wolfTPM

https://github.com/wolfssl/wolftpm
Admin
wolfTPM is a portable TPM 2.0 implementation designed for embedded systems that provides full TPM...
Tokens:81,725
Snippets:729
Trust Score:9.4
Update:4 months ago
Show doc for...
Tokens:
Raw
### Start swtpm and QEMU for Linux installation

Source: https://github.com/wolfssl/wolftpm/blob/master/docs/SWTPM.md

Commands to start swtpm with a Unix socket and then launch QEMU for installing a base Linux system.

```sh
# download mini install image
curl -O http://archive.ubuntu.com/ubuntu/dists/bionic-updates/main/installer-amd64/current/images/netboot/mini.iso
# create qemu image file
qemu-img create -f qcow2 lubuntu.qcow2 5G
# create directory for tpm state and socket
mkdir $PREFIX/mytpm
# start swtpm
$PREFIX/bin/swtpm socket --tpm2 --tpmstate dir=$PREFIX/mytpm \
  --ctrl type=unixio,path=$PREFIX/mytpm/swtpm-sock --log level=20 &
# start qemu for installation
qemu-system-x86_64 -m 1024 -boot d -bios bios-256k.bin -boot menu=on \
  -chardev socket,id=chrtpm,path=$PREFIX/mytpm/swtpm-sock \
  -tpmdev emulator,id=tpm0,chardev=chrtpm \
  -device tpm-tis,tpmdev=tpm0 -hda lubuntu.qcow2 -cdrom mini.iso
```

--------------------------------

### Start fwTPM Server

Source: https://github.com/wolfssl/wolftpm/blob/master/examples/pqc/README.md

Launch the `fwtpm_server` in the background, which is required for running the PQC examples.

```bash
./src/fwtpm/fwtpm_server --clear &
```

--------------------------------

### Run wolfTPM examples

Source: https://github.com/wolfssl/wolftpm/blob/master/docs/SWTPM.md

Commands to execute example utilities for wolfTPM, such as 'caps', 'extend', and 'wrap_test'.

```sh
./examples/wrap/caps
./examples/pcr/extend
./examples/wrap/wrap_test
```

--------------------------------

### Connect wolfTPM Clients to fwTPM Server

Source: https://github.com/wolfssl/wolftpm/blob/master/docs/FWTPM.md

Demonstrates starting the fwTPM server and then running wolfTPM example clients in separate terminals. Ensure clients are built with '--enable-swtpm'.

```sh
# In one terminal: start the server
./src/fwtpm/fwtpm_server

# In another terminal: run wolfTPM examples
./examples/wrap/wrap_test
./examples/keygen/keygen keyblob.bin -rsa -t
./examples/attestation/make_credential
```

--------------------------------

### Run TPM2 Capabilities Example

Source: https://github.com/wolfssl/wolftpm/blob/master/README.md

Execute the 'caps' example to retrieve TPM capabilities and search for persistent handles. This example demonstrates basic TPM interaction.

```bash
./examples/wrap/caps
```

```text
TPM2 Get Capabilities
wolfSSL Entering wolfCrypt_Init
Mfg NSG (0), Vendor NS350, Fw 30.30 (0x24042510), FIPS 140-2 1, CC-EAL4 0
Found 2 persistent handles
```

--------------------------------

### Start fwTPM Server with Default Ports

Source: https://github.com/wolfssl/wolftpm/blob/master/docs/FWTPM.md

Execute the fwTPM server binary to start it with the default command and platform ports.

```sh
./src/fwtpm/fwtpm_server
```

