24 changed files with 7304 additions and 254 deletions
--- a/.gitignore
+++ b/.gitignore
@ -1 +1,5 @@
-SOURCES/ibmtss1331.tar.gz
+/ibmtss713withman.tar
 /ibmtss1027.tar.gz
 /makeman.sh
 /ibmtss1331.tar.gz
 /ibmtss1.6.0.tar.gz
--- a/.tss2.metadata
+++ b/.tss2.metadata
@ -1 +0,0 @@
 39a13864ad42cafae27683fa52bc1d5d21dad39c SOURCES/ibmtss1331.tar.gz
--- a/0001-tss-Add-missing-parameter-union-members.patch
+++ b/0001-tss-Add-missing-parameter-union-members.patch
@ -0,0 +1,37 @@
 From 8e8c6777847825c5067b171c2e4ac8b33fe0d6bc Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?=C5=A0t=C4=9Bp=C3=A1n=20Hor=C3=A1=C4=8Dek?=
 <shoracek@redhat.com>
 Date: Sun, 1 May 2022 19:33:02 +0200
 Subject: [PATCH 1/4] tss: Add missing parameter union members
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 Signed-off-by: Štěpán Horáček <shoracek@redhat.com>
 ---
 utils/ibmtss/Parameters.h | 2 ++
 1 file changed, 2 insertions(+)
 diff --git a/utils/ibmtss/Parameters.h b/utils/ibmtss/Parameters.h
 index 98a04ff..5b6c29a 100644
 --- a/utils/ibmtss/Parameters.h
 +++ b/utils/ibmtss/Parameters.h
@@ -182,6 +182,7 @@
 typedef union {
     ActivateCredential_In         ActivateCredential;
     CertifyCreation_In            CertifyCreation;
 +    CertifyX509_In                CertifyX509;
     Certify_In                    Certify;
     ChangeEPS_In                  ChangeEPS;
     ChangePPS_In                  ChangePPS;
@@ -313,6 +314,7 @@ typedef union
 {
     ActivateCredential_Out         ActivateCredential;
     CertifyCreation_Out            CertifyCreation;
 +    CertifyX509_Out                CertifyX509;
     Certify_Out                    Certify;
     Commit_Out                     Commit;
     ContextLoad_Out                ContextLoad;
 -- 
 2.34.3
--- a/0001-utils-Generate-X509-certificate-serial-number-using-.patch
+++ b/0001-utils-Generate-X509-certificate-serial-number-using-.patch
@ -0,0 +1,62 @@
 From e0c1e3efd187a3cfa77906eef978fa6beada0b31 Mon Sep 17 00:00:00 2001
 From: Ken Goldman <kgoldman@us.ibm.com>
 Date: Thu, 1 Jul 2021 13:55:28 -0400
 Subject: [PATCH] utils: Generate X509 certificate serial number using sha256
 This is just a test certificate, not a real CA.  Certificate serial
 numbers can be 20 octets maximum.  Use a truncated sha256 because some
 'lint' programs are now scanning for sha1.
 Signed-off-by: Ken Goldman <kgoldman@us.ibm.com>
 ---
 utils/ekutils.c | 18 ++++++++++++++----
 1 file changed, 14 insertions(+), 4 deletions(-)
 diff --git a/utils/ekutils.c b/utils/ekutils.c
 index a0a2734..aad6fba 100644
 --- a/utils/ekutils.c
 +++ b/utils/ekutils.c
@@ -61,6 +61,7 @@
 #include <openssl/pem.h>
 #include <openssl/x509.h>
 +#include <openssl/evp.h>
 #include <ibmtss/tssresponsecode.h>
 #include <ibmtss/tssutils.h>
@@ -1835,7 +1836,7 @@ TPM_RC startCertificate(X509 *x509Certificate,	/* X509 certificate to be generat
     ASN1_TIME 		*arc;			/* return code */
     ASN1_INTEGER 	*x509Serial;		/* certificate serial number in ASN1 */
     BIGNUM 		*x509SerialBN;		/* certificate serial number as a BIGNUM */
 -    unsigned char 	x509Serialbin[SHA1_DIGEST_SIZE]; /* certificate serial number in binary */
 +    unsigned char 	x509Serialbin[EVP_MAX_MD_SIZE]; /* certificate serial number in binary */
     X509_NAME 		*x509IssuerName;	/* composite issuer name, key/value pairs */
     X509_NAME 		*x509SubjectName;	/* composite subject name, key/value pairs */
@@ -1855,11 +1856,20 @@ TPM_RC startCertificate(X509 *x509Certificate,	/* X509 certificate to be generat
       add certificate serial number
     */
     if (rc == 0) {
 +	const EVP_MD *type;
 +
 	if (tssUtilsVerbose) printf("startCertificate: Adding certificate serial number\n");
 	/* to create a unique serial number, hash the key to be certified */
 -	SHA1(keyBuffer, keyLength, x509Serialbin);
 -	/* convert the SHA1 digest to a BIGNUM */
 -	x509SerialBN = BN_bin2bn(x509Serialbin, SHA1_DIGEST_SIZE, x509SerialBN);
 +	type = EVP_sha256();
 +	irc = EVP_Digest(keyBuffer, keyLength, x509Serialbin, NULL, type, NULL);
 +	if (irc == 0) {
 +	    printf("startCertificate: Error in serial number EVP_Digest\n");
 +	    rc = TSS_RC_X509_ERROR;
 +	}
 +    }
 +    if (rc == 0) {
 +	/* convert the digest to a BIGNUM, use 20 octets */
 +	x509SerialBN = BN_bin2bn(x509Serialbin, 20, x509SerialBN);
 	if (x509SerialBN == NULL) {
 	    printf("startCertificate: Error in serial number BN_bin2bn\n");
 	    rc = TSS_RC_X509_ERROR;
 -- 
 2.34.1
--- a/0001-utils-Update-certifyx509-for-Openssl-3.0.0.patch
+++ b/0001-utils-Update-certifyx509-for-Openssl-3.0.0.patch
--- a/0002-regtest-Update-to-SHA-256-without-restricting-the-sc.patch
+++ b/0002-regtest-Update-to-SHA-256-without-restricting-the-sc.patch
@ -0,0 +1,600 @@
 From 3e4c744cf09d43aba0ae9381c1527263e39a7c70 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?=C5=A0t=C4=9Bp=C3=A1n=20Hor=C3=A1=C4=8Dek?=
 <shoracek@redhat.com>
 Date: Mon, 18 Apr 2022 23:51:02 +0200
 Subject: [PATCH 2/4] regtest: Update to SHA-256 without restricting the scope
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 Signed-off-by: Å tÄ›pÃ¡n HorÃ¡Ä<C2A1>ek <shoracek@redhat.com>
 Signed-off-by: Ken Goldman <kgold@linux.ibm.com>
 ---
 utils/policies/policycountertimer.bin | Bin 20 -> 32 bytes
 utils/policies/policycphash.bin       | Bin 20 -> 32 bytes
 utils/policies/policycphash.txt       |   2 +-
 utils/policies/policycphashhash.bin   |   2 +-
 utils/policies/policynvargs.txt       | Bin 13 -> 12 bytes
 utils/policies/policynvnv.bin         | Bin 20 -> 32 bytes
 utils/policies/policynvnv.txt         |   2 +-
 utils/policies/policypcr.bin          |   2 +-
 utils/policies/policypcr0.txt         |   2 +-
 utils/policies/policypcrbm0.bin       | Bin 20 -> 32 bytes
 utils/policies/policywrittenset.bin   |   2 +-
 utils/reg.sh                          |   2 +
 utils/regtests/testchangeauth.sh      |   4 +-
 utils/regtests/testevict.sh           |  12 ++--
 utils/regtests/testnv.sh              |   6 +-
 utils/regtests/testpolicy.sh          |  80 +++++++++++++-------------
 utils/regtests/testrsa.sh             |   8 +--
 utils/regtests/testsign.sh            |  12 ++--
 18 files changed, 69 insertions(+), 67 deletions(-)
 diff --git a/utils/policies/policycountertimer.bin b/utils/policies/policycountertimer.bin
 index f767440113ab39251794257628b34f761ae05121..8937a155bdcdc535e5f013a03ce58fd5a193a6fd 100644
 GIT binary patch
 literal 32
 ocmeBTv0vY?A&j>pRZ{#s$085m*E`r54EYbFMa|K0nsfat0L0V`*#H0l
 literal 20
 ccmaFX(x@JK!18iNvf_!!0jhUbsX5I80B48^c>n+a
 diff --git a/utils/policies/policycphash.bin b/utils/policies/policycphash.bin
 index 1c357a65cc7cf408bc27d0a2a5c6a0735778e5ed..0f998b85ac2b6620049e350b0c31cc38b2f7414a 100644
 GIT binary patch
 literal 32
 qcmV+*0N?)`MNQmb<N(X@{1co_-#=a<IaKWOQl0d(fR)m3=&W@Mq7i=p
 literal 20
 ccmZR3lJoQPaee~<iJE0anHyTR1PSH?0A-{JC;$Ke
 diff --git a/utils/policies/policycphash.txt b/utils/policies/policycphash.txt
 index 52edeab..bc06262 100644
 --- a/utils/policies/policycphash.txt
 +++ b/utils/policies/policycphash.txt
@@ -1 +1 @@
 -0000016eb5f919bbc01f0ebad02010169a67a8c158ec12f3
 +0000016e58f8c9f3300b71c97c7c6ec3e18afba176e3f582d96ab67df29acb559fc7d34f
 diff --git a/utils/policies/policycphashhash.bin b/utils/policies/policycphashhash.bin
 index a30627d..e88c974 100644
 --- a/utils/policies/policycphashhash.bin
 +++ b/utils/policies/policycphashhash.bin
@@ -1 +1 @@
 -µù»ÀºÐ šg¨ÁXìó
 \ No newline at end of file
 +XøÉó0qÉ||nÃáŠû¡vãõ‚Ùj¶}òšËUŸÇÓO
 \ No newline at end of file
 diff --git a/utils/policies/policynvargs.txt b/utils/policies/policynvargs.txt
 index 4f4d97c4a15e2f16ef61e8b3d31182382bc88b6d..ce58bc9f84b9623e708de4eb8427a57d9f9a160f 100644
 GIT binary patch
 literal 12
 KcmZQzKmY&$3;+QD
 literal 13
 LcmZQzKmaZP02crY
 diff --git a/utils/policies/policynvnv.bin b/utils/policies/policynvnv.bin
 index df080a73e76146d5474cc3d1b2ed1e09fad62e3d..bb54d249107c9ff17a8af7141d491f6bec88b001 100644
 GIT binary patch
 literal 32
 qcmV+*0N?+4*1${A{L{NkNx*#e^i_%2jn+j)Ac{3i{<g<lL9fU}!V=B^
 literal 20
 ccmdlp+sD6}Ax$z`_U4>Pb!)?)%V_-p09oM)7XSbN
 diff --git a/utils/policies/policynvnv.txt b/utils/policies/policynvnv.txt
 index a124ea9..5d3d62e 100644
 --- a/utils/policies/policynvnv.txt
 +++ b/utils/policies/policynvnv.txt
@@ -1 +1 @@
 -000001492c513f149e737ec4063fc1d37aee9beabc4b4bbf00042234b8df7cdf8605ee0a2088ac7dfe34c6566c5c
 \ No newline at end of file
 +0000014915ec7bf0b50732b49f8228e07d24365338f9e3ab994b00af08e5a3bffe55fd8b000b45a8f4283309cd5ef189746d7526786f712eb3df9960508ee343d3e63376bc6c
 \ No newline at end of file
 diff --git a/utils/policies/policypcr.bin b/utils/policies/policypcr.bin
 index 8f69740..2597338 100644
 --- a/utils/policies/policypcr.bin
 +++ b/utils/policies/policypcr.bin
@@ -1 +1 @@
 -…3ƒõè<`C4oŸ7!vŽ
 \ No newline at end of file
 +¿òÕŽ˜ù|ïÁOr<72>3¼p’ÖR·Èw•’T¯„6
 \ No newline at end of file
 diff --git a/utils/policies/policypcr0.txt b/utils/policies/policypcr0.txt
 index b61f288..cd09bbf 100644
 --- a/utils/policies/policypcr0.txt
 +++ b/utils/policies/policypcr0.txt
@@ -1 +1 @@
 -0000000000000000000000000000000000000000
 \ No newline at end of file
 +0000000000000000000000000000000000000000000000000000000000000000
 diff --git a/utils/policies/policypcrbm0.bin b/utils/policies/policypcrbm0.bin
 index bd0f292e05dc793b2831fec273c2eefa7b3a9672..666ea3c731d2f46d4d94768cab4464ff0bb0e5af 100644
 GIT binary patch
 literal 32
 ocmb>Z5cE02?1^I8ss%e3mgaqqyRPviCuhr<=Bo*jp4^KQ0V0YJ<^TWy
 literal 20
 bcmd0`@U(b%wL7eEQs@+Ww#>9`zjTxVT?`1l
 diff --git a/utils/policies/policywrittenset.bin b/utils/policies/policywrittenset.bin
 index 4f6bb8c..4ed9066 100644
 --- a/utils/policies/policywrittenset.bin
 +++ b/utils/policies/policywrittenset.bin
@@ -1 +1 @@
 -0sHß_ëíe”æý¬„"ã	
 \ No newline at end of file
 +÷ˆ}ŠèÓ‹à¬Sózža‹õH…E<zTÝ°Æ¦;ë
 \ No newline at end of file
 diff --git a/utils/reg.sh b/utils/reg.sh
 index 048863b..2d9d100 100755
 --- a/utils/reg.sh
 +++ b/utils/reg.sh
@@ -72,6 +72,8 @@ PREFIX=./
 # hash algorithms to be used for testing
 export ITERATE_ALGS="sha1 sha256 sha384 sha512"
 +export ITERATE_ALGS_SIZES="20 32 48 64"
 +export ITERATE_ALGS_COUNT=4
 export BAD_ITERATE_ALGS="sha256 sha384 sha512 sha1"
 printUsage ()
 diff --git a/utils/regtests/testchangeauth.sh b/utils/regtests/testchangeauth.sh
 index 303b318..b830a96 100755
 --- a/utils/regtests/testchangeauth.sh
 +++ b/utils/regtests/testchangeauth.sh
@@ -67,11 +67,11 @@ do
 	checkSuccess $?
