So, I am wanting to create a sealed and being able to unseal it with my python script that is on the ivy board down below is just internal testing on the ivy+ PN 01781000.
my current setup is on a docker container installed the necessary installments in the Dockerfile for TPM tpm2-tools, libtss2-dev.
docker compose.yml
devices:
- /dev/tpm0:/dev/tpm0
- /dev/tpmrm0:/dev/tpmrm0
volumes:
- /home/torizon/config/:/home/torizon/config/:rw
- /data/tpm:/data/tpm # make the TPM sealed files visible inside container
- /dev/tpm0:/dev/tpm0 # direct TPM access
- /dev/tpmrm0:/dev/tpmrm0 # resource manager
created the primary.ctx
everything is stored in this
/data/tpm folder
we create this seal.json
cat > seal.json << ‘EOF’
{
“parent”: “o”,
“public”: {
“type”: “seal”,
“nameAlg”: “sha256”,
“objectAttributes”: [
“fixedtpm”,
“fixedparent”,
“userwithauth”,
“noda”
]
}
}
EOF
tpm2_getrandom 32 > secret.bin
/*just to test to see if the secret.bin is created
python3 - << ‘EOF’
d = open(“secret.bin”,“rb”).read()
print(“Secret:”, d, “len:”, len(d))
EOF
tpm2_startauthsession --policy-session -S session.ctx
tpm2_policycommandcode -S session.ctx TPM2_CC_Unseal
tpm2_getpolicydigest -S session.ctx -o policy.dat
tpm2_flushcontext session.ctx
rm session.ctx
python3 - << ‘EOF’
d=open(“policy.dat”,“rb”).read()
print(“Policy digest:”, d.hex(), “len:”, len(d))
EOF
**tpm2_create
-C primary.ctx
–template-data=seal.json
-L policy.dat
-i secret.bin
-u seal.pub
-r seal.priv
tpm2_load
-C primary.ctx
-u seal.pub
-r seal.priv
-c seal.ctx**
#attempt to unseal
tpm2_startauthsession --policy-session -S session.ctx
tpm2_policycommandcode -S session.ctx TPM2_CC_Unseal
tpm2_unseal -c seal.ctx -p session:session.ctx | python3 - << ‘EOF’
import sys
d = sys.stdin.buffer.read()
print(“UNSEALED:”, d, “LEN:”, len(d))
EOF
result
UNSEALED: b’’ LEN: 0
if there are any documentation on this process out there, please point me in that direction
