicating that the sequence of octets used to compute
/// outDigest did not start with TPM_GENERATED_VALUE
/// This is a NULL Ticket when the sequence is HMAC. </returns>
SequenceCompleteResponse SequenceComplete
(
const TPM_HANDLE& sequenceHandle,
const ByteVec& buffer,
const TPM_HANDLE& hierarchy
);
/// <summary> This command adds the last part of data, if any, to an Event Sequence and
/// returns the result in a digest list. If pcrHandle references a PCR and not TPM_RH_NULL,
/// then the returned digest list is processed in the same manner as the digest list input
/// parameter to TPM2_PCR_Extend(). That is, if a bank contains a PCR associated with
/// pcrHandle, it is extended with the associated digest value from the list. </summary>
/// <param name = "pcrHandle"> PCR to be extended with the Event data
/// Auth Index: 1
/// Auth Role: USER </param>
/// <param name = "sequenceHandle"> Authorization for the sequence
/// Auth Index: 2
/// Auth Role: USER </param>
/// <param name = "buffer"> Data to be added to the Event </param>