 	echo "Sign a digest with the original key ${SESS}"
 -	${PREFIX}sign -hk 80000001 -halg sha1 -if policies/aaa -os sig.bin -pwdk sig ${SESS} > run.out
 +	${PREFIX}sign -hk 80000001 -halg sha256 -if policies/aaa -os sig.bin -pwdk sig ${SESS} > run.out
 	checkSuccess $?
 	echo "Sign a digest with the changed key"
 -	${PREFIX}sign -hk 80000002 -halg sha1 -if policies/aaa -os sig.bin -pwdk xxx > run.out
 +	${PREFIX}sign -hk 80000002 -halg sha256 -if policies/aaa -os sig.bin -pwdk xxx > run.out
 	checkSuccess $?
 	echo "Flush the key"
 diff --git a/utils/regtests/testevict.sh b/utils/regtests/testevict.sh
 index 761eaa8..8f2806f 100755
 --- a/utils/regtests/testevict.sh
 +++ b/utils/regtests/testevict.sh
@@ -58,11 +58,11 @@ ${PREFIX}evictcontrol -ho 80000001 -hp 81800000 -hi p > run.out
 checkSuccess $?
 echo "Sign a digest with the transient key"
 -${PREFIX}sign -hk 80000001 -halg sha1 -if policies/aaa -os sig.bin -pwdk sig > run.out
 +${PREFIX}sign -hk 80000001 -halg sha256 -if policies/aaa -os sig.bin -pwdk sig > run.out
 checkSuccess $?
 echo "Sign a digest with the persistent key"
 -${PREFIX}sign -hk 81800000 -halg sha1 -if policies/aaa -os sig.bin -pwdk sig > run.out
 +${PREFIX}sign -hk 81800000 -halg sha256 -if policies/aaa -os sig.bin -pwdk sig > run.out
 checkSuccess $?
 echo "Flush the transient key"
@@ -74,11 +74,11 @@ ${PREFIX}flushcontext -ha 81800000 > run.out
 checkFailure $?
 echo "Sign a digest with the transient key- should fail"
 -${PREFIX}sign -hk 80000001 -halg sha1 -if policies/aaa -os sig.bin -pwdk sig > run.out
 +${PREFIX}sign -hk 80000001 -halg sha256 -if policies/aaa -os sig.bin -pwdk sig > run.out
 checkFailure $?
 echo "Sign a digest with the persistent key"
 -${PREFIX}sign -hk 81800000 -halg sha1 -if policies/aaa -os sig.bin -pwdk sig > run.out
 +${PREFIX}sign -hk 81800000 -halg sha256 -if policies/aaa -os sig.bin -pwdk sig > run.out
 checkSuccess $?
 echo "Flush the persistent key"
@@ -86,11 +86,11 @@ ${PREFIX}evictcontrol -ho 81800000 -hp 81800000 -hi p > run.out
 checkSuccess $?
 echo "Sign a digest with the persistent key - should fail"
 -${PREFIX}sign -hk 81800000 -halg sha1 -if policies/aaa -os sig.bin -pwdk sig > run.out
 +${PREFIX}sign -hk 81800000 -halg sha256 -if policies/aaa -os sig.bin -pwdk sig > run.out
 checkFailure $?
 echo "Sign a digest with the transient key - should fail"
 -${PREFIX}sign -hk 80000001 -halg sha1 -if policies/aaa -os sig.bin -pwdk sig > run.out
 +${PREFIX}sign -hk 80000001 -halg sha256 -if policies/aaa -os sig.bin -pwdk sig > run.out
 checkFailure $?
 # ${PREFIX}getcapability  -cap 1 -pr 80000000
 diff --git a/utils/regtests/testnv.sh b/utils/regtests/testnv.sh
 index b941f2e..39a9a18 100755
 --- a/utils/regtests/testnv.sh
 +++ b/utils/regtests/testnv.sh
@@ -56,7 +56,7 @@ checkSuccess $?
 NALG=(${ITERATE_ALGS})
 BADNALG=(${BAD_ITERATE_ALGS})
 -for ((i = 0 ; i < 4; i++))
 +for ((i = 0 ; i < ${ITERATE_ALGS_COUNT}; i++))
 do
     for SESS in "" "-se0 02000000 1"
@@ -212,10 +212,10 @@ checkSuccess $?
 for SESS in "" "-se0 02000000 1"
 do
 -    SZ=(20 32 48 64)
 +    SZ=(${ITERATE_ALGS_SIZES})
     HALG=(${ITERATE_ALGS})
 -    for ((i = 0 ; i < 4; i++))
 +    for ((i = 0 ; i < ${ITERATE_ALGS_COUNT}; i++))
     do
 	echo "NV Define Space ${HALG[$i]}"
 diff --git a/utils/regtests/testpolicy.sh b/utils/regtests/testpolicy.sh
 index e2e8bec..971e67f 100755
 --- a/utils/regtests/testpolicy.sh
 +++ b/utils/regtests/testpolicy.sh
@@ -752,17 +752,17 @@ echo "Policy PCR no select"
 echo ""
 # create AND term for policy PCR
 -# > policymakerpcr -halg sha1 -bm 0 -v -pr -of policies/policypcr.txt
 +# > policymakerpcr -halg sha256 -bm 0 -v -pr -of policies/policypcr.txt
 # 0000017f00000001000403000000da39a3ee5e6b4b0d3255bfef95601890afd80709
 # convert to binary policy
 -# > policymaker -halg sha1 -if policies/policypcr.txt -of policies/policypcrbm0.bin -pr -v
 +# > policymaker -halg sha256 -if policies/policypcr.txt -of policies/policypcrbm0.bin -pr -v
 # 6d 38 49 38 e1 d5 8b 56 71 92 55 94 3f 06 69 66 
 # b6 fa 2c 23 
 echo "Create a signing key with policy PCR no select"
 -${PREFIX}create -hp 80000000 -si -kt f -kt p -opr tmppriv.bin -opu tmppub.bin -pwdp sto -pwdk sig -nalg sha1 -pol policies/policypcrbm0.bin > run.out
 +${PREFIX}create -hp 80000000 -si -kt f -kt p -opr tmppriv.bin -opu tmppub.bin -pwdp sto -pwdk sig -nalg sha256 -pol policies/policypcrbm0.bin > run.out
 checkSuccess $?
 echo "Load the signing key under the primary key"
@@ -770,11 +770,11 @@ ${PREFIX}load -hp 80000000 -ipr tmppriv.bin -ipu tmppub.bin -pwdp sto > run.out
 checkSuccess $?
 echo "Start a policy session"
 -${PREFIX}startauthsession -halg sha1 -se p > run.out
 +${PREFIX}startauthsession -halg sha256 -se p > run.out
 checkSuccess $?
 echo "Policy PCR, update with the correct digest"
 -${PREFIX}policypcr -ha 03000000 -halg sha1 -bm 0 > run.out
 +${PREFIX}policypcr -ha 03000000 -halg sha256 -bm 0 > run.out
 checkSuccess $?
 echo "Policy get digest - should be 6d 38 49 38 ... "
@@ -790,11 +790,11 @@ ${PREFIX}policyrestart -ha 03000000 > run.out
 checkSuccess $?
 echo "Policy PCR, update with the correct digest"
 -${PREFIX}policypcr -ha 03000000 -halg sha1 -bm 0 > run.out
 +${PREFIX}policypcr -ha 03000000 -halg sha256 -bm 0 > run.out
 checkSuccess $?
 echo "PCR extend PCR 0, updates pcr counter"
 -${PREFIX}pcrextend -ha 0 -halg sha1 -if policies/aaa > run.out
 +${PREFIX}pcrextend -ha 0 -halg sha256 -if policies/aaa > run.out
 checkSuccess $?
 echo "Sign, should fail"
@@ -816,17 +816,17 @@ echo ""
 # policypcr0.txt has 20 * 00
 # create AND term for policy PCR
 -# > policymakerpcr -halg sha1 -bm 010000 -if policies/policypcr0.txt -v -pr -of policies/policypcr.txt
 +# > policymakerpcr -halg sha256 -bm 010000 -if policies/policypcr0.txt -v -pr -of policies/policypcr.txt
 # 0000017f000000010004030000016768033e216468247bd031a0a2d9876d79818f8f
 # convert to binary policy
 -# > policymaker -halg sha1 -if policies/policypcr.txt -of policies/policypcr.bin -pr -v
 +# > policymaker -halg sha256 -if policies/policypcr.txt -of policies/policypcr.bin -pr -v
 # 85 33 11 83 19 03 12 f5 e8 3c 60 43 34 6f 9f 37
 # 21 04 76 8e
 echo "Create a signing key with policy PCR PCR 16 zero"
 -${PREFIX}create -hp 80000000 -si -kt f -kt p -opr tmppriv.bin -opu tmppub.bin -pwdp sto -pwdk sig -nalg sha1 -pol policies/policypcr.bin > run.out
 +${PREFIX}create -hp 80000000 -si -kt f -kt p -opr tmppriv.bin -opu tmppub.bin -pwdp sto -pwdk sig -nalg sha256 -pol policies/policypcr.bin > run.out
 checkSuccess $?
 echo "Load the signing key under the primary key"
@@ -838,11 +838,11 @@ ${PREFIX}pcrreset -ha 16 > run.out
 checkSuccess $?
 echo "Read PCR 16, should be 00 00 00 00 ..."
 -${PREFIX}pcrread -ha 16 -halg sha1 > run.out
 +${PREFIX}pcrread -ha 16 -halg sha256 > run.out
 checkSuccess $?
 echo "Start a policy session"
 -${PREFIX}startauthsession -se p -halg sha1 > run.out
 +${PREFIX}startauthsession -se p -halg sha256 > run.out
 checkSuccess $?
 echo "Sign, policy not satisfied - should fail"
@@ -850,7 +850,7 @@ ${PREFIX}sign -hk 80000001 -if msg.bin -os sig.bin -se0 03000000 0 > run.out
 checkFailure $?
 echo "Policy PCR, update with the correct digest"
 -${PREFIX}policypcr -ha 03000000 -halg sha1 -bm 10000 > run.out
 +${PREFIX}policypcr -ha 03000000 -halg sha256 -bm 10000 > run.out
 checkSuccess $?
 echo "Policy get digest - should be 85 33 11 83 ..."
@@ -862,19 +862,19 @@ ${PREFIX}sign -hk 80000001 -if msg.bin -os sig.bin -se0 03000000 0 > run.out
 checkSuccess $?
 echo "PCR extend PCR 16"
 -${PREFIX}pcrextend -ha 16 -halg sha1 -if policies/aaa > run.out
 +${PREFIX}pcrextend -ha 16 -halg sha256 -if policies/aaa > run.out
 checkSuccess $?
 echo "Read PCR 0, should be 1d 47 f6 8a ..."
