NV read/write with owner or platform hierarchy authorization

.gitignore

@@ -103,6 +103,7 @@ examples/nvram/read
 examples/nvram/counter
 examples/nvram/policy_nv
 examples/nvram/seal_nv
+examples/nvram/nvauth
 examples/gpio/gpio_config
 examples/gpio/gpio_set
 examples/gpio/gpio_read

CMakeLists.txt

@@ -957,6 +957,7 @@ if (WOLFTPM_EXAMPLES AND BUILD_WOLFTPM_LIB)
     add_tpm_example(read nvram/read.c)
     add_tpm_example(store nvram/store.c)
     add_tpm_example(seal_nv nvram/seal_nv.c)
+    add_tpm_example(nvauth nvram/nvauth.c)
     add_tpm_example(extend pcr/extend.c)
     add_tpm_example(policy_sign pcr/policy_sign.c)
     add_tpm_example(policy pcr/policy.c)

examples/README.md

@@ -431,6 +431,18 @@ Extraction of key from NVRAM at index 0x1800202 succeeded
 
 After successful key extraction using "read", the NV Index is destroyed. Therefore, to use "read" again, the "store" example must be run again as well.
 
+### NV Index with Owner Authorization
+
+The `nvram/nvauth` example creates an NV Index that can be read without a password (`TPMA_NV_AUTHREAD` with an empty NV Index auth), while write and delete require the owner hierarchy authorization (`TPMA_NV_OWNERWRITE`). For an owner or platform authorized index set `nv.handle.hndl` to `TPM_RH_OWNER` or `TPM_RH_PLATFORM` and `nv.handle.auth` to that hierarchy auth after `wolfTPM2_NVOpen`, then use `wolfTPM2_NVWriteAuth` or `wolfTPM2_NVReadAuth`.
+
+With `-policy` the write uses `TPMA_NV_POLICYWRITE` with a PolicyCommandCode(NV_Write) + PolicySecret(owner) policy, satisfied by the caller and passed to `wolfTPM2_NVWriteAuthPolicy` with no PCR's.
+
+Deleting an NV Index (`TPM2_NV_UndefineSpace`) always requires the owner (or platform) auth. The owner auth can be changed with `TPM2_HierarchyChangeAuth` using only the current owner auth; the index is bound to the hierarchy, not its auth value, so it keeps working. `-rotate=<newpw>` demonstrates this and restores the original owner auth.
+
+```sh
+./examples/nvram/nvauth [-ownerauth=<pw>] [-rotate=<newpw>] [-policy] [-aes/-xor]
+```
+
 ## Seal / Unseal
 
 TPM 2.0 can protect secrets using a standard Seal/Unseal procedure. Seal can be created using a TPM 2.0 key or against a set of PCR values. Note: Secret data sealed in a key is limited to a maximum size of 128 bytes.

examples/nvram/include.am

@@ -39,6 +39,11 @@ examples_nvram_seal_nv_SOURCES      = examples/nvram/seal_nv.c \
                                       examples/tpm_test_keys.c
 examples_nvram_seal_nv_LDADD        = src/libwolftpm.la $(LIB_STATIC_ADD)
 examples_nvram_seal_nv_DEPENDENCIES = src/libwolftpm.la
+
+noinst_PROGRAMS += examples/nvram/nvauth
+examples_nvram_nvauth_SOURCES      = examples/nvram/nvauth.c
+examples_nvram_nvauth_LDADD        = src/libwolftpm.la $(LIB_STATIC_ADD)
+examples_nvram_nvauth_DEPENDENCIES = src/libwolftpm.la
 endif
 
 example_nvramdir = $(exampledir)/nvram
@@ -48,11 +53,13 @@ dist_example_nvram_DATA = \
   examples/nvram/counter.c \
   examples/nvram/policy_nv.c \
   examples/nvram/extend.c \
-  examples/nvram/seal_nv.c
+  examples/nvram/seal_nv.c \
+  examples/nvram/nvauth.c
 
 DISTCLEANFILES+= examples/nvram/.libs/store \
                  examples/nvram/.libs/read \
                  examples/nvram/.libs/counter \
                  examples/nvram/.libs/policy_nv \
                  examples/nvram/.libs/extend \
-                 examples/nvram/.libs/seal_nv
+                 examples/nvram/.libs/seal_nv \
+                 examples/nvram/.libs/nvauth