node-tpm2 0.0.4-beta.3 → 0.0.5-beta.0

package/api.js

@@ -66,6 +66,46 @@ export class TpmError extends Error {
   }
 }
 
+function parseTpmHandle(handle) {
+  if (typeof handle === 'number') {
+    return `0x${handle.toString(16).padStart(8, '0')}`;
+  }
+  return handle;
+}
+
+function createKeyHandle(publicKeyDer, keyBlob) {
+  return {
+    export() {
+      return {
+        public: Buffer.from(keyBlob.public),
+        private: Buffer.from(keyBlob.private),
+      };
+    },
+
+    get publicKeyDer() {
+      return Buffer.from(publicKeyDer);
+    },
+
+    sign: wrapNative(async (digest) => {
+      requireNative('signKeyBlob');
+      const sig = await native.signKeyBlob({
+        keyBlob,
+        digest,
+      });
+      return Buffer.from(sig);
+    }),
+
+    decrypt: wrapNative(async (cipher) => {
+      requireNative('decryptKeyBlob');
+      const plain = await native.decryptKeyBlob({
+        keyBlob,
+        cipher,
+      });
+      return Buffer.from(plain);
+    }),
+  };
+}
+
 function createAkHandle(akPublicDer, akBlob) {
   return {
     /** Wrapped TPM2B_PUBLIC + TPM2B_PRIVATE for persistence (no persistent TPM handle). */
@@ -114,6 +154,102 @@ function createTpmHandle() {
         requireNative('pcrRead');
         return native.pcrRead(selection, bank);
       }),
+
+      /** Extend a PCR digest in the SHA-256 bank. */
+      extend: wrapNative(async (index, digest) => {
+        requireNative('pcrExtend');
+        await native.pcrExtend(index, digest);
+      }),
+    },
+
+    random: {
+      /** Read `count` bytes from the TPM RNG (GetRandom). */
+      bytes: wrapNative(async (count) => {
+        requireNative('randomBytes');
+        const buf = await native.randomBytes(count);
+        return Buffer.from(buf);
+      }),
+    },
+
+    nv: {
+      readPublic: wrapNative(async (handle) => {
+        requireNative('nvReadPublic');
+        return native.nvReadPublic(parseTpmHandle(handle));
+      }),
+
+      read: wrapNative(async (handle, offset, size, auth) => {
+        requireNative('nvRead');
+        const buf = await native.nvRead(
+          parseTpmHandle(handle),
+          offset ?? undefined,
+          size ?? undefined,
+          auth ?? undefined,
+        );
+        return Buffer.from(buf);
+      }),
+
+      write: wrapNative(async (handle, data, offset, auth) => {
+        requireNative('nvWrite');
+        await native.nvWrite({
+          handle: parseTpmHandle(handle),
+          data,
+          offset: offset ?? undefined,
+          auth: auth ?? undefined,
+        });
+      }),
+
+      define: wrapNative(async (opts) => {
+        requireNative('nvDefine');
+        await native.nvDefine({
+          handle: parseTpmHandle(opts.handle),
+          size: opts.size,
+          auth: opts.auth ?? undefined,
+          ownerAuth: opts.ownerAuth ?? undefined,
+        });
+      }),
+
+      undefine: wrapNative(async (handle, ownerAuth) => {
+        requireNative('nvUndefine');
+        await native.nvUndefine({
+          handle: parseTpmHandle(handle),
+          ownerAuth: ownerAuth ?? undefined,
+        });
+      }),
+    },
+
+    keys: {
+      create: wrapNative(async (opts) => {
+        requireNative('createKey');
+        const result = await native.createKey({
+          keyType: opts?.type,
+          sign: opts?.sign,
+          decrypt: opts?.decrypt,
+        });
+        return createKeyHandle(result.publicKeyDer, result.keyBlob);
+      }),
+
+      load: wrapNative(async (blob) => {
+        requireNative('keyBlobPublicDer');
+        const publicKeyDer = await native.keyBlobPublicDer(blob);
+        return createKeyHandle(publicKeyDer, blob);
+      }),
+    },
+
+    seal: {
+      seal: wrapNative(async (opts) => {
+        requireNative('seal');
+        const buf = await native.seal({
+          data: opts.data,
+          pcrSelection: opts.pcrSelection,
+        });
+        return Buffer.from(buf);
+      }),
+
+      unseal: wrapNative(async (blob) => {
+        requireNative('unseal');
+        const plain = await native.unseal(blob);
+        return Buffer.from(plain);
+      }),
     },
 
     attest: {
@@ -202,12 +338,25 @@ export const Tpm = {
     return this.getFixedProperties();
   },
 
