#!/bin/bash

source common.sh

#   Create a signing authority
openssl genrsa -out signing_key_private.pem 2048
openssl rsa -in signing_key_private.pem -out signing_key_public.pem -pubout
tpm2_loadexternal -G rsa -a o -u signing_key_public.pem -o signing_key.ctx \
	-n signing_key.name

echo "Signing authority created"

#   Create a policy to be authorized like a pcr policy:
tpm2_pcrlist -L $PCRS -o pcrs.sha256
tpm2_startauthsession -S session.ctx
tpm2_policypcr -S session.ctx -L $PCRS -F pcrs.sha256 -f pcr.policy
tpm2_flushcontext -S session.ctx
rm -f session.ctx

echo "pcr policy created"

#   Sign the policy
openssl dgst -sha256 -sign signing_key_private.pem -out pcr.signature pcr.policy

echo "policy is signed"

#   Authorize the policy in the policy digest:
tpm2_startauthsession -S session.ctx
tpm2_policyauthorize -S session.ctx -o authorized.policy -f pcr.policy \
	-n signing_key.name
tpm2_flushcontext -S session.ctx
rm -f session.ctx

echo "policy authorized"

#   Create a TPM object like a sealing object with the authorized policy
#   based authentication:
echo "secret to seal 123" > secret_file
tpm2_createprimary -Q -a o -g sha256 -G rsa -o prim.ctx
tpm2_create -Q -g sha256 -u sealing_pubkey.pub -r sealing_prikey.pub \
	-I secret_file -C prim.ctx -L authorized.policy

echo "sealing object created"

#   Satisfy policy and unseal the secret:
tpm2_verifysignature -c signing_key.ctx -G sha256 -m pcr.policy \
	-s pcr.signature -t verification.tkt -f rsassa
tpm2_startauthsession -a -S session.ctx
tpm2_policypcr -Q -S session.ctx -L $PCRS -f pcr.policy
tpm2_policyauthorize -S session.ctx -o authorized.policy -f pcr.policy \
	-n signing_key.name -t verification.tkt
tpm2_load -Q -C prim.ctx -u sealing_pubkey.pub -r sealing_prikey.pub \
	-o sealing_key.ctx
tpm2_unseal -p "session:session.ctx" -c sealing_key.ctx -o unsealed
cat unsealed
tpm2_flushcontext -S session.ctx
rm -f session.ctx unsealed

echo "the end"