--------------------------------

### Add TPM Example

Source: https://github.com/wolfssl/wolftpm/blob/master/CMakeLists.txt

Adds a TPM example to the build if WOLFTPM_EXAMPLES and BUILD_WOLFTPM_LIB are enabled. This macro takes the example name and its source file path.

```cmake
if (WOLFTPM_EXAMPLES AND BUILD_WOLFTPM_LIB)
    add_tpm_example(activate_credential attestation/activate_credential.c)
    add_tpm_example(certify attestation/certify.c)
    add_tpm_example(make_credential attestation/make_credential.c)
    add_tpm_example(bench bench/bench.c)
    add_tpm_example(secret_seal boot/secret_seal.c)
    add_tpm_example(secret_unseal boot/secret_unseal.c)
    add_tpm_example(secure_rot boot/secure_rot.c)
    add_tpm_example(csr csr/csr.c)
    add_tpm_example(get_ek_certs endorsement/get_ek_certs.c)
    add_tpm_example(ifx_fw_update firmware/ifx_fw_update.c)
    add_tpm_example(gpio_config gpio/gpio_config.c)
    add_tpm_example(gpio_read gpio/gpio_read.c)
    add_tpm_example(gpio_set gpio/gpio_set.c)
    add_tpm_example(create_primary keygen/create_primary.c)
    add_tpm_example(external_import keygen/external_import.c)
    add_tpm_example(keygen keygen/keygen.c)
    add_tpm_example(keyimport keygen/keyimport.c)
    add_tpm_example(keyload keygen/keyload.c)
    add_tpm_example(flush management/flush.c)
    add_tpm_example(tpmclear management/tpmclear.c)
    add_tpm_example(native_test native/native_test.c)
    add_tpm_example(counter nvram/counter.c)
    add_tpm_example(nvextend nvram/extend.c)
    add_tpm_example(policy_nv nvram/policy_nv.c)
    add_tpm_example(read nvram/read.c)
    add_tpm_example(store nvram/store.c)
    add_tpm_example(seal_nv nvram/seal_nv.c)
    add_tpm_example(extend pcr/extend.c)
    add_tpm_example(policy_sign pcr/policy_sign.c)
    add_tpm_example(policy pcr/policy.c)
    add_tpm_example(quote pcr/quote.c)
    add_tpm_example(read_pcr pcr/read_pcr.c)
    add_tpm_example(reset pcr/reset.c)
    add_tpm_example(pkcs7 pkcs7/pkcs7.c)
    add_tpm_example(seal seal/seal.c)
    add_tpm_example(unseal seal/unseal.c)
    add_tpm_example(seal_pcr seal/seal_pcr.c)
    add_tpm_example(seal_policy_auth seal/seal_policy_auth.c)
    add_tpm_example(clock_set timestamp/clock_set.c)
    add_tpm_example(signed_timestamp timestamp/signed_timestamp.c)
    add_tpm_example(tls_client_notpm tls/tls_client_notpm.c)
    add_tpm_example(tls_client tls/tls_client.c)
    add_tpm_example(tls_server tls/tls_server.c)
    add_tpm_example(caps wrap/caps.c)
    add_tpm_example(wrap_test wrap/wrap_test.c)
endif()
```

--------------------------------

### Run wolfTPM Examples

Source: https://github.com/wolfssl/wolftpm/blob/master/src/fwtpm/README.md

Execute wolfTPM examples that utilize the built-in swtpm client to communicate with the fwTPM server using the mssim protocol.

```bash
./examples/wrap/caps
./examples/keygen/keygen
```

--------------------------------

### Activate Credential Example

Source: https://github.com/wolfssl/wolftpm/blob/master/examples/attestation/README.md

Demonstrates how a client can decrypt a remote attestation challenge using the activate_credential example. The secret is exposed in plain and can be exchanged with the attestation server.

```bash
$ ./examples/attestation/activate_credential
Using default values
Demo how to create a credential blob for remote attestation
wolfTPM2_Init: success
Credential will be read from cred.blob
Loading SRK: Storage 0x81000200 (282 bytes)
SRK loaded
Reading 508 bytes from keyblob.bin
Reading the private part of the key
AK loaded at 0x80000001
Read credential blob and secret from cred.blob, 648 bytes
TPM2_ActivateCredential success
```

--------------------------------

### Run `pqc_mssim_e2e` Example

Source: https://github.com/wolfssl/wolftpm/blob/master/examples/pqc/README.md

Execute the end-to-end client test for PQC over the mssim socket, covering ML-KEM encapsulation/decapsulation and ML-DSA signing/verification.

```bash
./examples/pqc/pqc_mssim_e2e
```

--------------------------------

### Install Header Files

Source: https://github.com/wolfssl/wolftpm/blob/master/CMakeLists.txt

Installs header files from both the binary and source directories into the include/wolftpm path. It uses 'FILES_MATCHING PATTERN "*.h"' to ensure only header files are copied.

```cmake
# Install the headers
install(DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}/wolftpm/
        DESTINATION include/wolftpm
        FILES_MATCHING PATTERN "*.h")
install(DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}/wolftpm/
        DESTINATION include/wolftpm
        FILES_MATCHING PATTERN "*.h")
```

--------------------------------

### Install WolfSSL config.h

Source: https://github.com/wolfssl/wolftpm/blob/master/IDE/Espressif/components/wolfssl/CMakeLists.txt

