tpm

type AppKeyStoreData struct {
	ParentHandle tpm2.TPMHandle
	ParentPass   []byte
	Public       tpm2.TPM2BPublic
	Private      tpm2.TPM2BPrivate
	Pass         []byte
}

type CSRPayload struct {
	// Product model string
	ProdModel []byte `json:"prodModel"`
	// Product serial number string
	ProdSerial []byte `json:"prodSerial"`
	// CA-specific data
	ProdCaData []byte `json:"prodCaData"`
	// Boot event log
	BootEvntLog []byte `json:"bootEvntLog"`
	// TPM EK certificate (DER format)
	EkCert []byte `json:"ekCert"`
	// Attestation key public area
	AttestPub []byte `json:"attestPub"`
	// TPM2_CertifyCreation ticket
	AtCreateTkt []byte `json:"atCreateTkt"`
	// TPM2_Certify info for attestation key (currently unused)
	AtCertifyInfo []byte `json:"atCertifyInfo"`
	// Signature over attestation certify info (currently unused)
	AtCertifyInfoSignature []byte `json:"atCertifyInfoSignature"`
	// Signing key public area
	SigningPub []byte `json:"signingPub"`
	// TPM2_Certify info for signing key
	SgnCertifyInfo []byte `json:"sgnCertifyInfo"`
	// Signature over signing certify info
	SgnCertifyInfoSignature []byte `json:"sgnCertifyInfoSignature"`
	// Padding
	Pad []byte `json:"pad"`
}

type Certifiable interface {
	// Handle returns the Handle of the Key to certify
	Handle() tpm2.AuthHandle
}

type Client interface {
	// Public returns the public key corresponding to the LDevID private key
	Public() crypto.PublicKey
	// MakeCSR generates a TCG-CSR-IDEVID structure for enrollment requests
	MakeCSR(deviceName string, qualifyingData []byte) ([]byte, error)
	// SolveChallenge uses TPM2_ActivateCredential to decrypt an encrypted secret
	SolveChallenge(credentialBlob, encryptedSecret []byte) ([]byte, error)
	// GetSigner returns the crypto.Signer interface for this client
	GetSigner() crypto.Signer
	// UpdateNonce updates the nonce used for TPM operations
	UpdateNonce(nonce []byte) error
	// Clear clears any stored TPM data
	Clear() error
	// Close closes the TPM session
	Close() error
	// VendorInfoCollector collects vendor information from the TPM
	VendorInfoCollector(ctx context.Context) string
	// CreateApplicationKey generates a TCG CSR IDEVID bundle and a TSS2 PEM encoded file for the specified application
	CreateApplicationKey(name string) ([]byte, []byte, error)
}

type CredentialChallenge struct {
	CredentialBlob  []byte
	EncryptedSecret []byte
	ExpectedSecret  []byte
}

type DeviceID interface {
	crypto.Signer
	Certifiable
	// Close flushes the key
	Close() error
	// PublicBlob returns the serialized TPM2Public portion of the key
	PublicBlob() []byte
}

type ExportableDeviceID interface {
	DeviceID
	// Export generates a TSS2 PEM formatted file
	Export() ([]byte, error)
}

type IDevIDContent struct {
	StructVer  [4]byte `json:"-"` // Version 1.0 = 0x00000100
	HashAlgoId [4]byte `json:"-"` // TCG algorithm identifier for CSR hash
	HashSz     [4]byte `json:"-"` // Size, in bytes, of hash used

	// Hash of all that follows is placed here order must not change
	ProdModelSz               [4]byte `json:"-"` // Size of unterminated product model string
	ProdSerialSz              [4]byte `json:"-"` // Size of unterminated product serial number string
	ProdCaDataSz              [4]byte `json:"-"` // Size of CA-specific required data structure
	BootEvntLogSz             [4]byte `json:"-"` // Size of boot event log
	EkCertSz                  [4]byte `json:"-"` // TPM EK cert size
	AttestPubSz               [4]byte `json:"-"` // Attestation key public size
	AtCreateTktSz             [4]byte `json:"-"` // TPM2_CertifyCreation ticket size
	AtCertifyInfoSz           [4]byte `json:"-"` // TPM2_Certify info size
	AtCertifyInfoSignatureSz  [4]byte `json:"-"` // TPM2_CertifyInfo Signature size
	SigningPubSz              [4]byte `json:"-"` // Signing key public size
	SgnCertifyInfoSz          [4]byte `json:"-"` // TPM2_Certify info size
	SgnCertifyInfoSignatureSz [4]byte `json:"-"` // TPM2_CertifyInfo Signature size

	PadSz [4]byte `json:"-"` // Padding size
}

type KeyAlgorithm string

type KeyFileOption func(*tpmKey)

type KeyFileType string

type KeyType string

type MockCertifiable struct {
	// contains filtered or unexported fields
}

type MockCertifiableMockRecorder struct {
	// contains filtered or unexported fields
}

type MockClient struct {
	// contains filtered or unexported fields
}

type MockClientMockRecorder struct {
	// contains filtered or unexported fields
}

type MockDeviceID struct {
	// contains filtered or unexported fields
}

type MockDeviceIDMockRecorder struct {
	// contains filtered or unexported fields
}

type MockExportableDeviceID struct {
	// contains filtered or unexported fields
}

type MockExportableDeviceIDMockRecorder struct {
	// contains filtered or unexported fields
}

type MockSession struct {
	// contains filtered or unexported fields
}

type MockSessionMockRecorder struct {
	// contains filtered or unexported fields
}