 -${PREFIX}pcrread -ha 16 -halg sha1 > run.out
 +${PREFIX}pcrread -ha 16 -halg sha256 > run.out
 checkSuccess $?
 echo "Start a policy session"
 -${PREFIX}startauthsession -se p -halg sha1 > run.out
 +${PREFIX}startauthsession -se p -halg sha256 > run.out
 checkSuccess $?
 echo "Policy PCR, update with the wrong digest"
 -${PREFIX}policypcr -ha 03000000 -halg sha1 -bm 10000 > run.out
 +${PREFIX}policypcr -ha 03000000 -halg sha256 -bm 10000 > run.out
 checkSuccess $?
 echo "Policy get digest - should be 66 dd e5 e3"
@@ -903,21 +903,21 @@ checkSuccess $?
 #
 # policynvargs.txt (binary)
 # args = hash of 0000 0000 0000 0000 | 0000 | 0000 (eight bytes of zero | offset | op ==)
 -# hash -hi n -halg sha1 -if policies/policynvargs.txt -v
 -# openssl dgst -sha1 policies/policynvargs.txt
 +# hash -hi n -halg sha256 -if policies/policynvargs.txt -v
 +# openssl dgst -sha256 policies/policynvargs.txt
 # 2c513f149e737ec4063fc1d37aee9beabc4b4bbf
 #
 # NV authorizing index
 #
 # after defining index and NV write to set written, use 
 -# ${PREFIX}nvreadpublic -ha 01000000 -nalg sha1
 +# ${PREFIX}nvreadpublic -ha 01000000 -nalg sha256
 # to get name
 # 00042234b8df7cdf8605ee0a2088ac7dfe34c6566c5c
 #
 # append Name to policynvnv.txt
 #
 # convert to binary policy
 -# > policymaker -halg sha1 -if policies/policynvnv.txt -of policies/policynvnv.bin -pr -v
 +# > policymaker -halg sha256 -if policies/policynvnv.txt -of policies/policynvnv.bin -pr -v
 # bc 9b 4c 4f 7b 00 66 19 5b 1d d9 9c 92 7e ad 57 e7 1c 2a fc 
 #
 # file zero8.bin has 8 bytes of hex zero
@@ -927,11 +927,11 @@ echo "Policy NV, NV index authorizing"
 echo ""
 echo "Define a setbits index, authorizing index"
 -${PREFIX}nvdefinespace -hi p -nalg sha1 -ha 01000000 -pwdn nnn -ty b > run.out
 +${PREFIX}nvdefinespace -hi p -nalg sha256 -ha 01000000 -pwdn nnn -ty b > run.out
 checkSuccess $?
 echo "NV Read public, get Name, not written"
 -${PREFIX}nvreadpublic -ha 01000000 -nalg sha1 > run.out
 +${PREFIX}nvreadpublic -ha 01000000 -nalg sha256 > run.out
 checkSuccess $?
 echo "NV setbits to set written"
@@ -939,7 +939,7 @@ ${PREFIX}nvsetbits -ha 01000000 -pwdn nnn > run.out
 checkSuccess $?
 echo "NV Read public, get Name, written"
 -${PREFIX}nvreadpublic -ha 01000000 -nalg sha1 > run.out
 +${PREFIX}nvreadpublic -ha 01000000 -nalg sha256 > run.out
 checkSuccess $?
 echo "NV Read, should be zero"
@@ -947,11 +947,11 @@ ${PREFIX}nvread -ha 01000000 -pwdn nnn -sz 8 > run.out
 checkSuccess $?
 echo "Define an ordinary index, authorized index, policyNV"
 -${PREFIX}nvdefinespace -hi p -nalg sha1 -ha 01000001 -pwdn nnn -sz 2 -ty o -pol policies/policynvnv.bin > run.out
 +${PREFIX}nvdefinespace -hi p -nalg sha256 -ha 01000001 -pwdn nnn -sz 2 -ty o -pol policies/policynvnv.bin > run.out
 checkSuccess $?
 echo "NV Read public, get Name, not written"
 -${PREFIX}nvreadpublic -ha 01000001 -nalg sha1 > run.out
 +${PREFIX}nvreadpublic -ha 01000001 -nalg sha256 > run.out
 checkSuccess $?
 echo "NV write to set written"
@@ -959,7 +959,7 @@ ${PREFIX}nvwrite -ha 01000001 -pwdn nnn -ic aa > run.out
 checkSuccess $?
 echo "Start policy session"
 -${PREFIX}startauthsession -se p -halg sha1 > run.out
 +${PREFIX}startauthsession -se p -halg sha256 > run.out
 checkSuccess $?
 echo "NV write, policy not satisfied  - should fail"
@@ -1015,15 +1015,15 @@ echo "Policy NV Written"
 echo ""
 echo "Define an ordinary index, authorized index, policyNV"
 -${PREFIX}nvdefinespace -hi p -nalg sha1 -ha 01000000 -pwdn nnn -sz 2 -ty o -pol policies/policywrittenset.bin > run.out  
 +${PREFIX}nvdefinespace -hi p -nalg sha256 -ha 01000000 -pwdn nnn -sz 2 -ty o -pol policies/policywrittenset.bin > run.out
 checkSuccess $?
 echo "NV Read public, get Name, not written"
 -${PREFIX}nvreadpublic -ha 01000000 -nalg sha1 > run.out  
 +${PREFIX}nvreadpublic -ha 01000000 -nalg sha256 > run.out
 checkSuccess $?
 echo "Start policy session"
 -${PREFIX}startauthsession -se p -halg sha1 > run.out
 +${PREFIX}startauthsession -se p -halg sha256 > run.out
 checkSuccess $?
 echo "NV write, policy not satisfied  - should fail"
@@ -1043,7 +1043,7 @@ ${PREFIX}flushcontext -ha 03000000 > run.out
 checkSuccess $?
 echo "Start policy session"
 -${PREFIX}startauthsession -se p -halg sha1 > run.out
 +${PREFIX}startauthsession -se p -halg sha256 > run.out
 checkSuccess $?
 echo "Policy NV Written yes, satisfy policy"
@@ -1063,7 +1063,7 @@ ${PREFIX}nvwrite -ha 01000000 -ic aa -pwdn nnn > run.out
 checkSuccess $?
 echo "Start policy session"
 -${PREFIX}startauthsession -se p -halg sha1 > run.out
 +${PREFIX}startauthsession -se p -halg sha256 > run.out
 checkSuccess $?
 echo "Policy NV Written yes, satisfy policy"
@@ -1079,7 +1079,7 @@ ${PREFIX}flushcontext -ha 03000000 > run.out
 checkSuccess $?
 echo "Start policy session"
 -${PREFIX}startauthsession -se p -halg sha1 > run.out
 +${PREFIX}startauthsession -se p -halg sha256 > run.out
 checkSuccess $?
 echo "Policy NV Written no"
@@ -1326,12 +1326,12 @@ checkSuccess $?
 # test using clockrateadjust
 # policycphashhash.txt is (hex) 00000130 4000000c 000
 -# hash -if policycphashhash.txt -oh policycphashhash.bin -halg sha1 -v
 -# openssl dgst -sha1 policycphashhash.txt
 +# hash -if policycphashhash.txt -oh policycphashhash.bin -halg sha256 -v
 +# openssl dgst -sha256 policycphashhash.txt
 # cpHash is
 # b5f919bbc01f0ebad02010169a67a8c158ec12f3
 # append to policycphash.txt 00000163 + cpHash
 -# policymaker -halg sha1 -if policies/policycphash.txt -of policies/policycphash.bin -pr
 +# policymaker -halg sha256 -if policies/policycphash.txt -of policies/policycphash.bin -pr
 #  06 e4 6c f9 f3 c7 0f 30 10 18 7c a6 72 69 b0 84 b4 52 11 6f 
 echo ""
@@ -1339,7 +1339,7 @@ echo "Policy cpHash"
 echo ""
 echo "Set the platform policy to policy cpHash"
 -${PREFIX}setprimarypolicy -hi p -pol policies/policycphash.bin -halg sha1 > run.out
 +${PREFIX}setprimarypolicy -hi p -pol policies/policycphash.bin -halg sha256 > run.out
 checkSuccess $?
 echo "Clockrate adjust using wrong password - should fail"
@@ -1347,7 +1347,7 @@ ${PREFIX}clockrateadjust -hi p -pwdp ppp -adj 0 > run.out
 checkFailure $?
 echo "Start policy session"
 -${PREFIX}startauthsession -se p -halg sha1 > run.out 
 +${PREFIX}startauthsession -se p -halg sha256 > run.out
 checkSuccess $?
 echo "Clockrate adjust, policy not satisfied - should fail"
@@ -1690,7 +1690,7 @@ echo "Policy Counter Timer"
 echo ""
 echo "Set the platform policy to policy "
 -${PREFIX}setprimarypolicy -hi p -pol policies/policycountertimer.bin -halg sha1 > run.out
 +${PREFIX}setprimarypolicy -hi p -pol policies/policycountertimer.bin -halg sha256 > run.out
 checkSuccess $?
 echo "Clockrate adjust using wrong password - should fail"
@@ -1698,7 +1698,7 @@ ${PREFIX}clockrateadjust -hi p -pwdp ppp -adj 0 > run.out
 checkFailure $?
 echo "Start policy session"
 -${PREFIX}startauthsession -se p -halg sha1 > run.out
 +${PREFIX}startauthsession -se p -halg sha256 > run.out
 checkSuccess $?
 echo "Clockrate adjust, policy not satisfied - should fail"
 diff --git a/utils/regtests/testrsa.sh b/utils/regtests/testrsa.sh
 index 4f76522..6e25398 100755
 --- a/utils/regtests/testrsa.sh
 +++ b/utils/regtests/testrsa.sh
@@ -131,10 +131,10 @@ do
     ${PREFIX}load -hp 80000000 -ipu derrsa${BITS}pub.bin -ipr derrsa${BITS}priv.bin -pwdp sto > run.out
     checkSuccess $?
 +    HSIZ=(${ITERATE_ALGS_SIZES})
     HALG=(${ITERATE_ALGS})
 -    HSIZ=("20" "32" "48" "64")
 -    for ((i = 0 ; i < 4 ; i++))
 +    for ((i = 0 ; i < ${ITERATE_ALGS_COUNT} ; i++))
     do
 	echo "Decrypt/Sign with a caller specified OID - ${HALG[i]}"
@@ -298,7 +298,7 @@ echo "Encrypt with OpenSSL OAEP, decrypt with TPM"
 echo ""
 echo "Create OAEP encryption key"
 -${PREFIX}create -hp 80000000 -pwdp sto -deo -kt f -kt p -halg sha1 -opr tmpprivkey.bin -opu tmppubkey.bin -opem tmppubkey.pem > run.out	
 +${PREFIX}create -hp 80000000 -pwdp sto -deo -kt f -kt p -halg sha256 -opr tmpprivkey.bin -opu tmppubkey.bin -opem tmppubkey.pem > run.out
 checkSuccess $?
 echo "Load encryption key at 80000001"
@@ -306,7 +306,7 @@ ${PREFIX}load -hp 80000000 -pwdp sto -ipr tmpprivkey.bin -ipu tmppubkey.bin  > r
 checkSuccess $?
 echo "Encrypt using OpenSSL and the PEM public key"
 -openssl rsautl -oaep -encrypt -inkey tmppubkey.pem -pubin -in policies/aaa -out enc.bin > run.out 2>&1
 +openssl pkeyutl -encrypt -inkey tmppubkey.pem -pubin -pkeyopt rsa_padding_mode:oaep -pkeyopt rsa_oaep_md:sha256 -in policies/aaa -out enc.bin > run.out 2>&1
 checkSuccess $?
 echo "Decrypt using TPM key at 80000001"
 diff --git a/utils/regtests/testsign.sh b/utils/regtests/testsign.sh
 index edfa014..8a99bbf 100755
 --- a/utils/regtests/testsign.sh
 +++ b/utils/regtests/testsign.sh
@@ -302,14 +302,14 @@ echo ""
 # > openssl dgst -sha1 -sign rsaprivkey.pem -passin pass:rrrr -out pssig.bin msg.bin
 echo "Load external just the public part of PEM RSA"
 -${PREFIX}loadexternal -halg sha1 -nalg sha1 -ipem policies/rsapubkey.pem > run.out
 +${PREFIX}loadexternal -halg sha256 -nalg sha256 -ipem policies/rsapubkey.pem > run.out
 checkSuccess $?
 echo "Sign a test message with openssl RSA"
 -openssl dgst -sha1 -sign policies/rsaprivkey.pem -passin pass:rrrr -out pssig.bin msg.bin > run.out 2>&1
 +openssl dgst -sha256 -sign policies/rsaprivkey.pem -passin pass:rrrr -out pssig.bin msg.bin > run.out 2>&1
 echo "Verify the RSA signature"
 -${PREFIX}verifysignature -hk 80000001 -halg sha1 -if msg.bin -is pssig.bin -raw > run.out
 +${PREFIX}verifysignature -hk 80000001 -halg sha256 -if msg.bin -is pssig.bin -raw > run.out
 checkSuccess $?