Copies and renames a dummy config.h file to the project's include directory if one doesn't exist.

```cmake
file(COPY   "${WOLFSSL_ROOT}/IDE/Espressif/ESP-IDF/dummy_config_h" DESTINATION "${WOLFSSL_PROJECT_DIR}/include/")
file(RENAME "${WOLFSSL_PROJECT_DIR}/include/dummy_config_h" "${WOLFSSL_PROJECT_DIR}/include/config.h")
```

--------------------------------

### Install fwtpm Server

Source: https://github.com/wolfssl/wolftpm/blob/master/CMakeLists.txt

Installs the fwtpm_server executable. This installation is conditional on the WOLFTPM_FWTPM flag.

```cmake
# Install fwTPM server
if(WOLFTPM_FWTPM)
    install(TARGETS fwtpm_server
            RUNTIME DESTINATION bin
            )
endif()
```

--------------------------------

### TPM TLS Server Example

Source: https://github.com/wolfssl/wolftpm/blob/master/README.md

This example demonstrates a TPM-integrated TLS server. It loads the TPM public key, and the crypto callback uses the TPM for private key signing.

```bash
./examples/tls/tls_server
TPM2 TLS Server Example
Loading RSA certificate and public key
Read (29): GET /index.html HTTP/1.0


Write (193): HTTP/1.1 200 OK
Content-Type: text/html
Connection: close

<html>
<head>
<title>Welcome to wolfSSL!</title>
</head>
<body>
<p>wolfSSL has successfully performed handshake!</p>
</body>
</html>
```

--------------------------------

### Build TPM Test Library for Examples

Source: https://github.com/wolfssl/wolftpm/blob/master/CMakeLists.txt

Adds a static library for TPM test keys used in examples. It links against the wolftpm library and its wolfSSL dependency.

```cmake
if (WOLFTPM_EXAMPLES AND BUILD_WOLFTPM_LIB)
    add_library(tpm_test_lib STATIC
        examples/tpm_test_keys.c
        )
    # wolftpm_wolfssl_dep is needed explicitly because wolftpm now links it
    # PRIVATE (so wolfSSL does not leak into wolftpm's installed export set).
    target_link_libraries(tpm_test_lib PRIVATE wolftpm wolftpm_wolfssl_dep)
endif()
```

--------------------------------

### Run `mlkem_encap` Example

Source: https://github.com/wolfssl/wolftpm/blob/master/examples/pqc/README.md

Perform an ML-KEM encapsulation and decapsulation round-trip. Supports different ML-KEM parameter sets.

```bash
./examples/pqc/mlkem_encap                # default: MLKEM-768
```

```bash
./examples/pqc/mlkem_encap -mlkem=512
```

```bash
./examples/pqc/mlkem_encap -mlkem=1024
```

--------------------------------

### Start QEMU with TPM device

Source: https://github.com/wolfssl/wolftpm/blob/master/examples/u-boot/README.md

Launch QEMU with the ARM64 virtual machine, connecting it to the swtpm simulator via a character device and a TPM device.

```bash
qemu-system-aarch64 -machine virt -nographic -cpu cortex-a57 -bios u-boot.bin -chardev socket,id=chrtpm,path=/tmp/mytpm1/swtpm-sock -tpmdev emulator,id=tpm0,chardev=chrtpm -device tpm-tis-device,tpmdev=tpm0
```

--------------------------------

### Start swtpm and QEMU for wolfTPM development

Source: https://github.com/wolfssl/wolftpm/blob/master/docs/SWTPM.md

Commands to restart swtpm and launch QEMU for building and running wolfSSL and wolfTPM within the QEMU instance.

```sh
# start swtpm again
$PREFIX/bin/swtpm socket --tpm2 --tpmstate dir=$PREFIX/mytpm \
  --ctrl type=unixio,path=$PREFIX/mytpm/swtpm-sock --log level=20 &
# start qemu system to install and run wolfTPM
qemu-system-x86_64 -m 1024 -boot d -bios bios-256k.bin -boot menu=on \
  -chardev socket,id=chrtpm,path=$PREFIX/mytpm/swtpm-sock \
  -tpmdev emulator,id=tpm0,chardev=chrtpm \
  -device tpm-tis,tpmdev=tpm0 -hda lubuntu.qcow2
```

--------------------------------

### Create Primary RSA Key Example (IAK)

Source: https://github.com/wolfssl/wolftpm/blob/master/examples/attestation/README.md

