SuavePlan/skills
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
main
skills/plugins/document-navigator/docs/security-stack/security/tpm-struct/README.md
admin 427a5bd919 updated skills
2026-06-09 21:06:27 +01:00

15 KiB
Raw Permalink Blame History

@suaveplan/tpm-struct - Zero-dep, universal TPM 2.0 attestation-structure parser/serialiser. Decodes TPMS_ATTEST (TCG Part 2 §10.12) and TPMT_PUBLIC (§12.2) byte strings, computes canonical TPM names (Part 1 §16), and underpins WebAuthn 'tpm'-format attestation verification.

Summary

Zero-runtime-dep TPM 2.0 attestation-structure parser and serialiser. Decodes TPMS_ATTEST (TCG TPM 2.0 Library Part 2 §10.12), decodes TPMT_PUBLIC (§12.2), and computes canonical TPM 2.0 name digests per TCG Part 1 §16. Underpins WebAuthn tpm-format attestation verification (W3C WebAuthn L3 §8.3) and every future TPM 2.0 attestation context (AIK enrollment, remote attestation, vTPM provisioning) without dragging in a TPM driver, Node-only runtime, or CommonJS legacy bridge.

The package is buffer-only: it neither imports a hash library nor talks to a TPM device. Callers inject HashLike for computeTpmtPublicName and ConstantTimeEqual for extraDataMatches, which keeps the package free of crypto-engine selection while making the right shape available at the WebAuthn step-5/step-8 call site.

Documentation tree

  • alg — (no submodules)
    • alg — (no submodules)
  • attest — (no submodules) - serialize — serializeTpmsAttest re-emits a parsed…
    • attest — (no submodules) - serialize — serializeTpmsAttest re-emits a parsed…
    • serialize — serializeTpmsAttest re-emits a parsed TpmsAttest value as the TCG-canonical byte string per Library Part 2 §10.12.…
  • buffer — (no submodules)
  • diagnostic — (no submodules)
  • errors — (no submodules)
  • extra-data — (no submodules)
  • name — (no submodules)
    • name — (no submodules)
  • observability — (no submodules)
  • public — (no submodules) - serialize — serializeTpmtPublic re-emits a parsed…
    • object-attributes — decodeObjectAttributes (and its inverse encodeObjectAttributes) walk the 32-bit TPMA_OBJECT bitfield documented i…
    • public — (no submodules) - serialize — serializeTpmtPublic re-emits a parsed…
    • serialize — serializeTpmtPublic re-emits a parsed TpmtPublic value as the TCG-canonical byte string per Library Part 2 §12.2. I…
  • schemas — (no submodules)
- [alg](./src/alg/alg.md) — _(no submodules)_- [attest](./src/attest/attest.md) — _(no submodules)_- serialize — `serializeTpmsAttest` re-emits a parsed…
  • attest — (no submodules)- serialize — serializeTpmsAttest re-emits a parsed…
  • serialize — serializeTpmsAttest re-emits a parsed TpmsAttest value as the TCG-canonical byte string per Library Part 2 §10.12.…
  • buffer — (no submodules)- buffer — (no submodules)- diagnostic — (no submodules)- diagnostic — (no submodules)- errors — (no submodules)- error-codes — (no submodules)- extra-data — (no submodules)- extra-data — (no submodules)- name — (no submodules)- name — (no submodules)- observability — (no submodules)- metrics — (no submodules)- public — (no submodules)- serialize — serializeTpmtPublic re-emits a parsed…
    • object-attributes — decodeObjectAttributes (and its inverse encodeObjectAttributes) walk the 32-bit TPMA_OBJECT bitfield documented i…
    • public — (no submodules)- serialize — serializeTpmtPublic re-emits a parsed…
    • serialize — serializeTpmtPublic re-emits a parsed TpmtPublic value as the TCG-canonical byte string per Library Part 2 §12.2. I…
  • schemas — (no submodules)- schemas — (no submodules)- alg — (no submodules)- attest — (no submodules)- serialize — serializeTpmsAttest re-emits a parsed…
    • attest — (no submodules)- serialize — serializeTpmsAttest re-emits a parsed…
    • serialize — serializeTpmsAttest re-emits a parsed TpmsAttest value as the TCG-canonical byte string per Library Part 2 §10.12.…
  • buffer — (no submodules)- buffer — (no submodules)- diagnostic — (no submodules)- diagnostic — (no submodules)- errors — (no submodules)- error-codes — (no submodules)- extra-data — (no submodules)- extra-data — (no submodules)- name — (no submodules)- name — (no submodules)- observability — (no submodules)- metrics — (no submodules)- public — (no submodules)- serialize — serializeTpmtPublic re-emits a parsed…
    • object-attributes — decodeObjectAttributes (and its inverse encodeObjectAttributes) walk the 32-bit TPMA_OBJECT bitfield documented i…
    • public — (no submodules)- serialize — serializeTpmtPublic re-emits a parsed…
    • serialize — serializeTpmtPublic re-emits a parsed TpmtPublic value as the TCG-canonical byte string per Library Part 2 §12.2. I…
  • schemas — (no submodules)- schemas — (no submodules)- alg — (no submodules)- attest — (no submodules)- serialize — serializeTpmsAttest re-emits a parsed…
    • attest — (no submodules)- serialize — serializeTpmsAttest re-emits a parsed…
    • serialize — serializeTpmsAttest re-emits a parsed TpmsAttest value as the TCG-canonical byte string per Library Part 2 §10.12.…
  • buffer — (no submodules)- buffer — (no submodules)- diagnostic — (no submodules)- diagnostic — (no submodules)- errors — (no submodules)- error-codes — (no submodules)- extra-data — (no submodules)- extra-data — (no submodules)- name — (no submodules)- name — (no submodules)- observability — (no submodules)- metrics — (no submodules)- public — (no submodules)- serialize — serializeTpmtPublic re-emits a parsed…
    • object-attributes — decodeObjectAttributes (and its inverse encodeObjectAttributes) walk the 32-bit TPMA_OBJECT bitfield documented i…
    • public — (no submodules)- serialize — serializeTpmtPublic re-emits a parsed…
    • serialize — serializeTpmtPublic re-emits a parsed TpmtPublic value as the TCG-canonical byte string per Library Part 2 §12.2. I…
  • schemas — (no submodules)- schemas — (no submodules)- alg — (no submodules)- attest — (no submodules) - attest — (no submodules) - serialize — serializeTpmsAttest re-emits a parsed TpmsAttest value as the TCG-canonical byte string per Library Part 2 §10.12.…
  • buffer — (no submodules) - buffer — (no submodules)- diagnostic — (no submodules) - diagnostic — (no submodules)- errors — (no submodules) - error-codes — (no submodules)- extra-data — (no submodules) - extra-data — (no submodules)- name — (no submodules) - name — (no submodules)- observability — (no submodules) - metrics — (no submodules)- public — (no submodules) - object-attributes — decodeObjectAttributes (and its inverse encodeObjectAttributes) walk the 32-bit TPMA_OBJECT bitfield documented i…
    • public — (no submodules) - serialize — serializeTpmtPublic re-emits a parsed TpmtPublic value as the TCG-canonical byte string per Library Part 2 §12.2. I…
  • schemas — (no submodules) - schemas — (no submodules)