+  /** Flat: TPM RNG bytes (GetRandom). Prefer `tpm.random.bytes` on an open handle. */
+  randomBytes: wrapNative(async (count) => {
+    requireNative('randomBytes');
+    const buf = await native.randomBytes(count);
+    return Buffer.from(buf);
+  }),
+
   /** Flat native binding: PCR read. Prefer `tpm.pcr.read` on an open handle. */
   pcrRead: wrapNative(async (selection, bank) => {
     requireNative('pcrRead');
     return native.pcrRead(selection, bank);
   }),
 
+  /** Flat native binding: PCR extend. Prefer `tpm.pcr.extend` on an open handle. */
+  pcrExtend: wrapNative(async (index, digest) => {
+    requireNative('pcrExtend');
+    await native.pcrExtend(index, digest);
+  }),
+
   /** Flat native binding: ReadPublic. */
   readPublic: wrapNative(async (handle) => {
     requireNative('readPublic');
@@ -245,4 +394,88 @@ export const Tpm = {
     requireNative('activateCredential');
     return native.activateCredential(opts);
   }),
+
+  createKey: wrapNative(async (opts) => {
+    requireNative('createKey');
+    const result = await native.createKey({
+      keyType: opts?.type,
+      sign: opts?.sign,
+      decrypt: opts?.decrypt,
+    });
+    return {
+      publicKeyDer: result.publicKeyDer,
+      keyBlob: result.keyBlob,
+    };
+  }),
+
+  signKeyBlob: wrapNative(async (opts) => {
+    requireNative('signKeyBlob');
+    const sig = await native.signKeyBlob(opts);
+    return Buffer.from(sig);
+  }),
+
+  decryptKeyBlob: wrapNative(async (opts) => {
+    requireNative('decryptKeyBlob');
+    const plain = await native.decryptKeyBlob(opts);
+    return Buffer.from(plain);
+  }),
+
+  nvRead: wrapNative(async (handle, offset, size, auth) => {
+    requireNative('nvRead');
+    const buf = await native.nvRead(
+      parseTpmHandle(handle),
+      offset ?? undefined,
+      size ?? undefined,
+      auth ?? undefined,
+    );
+    return Buffer.from(buf);
+  }),
+
+  nvWrite: wrapNative(async (handle, data, offset, auth) => {
+    requireNative('nvWrite');
+    await native.nvWrite({
+      handle: parseTpmHandle(handle),
+      data,
+      offset: offset ?? undefined,
+      auth: auth ?? undefined,
+    });
+  }),
+
+  nvReadPublic: wrapNative(async (handle) => {
+    requireNative('nvReadPublic');
+    return native.nvReadPublic(parseTpmHandle(handle));
+  }),
+
+  nvDefine: wrapNative(async (opts) => {
+    requireNative('nvDefine');
+    await native.nvDefine({
+      handle: parseTpmHandle(opts.handle),
+      size: opts.size,
+      auth: opts.auth ?? undefined,
+      ownerAuth: opts.ownerAuth ?? undefined,
+    });
+  }),
+
+  nvUndefine: wrapNative(async (handle, ownerAuth) => {
+    requireNative('nvUndefine');
+    await native.nvUndefine({
+      handle: parseTpmHandle(handle),
+      ownerAuth: ownerAuth ?? undefined,
+    });
+  }),
+
+  seal: wrapNative(async (opts) => {
+    requireNative('seal');
+    const buf = await native.seal({
+      data: opts.data,
+      pcrSelection: opts.pcrSelection,
+    });
+    return Buffer.from(buf);
+  }),
+
+  unseal: wrapNative(async (blob) => {
+    requireNative('unseal');
+    const plain = await native.unseal(blob);
+    return Buffer.from(plain);
+  }),
 };