Generates an RSA Initial Device Identity (IDevID) key using the create_primary example. This key is created under the endorsement hierarchy.

```bash
% ./examples/keygen/create_primary -rsa -eh -iak -keep
TPM2.0 Primary Key generation example
        Algorithm: RSA
        Unique: IAK
        Store Handle: 0x00000000
        Use Parameter Encryption: NULL
Creating new RSA primary key...
Create Primary Handle: 0x80000000
```

--------------------------------

### Install build dependencies

Source: https://github.com/wolfssl/wolftpm/blob/master/README.md

Installs the necessary build tools, automake and libtool, required for the autogen.sh script.

```bash
sudo apt-get install automake libtool
```

--------------------------------

### Build and Get Help for Infineon Firmware Extraction Tool

Source: https://github.com/wolfssl/wolftpm/blob/master/examples/firmware/README.md

Build the `ifx_fw_extract` host tool using make and view its help message to understand usage.

```sh
# Build host tool
make

# Help
./ifx_fw_extract --help
```

--------------------------------

### Start swtpm simulator

Source: https://github.com/wolfssl/wolftpm/blob/master/examples/u-boot/README.md

Start the swtpm simulator using the socket interface. This command creates a Unix domain socket for communication with the TPM emulator.

```bash
swtpm socket --tpm2 --tpmstate dir=/tmp/mytpm1 --ctrl type=unixio,path=/tmp/mytpm1/swtpm-sock --log level=20
```

--------------------------------

### Basic CMake Project Setup

Source: https://github.com/wolfssl/wolftpm/blob/master/zephyr/samples/wolftpm_wrap_caps/CMakeLists.txt

Initializes the CMake build system for the Zephyr project, specifying the minimum required version and finding the Zephyr package.

```cmake
cmake_minimum_required(VERSION 3.13.1)
find_package(Zephyr REQUIRED HINTS $ENV{ZEPHYR_BASE})
project(wolftpm_wrap_caps)
```

--------------------------------

### Example TPM2 HAL IO Callback Function Definitions

Source: https://github.com/wolfssl/wolftpm/blob/master/hal/README.md

Provides example function definitions for the TPM2 HAL IO callback, adapting to the presence of the WOLFTPM_ADV_IO macro.

```c
#ifdef WOLFTPM_ADV_IO
int TPM2_IoCb(TPM2_CTX*, int isRead, word32 addr, byte* buf, word16 size,
    void* userCtx);
#else
int TPM2_IoCb(TPM2_CTX* ctx, const byte* txBuf, byte* rxBuf,
    word16 xferSz, void* userCtx);
#endif
```

--------------------------------

### ST33 Firmware Update Example

Source: https://github.com/wolfssl/wolftpm/blob/master/README.md

This example allows updating firmware on STMicro ST33 TPMs. It supports both legacy and modern firmware formats, auto-detecting based on the TPM's firmware version.

```bash
# Display firmware information
./examples/firmware/st33_fw_update

# Cancel any in-progress firmware update
./examples/firmware/st33_fw_update --abandon

# Perform firmware update (format auto-detected from TPM firmware version)
./examples/firmware/st33_fw_update <firmware.fi>
```

```text
ST33 Firmware Update Tool
Mfg STM  (2), Vendor ST33KTPM2X, Fw 9.512 (0x0)
Firmware version details: Major=9, Minor=512, Vendor=0x0
Hardware: ST33K (modern firmware, Generation 2)
Firmware update: LMS format required
```

--------------------------------

### TPM TLS Client Example

Source: https://github.com/wolfssl/wolftpm/blob/master/README.md

This example shows a TPM-integrated TLS client. It requires loading a public key for mutual authentication, and the crypto callback uses the TPM for private key signing.

```bash
./examples/tls/tls_client
TPM2 TLS Client Example
Write (29): GET /index.html HTTP/1.0


Read (193): HTTP/1.1 200 OK
Content-Type: text/html
Connection: close

<html>
<head>
<title>Welcome to wolfSSL!</title>
</head>
<body>
<p>wolfSSL has successfully performed handshake!</p>
</body>
</html>
```

