View on GitHub

tpmtool

A Linux only tool for TPM interaction

Download this project as a .zip file Download this project as a tar.gz file

tpmtool is a tool for TPM interaction and disk encryption. It is written in pure Go.

Basic Features

Core Features

TPM Manufacturer:          STMicroelectronics
TPM spec:                  1.2
TPM owned:                 true
TPM activated:             true
TPM enabled:               true
TPM temporary deactivated: false

Package Availability

Packaging status

Dependencies

PCR pre-calculation

PCR pre-calculation is an important feature to reseal credential in case of PCR changes e.g. kernel/firmware update.

Usage:

tpmtool crypt reseal sealing.yml sealed-key.file

Example sealing configuration:

---
pcr0:
  - method: measure
    filepaths:
      - /boot/kernel
      - /boot/initramfs
  - method: extend
    hashes:
      - 8dad1c80be028384f26b929b7e7e251fbe3c1d5
pcr1:
  - method: dynamic
pcr2:
  - method: static
    hash: c3018af653e2f1a16118dd8bab2f409fbc82aa9f
pcr3:
  - method: log
    firmware: UEFI

Calculation methods

Every PCR can contain different calculation methods. The static and dynamic method are standalone and can’t be used with other methods.

Static

Overwrites and sets the PCR hash you define.

method: static

hash: 8dad1c80be028384f26b929b7e7e251fbe3c1d5 (string type)

Dynamic

Gets the current PCR of the TPM. Overwrites and sets the hash.

method: dynamic

Extend

Extends a hash into the current PCR.

method: extend

hashes: [ 8dad1c80be028384f26b929b7e7e251fbe3c1d5, c3018af653e2f1a16118dd8bab2f409fbc82aa9f ] (array type)

FimwareLog

Uses the existing firmware log for PCR pre-calculation.

method: log

firmware: BIOS (enum type){UEFI, BIOS}

Measure

Measures a file into the current PCR.

method: measure

filepaths: [ /foo/bash, /test/foo ] (array type)

Luks

Measures a LUKS header of a device into the current PCR.

method: luks

devicepath: /dev/sda (string type)