pub fn create_ak<IKC: IntoKeyCustomization>(
    context: &mut Context,
    parent: KeyHandle,
    hash_alg: HashingAlgorithm,
    sign_alg: SignatureSchemeAlgorithm,
    ak_auth_value: Option<&Auth>,
    key_customization: IKC,
) -> Result<CreateKeyResult> {
    let key_alg = AsymmetricAlgorithm::try_from(sign_alg).map_err(|e| {
        // sign_alg is either HMAC or Null.
        error!("Could not retrieve asymmetric algorithm for provided signature scheme");
        e
    })?;

    let ak_pub = create_ak_public(key_alg, hash_alg, sign_alg, key_customization)?;

    let policy_auth_session = context
        .start_auth_session(
            None,
            None,
            None,
            SessionType::Policy,
            Cipher::aes_128_cfb().try_into()?,
            HashingAlgorithm::Sha256,
        )?
        .ok_or_else(|| Error::local_error(WrapperErrorKind::WrongValueFromTpm))?;

    let (session_attributes, session_attributes_mask) = SessionAttributesBuilder::new()
        .with_decrypt(true)
        .with_encrypt(true)
        .build();
    context.tr_sess_set_attributes(
        policy_auth_session,
        session_attributes,
        session_attributes_mask,
    )?;

    context.execute_with_temporary_object(
        SessionHandle::from(policy_auth_session).into(),
        |ctx, _| {
            let _ = ctx.execute_with_nullauth_session(|ctx| {
                ctx.policy_secret(
                    PolicySession::try_from(policy_auth_session)?,
                    AuthHandle::Endorsement,
                    Default::default(),
                    Default::default(),
                    Default::default(),
                    None,
                )
            })?;

            ctx.execute_with_session(Some(policy_auth_session), |ctx| {
                ctx.create(parent, &ak_pub, ak_auth_value, None, None, None)
            })
        },
    )
}
/// This creates an Attestation Key in the Endorsement hierarchy
This creates an Attestation Key in the Endorsement hierarchy
This creates an Attestation Key in the Endorsement hierarchy
pub fn create_ak<IKC: IntoKeyCustomization>(
    context: &mut Context,
    parent: KeyHandle,
    hash_alg: HashingAlgorithm,
    sign_alg: SignatureSchemeAlgorithm,
    ak_auth_value: Option<&Auth>,
    key_customization: IKC,
) -> Result<CreateKeyResult> {
    let key_alg = AsymmetricAlgorithm::try_from(sign_alg).map_err(|e| {
        // sign_alg is either HMAC or Null.
        error!("Could not retrieve asymmetric algorithm for provided signature scheme");
        e
    })?;
    let ak_pub = create_ak_public(key_alg, hash_alg, sign_alg, key_customization)?;
    let policy_auth_session = context
        .start_auth_session(
            None,
            None,
            None,
            SessionType::Policy,
            Cipher::aes_128_cfb().try_into()?,
            HashingAlgorithm::Sha256,
        )?
        .ok_or_else(|| Error::local_error(WrapperErrorKind::WrongValueFromTpm))?;
    let (session_attributes, session_attributes_mask) = SessionAttributesBuilder::new()
        .with_decrypt(true)
        .with_encrypt(true)
        .build();
    context.tr_sess_set_attributes(
        policy_auth_session,
        session_attributes,
        session_attributes_mask,
    )?;
    context.execute_with_temporary_object(
        SessionHandle::from(policy_auth_session).into(),
        |ctx, _| {
            let _ = ctx.execute_with_nullauth_session(|ctx| {
                ctx.policy_secret(
                    PolicySession::try_from(policy_auth_session)?,
                    AuthHandle::Endorsement,
                    Default::default(),
                    Default::default(),
                    Default::default(),
                    None,
                )
            })?;
            ctx.execute_with_session(Some(policy_auth_session), |ctx| {
                ctx.create(parent, &ak_pub, ak_auth_value, None, None, None)
            })
        },
    )
}
pub fn create_ak < IKC : IntoKeyCustomization > ( context : & mut Context , parent : KeyHandle , hash_alg : HashingAlgorithm , sign_alg : SignatureSchemeAlgorithm , ak_auth_value : Option < & Auth > , key_customization : IKC , ) -> Result < CreateKeyResult > { let key_alg = AsymmetricAlgorithm :: try_from ( sign_alg ) . map_err ( | e | { // sign_alg is either HMAC or Null. error ! ( " " ) ; e } ) ? ; let ak_pub = create_ak_public ( key_alg , hash_alg , sign_alg , key_customization ) ? ; let policy_auth_session = context . start_auth_session ( None , None , None , SessionType :: Policy , Cipher :: aes_128_cfb ( ) . try_into ( ) ? , HashingAlgorithm :: Sha256 , ) ? . ok_or_else ( | | Error :: local_error ( WrapperErrorKind :: WrongValueFromTpm ) ) ? ; let ( session_attributes , session_attributes_mask ) = SessionAttributesBuilder :: new ( ) . with_decrypt ( true ) . with_encrypt ( true ) . build ( ) ; context . tr_sess_set_attributes ( policy_auth_session , session_attributes , session_attributes_mask , ) ? ; context . execute_with_temporary_object ( SessionHandle :: from ( policy_auth_session ) . into ( ) , | ctx , _ | { let _ = ctx . execute_with_nullauth_session ( | ctx | { ctx . policy_secret ( PolicySession :: try_from ( policy_auth_session ) ? , AuthHandle :: Endorsement , Default :: default ( ) , Default :: default ( ) , Default :: default ( ) , None , ) } ) ? ; ctx . execute_with_session ( Some ( policy_auth_session ) , | ctx | { ctx . create ( parent , & ak_pub , ak_auth_value , None , None , None ) } ) } , ) }
This creates an Attestation Key in the Endorsement hierarchy
This creates an Attestation Key in the Endorsement hierarchy
context
&mut Context
parent
KeyHandle
hash_alg
HashingAlgorithm
sign_alg
SignatureSchemeAlgorithm
ak_auth_value
Option<&Auth>
key_customization
IKC
context
&mut Context
parent
KeyHandle
hash_alg
HashingAlgorithm
sign_alg
SignatureSchemeAlgorithm
ak_auth_value
Option<&Auth>
key_customization
IKC