--------------------------------

### Build wolfSSL and wolfTPM within QEMU

Source: https://github.com/wolfssl/wolftpm/blob/master/docs/SWTPM.md

Steps to install build tools, clone, and build wolfSSL with wolfTPM support and then build wolfTPM itself within the QEMU environment.

```sh
sudo apt install automake libtool gcc git make

# get and build wolfSSL
git clone https://github.com/wolfssl/wolfssl.git
pushd wolfssl
./autogen.sh && \
  ./configure --enable-wolftpm --disable-examples --prefix=$PWD/../inst && \
  make install
popd

# get and build wolfTPM
git clone https://github.com/wolfssl/wolftpm.git
pushd wolftpm
./autogen.sh && \
  ./configure --enable-devtpm --prefix=$PWD/../inst --enable-debug && \
  make install
sudo make check
popd
```

--------------------------------

### Create Primary RSA Key Example (IDevID)

Source: https://github.com/wolfssl/wolftpm/blob/master/examples/attestation/README.md

Generates an RSA Attestation Identity (IAK) key using the create_primary example. This key is created under the endorsement hierarchy.

```bash
% ./examples/keygen/create_primary -rsa -eh -idevid -keep
TPM2.0 Primary Key generation example
        Algorithm: RSA
        Unique: IDEVID
        Store Handle: 0x00000000
        Use Parameter Encryption: NULL
Creating new RSA primary key...
Create Primary Handle: 0x80000001
```

--------------------------------

### Build Host Client and Run Examples with SWTPM UART

Source: https://github.com/wolfssl/wolftpm/blob/master/docs/SWTPM.md

Build the host client with UART transport enabled and then run wolfTPM examples against an STM32 fwTPM. The TPM2_SWTPM_HOST environment variable is used to specify the serial device path.

```sh
# Build host client with UART transport
./configure --enable-swtpm=uart
make

# Run examples against STM32 fwTPM (adjust device path as needed)
export TPM2_SWTPM_HOST=/dev/ttyACM0
./examples/wrap/caps
./examples/keygen/keygen -ecc
./examples/seal/seal
```

--------------------------------

### Wrapper API Test

Source: https://github.com/wolfssl/wolftpm/blob/master/examples/README.md

Demonstrates calling the wolfTPM2_* wrapper API functions. This example is located at ./examples/wrap/wrap_test.

```bash
./examples/wrap/wrap_test
```

--------------------------------

### Configure and Build wolfSSL with wolfTPM

Source: https://github.com/wolfssl/wolftpm/blob/master/docs/README.md

Configure the wolfSSL build to include wolfTPM support, then build and install the library. Ensure wolfSSL is built before wolfTPM.

```sh
./configure --enable-wolftpm && make && sudo make install
```

--------------------------------

### Enable SPDM on TPM and Reset

Source: https://github.com/wolfssl/wolftpm/blob/master/examples/spdm/README.md

Perform a one-time setup to enable SPDM on the TPM. This command requires a subsequent TPM reset to apply the changes.

```bash
./examples/spdm/spdm_ctrl --enable
# Reset the TPM (see "TPM Reset Pin Control" below)
```

--------------------------------

### Porting Example: SPI Transport and Flash NV

Source: https://github.com/wolfssl/wolftpm/blob/master/docs/FWTPM.md

Example of porting fwTPM to a bare-metal embedded target using SPI for both transport and NV storage. It demonstrates initializing fwTPM, setting custom IO and NV HALs, and starting the server loop.

```c
FWTPM_CTX ctx;
FWTPM_Init(&ctx);

/* Set custom IO transport */
FWTPM_IO_HAL ioHal = {
    .send = spi_slave_send,
    .recv = spi_slave_recv,
    .wait = spi_slave_poll,
    .accept = NULL,         /* not connection-oriented */
    .close_conn = NULL,
    .ctx = &spiHandle
};
FWTPM_IO_SetHAL(&ctx, &ioHal);

/* Set custom NV storage */
FWTPM_NV_HAL nvHal = {
    .read = spi_flash_read,
    .write = spi_flash_write,
    .ctx = &flashHandle
};
FWTPM_NV_SetHAL(&ctx, &nvHal);

/* Initialize IO and run */
FWTPM_IO_Init(&ctx);
FWTPM_IO_ServerLoop(&ctx);  /* blocks */

FWTPM_IO_Cleanup(&ctx);
FWTPM_Cleanup(&ctx);
```

--------------------------------

### U-Boot TPM Get Capability Command

Source: https://github.com/wolfssl/wolftpm/blob/master/examples/u-boot/README.md

Read TPM capabilities using the get_capability command with specified parameters. This example demonstrates reading properties from the TPM.

```text
=> tpm2 get_capability 0x6 0x20e 0x200 1
Capabilities read from TPM:
Property 0x6a2e45a9: 0x6c3646a9
```