 echo "Flush the signing key"
@@ -328,14 +328,14 @@ for CURVE in p256 p384
 do
     echo "Load external just the public part of PEM ECC ${CURVE}"
 -    ${PREFIX}loadexternal -halg sha1 -nalg sha1 -ipem policies/${CURVE}pubkey.pem -ecc > run.out
 +    ${PREFIX}loadexternal -halg sha256 -nalg sha256 -ipem policies/${CURVE}pubkey.pem -ecc > run.out
     checkSuccess $?
     echo "Sign a test message with openssl ECC ${CURVE}"
 -    openssl dgst -sha1 -sign policies/${CURVE}privkey.pem -out pssig.bin msg.bin > run.out 2>&1
 +    openssl dgst -sha256 -sign policies/${CURVE}privkey.pem -out pssig.bin msg.bin > run.out 2>&1
     echo "Verify the ECC signature ${CURVE}"
 -    ${PREFIX}verifysignature -hk 80000001 -halg sha1 -if msg.bin -is pssig.bin -raw -ecc > run.out
 +    ${PREFIX}verifysignature -hk 80000001 -halg sha256 -if msg.bin -is pssig.bin -raw -ecc > run.out
     checkSuccess $?
     echo "Flush the ECC ${CURVE} signing key"
 -- 
 2.34.3
--- a/0002-utils-Remove-unused-variables-from-certifyx509.patch
+++ b/0002-utils-Remove-unused-variables-from-certifyx509.patch
@ -0,0 +1,54 @@
 From 87120cf7fedcfc063ba5cd28ae4571909209a547 Mon Sep 17 00:00:00 2001
 From: Ken Goldman <kgoldman@us.ibm.com>
 Date: Mon, 23 Aug 2021 17:30:56 -0400
 Subject: [PATCH 2/7] utils: Remove unused variables from certifyx509
 notBefore and notAfter are set driectly in the partialCertificate
 structure, and that is used to directly set the x509 structure.
 Signed-off-by: Ken Goldman <kgoldman@us.ibm.com>
 ---
 utils/certifyx509.c | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)
 diff --git a/utils/certifyx509.c b/utils/certifyx509.c
 index ed42ac0..44640aa 100644
 --- a/utils/certifyx509.c
 +++ b/utils/certifyx509.c
@@ -204,6 +204,7 @@ int main(int argc, char *argv[])
     setvbuf(stdout, 0, _IONBF, 0);      /* output may be going through pipe to log file */
     TSS_SetProperty(NULL, TPM_TRACE_LEVEL, "1");
 +    curveID = curveID;		/* no longer used, get from parent */
     /* command line argument defaults */
     for (i=1 ; (i<argc) && (rc == 0) ; i++) {
 	if (strcmp(argv[i],"-ho") == 0) {
@@ -686,8 +687,6 @@ TPM_RC createPartialCertificate(TPM_PARTIAL_CERT *partialCertificate,	/* input /
     X509_NAME 	*x509SubjectName = NULL;/* composite subject name, key/value pairs */
     size_t	issuerEntriesSize = sizeof(issuerEntries)/sizeof(char *);
     size_t	subjectEntriesSize = sizeof(subjectEntries)/sizeof(char *);
 -    ASN1_TIME 	*notBefore = NULL;
 -    ASN1_TIME 	*notAfter = NULL;
     uint8_t 	*tmpPartialDer = NULL;	/* for the i2d */
     /* add issuer */
@@ -717,8 +716,6 @@ TPM_RC createPartialCertificate(TPM_PARTIAL_CERT *partialCertificate,	/* input /
 	}
     }
     if (rc == 0) {
 -	/* can't fail, just returns a structure member */
 -	notBefore = X509_get_notBefore(x509Certificate);
 	irc = X509_set1_notBefore(x509Certificate, partialCertificate->validity->notBefore);
 	if (irc == 0) {
 	    printf("createPartialCertificate: Error setting notBefore time\n");
@@ -737,7 +734,6 @@ TPM_RC createPartialCertificate(TPM_PARTIAL_CERT *partialCertificate,	/* input /
 	}
     }
     if (rc == 0) {
 -	notAfter = X509_get_notAfter(x509Certificate);
 	irc = X509_set1_notAfter(x509Certificate,partialCertificate->validity->notAfter);
 	if (irc == 0) {
 	    printf("createPartialCertificate: Error setting notAfter time\n");
 -- 
 2.34.1
--- a/0003-Update-certifyx509-for-Windows.patch
+++ b/0003-Update-certifyx509-for-Windows.patch
@ -0,0 +1,99 @@
 From 1c462889a517d6dbab721aa3e0597878e9c237d5 Mon Sep 17 00:00:00 2001
 From: Ken Goldman <kgold@linux.ibm.com>
 Date: Wed, 25 Aug 2021 18:02:11 -0400
 Subject: [PATCH 3/7] : Update certifyx509 for Windows
 Add static_ to the ASN1_SEQUENCE_END macros to suppress a gcc warning.
 Change free to OPENSSL_free, required with i2d when OpenSSL is a dll.
 Remove the tmpx509i file handling from the .bat file since certifyx509
 no longer outputs it.
 Signed-off-by: Ken Goldman <kgold@linux.ibm.com>
 ---
 utils/certifyx509.c         | 10 +++++-----
 utils/regtests/testx509.bat |  5 -----
 2 files changed, 5 insertions(+), 10 deletions(-)
 diff --git a/utils/certifyx509.c b/utils/certifyx509.c
 index 44640aa..5602f62 100644
 --- a/utils/certifyx509.c
 +++ b/utils/certifyx509.c
@@ -94,7 +94,7 @@ typedef struct {
 ASN1_SEQUENCE(TPM_PARTIAL_CERT_VALIDITY) = {
     ASN1_SIMPLE(TPM_PARTIAL_CERT_VALIDITY, notBefore, ASN1_TIME),
     ASN1_SIMPLE(TPM_PARTIAL_CERT_VALIDITY, notAfter, ASN1_TIME),
 -} ASN1_SEQUENCE_END(TPM_PARTIAL_CERT_VALIDITY)
 +} static_ASN1_SEQUENCE_END(TPM_PARTIAL_CERT_VALIDITY)
 /* the signature algorithm is optional while the extension list is mandatory */
 ASN1_SEQUENCE(TPM_PARTIAL_CERT) = {
@@ -103,7 +103,7 @@ ASN1_SEQUENCE(TPM_PARTIAL_CERT) = {
     ASN1_SIMPLE(TPM_PARTIAL_CERT, validity, TPM_PARTIAL_CERT_VALIDITY),
     ASN1_SIMPLE(TPM_PARTIAL_CERT, subject, X509_NAME),
     ASN1_EXP_SEQUENCE_OF(TPM_PARTIAL_CERT, extensions, X509_EXTENSION, 3),
 -} ASN1_SEQUENCE_END(TPM_PARTIAL_CERT)
 +} static_ASN1_SEQUENCE_END(TPM_PARTIAL_CERT)
 DECLARE_ASN1_FUNCTIONS(TPM_PARTIAL_CERT)
 IMPLEMENT_ASN1_FUNCTIONS(TPM_PARTIAL_CERT)
@@ -122,7 +122,7 @@ ASN1_SEQUENCE(TPM_ADDTOCERT) = {
     ASN1_SIMPLE(TPM_ADDTOCERT, serialNumber, ASN1_INTEGER),
     ASN1_SIMPLE(TPM_ADDTOCERT, signatureAlgorithm, X509_ALGOR),
     ASN1_SIMPLE(TPM_ADDTOCERT, key, X509_PUBKEY),
 -} ASN1_SEQUENCE_END(TPM_ADDTOCERT)
 +} static_ASN1_SEQUENCE_END(TPM_ADDTOCERT)
 DECLARE_ASN1_FUNCTIONS(TPM_ADDTOCERT)
 IMPLEMENT_ASN1_FUNCTIONS(TPM_ADDTOCERT)
@@ -629,7 +629,7 @@ int main(int argc, char *argv[])
 	X509_free(x509Certificate);			/* @1 */
     }
     free(x509Der);					/* @2 */
 -    free(addToCert);					/* @3 */
 +    OPENSSL_free(addToCert);				/* @3 */
     return rc;
 }
@@ -808,7 +808,7 @@ TPM_RC createPartialCertificate(TPM_PARTIAL_CERT *partialCertificate,	/* input /
 #endif
     X509_NAME_free(x509IssuerName);	/* @1 */
     X509_NAME_free(x509SubjectName);	/* @2 */
 -    free(tmpPartialDer);		/* @3 */
 +    OPENSSL_free(tmpPartialDer);	/* @3 */
     return rc;
 }
 diff --git a/utils/regtests/testx509.bat b/utils/regtests/testx509.bat
 index 0951ad6..17b69f6 100644
 --- a/utils/regtests/testx509.bat
 +++ b/utils/regtests/testx509.bat
@@ -80,8 +80,6 @@ for /L %%i in (1,1,!L!) do (
 	exit /B 1
     )
 -    rem # dumpasn1 -a -l -d     tmpx509i.bin > tmpx509i1.dump
 -    rem # dumpasn1 -a -l -d -hh tmpx509i.bin > tmpx509i1.dumphh
     rem # dumpasn1 -a -l -d     tmppart1.bin > tmppart1.dump
     rem # dumpasn1 -a -l -d -hh tmppart1.bin > tmppart1.dumphh
     rem # dumpasn1 -a -l -d     tmpadd1.bin  > tmpadd1.dump
@@ -102,8 +100,6 @@ for /L %%i in (1,1,!L!) do (
 	exit /B 1
     )
 -rem     # dumpasn1 -a -l -d     tmpx509i.bin > tmpx509i2.dump
 -rem     # dumpasn1 -a -l -d -hh tmpx509i.bin > tmpx509i2.dumphh
 rem     # dumpasn1 -a -l -d     tmppart2.bin > tmppart2.dump
 rem     # dumpasn1 -a -l -d -hh tmppart2.bin > tmppart2.dumphhe 
 rem     # dumpasn1 -a -l -d     tmpadd2.bin  > tmpadd2.dump
@@ -446,7 +442,6 @@ rm tmpsig1.bin
 rm tmpx5091.bin
 rm tmpx5091.pem
 rm tmpx5092.pem
 -rm tmpx509i.bin
 rm tmppart2.bin
 rm tmpadd2.bin
 rm tmptbs2.bin
 -- 
 2.34.1
--- a/0003-tss-Restrict-usage-of-SHA-1.patch
+++ b/0003-tss-Restrict-usage-of-SHA-1.patch
@ -0,0 +1,907 @@
 From 163843248ce6bb85fa5a3527f93610328877a1cf Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?=C5=A0t=C4=9Bp=C3=A1n=20Hor=C3=A1=C4=8Dek?=
 <shoracek@redhat.com>
 Date: Sat, 30 Apr 2022 22:15:43 +0200
 Subject: [PATCH 3/4] tss: Restrict usage of SHA-1
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 Due to SHA-1 not being considered secure, it should be not used for
 cryptographical purposes. This commit disables the usage of SHA-1 in
 cases where it is used in potentially exploitable situations, most
 notably for creating signatures.
 - Compared to the next branch commit af3154e2, changes related to
  unimplemented ECC functionality are ommited.
