linux

type CryptoKey interface {
	// GetHandle returns the handle to the key in the TPM.
	GetHandle() tpmutil.Handle

	// GetLoadedHandle returns the handle to the key in the TPM when loaded.
	// This differs from GetHandle; GetHandle is for the persistent handle of
	// the key in the TPM, GetLoadedHandle is for the handle where the key may
	// actually be used and may be 0 if the key is not loaded for use.
	GetLoadedHandle() tpmutil.Handle

	// SetLoadedHandle provides a way to set the TPM handle the key is currently
	// loaded at. Set to 0 to indicate the key is not loaded.
	SetLoadedHandle(handle tpmutil.Handle)

	// Close empties a key's fields to make it invalid for future use.
	Close() error

	// IsEmpty determines if a TPMKey is empty (has no usable key data).
	// Currently this only means the public area is empty.
	IsEmpty() bool

	// GetECPublicKey extracts the ECC public key parameters from the key's
	// public area and returns it to you. If this is not an ECC key, this
	// will return an error.
	GetECPublicKey() (*utils.ECCPublicKey, error)

	// GetPublicArea returns the key's public area.
	GetPublicArea() tpm2.Public

	// GetPublicBytes returns the raw bytes of the key's public area.
	// This may return nil if an error occurs.
	GetPublicBytes() []byte

	// GetPrivateArea returns the key's private area. This is not guaranteed to
	// be available, in which case the returned tpm2.Private struct will be
	// empty.
	GetPrivateArea() tpm2.Private

	// GetPrivateBytes returns the raw bytes of the key's private area. This is
	// not guaranteed to be available.
	GetPrivateBytes() []byte

	// FillKeyData provides a way to fill in key data not directly filled in
	// when a key is generated.
	FillKeyData(publicBytes, privateBytes, creationData, keyName []byte) error
}

type Cryptoprocessor interface {
	// Initialize instantiates a new connection to the TPM.
	Initialize() error

	// CloseTPM shuts down a TPM session. This should always be called right
	// before the process exist. After calling `Close()`, calls to the TPM will
	// fail and you must fetch a new Cryptoprocessor instance.
	Close() error

	// GenKeyPair generates a key pair given a label and a tag. The public key
	// is returned as X and Y in ASN.1 DER format.
	GenKeyPair(keyID string) ([]byte, error)

	// GetSecureHardwareVendorData gets vendor specific information from the secure
	// hardware implementation available for a given device
	GetSecureHardwareVendorData() (*attest.SecureHardwareVendorData, error)

	// FindPubKey looks for a key with the specified label and tag and return
	// the public key, as X and Y in ASN.1 DER format.
	FindPubKey(keyID string) ([]byte, error)

	// DeleteKey deletes a key from TPM persistent storage
	DeleteKey(keyID string) error

	// SignWithKey gets the key with the specified keyID and tag and signs the
	// provided data with it. The caller is expected to have hashed the data
	// and pass the digest here. The signature is returned in ASN.1 DER format
	// with only the R and S values.
	SignWithKey(keyID string, digest []byte) ([]byte, error)

	// AttestKey performs a TPM 2.0 handshake and attests the provided TPM key
	AttestKey(keyID string, attestor attest.Attestor) (*attest.Resp, error)
}

type KeyHandler struct {
	// contains filtered or unexported fields
}