type MockStorage struct {
	// contains filtered or unexported fields
}

type MockStorageMockRecorder struct {
	// contains filtered or unexported fields
}

type ParsedTCGCSR struct {
	StructVer       uint32
	Contents        uint32
	SigSz           uint32
	CSRContents     *ParsedTCGContent
	Signature       []byte
	IsValid         bool
	ValidationError string
}

type ParsedTCGContent struct {
	StructVer                 uint32
	HashAlgoId                uint32
	HashSz                    uint32
	ProdModelSz               uint32
	ProdSerialSz              uint32
	ProdCaDataSz              uint32
	BootEvntLogSz             uint32
	EkCertSz                  uint32
	AttestPubSz               uint32
	AtCreateTktSz             uint32
	AtCertifyInfoSz           uint32
	AtCertifyInfoSignatureSz  uint32
	SigningPubSz              uint32
	SgnCertifyInfoSz          uint32
	SgnCertifyInfoSignatureSz uint32
	PadSz                     uint32
	Payload                   *ParsedTCGPayload
}

type ParsedTCGPayload struct {
	ProdModel               []byte
	ProdSerial              []byte
	ProdCaData              []byte
	BootEvntLog             []byte
	EkCert                  []byte
	AttestPub               []byte
	AtCreateTkt             []byte
	AtCertifyInfo           []byte
	AtCertifyInfoSignature  []byte
	SigningPub              []byte
	SgnCertifyInfo          []byte
	SgnCertifyInfoSignature []byte
	Pad                     []byte
}

type Session interface {
	// CreateKey creates a new key of the specified type
	CreateKey(keyType KeyType) (*tpm2.CreateResponse, error)
	// LoadKey loads a key into the TPM and returns its handle
	LoadKey(keyType KeyType) (*tpm2.NamedHandle, error)
	// CertifyKey certifies a key with the LAK
	CertifyKey(keyType KeyType, qualifyingData []byte) (certifyInfo, signature []byte, err error)
	// Certify certifies a key with the LAK
	Certify(key Certifiable, qualifyingData []byte) (certifyInfo, signature []byte, err error)
	// LoadApplicationKey creates or returns an already existing DeviceID
	LoadApplicationKey(appName string) (ExportableDeviceID, error)
	// RemoveApplicationKey removes the key for the specified application
	RemoveApplicationKey(appName string) error
	// Sign signs data with the specified key
	Sign(keyType KeyType, digest []byte) ([]byte, error)
	// GetPublicKey gets the public key for a key type
	GetPublicKey(keyType KeyType) (*tpm2.TPM2BPublic, error)
	// GetEndorsementKeyCert returns the endorsement key certificate
	GetEndorsementKeyCert() ([]byte, error)
	// GenerateChallenge creates a credential challenge used to prove ownership
	GenerateChallenge(secret []byte) ([]byte, []byte, error)
	// SolveChallenge decrypts the encryptedSecret to prove ownership of the credentials
	SolveChallenge(credentialBlob, encryptedSecret []byte) ([]byte, error)
	// Clear performs a best-effort clear of the TPM, resetting keys and auth
	Clear() error
	// Close closes the session and flushes handles
	Close() error
}

type SessionOption func(*tpmSession)

type Storage interface {
	// GetKey retrieves stored key data for the specified key type
	// Returns nil values if key doesn't exist
	GetKey(keyType KeyType) (*tpm2.TPM2BPublic, *tpm2.TPM2BPrivate, error)
	// StoreKey stores key data for the specified key type
	StoreKey(keyType KeyType, public tpm2.TPM2BPublic, private tpm2.TPM2BPrivate) error
	// ClearKey clears key data for the specified key type
	ClearKey(keyType KeyType) error
	// GetApplicationKey returns the AppKeyStoreData for a given application
	GetApplicationKey(string) (*AppKeyStoreData, error)
	// StoreApplicationKey stores the AppKeyStoreData for a given application
	StoreApplicationKey(string, AppKeyStoreData) error
	// ClearApplicationKey removes the stored info for the application
	ClearApplicationKey(string) error
	// ClearApplicationKeys removes all application keys
	ClearApplicationKeys() error
	// GetPassword retrieves the stored storage hierarchy password
	GetPassword() ([]byte, error)
	// StorePassword stores the storage hierarchy password
	StorePassword(password []byte) error
	// ClearPassword removes the stored password
	ClearPassword() error
	// Close closes the storage and releases any resources
	Close() error
}

type TCGCSRIDevID struct {
	// Version 1.0 = 0x01000100
	StructVer [4]byte `json:"-"`
	// Size of csrContents
	Contents [4]byte `json:"-"`
	// Size, in bytes, of signature
	SigSz [4]byte `json:"-"`
	// The actual content
	CSRContents IDevIDContent `json:"csrContents"`
	// DER encoded signature, including algorithm ID
	Signature []byte `json:"signature"`
}

type TCGCSRParser struct {
	// contains filtered or unexported fields
}

type TPMAttestationData struct {
	EKCertificate          []byte
	LAKPublicKey           []byte
	LAKCertifyInfo         []byte // (currently unused)
	LAKCertifySignature    []byte // (currently unused)
	LDevIDPublicKey        []byte
	LDevIDCertifyInfo      []byte
	LDevIDCertifySignature []byte
	ProductModel           string
	ProductSerial          string
	StandardCSR            []byte // Embedded standard X.509 CSR if available
}