 Signed-off-by: Štěpán Horáček <shoracek@redhat.com>
 Signed-off-by: Ken Goldman <kgold@linux.ibm.com>
 ---
 configure.ac                 |  24 +-
 utils/Makefile.am            |  16 +-
 utils/cryptoutils.c          |   4 +
 utils/reg.sh                 |  20 +-
 utils/regtests/testattest.sh |   3 +-
 utils/regtests/testevent.sh  |   2 +-
 utils/tss20.c                | 638 ++++++++++++++++++++++++++++-------
 utils/tsscryptoh.c           |   9 +-
 8 files changed, 582 insertions(+), 134 deletions(-)
 diff --git a/configure.ac b/configure.ac
 index ad870b1..c570cb0 100644
 --- a/configure.ac
 +++ b/configure.ac
@@ -123,6 +123,11 @@ AC_ARG_ENABLE(rmtpm,
    AM_CONDITIONAL([CONFIG_RMTPM], [test "x$enable_rmtpm" = "xyes"])
    AS_IF([test "$enable_rmtpm" != "yes"], [enable_rmtpm="no"])
 +AC_ARG_ENABLE(nodeprecatedalgs,
 +   AS_HELP_STRING([--enable-nodeprecatedalgs], [Restrict usage of SHA-1]))
 +   AM_CONDITIONAL([CONFIG_TSS_NODEPRECATEDALGS], [test "x$enable_nodeprecatedalgs" = "xyes"])
 +   AS_IF([test "$enable_nodeprecatedalgs" != "yes"], [enable_nodeprecatedalgs="no"])
 +
 AC_CONFIG_FILES([Makefile
 		utils/Makefile
 		utils12/Makefile
@@ -131,12 +136,13 @@ AC_OUTPUT
 # Give some feedback
 echo   "Configuration:"
 -echo   "	CFLAGS:		$CFLAGS"
 -echo   "	tpm12:		$tpm12"
 -echo   "	tpm20:		$tpm20"
 -echo   "	hwtpm:		$enable_hwtpm"
 -echo   "	rmtpm:		$enable_rmtpm"
 -echo   "	nofile:		$enable_nofile"
 -echo   "	noprint:	$enable_noprint"
 -echo   "	nocrypto:	$enable_nocrypto"
 -echo   "	noecc:		$enable_noecc"
 +echo   "	CFLAGS:			$CFLAGS"
 +echo   "	tpm12:			$tpm12"
 +echo   "	tpm20:			$tpm20"
 +echo   "	hwtpm:			$enable_hwtpm"
 +echo   "	rmtpm:			$enable_rmtpm"
 +echo   "	nofile:			$enable_nofile"
 +echo   "	noprint:		$enable_noprint"
 +echo   "	nocrypto:		$enable_nocrypto"
 +echo   "	noecc:			$enable_noecc"
 +echo   "	nodeprecatedalgs:	$enable_nodeprecatedalgs"
 diff --git a/utils/Makefile.am b/utils/Makefile.am
 index d3af94e..53c53d9 100755
 --- a/utils/Makefile.am
 +++ b/utils/Makefile.am
@@ -60,6 +60,10 @@ if CONFIG_TSS_NOECC
 libibmtss_la_CFLAGS += -DTPM_TSS_NOECC
 endif
 +if CONFIG_TSS_NODEPRECATEDALGS
 +libibmtss_la_CFLAGS += -DTPM_TSS_NODEPRECATEDALGS
 +endif
 +
 libibmtss_la_CCFLAGS = -Wall -Wmissing-declarations -Wmissing-prototypes -Wnested-externs -Wformat=2 -Wold-style-definition -Wno-self-assign -ggdb
 libibmtss_la_LDFLAGS = -version-info @TSSLIB_VERSION_INFO@
@@ -78,6 +82,10 @@ if CONFIG_TSS_NOECC
 libibmtssutils_la_CFLAGS += -DTPM_TSS_NOECC
 endif
 +if CONFIG_TSS_NODEPRECATEDALGS
 +libibmtssutils_la_CFLAGS += -DTPM_TSS_NODEPRECATEDALGS
 +endif
 +
 #current[:revision[:age]]
 #result: [current-age].age.revision
 libibmtssutils_la_LDFLAGS = -version-info @TSSLIB_VERSION_INFO@
@@ -115,8 +123,14 @@ bin_PROGRAMS = activatecredential eventextend imaextend certify certifycreation
 	verifysignature zgen2phase signapp writeapp timepacket createek createekcert tpm2pem tpmpublic2eccpoint \
 	ntc2getconfig ntc2preconfig ntc2lockconfig publicname tpmcmd printattr
 +UTILS_CFLAGS =
 +
 if CONFIG_TSS_NOECC
 -UTILS_CFLAGS = -DTPM_TSS_NOECC
 +UTILS_CFLAGS += -DTPM_TSS_NOECC
 +endif
 +
 +if CONFIG_TSS_NODEPRECATEDALGS
 +UTILS_CFLAGS += -DTPM_TSS_NODEPRECATEDALGS
 endif
 activatecredential_SOURCES = activatecredential.c
 diff --git a/utils/cryptoutils.c b/utils/cryptoutils.c
 index 7c4e931..9ac77a1 100644
 --- a/utils/cryptoutils.c
 +++ b/utils/cryptoutils.c
@@ -1834,9 +1834,11 @@ TPM_RC signRSAFromRSA(uint8_t *signature, size_t *signatureLength,
     /* map the hash algorithm to the openssl NID */
     if (rc == 0) {
 	switch (hashAlg) {
 +#ifndef TPM_TSS_NODEPRECATEDALGS
 	  case TPM_ALG_SHA1:
 	    nid = NID_sha1;
 	    break;
 +#endif
 	  case TPM_ALG_SHA256:
 	    nid = NID_sha256;
 	    break;
@@ -1896,10 +1898,12 @@ TPM_RC verifyRSASignatureFromRSA(unsigned char *message,
     /* map from hash algorithm to openssl nid */
     if (rc == 0) {
 	switch (halg) {
 +#ifndef TPM_TSS_NODEPRECATEDALGS
 	  case TPM_ALG_SHA1:
 	    nid = NID_sha1;
 	    md = EVP_sha1();
 	    break;
 +#endif
 	  case TPM_ALG_SHA256:
 	    nid = NID_sha256;
 	    md = EVP_sha256();
 diff --git a/utils/reg.sh b/utils/reg.sh
 index 2d9d100..02d7d5f 100755
 --- a/utils/reg.sh
 +++ b/utils/reg.sh
@@ -69,12 +69,20 @@ PREFIX=./
 #PREFIX="valgrind ./"
 -# hash algorithms to be used for testing
 -
 -export ITERATE_ALGS="sha1 sha256 sha384 sha512"
 -export ITERATE_ALGS_SIZES="20 32 48 64"
 -export ITERATE_ALGS_COUNT=4
 -export BAD_ITERATE_ALGS="sha256 sha384 sha512 sha1"
 +# Hash algorithms to be used for testing. Uncomment or set shell env variable to restrict.
 +# export TPM_TSS_NODEPRECATEDALGS=1
 +if [ "${TPM_TSS_NODEPRECATEDALGS}" ]; then
 +	export ITERATE_ALGS="sha256 sha384 sha512"
 +	export ITERATE_ALGS_SIZES="32 48 64"
 +	export ITERATE_ALGS_COUNT=3
 +	export BAD_ITERATE_ALGS="sha384 sha512 sha256"
 +else
 +	export ITERATE_ALGS="sha1 sha256 sha384 sha512"
 +	export ITERATE_ALGS_SIZES="20 32 48 64"
 +	export ITERATE_ALGS_COUNT=4
 +	export BAD_ITERATE_ALGS="sha256 sha384 sha512 sha1"
 +fi
 +export ITERATE_ALGS_WITH_SHA1="sha1 sha256 sha384 sha512"
 printUsage ()
 {
 diff --git a/utils/regtests/testattest.sh b/utils/regtests/testattest.sh
 index 2dacf88..4766554 100755
 --- a/utils/regtests/testattest.sh
 +++ b/utils/regtests/testattest.sh
@@ -381,9 +381,8 @@ echo ""
 for HALG in ${ITERATE_ALGS}
 do
 -
     echo "Start an audit session ${HALG}"
 -    ${PREFIX}startauthsession -se h -halg  ${HALG} > run.out
 +    ${PREFIX}startauthsession -se h -halg ${HALG} > run.out
     checkSuccess $?
     echo "PCR 16 reset"
 diff --git a/utils/regtests/testevent.sh b/utils/regtests/testevent.sh
 index 6336920..57a96d2 100755
 --- a/utils/regtests/testevent.sh
 +++ b/utils/regtests/testevent.sh
@@ -62,7 +62,7 @@ echo ""
 for TYPE in "1" "2"
 do
 -    for HALG in ${ITERATE_ALGS}
 +    for HALG in ${ITERATE_ALGS_WITH_SHA1}
     do
 	echo "Power cycle to reset IMA PCR"
 diff --git a/utils/tss20.c b/utils/tss20.c
 index c778069..6b1e79b 100644
 --- a/utils/tss20.c
 +++ b/utils/tss20.c
@@ -112,6 +112,7 @@ struct TSS_HMAC_CONTEXT {
 /* functions for command pre- and post- processing */
 +typedef TPM_RC (*TSS_CheckParametersFunction_t)(COMMAND_PARAMETERS *in);
 typedef TPM_RC (*TSS_PreProcessFunction_t)(TSS_CONTEXT *tssContext,
 					   COMMAND_PARAMETERS *in,
 					   EXTRA_PARAMETERS *extra);
@@ -238,11 +239,378 @@ static TPM_RC TSS_PO_NV_ReadLock(TSS_CONTEXT *tssContext,
 				 void *out,
 				 void *extra);
 +/*
 +  Functions to check for usage of deprecated algorithms.
 +*/
 +
 +static TPM_RC TSS_CheckSha1_PublicArea(TPMT_PUBLIC *publicArea)
 +{
 +    TPM_RC rc = 0;
 +
 +    if (rc == 0) {
 +	if (publicArea->nameAlg == TPM_ALG_SHA1) {
 +	    rc = TSS_RC_BAD_HASH_ALGORITHM;
 +	}
 +    }
 +
 +    if (rc == 0) {
 +	if (((publicArea->type == TPM_ALG_RSA) || (publicArea->type == TPM_ALG_ECC)) &&
 +	    (publicArea->parameters.asymDetail.scheme.scheme != TPM_ALG_NULL) &&
 +	    (publicArea->parameters.asymDetail.scheme.details.anySig.hashAlg == TPM_ALG_SHA1)) {
 +	    rc = TSS_RC_BAD_HASH_ALGORITHM;
 +	}
 +    }
 +
 +    return rc;
 +}
 +
 +static TPM_RC TSS_CheckSha1_SigScheme(TPMT_SIG_SCHEME *sigScheme)
 +{
 +    TPM_RC rc = 0;
 +
 +    if (rc == 0) {
 +	if (sigScheme->details.any.hashAlg == TPM_ALG_SHA1) {
 +	    rc = TSS_RC_BAD_HASH_ALGORITHM;
 +	}
 +    }
 +
 +    return rc;
 +}
 +
 +static TPM_RC TSS_CH_StartAuthSession(StartAuthSession_In *in)
 +{
 +    TPM_RC rc = 0;
 +
 +    if (rc == 0) {
 +	if (in->authHash == TPM_ALG_SHA1) {
 +	    rc = TSS_RC_BAD_HASH_ALGORITHM;
 +	}
 +    }
 +
 +    return rc;
 +}
 +
 +static TPM_RC TSS_CH_Create(Create_In *in)
 +{
 +    TPM_RC rc = 0;
 +
 +    if (rc == 0) {
 +	rc = TSS_CheckSha1_PublicArea(&in->inPublic.publicArea);
 +    }
 +
 +    return rc;
 +}
 +
 +static TPM_RC TSS_CH_Load(Load_In *in)
 +{
 +    TPM_RC rc = 0;
 +
 +    if (rc == 0) {
 +	rc = TSS_CheckSha1_PublicArea(&in->inPublic.publicArea);
 +    }
 +
 +    return rc;
 +}
 +
 +static TPM_RC TSS_CH_LoadExternal(LoadExternal_In *in)
 +{
 +    TPM_RC rc = 0;
 +
 +    if (rc == 0) {
 +	rc = TSS_CheckSha1_PublicArea(&in->inPublic.publicArea);
 +    }
 +
 +    return rc;
 +}
 +
 +static TPM_RC TSS_CH_CreateLoaded(CreateLoaded_In *in)
 +{
 +    TPM_RC rc = 0;
 +    uint32_t size = sizeof(in->inPublic.t.buffer);