Install

bun add @suaveplan/tpm-struct

Quick start

import { createHash } from "node:crypto";
import {
    parseTpmsAttest,
    parseTpmtPublic,
    computeTpmtPublicName,
    extraDataMatches,
} from "@suaveplan/tpm-struct";

const att = parseTpmsAttest(attestationData);          // TPMS_ATTEST
const pub = parseTpmtPublic(pubArea);                  // TPMT_PUBLIC
const name = computeTpmtPublicName(pub, {              // 0x000b || sha256(...)
    digest: (b) => new Uint8Array(createHash("sha256").update(b).digest()),
});

if (
    att.type === "TPM_ST_ATTEST_CERTIFY" &&
    extraDataMatches(att.attested.name, name, /* injected constantTimeEqual */ null!)
) {
    // pubArea is the public area the TPM certified.
}

Modules

Module Purpose
buffer TpmBufferReader / TpmBufferWriter over §10.1 octet streams.
alg TPM_ALG / TPM_ECC_CURVE frozen registries + symbolic lookup.
public/public parseTpmtPublic per §12.2.
public/serialize serializeTpmtPublic canonical encoder.
public/object-attributes TPMA_OBJECT bitfield decoder (§8.3).
attest/attest parseTpmsAttest per §10.12.
attest/serialize serializeTpmsAttest canonical encoder.
name/name computeTpmtPublicName per Part 1 §16.
extra-data/extra-data WebAuthn step-8 extraData match.
schemas/schemas Zod boundary schemas.
errors/error-codes TPM_STRUCT_CODES + TpmStructError.
observability/metrics OTel histograms + counters.
diagnostic/diagnostic Debug-only human-readable dumper.

Subpath exports

., ./buffer, ./alg, ./public, ./attest, ./name, ./extra-data, ./schemas, ./errors, ./diagnostic.

Dependencies

@suaveplan/error, @suaveplan/types, @opentelemetry/api, tslib, zod. No node:* imports; no external TPM tooling.

License

MIT.

Reference in New Issue View Git Blame Copy Permalink