--------------------------------

### Retrieve EK Certificates

Source: https://github.com/wolfssl/wolftpm/blob/master/README.md

This example demonstrates how to retrieve EK certificates, validate them, and create a primary EK handle for signing. Refer to the `./examples/endorsement/get_ek_certs` directory for the full implementation.

```c
#include <wolfssl/wolfcrypt/tpm.h>
#include <stdio.h>

int main() {
    // Example usage of get_ek_certs function (implementation details omitted for brevity)
    // This function is intended to retrieve and validate EK certificates.
    printf("Example for retrieving EK certificates.\n");
    // ... actual implementation ...
    return 0;
}
```

--------------------------------

### Define TPM Example Executable Function

Source: https://github.com/wolfssl/wolftpm/blob/master/CMakeLists.txt

A CMake function to add TPM example executables. It takes an example name and source file, creates an executable, and links necessary libraries including wolftpm and its wolfSSL dependency.

```cmake
function(add_tpm_example name src)
    add_executable(${name}
        examples/${src}
        )
    target_link_libraries(${name} PRIVATE wolftpm tpm_test_lib wolftpm_wolfssl_dep)
    if(WIN32)
        target_link_libraries(${name} PRIVATE ws2_32)
    endif()
endfunction()
```

--------------------------------

### TPM PCR Reset

Source: https://github.com/wolfssl/wolftpm/blob/master/examples/README.md

Example for resetting a TPM PCR value. This is part of the PCR attestation examples.

```bash
./examples/pcr/reset
```

--------------------------------

### TPM PCR Extend

Source: https://github.com/wolfssl/wolftpm/blob/master/examples/README.md

Example for extending a TPM PCR value. This is part of the PCR attestation examples.

```bash
./examples/pcr/extend
```

--------------------------------

### Start fwTPM Server on Custom Ports

Source: https://github.com/wolfssl/wolftpm/blob/master/docs/FWTPM.md

Start the fwTPM server specifying custom ports for command and platform communication.

```sh
./src/fwtpm/fwtpm_server --port 2331 --platform-port 2332
```

--------------------------------

### Install wolftpm Library

Source: https://github.com/wolfssl/wolftpm/blob/master/CMakeLists.txt

Installs the wolftpm library target, including its library, archive, and runtime components. This snippet is conditional on the BUILD_WOLFTPM_LIB flag.

```cmake
include(GNUInstallDirs)

if(BUILD_WOLFTPM_LIB)
    # Note: wolftpm_wolfssl_dep is an INTERFACE helper used only at build
    # time to share wolfSSL include/link settings. It is intentionally NOT
    # installed/exported — downstream `find_package(wolftpm)` should only
    # see the real wolftpm target and discover wolfSSL via its own config.
    install(TARGETS wolftpm
            EXPORT  wolftpm-targets
            LIBRARY DESTINATION lib
            ARCHIVE DESTINATION lib
            RUNTIME DESTINATION bin
            )

    # Install the export set
    install(EXPORT wolftpm-targets
            DESTINATION ${CMAKE_INSTALL_LIBDIR}/cmake/wolftpm
            FILE wolftpm-config.cmake
            NAMESPACE wolfssl::)
endif()
```

--------------------------------

### Build wolfTPM for Infineon TPMs

Source: https://github.com/wolfssl/wolftpm/blob/master/README.md

Clone the wolfTPM repository, configure with Infineon support, and build. Use `--enable-infineon=slb9670` for SLB9670.

```bash
git clone https://github.com/wolfSSL/wolfTPM.git
cd wolfTPM
./autogen.sh
./configure --enable-infineon [--enable-i2c] 
make
```

--------------------------------

### NUnit Test Output Example

Source: https://github.com/wolfssl/wolftpm/blob/master/wrapper/CSharp/README.md

Example output from running NUnit tests for the wolfTPM CSharp wrapper, showing test execution status.

```text
Selected test(s): tpm_csharp_test.WolfTPMTest.TrySelfTest

wolfSSL Entering wolfCrypt_Init
.
Tests run: 1, Errors: 0, Failures: 0, Inconclusive: 0, Time: 0.1530346 seconds

  Not run: 0, Invalid: 0, Ignored: 0, Skipped: 0

wolfSSL Entering wolfCrypt_Cleanup
```

--------------------------------

### Fatal Error for Duplicate WolfSSL Installations

Source: https://github.com/wolfssl/wolftpm/blob/master/IDE/Espressif/components/wolfssl/CMakeLists.txt