 +    uint8_t *buffer = in->inPublic.t.buffer;
 +    TPMT_PUBLIC publicArea;
 +
 +    if (rc == 0) {
 +	rc = TSS_TPMT_PUBLIC_Unmarshalu(&publicArea, &buffer, &size, TRUE);
 +    }
 +
 +    if (rc == 0) {
 +	rc = TSS_CheckSha1_PublicArea(&publicArea);
 +    }
 +
 +    return rc;
 +}
 +
 +static TPM_RC TSS_CH_Import(Import_In *in)
 +{
 +    TPM_RC rc = 0;
 +
 +    if (rc == 0) {
 +	rc = TSS_CheckSha1_PublicArea(&in->objectPublic.publicArea);
 +    }
 +
 +    return rc;
 +}
 +
 +static TPM_RC TSS_CH_RSA_Encrypt(RSA_Encrypt_In *in)
 +{
 +    TPM_RC rc = 0;
 +
 +    if (rc == 0) {
 +	if (in->inScheme.details.anySig.hashAlg == TPM_ALG_SHA1) {
 +	    rc = TSS_RC_BAD_HASH_ALGORITHM;
 +	}
 +    }
 +
 +    return rc;
 +}
 +
 +static TPM_RC TSS_CH_RSA_Decrypt(RSA_Decrypt_In *in)
 +{
 +    TPM_RC rc = 0;
 +
 +    if (rc == 0) {
 +	if (in->inScheme.details.anySig.hashAlg == TPM_ALG_SHA1) {
 +	    rc = TSS_RC_BAD_HASH_ALGORITHM;
 +	}
 +    }
 +
 +    return rc;
 +}
 +
 +static TPM_RC TSS_CH_Hash(Hash_In *in)
 +{
 +    TPM_RC rc = 0;
 +
 +    if (rc == 0) {
 +	if (in->hashAlg == TPM_ALG_SHA1) {
 +	    rc = TSS_RC_BAD_HASH_ALGORITHM;
 +	}
 +    }
 +
 +    return rc;
 +}
 +
 +static TPM_RC TSS_CH_HMAC(HMAC_In *in)
 +{
 +    TPM_RC rc = 0;
 +
 +    if (rc == 0) {
 +	if (in->hashAlg == TPM_ALG_SHA1) {
 +	    rc = TSS_RC_BAD_HASH_ALGORITHM;
 +	}
 +    }
 +
 +    return rc;
 +}
 +
 +static TPM_RC TSS_CH_HMAC_Start(HMAC_Start_In *in)
 +{
 +    TPM_RC rc = 0;
 +
 +    if (rc == 0) {
 +	if (in->hashAlg == TPM_ALG_SHA1) {
 +	    rc = TSS_RC_BAD_HASH_ALGORITHM;
 +	}
 +    }
 +
 +    return rc;
 +}
 +
 +static TPM_RC TSS_CH_HashSequenceStart(HashSequenceStart_In *in)
 +{
 +    TPM_RC rc = 0;
 +
 +    if (rc == 0) {
 +	if (in->hashAlg == TPM_ALG_SHA1) {
 +	    rc = TSS_RC_BAD_HASH_ALGORITHM;
 +	}
 +    }
 +
 +    return rc;
 +}
 +
 +static TPM_RC TSS_CH_Certify(Certify_In *in)
 +{
 +    TPM_RC rc = 0;
 +
 +    if (rc == 0) {
 +	rc = TSS_CheckSha1_SigScheme(&in->inScheme);
 +    }
 +
 +    return rc;
 +}
 +
 +static TPM_RC TSS_CH_CertifyX509(CertifyX509_In *in)
 +{
 +    TPM_RC rc = 0;
 +
 +    if (rc == 0) {
 +	rc = TSS_CheckSha1_SigScheme(&in->inScheme);
 +    }
 +
 +    return rc;
 +}
 +
 +static TPM_RC TSS_CH_CertifyCreation(CertifyCreation_In *in)
 +{
 +    TPM_RC rc = 0;
 +
 +    if (rc == 0) {
 +	rc = TSS_CheckSha1_SigScheme(&in->inScheme);
 +    }
 +
 +    return rc;
 +}
 +
 +static TPM_RC TSS_CH_Quote(Quote_In *in)
 +{
 +    TPM_RC rc = 0;
 +
 +    if (rc == 0) {
 +	rc = TSS_CheckSha1_SigScheme(&in->inScheme);
 +    }
 +
 +    return rc;
 +}
 +
 +static TPM_RC TSS_CH_GetSessionAuditDigest(GetSessionAuditDigest_In *in)
 +{
 +    TPM_RC rc = 0;
 +
 +    if (rc == 0) {
 +	rc = TSS_CheckSha1_SigScheme(&in->inScheme);
 +    }
 +
 +    return rc;
 +}
 +
 +static TPM_RC TSS_CH_GetCommandAuditDigest(GetCommandAuditDigest_In *in)
 +{
 +    TPM_RC rc = 0;
 +
 +    if (rc == 0) {
 +	rc = TSS_CheckSha1_SigScheme(&in->inScheme);
 +    }
 +
 +    return rc;
 +}
 +
 +static TPM_RC TSS_CH_GetTime(GetTime_In *in)
 +{
 +    TPM_RC rc = 0;
 +
 +    if (rc == 0) {
 +	rc = TSS_CheckSha1_SigScheme(&in->inScheme);
 +    }
 +
 +    return rc;
 +}
 +
 +static TPM_RC TSS_CH_VerifySignature(VerifySignature_In *in)
 +{
 +    TPM_RC rc = 0;
 +
 +    if (rc == 0) {
 +	if (in->signature.signature.any.hashAlg == TPM_ALG_SHA1) {
 +	    rc = TSS_RC_BAD_HASH_ALGORITHM;
 +	}
 +    }
 +
 +    return rc;
 +}
 +
 +static TPM_RC TSS_CH_Sign(Sign_In *in)
 +{
 +    TPM_RC rc = 0;
 +
 +    if (rc == 0) {
 +	rc = TSS_CheckSha1_SigScheme(&in->inScheme);
 +    }
 +
 +    return rc;
 +}
 +
 +static TPM_RC TSS_CH_SetCommandCodeAuditStatus(SetCommandCodeAuditStatus_In *in)
 +{
 +    TPM_RC rc = 0;
 +
 +    if (rc == 0) {
 +	if (in->auditAlg == TPM_ALG_SHA1) {
 +	    rc = TSS_RC_BAD_HASH_ALGORITHM;
 +	}
 +    }
 +
 +    return rc;
 +}
 +
 +static TPM_RC TSS_CH_PolicySigned(PolicySigned_In *in)
 +{
 +    TPM_RC rc = 0;
 +
 +    if (rc == 0) {
 +	if (in->auth.signature.any.hashAlg == TPM_ALG_SHA1) {
 +	    rc = TSS_RC_BAD_HASH_ALGORITHM;
 +	}
 +    }
 +
 +    return rc;
 +}
 +
 +static TPM_RC TSS_CH_CreatePrimary(CreatePrimary_In *in)
 +{
 +    TPM_RC rc = 0;
 +
 +    if (rc == 0) {
 +	rc = TSS_CheckSha1_PublicArea(&in->inPublic.publicArea);
 +    }
 +
 +    return rc;
 +}
 +
 +static TPM_RC TSS_CH_SetPrimaryPolicy(SetPrimaryPolicy_In *in)
 +{
 +    TPM_RC rc = 0;
 +
 +    if (rc == 0) {
 +	if (in->hashAlg == TPM_ALG_SHA1) {
 +	    rc = TSS_RC_BAD_HASH_ALGORITHM;
 +	}
 +    }
 +
 +    return rc;
 +}
 +
 +static TPM_RC TSS_CH_NV_DefineSpace(NV_DefineSpace_In *in)
 +{
 +    TPM_RC rc = 0;
 +
 +    if (rc == 0) {
 +	if (in->publicInfo.nvPublic.nameAlg == TPM_ALG_SHA1) {
 +	    rc = TSS_RC_BAD_HASH_ALGORITHM;
 +	}
 +    }
 +
 +    return rc;
 +}
 +
 +static TPM_RC TSS_CH_NV_Certify(NV_Certify_In *in)
 +{
 +    TPM_RC rc = 0;
 +
 +    if (rc == 0) {
 +	rc = TSS_CheckSha1_SigScheme(&in->inScheme);
 +    }
 +
 +    return rc;
 +}
 +
 typedef struct TSS_TABLE {
 -    TPM_CC 			commandCode;
 -    TSS_PreProcessFunction_t	preProcessFunction;
 -    TSS_ChangeAuthFunction_t	changeAuthFunction;
 -    TSS_PostProcessFunction_t 	postProcessFunction;
 +    TPM_CC 				commandCode;
 +    TSS_CheckParametersFunction_t	checkParametersFunction;
 +    TSS_PreProcessFunction_t		preProcessFunction;
 +    TSS_ChangeAuthFunction_t		changeAuthFunction;
 +    TSS_PostProcessFunction_t 		postProcessFunction;
 } TSS_TABLE;
 /* This table indexes from the command to pre- and post- processing functions.  A missing entry is
@@ -250,116 +618,116 @@ typedef struct TSS_TABLE {
 static const TSS_TABLE tssTable [] = {
 -    {TPM_CC_Startup, NULL, NULL, NULL},
 -    {TPM_CC_Shutdown, NULL, NULL, NULL},
 -    {TPM_CC_SelfTest, NULL, NULL, NULL},
 -    {TPM_CC_IncrementalSelfTest, NULL, NULL, NULL},
 -    {TPM_CC_GetTestResult, NULL, NULL, NULL},
 -    {TPM_CC_StartAuthSession, (TSS_PreProcessFunction_t)TSS_PR_StartAuthSession, NULL, (TSS_PostProcessFunction_t)TSS_PO_StartAuthSession},
 -    {TPM_CC_PolicyRestart, NULL, NULL, NULL},
 -    {TPM_CC_Create, NULL, NULL, NULL},
 -    {TPM_CC_Load, NULL, NULL, (TSS_PostProcessFunction_t)TSS_PO_Load},
 -    {TPM_CC_LoadExternal, NULL, NULL, (TSS_PostProcessFunction_t)TSS_PO_LoadExternal},
 -    {TPM_CC_ReadPublic, NULL, NULL, (TSS_PostProcessFunction_t)TSS_PO_ReadPublic},
 -    {TPM_CC_ActivateCredential, NULL, NULL, NULL},
 -    {TPM_CC_MakeCredential, NULL, NULL, NULL},
 -    {TPM_CC_Unseal, NULL, NULL, NULL},
 -    {TPM_CC_ObjectChangeAuth, NULL, NULL, NULL},
 -    {TPM_CC_CreateLoaded, NULL, NULL, (TSS_PostProcessFunction_t)TSS_PO_CreateLoaded},
 -    {TPM_CC_Duplicate, NULL, NULL, NULL},
 -    {TPM_CC_Rewrap, NULL, NULL, NULL},
 -    {TPM_CC_Import, NULL, NULL, NULL},
 -    {TPM_CC_RSA_Encrypt, NULL, NULL, NULL},
 -    {TPM_CC_RSA_Decrypt, NULL, NULL, NULL},
 -    {TPM_CC_ECDH_KeyGen, NULL, NULL, NULL},
 -    {TPM_CC_ECDH_ZGen, NULL, NULL, NULL},
 -    {TPM_CC_ECC_Parameters, NULL, NULL, NULL},
 -    {TPM_CC_ZGen_2Phase, NULL, NULL, NULL},
 -    {TPM_CC_EncryptDecrypt, NULL, NULL, NULL},
 -    {TPM_CC_EncryptDecrypt2, NULL, NULL, NULL},
 -    {TPM_CC_Hash, NULL, NULL, NULL},
 -    {TPM_CC_HMAC, NULL, NULL, NULL},
 -    {TPM_CC_GetRandom, NULL, NULL, NULL},
 -    {TPM_CC_StirRandom, NULL, NULL, NULL},
 -    {TPM_CC_HMAC_Start, NULL, NULL, (TSS_PostProcessFunction_t)TSS_PO_HMAC_Start},
 -    {TPM_CC_HashSequenceStart, NULL, NULL, (TSS_PostProcessFunction_t)TSS_PO_HashSequenceStart},
 -    {TPM_CC_SequenceUpdate, NULL, NULL, NULL},
 -    {TPM_CC_SequenceComplete, NULL,NULL, (TSS_PostProcessFunction_t)TSS_PO_SequenceComplete},
 -    {TPM_CC_EventSequenceComplete, NULL, NULL, (TSS_PostProcessFunction_t)TSS_PO_EventSequenceComplete},
 -    {TPM_CC_Certify, NULL, NULL, NULL},
 -    {TPM_CC_CertifyX509, NULL, NULL, NULL},
 -    {TPM_CC_CertifyCreation, NULL, NULL, NULL},
 -    {TPM_CC_Quote, NULL, NULL, NULL},
 -    {TPM_CC_GetSessionAuditDigest, NULL, NULL, NULL},
 -    {TPM_CC_GetCommandAuditDigest, NULL, NULL, NULL},
 -    {TPM_CC_GetTime, NULL, NULL, NULL},
 -    {TPM_CC_Commit, NULL, NULL, NULL},
 -    {TPM_CC_EC_Ephemeral, NULL, NULL, NULL},
 -    {TPM_CC_VerifySignature, NULL, NULL, NULL},
 -    {TPM_CC_Sign, NULL, NULL, NULL},
 -    {TPM_CC_SetCommandCodeAuditStatus, NULL, NULL, NULL},
 -    {TPM_CC_PCR_Extend, NULL, NULL, NULL},
 -    {TPM_CC_PCR_Event, NULL, NULL, NULL},
 -    {TPM_CC_PCR_Read, NULL, NULL, NULL},
 -    {TPM_CC_PCR_Allocate, NULL, NULL, NULL},
 -    {TPM_CC_PCR_SetAuthPolicy, NULL, NULL, NULL},
 -    {TPM_CC_PCR_SetAuthValue, NULL, NULL, NULL},
 -    {TPM_CC_PCR_Reset, NULL, NULL, NULL},
 -    {TPM_CC_PolicySigned, NULL, NULL, NULL},
 -    {TPM_CC_PolicySecret, NULL, NULL, NULL},
 -    {TPM_CC_PolicyTicket, NULL, NULL, NULL},
 -    {TPM_CC_PolicyOR, NULL, NULL, NULL},
 -    {TPM_CC_PolicyPCR, NULL, NULL, NULL},
 -    {TPM_CC_PolicyLocality, NULL, NULL, NULL},
 -    {TPM_CC_PolicyNV, NULL, NULL, NULL},
 -    {TPM_CC_PolicyAuthorizeNV, NULL, NULL, NULL},
 -    {TPM_CC_PolicyCounterTimer, NULL, NULL, NULL},
 -    {TPM_CC_PolicyCommandCode, NULL, NULL, NULL},
 -    {TPM_CC_PolicyPhysicalPresence, NULL, NULL, NULL},
 -    {TPM_CC_PolicyCpHash, NULL, NULL, NULL},
 -    {TPM_CC_PolicyNameHash, NULL, NULL, NULL},
 -    {TPM_CC_PolicyDuplicationSelect, NULL, NULL, NULL},
 -    {TPM_CC_PolicyAuthorize, NULL, NULL, NULL},
 -    {TPM_CC_PolicyAuthValue, NULL, NULL, (TSS_PostProcessFunction_t)TSS_PO_PolicyAuthValue},
 -    {TPM_CC_PolicyPassword, NULL, NULL, (TSS_PostProcessFunction_t)TSS_PO_PolicyPassword},
 -    {TPM_CC_PolicyGetDigest, NULL, NULL, NULL},
 -    {TPM_CC_PolicyNvWritten, NULL, NULL, NULL},
 -    {TPM_CC_PolicyTemplate, NULL, NULL, NULL},
 -    {TPM_CC_CreatePrimary, NULL, NULL, (TSS_PostProcessFunction_t)TSS_PO_CreatePrimary},
 -    {TPM_CC_HierarchyControl, NULL, NULL, NULL},
 -    {TPM_CC_SetPrimaryPolicy, NULL, NULL, NULL},
 -    {TPM_CC_ChangePPS, NULL, NULL, NULL},
 -    {TPM_CC_ChangeEPS, NULL, NULL, NULL},
 -    {TPM_CC_Clear, NULL, NULL, NULL},
 -    {TPM_CC_ClearControl, NULL, NULL, NULL},
 -    {TPM_CC_HierarchyChangeAuth, NULL, (TSS_ChangeAuthFunction_t)TSS_CA_HierarchyChangeAuth, NULL},
 -    {TPM_CC_DictionaryAttackLockReset, NULL, NULL, NULL},
 -    {TPM_CC_DictionaryAttackParameters, NULL, NULL, NULL},
 -    {TPM_CC_PP_Commands, NULL, NULL, NULL},
 -    {TPM_CC_SetAlgorithmSet, NULL, NULL, NULL},
 -    {TPM_CC_ContextSave, NULL, NULL, (TSS_PostProcessFunction_t)TSS_PO_ContextSave},
 -    {TPM_CC_ContextLoad, NULL, NULL, (TSS_PostProcessFunction_t)TSS_PO_ContextLoad},
 -    {TPM_CC_FlushContext, NULL, NULL, (TSS_PostProcessFunction_t)TSS_PO_FlushContext},
 -    {TPM_CC_EvictControl, NULL, NULL, (TSS_PostProcessFunction_t)TSS_PO_EvictControl},
 -    {TPM_CC_ReadClock, NULL, NULL, NULL},
 -    {TPM_CC_ClockSet, NULL, NULL, NULL},
 -    {TPM_CC_ClockRateAdjust, NULL, NULL, NULL},
 -    {TPM_CC_GetCapability, NULL, NULL, NULL},
 -    {TPM_CC_TestParms, NULL, NULL, NULL},
 -    {TPM_CC_NV_DefineSpace, (TSS_PreProcessFunction_t)TSS_PR_NV_DefineSpace, NULL,  (TSS_PostProcessFunction_t)TSS_PO_NV_DefineSpace},
 -    {TPM_CC_NV_UndefineSpace, NULL, NULL, (TSS_PostProcessFunction_t)TSS_PO_NV_UndefineSpace},
 -    {TPM_CC_NV_UndefineSpaceSpecial, NULL, (TSS_ChangeAuthFunction_t)TSS_CA_NV_UndefineSpaceSpecial, (TSS_PostProcessFunction_t)TSS_PO_NV_UndefineSpaceSpecial},
 -    {TPM_CC_NV_ReadPublic, NULL, NULL, (TSS_PostProcessFunction_t)TSS_PO_NV_ReadPublic},
 -    {TPM_CC_NV_Write, NULL, NULL, (TSS_PostProcessFunction_t)TSS_PO_NV_Write},
 -    {TPM_CC_NV_Increment, NULL, NULL, (TSS_PostProcessFunction_t)TSS_PO_NV_Write},
 -    {TPM_CC_NV_Extend, NULL, NULL, (TSS_PostProcessFunction_t)TSS_PO_NV_Write},
 -    {TPM_CC_NV_SetBits, NULL, NULL, (TSS_PostProcessFunction_t)TSS_PO_NV_Write},
 -    {TPM_CC_NV_WriteLock, NULL, NULL, (TSS_PostProcessFunction_t)TSS_PO_NV_WriteLock},
 -    {TPM_CC_NV_GlobalWriteLock, NULL, NULL, NULL},
 -    {TPM_CC_NV_Read, NULL, NULL, NULL},
 -    {TPM_CC_NV_ReadLock, NULL, NULL, (TSS_PostProcessFunction_t)TSS_PO_NV_ReadLock},
 -    {TPM_CC_NV_ChangeAuth, NULL, (TSS_ChangeAuthFunction_t)TSS_CA_NV_ChangeAuth, NULL},
 -    {TPM_CC_NV_Certify, NULL, NULL, NULL}
 +    {TPM_CC_Startup, NULL, NULL, NULL, NULL},
 +    {TPM_CC_Shutdown, NULL, NULL, NULL, NULL},
 +    {TPM_CC_SelfTest, NULL, NULL, NULL, NULL},
 +    {TPM_CC_IncrementalSelfTest, NULL, NULL, NULL, NULL},
 +    {TPM_CC_GetTestResult, NULL, NULL, NULL, NULL},
 +    {TPM_CC_StartAuthSession, (TSS_CheckParametersFunction_t)TSS_CH_StartAuthSession, (TSS_PreProcessFunction_t)TSS_PR_StartAuthSession, NULL, (TSS_PostProcessFunction_t)TSS_PO_StartAuthSession},
 +    {TPM_CC_PolicyRestart, NULL, NULL, NULL, NULL},
 +    {TPM_CC_Create, (TSS_CheckParametersFunction_t)TSS_CH_Create, NULL, NULL, NULL},
 +    {TPM_CC_Load, (TSS_CheckParametersFunction_t)TSS_CH_Load, NULL, NULL, (TSS_PostProcessFunction_t)TSS_PO_Load},
 +    {TPM_CC_LoadExternal, (TSS_CheckParametersFunction_t)TSS_CH_LoadExternal, NULL, NULL, (TSS_PostProcessFunction_t)TSS_PO_LoadExternal},
 +    {TPM_CC_ReadPublic, NULL, NULL, NULL, (TSS_PostProcessFunction_t)TSS_PO_ReadPublic},
 +    {TPM_CC_ActivateCredential, NULL, NULL, NULL, NULL},
 +    {TPM_CC_MakeCredential, NULL, NULL, NULL, NULL},
 +    {TPM_CC_Unseal, NULL, NULL, NULL, NULL},
 +    {TPM_CC_ObjectChangeAuth, NULL, NULL, NULL, NULL},
 +    {TPM_CC_CreateLoaded, (TSS_CheckParametersFunction_t)TSS_CH_CreateLoaded, NULL, NULL, (TSS_PostProcessFunction_t)TSS_PO_CreateLoaded},
 +    {TPM_CC_Duplicate, NULL, NULL, NULL, NULL},
 +    {TPM_CC_Rewrap, NULL, NULL, NULL, NULL},
 +    {TPM_CC_Import, (TSS_CheckParametersFunction_t)TSS_CH_Import, NULL, NULL, NULL},
 +    {TPM_CC_RSA_Encrypt, (TSS_CheckParametersFunction_t)TSS_CH_RSA_Encrypt, NULL, NULL, NULL},
 +    {TPM_CC_RSA_Decrypt, (TSS_CheckParametersFunction_t)TSS_CH_RSA_Decrypt, NULL, NULL, NULL},
 +    {TPM_CC_ECDH_KeyGen, NULL, NULL, NULL, NULL},
 +    {TPM_CC_ECDH_ZGen, NULL, NULL, NULL, NULL},
 +    {TPM_CC_ECC_Parameters, NULL, NULL, NULL, NULL},
 +    {TPM_CC_ZGen_2Phase, NULL, NULL, NULL, NULL},
 +    {TPM_CC_EncryptDecrypt, NULL, NULL, NULL, NULL},
 +    {TPM_CC_EncryptDecrypt2, NULL, NULL, NULL, NULL},
 +    {TPM_CC_Hash, (TSS_CheckParametersFunction_t)TSS_CH_Hash, NULL, NULL, NULL},
 +    {TPM_CC_HMAC, (TSS_CheckParametersFunction_t)TSS_CH_HMAC, NULL, NULL, NULL},
 +    {TPM_CC_GetRandom, NULL, NULL, NULL, NULL},
 +    {TPM_CC_StirRandom, NULL, NULL, NULL, NULL},
 +    {TPM_CC_HMAC_Start, (TSS_CheckParametersFunction_t)TSS_CH_HMAC_Start, NULL, NULL, (TSS_PostProcessFunction_t)TSS_PO_HMAC_Start},
 +    {TPM_CC_HashSequenceStart, (TSS_CheckParametersFunction_t)TSS_CH_HashSequenceStart, NULL, NULL, (TSS_PostProcessFunction_t)TSS_PO_HashSequenceStart},
 +    {TPM_CC_SequenceUpdate, NULL, NULL, NULL, NULL},
 +    {TPM_CC_SequenceComplete, NULL, NULL,NULL, (TSS_PostProcessFunction_t)TSS_PO_SequenceComplete},
 +    {TPM_CC_EventSequenceComplete, NULL, NULL, NULL, (TSS_PostProcessFunction_t)TSS_PO_EventSequenceComplete},
 +    {TPM_CC_Certify, (TSS_CheckParametersFunction_t)TSS_CH_Certify, NULL, NULL, NULL},
 +    {TPM_CC_CertifyX509, (TSS_CheckParametersFunction_t)TSS_CH_CertifyX509, NULL, NULL, NULL},
 +    {TPM_CC_CertifyCreation, (TSS_CheckParametersFunction_t)TSS_CH_CertifyCreation, NULL, NULL, NULL},
 +    {TPM_CC_Quote, (TSS_CheckParametersFunction_t)TSS_CH_Quote, NULL, NULL, NULL},
 +    {TPM_CC_GetSessionAuditDigest, (TSS_CheckParametersFunction_t)TSS_CH_GetSessionAuditDigest, NULL, NULL, NULL},
 +    {TPM_CC_GetCommandAuditDigest, (TSS_CheckParametersFunction_t)TSS_CH_GetCommandAuditDigest, NULL, NULL, NULL},
 +    {TPM_CC_GetTime, (TSS_CheckParametersFunction_t)TSS_CH_GetTime, NULL, NULL, NULL},
 +    {TPM_CC_Commit, NULL, NULL, NULL, NULL},
 +    {TPM_CC_EC_Ephemeral, NULL, NULL, NULL, NULL},
 +    {TPM_CC_VerifySignature, (TSS_CheckParametersFunction_t)TSS_CH_VerifySignature, NULL, NULL, NULL},
 +    {TPM_CC_Sign, (TSS_CheckParametersFunction_t)TSS_CH_Sign, NULL, NULL, NULL},
 +    {TPM_CC_SetCommandCodeAuditStatus, (TSS_CheckParametersFunction_t)TSS_CH_SetCommandCodeAuditStatus, NULL, NULL, NULL},
 +    {TPM_CC_PCR_Extend, NULL, NULL, NULL, NULL},
 +    {TPM_CC_PCR_Event, NULL, NULL, NULL, NULL},
 +    {TPM_CC_PCR_Read, NULL, NULL, NULL, NULL},
 +    {TPM_CC_PCR_Allocate, NULL, NULL, NULL, NULL},
 +    {TPM_CC_PCR_SetAuthPolicy, NULL, NULL, NULL, NULL},
 +    {TPM_CC_PCR_SetAuthValue, NULL, NULL, NULL, NULL},
 +    {TPM_CC_PCR_Reset, NULL, NULL, NULL, NULL},
 +    {TPM_CC_PolicySigned, (TSS_CheckParametersFunction_t)TSS_CH_PolicySigned, NULL, NULL, NULL},