This snippet triggers a fatal error if WolfSSL is found in both the local project and the IDF_PATH, enforcing a single installation.

```cmake
message(STATUS "")
message(STATUS "**************************************************************************************")
message(STATUS "")
message(STATUS "Error: Found components/wolfssl in both local project and IDF_PATH")
message(STATUS "")
message(STATUS "To proceed: ")
message(STATUS "")
message(STATUS "Remove either the local project component: ${WOLFSSL_PROJECT_DIR} ")
message(STATUS "or the Espressif shared component installed at: $ENV{IDF_PATH}/components/wolfssl/ ")
message(STATUS "")
message(STATUS "")
message(STATUS "**************************************************************************************")
message(STATUS "")

message(FATAL_ERROR "Please use wolfSSL in either local project or Espressif components, but not both.")
# Abort CMake after fatal error.
```

--------------------------------

### Flush RSA Key Example

Source: https://github.com/wolfssl/wolftpm/blob/master/examples/attestation/README.md

Frees TPM2.0 resources by flushing the specified key handles. This example demonstrates cleaning up primary keys after use.

```bash
% ./examples/management/flush 0x80000001
Preparing to free TPM2.0 Resources
Freeing 80000001 object

% ./examples/management/flush 0x80000000
Preparing to free TPM2.0 Resources
Freeing 80000000 object
```

--------------------------------

### Build ms-tpm-20-ref

Source: https://github.com/wolfssl/wolftpm/blob/master/docs/SWTPM.md

Steps to clone, configure, and build the ms-tpm-20-ref project.

```sh
git clone https://github.com/microsoft/ms-tpm-20-ref
cd ms-tpm-20-ref/TPMCmd
./bootstrap
./configure
make
```

--------------------------------

### Build wolfSSL in an alternate directory

Source: https://github.com/wolfssl/wolftpm/blob/master/README.md

Builds the wolfSSL library and installs it to a specified alternate directory. This is useful for managing multiple build configurations or custom installations.

```bash
# cd /your-wolfssl-repo
./autogen.h # as necessary
./configure --prefix=~/workspace/my_wolfssl_bin --enable-all
make install
```

--------------------------------

### Build wolfSSL with WolfTPM

Source: https://github.com/wolfssl/wolftpm/blob/master/README.md

Clone the wolfSSL repository, enable WolfTPM, build, and install the library. Ensure autogen.sh and configure scripts are run. This process requires automake and libtool.

```bash
git clone https://github.com/wolfSSL/wolfssl.git
cd wolfssl
./autogen.sh
./configure --enable-wolftpm
make
sudo make install
sudo ldconfig
```

--------------------------------

### Enable wolfTPM in U-Boot Configuration

Source: https://github.com/wolfssl/wolftpm/blob/master/examples/u-boot/README.md

Add these options to your board's defconfig file to enable wolfTPM support in U-Boot. Alternatively, use 'make menuconfig' to enable the corresponding options.

```bash
CONFIG_TPM=y
CONFIG_TPM_V2=y
CONFIG_TPM_WOLF=y
CONFIG_CMD_WOLFTPM=y
```

--------------------------------

### Build swtpm

Source: https://github.com/wolfssl/wolftpm/blob/master/examples/u-boot/README.md

Clone the swtpm repository and build the software TPM simulator. This is a prerequisite for running wolfTPM with U-Boot in QEMU.

```bash
git clone git@github.com:stefanberger/swtpm.git
cd swtpm
./autogen.sh
make
```

--------------------------------

### Build U-Boot

Source: https://github.com/wolfssl/wolftpm/blob/master/examples/u-boot/README.md

Clean the U-Boot build environment, set the cross-compiler and architecture, and then build U-Boot for the QEMU ARM64 target.

```bash
make distclean
export CROSS_COMPILE=aarch64-linux-gnu-
export ARCH=aarch64
make qemu_arm64_defconfig
make -j4
```

--------------------------------

### Build wolfTPM with PQC Support

Source: https://github.com/wolfssl/wolftpm/blob/master/examples/pqc/README.md

Configure and build the wolfTPM library, enabling TPM 2.0 v1.85 Post-Quantum support.

```bash
./configure --enable-fwtpm --enable-pqc
make
```

--------------------------------

### Build wolfTPM Wrap Capabilities Application

Source: https://github.com/wolfssl/wolftpm/blob/master/zephyr/README.md

Build the wolfTPM wrap capabilities application for a QEMU x86 target. This command assumes you are in the Zephyr project directory.

```bash
cd [zephyrproject]
west build -p auto -b qemu_x86 modules/lib/wolftpm/zephyr/samples/wolftpm_wrap_caps
```

--------------------------------

### Build wolfTPM Wrap Test Application

Source: https://github.com/wolfssl/wolftpm/blob/master/zephyr/README.md

Build the wolfTPM wrap test application for a QEMU x86 target. This command assumes you are in the Zephyr project directory.

```bash
cd [zephyrproject]
west build -p auto -b qemu_x86 modules/lib/wolftpm/zephyr/samples/wolftpm_wrap_test
```

--------------------------------

### Set wolftpm Root Directory Examples

Source: https://github.com/wolfssl/wolftpm/blob/master/IDE/Espressif/components/wolftpm/CMakeLists.txt

These examples show different ways to set the WOLFTPM_ROOT variable in the top-level project's CMakeLists.txt, including absolute paths with spaces and paths relative to the username.

```cmake
# set the root of wolftpm in top-level project CMakelists.txt:
#   set(WOLFTPM_ROOT  "C:/some path/with/spaces")
#   set(WOLFTPM_ROOT  "c:/workspace/wolftpm-[username]")
#   set(WOLFTPM_ROOT  "/mnt/c/some path/with/spaces")
```

--------------------------------

### Import RSA Private Key and Load

Source: https://github.com/wolfssl/wolftpm/blob/master/examples/README.md

Imports an RSA private key, saves it as a TPM key blob to a file, and then loads it back into the TPM.

```bash
$ ./examples/keygen/keyimport keyblob.bin -rsa
TPM2.0 Key import example
Loading SRK: Storage 0x81000200 (282 bytes)
Imported key (pub 278, priv 222 bytes)
Wrote 840 bytes to keyblob.bin

$ ./examples/keygen/keyload keyblob.bin
TPM2.0 Key load example
Loading SRK: Storage 0x81000200 (282 bytes)
Reading 840 bytes from keyblob.bin
Loaded key to 0x80000001
```

--------------------------------

### U-Boot TPM Startup Command

Source: https://github.com/wolfssl/wolftpm/blob/master/examples/u-boot/README.md

Issue a TPM2_Startup command to initialize the TPM. Use TPM2_SU_CLEAR for a reset or TPM2_SU_STATE for preserved state.

```text
=> tpm2 startup TPM2_SU_CLEAR
```

--------------------------------

### Get fwTPM Version String

Source: https://github.com/wolfssl/wolftpm/blob/master/docs/FWTPM.md

Returns the version string of the fwTPM.

```c
const char* FWTPM_GetVersionString(void)
```

--------------------------------

### Native API Test

Source: https://github.com/wolfssl/wolftpm/blob/master/examples/README.md

Demonstrates calling native TPM2_* API functions. This example is located at ./examples/native/native_test.

```bash
./examples/native/native_test
```

--------------------------------

### Run fwTPM Server

Source: https://github.com/wolfssl/wolftpm/blob/master/src/fwtpm/README.md

Start the fwTPM server, which listens on localhost ports 2321 (command) and 2322 (platform).

```bash
# Listens on localhost:2321 (cmd) and :2322 (platform)
src/fwtpm/fwtpm_server

# Optionally start with clear NV
src/fwtpm/fwtpm_server --clear
```

--------------------------------

### SWTPM Configuration for Mac OS X

Source: https://github.com/wolfssl/wolftpm/blob/master/docs/SWTPM.md

Environment variables and package installations required for swtpm on Mac OS X.

```sh
brew install openssl socat
pip3 install cryptography

export LDFLAGS="-L/usr/local/opt/openssl@1.1/lib"
export CPPFLAGS="-I/usr/local/opt/openssl@1.1/include"

# libtpms had to use --prefix=/usr/local
```

--------------------------------

### Run `mldsa_sign` Example

Source: https://github.com/wolfssl/wolftpm/blob/master/examples/pqc/README.md

Execute a pure ML-DSA sign and verify round-trip. Supports different ML-DSA parameter sets and uses sequence operations for signing and verification.

```bash
./examples/pqc/mldsa_sign                 # default: MLDSA-65
```

```bash
./examples/pqc/mldsa_sign -mldsa=44
```

```bash
./examples/pqc/mldsa_sign -mldsa=87
```
Tokens:
Raw