 +    {TPM_CC_PolicySecret, NULL, NULL, NULL, NULL},
 +    {TPM_CC_PolicyTicket, NULL, NULL, NULL, NULL},
 +    {TPM_CC_PolicyOR, NULL, NULL, NULL, NULL},
 +    {TPM_CC_PolicyPCR, NULL, NULL, NULL, NULL},
 +    {TPM_CC_PolicyLocality, NULL, NULL, NULL, NULL},
 +    {TPM_CC_PolicyNV, NULL, NULL, NULL, NULL},
 +    {TPM_CC_PolicyAuthorizeNV, NULL, NULL, NULL, NULL},
 +    {TPM_CC_PolicyCounterTimer, NULL, NULL, NULL, NULL},
 +    {TPM_CC_PolicyCommandCode, NULL, NULL, NULL, NULL},
 +    {TPM_CC_PolicyPhysicalPresence, NULL, NULL, NULL, NULL},
 +    {TPM_CC_PolicyCpHash, NULL, NULL, NULL, NULL},
 +    {TPM_CC_PolicyNameHash, NULL, NULL, NULL, NULL},
 +    {TPM_CC_PolicyDuplicationSelect, NULL, NULL, NULL, NULL},
 +    {TPM_CC_PolicyAuthorize, NULL, NULL, NULL, NULL},
 +    {TPM_CC_PolicyAuthValue, NULL, NULL, NULL, (TSS_PostProcessFunction_t)TSS_PO_PolicyAuthValue},
 +    {TPM_CC_PolicyPassword, NULL, NULL, NULL, (TSS_PostProcessFunction_t)TSS_PO_PolicyPassword},
 +    {TPM_CC_PolicyGetDigest, NULL, NULL, NULL, NULL},
 +    {TPM_CC_PolicyNvWritten, NULL, NULL, NULL, NULL},
 +    {TPM_CC_PolicyTemplate, NULL, NULL, NULL, NULL},
 +    {TPM_CC_CreatePrimary, (TSS_CheckParametersFunction_t)TSS_CH_CreatePrimary, NULL, NULL, (TSS_PostProcessFunction_t)TSS_PO_CreatePrimary},
 +    {TPM_CC_HierarchyControl, NULL, NULL, NULL, NULL},
 +    {TPM_CC_SetPrimaryPolicy, (TSS_CheckParametersFunction_t)TSS_CH_SetPrimaryPolicy, NULL, NULL, NULL},
 +    {TPM_CC_ChangePPS, NULL, NULL, NULL, NULL},
 +    {TPM_CC_ChangeEPS, NULL, NULL, NULL, NULL},
 +    {TPM_CC_Clear, NULL, NULL, NULL, NULL},
 +    {TPM_CC_ClearControl, NULL, NULL, NULL, NULL},
 +    {TPM_CC_HierarchyChangeAuth, NULL, NULL, (TSS_ChangeAuthFunction_t)TSS_CA_HierarchyChangeAuth, NULL},
 +    {TPM_CC_DictionaryAttackLockReset, NULL, NULL, NULL, NULL},
 +    {TPM_CC_DictionaryAttackParameters, NULL, NULL, NULL, NULL},
 +    {TPM_CC_PP_Commands, NULL, NULL, NULL, NULL},
 +    {TPM_CC_SetAlgorithmSet, NULL, NULL, NULL, NULL},
 +    {TPM_CC_ContextSave, NULL, NULL, NULL, (TSS_PostProcessFunction_t)TSS_PO_ContextSave},
 +    {TPM_CC_ContextLoad, NULL, NULL, NULL, (TSS_PostProcessFunction_t)TSS_PO_ContextLoad},
 +    {TPM_CC_FlushContext, NULL, NULL, NULL, (TSS_PostProcessFunction_t)TSS_PO_FlushContext},
 +    {TPM_CC_EvictControl, NULL, NULL, NULL, (TSS_PostProcessFunction_t)TSS_PO_EvictControl},
 +    {TPM_CC_ReadClock, NULL, NULL, NULL, NULL},
 +    {TPM_CC_ClockSet, NULL, NULL, NULL, NULL},
 +    {TPM_CC_ClockRateAdjust, NULL, NULL, NULL, NULL},
 +    {TPM_CC_GetCapability, NULL, NULL, NULL, NULL},
 +    {TPM_CC_TestParms, NULL, NULL, NULL, NULL},
 +    {TPM_CC_NV_DefineSpace, (TSS_CheckParametersFunction_t)TSS_CH_NV_DefineSpace, (TSS_PreProcessFunction_t)TSS_PR_NV_DefineSpace, NULL,  (TSS_PostProcessFunction_t)TSS_PO_NV_DefineSpace},
 +    {TPM_CC_NV_UndefineSpace, NULL, NULL, NULL, (TSS_PostProcessFunction_t)TSS_PO_NV_UndefineSpace},
 +    {TPM_CC_NV_UndefineSpaceSpecial, NULL, NULL, (TSS_ChangeAuthFunction_t)TSS_CA_NV_UndefineSpaceSpecial, (TSS_PostProcessFunction_t)TSS_PO_NV_UndefineSpaceSpecial},
 +    {TPM_CC_NV_ReadPublic, NULL, NULL, NULL, (TSS_PostProcessFunction_t)TSS_PO_NV_ReadPublic},
 +    {TPM_CC_NV_Write, NULL, NULL, NULL, (TSS_PostProcessFunction_t)TSS_PO_NV_Write},
 +    {TPM_CC_NV_Increment, NULL, NULL, NULL, (TSS_PostProcessFunction_t)TSS_PO_NV_Write},
 +    {TPM_CC_NV_Extend, NULL, NULL, NULL, (TSS_PostProcessFunction_t)TSS_PO_NV_Write},
 +    {TPM_CC_NV_SetBits, NULL, NULL, NULL, (TSS_PostProcessFunction_t)TSS_PO_NV_Write},
 +    {TPM_CC_NV_WriteLock, NULL, NULL, NULL, (TSS_PostProcessFunction_t)TSS_PO_NV_WriteLock},
 +    {TPM_CC_NV_GlobalWriteLock, NULL, NULL, NULL, NULL},
 +    {TPM_CC_NV_Read, NULL, NULL, NULL, NULL},
 +    {TPM_CC_NV_ReadLock, NULL, NULL, NULL, (TSS_PostProcessFunction_t)TSS_PO_NV_ReadLock},
 +    {TPM_CC_NV_ChangeAuth, NULL, NULL, (TSS_ChangeAuthFunction_t)TSS_CA_NV_ChangeAuth, NULL},
 +    {TPM_CC_NV_Certify, (TSS_CheckParametersFunction_t)TSS_CH_NV_Certify, NULL, NULL, NULL}
 };
 #ifndef TPM_TSS_NO_PRINT
@@ -646,6 +1014,10 @@ static TPM_RC TSS_Command_ChangeAuthProcessor(TSS_CONTEXT *tssContext,
 					      COMMAND_PARAMETERS *in);
 #endif	/* TPM_TSS_NOCRYPTO */
 +#ifdef TPM_TSS_NODEPRECATEDALGS
 +static TPM_RC TSS_Command_CheckParameters(TPM_CC commandCode,
 +					  COMMAND_PARAMETERS *in);
 +#endif
 static TPM_RC TSS_Command_PreProcessor(TSS_CONTEXT *tssContext,
 				       TPM_CC commandCode,
 				       COMMAND_PARAMETERS *in,
@@ -688,6 +1060,12 @@ TPM_RC TSS_Execute20(TSS_CONTEXT *tssContext,
 {
     TPM_RC		rc = 0;
 +#ifdef TPM_TSS_NODEPRECATEDALGS
 +    if (rc == 0) {
 +	rc = TSS_Command_CheckParameters(commandCode, in);
 +    }
 +#endif
 +
     /* create a TSS authorization context */
     if (rc == 0) {
 	TSS_InitAuthContext(tssContext->tssAuthContext);
@@ -3751,6 +4129,38 @@ static TPM_RC TSS_CA_NV_UndefineSpaceSpecial(TSS_CONTEXT *tssContext,
     return rc;
 }
 +#ifdef TPM_TSS_NODEPRECATEDALGS
 +static TPM_RC TSS_Command_CheckParameters(TPM_CC commandCode,
 +					  COMMAND_PARAMETERS *in)
 +{
 +    TPM_RC 				rc = 0;
 +    size_t 				index;
 +    int 				found;
 +    TSS_CheckParametersFunction_t	checkParametersFunction = NULL;
 +
 +    /* search the table for a check parameters function */
 +    if (rc == 0) {
 +	found = FALSE;
 +	for (index = 0 ; (index < (sizeof(tssTable) / sizeof(TSS_TABLE))) && !found ; index++) {
 +	    if (tssTable[index].commandCode == commandCode) {
 +		found = TRUE;
 +		break;	/* don't increment index if found */
 +	    }
 +	}
 +    }
 +    /* found false means there is no check parameters function.  This permits the table to be smaller
 +       if desired. */
 +    if ((rc == 0) && found) {
 +	checkParametersFunction = tssTable[index].checkParametersFunction;
 +	/* call the check parameters function if there is one */
 +	if (checkParametersFunction != NULL) {
 +	    rc = checkParametersFunction(in);
 +	}
 +    }
 +    return rc;
 +}
 +#endif
 +
 /*
   Command Pre-Processor
 */
 diff --git a/utils/tsscryptoh.c b/utils/tsscryptoh.c
 index 197549d..52f4616 100644
 --- a/utils/tsscryptoh.c
 +++ b/utils/tsscryptoh.c
@@ -454,7 +454,14 @@ TPM_RC TSS_RSA_padding_add_PKCS1_OAEP(unsigned char *em, uint32_t emLen,
     unsigned char *maskedSeed;
     uint16_t hlen = TSS_GetDigestSize(halg);
 -    em[0] = 0x00;	/* firsr byte is 0x00 per the standard */
 +    em[0] = 0x00;	/* first byte is 0x00 per the standard */
 +#ifdef TPM_TSS_NODEPRECATEDALGS
 +    if (rc == 0) {
 +	if (halg == TPM_ALG_SHA1) {
 +	    rc = TSS_RC_BAD_HASH_ALGORITHM;
 +	}
 +    }
 +#endif
     /* 1.a. If the length of L is greater than the input limitation for */
     /* the hash function (2^61-1 octets for SHA-1) then output "parameter */
     /* string too long" and stop. */
 -- 
 2.34.3
--- a/0004-man-Include-information-about-possible-hash-restrict.patch
+++ b/0004-man-Include-information-about-possible-hash-restrict.patch
@ -0,0 +1,593 @@
 From df5038caa1785d2661d283e6eeb1d6d5184d5272 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?=C5=A0t=C4=9Bp=C3=A1n=20Hor=C3=A1=C4=8Dek?=
 <shoracek@redhat.com>
 Date: Mon, 2 May 2022 23:51:15 +0200
 Subject: [PATCH 4/4] man: Include information about possible hash restriction
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 Signed-off-by: Štěpán Horáček <shoracek@redhat.com>
 Signed-off-by: Ken Goldman <kgold@linux.ibm.com>
 ---
 utils/certify.c                               | 2 ++
 utils/certifycreation.c                       | 2 ++
 utils/create.c                                | 2 ++
 utils/createloaded.c                          | 2 ++
 utils/createprimary.c                         | 2 ++
 utils/getcommandauditdigest.c                 | 2 ++
 utils/getsessionauditdigest.c                 | 2 ++
 utils/gettime.c                               | 2 ++
 utils/hash.c                                  | 2 ++
 utils/hashsequencestart.c                     | 2 ++
 utils/hmac.c                                  | 2 ++
 utils/hmacstart.c                             | 2 ++
 utils/importpem.c                             | 2 ++
 utils/loadexternal.c                          | 2 ++
 utils/man/man1/tsscertify.1                   | 2 ++
 utils/man/man1/tsscertifycreation.1           | 2 ++
 utils/man/man1/tsscreate.1                    | 2 ++
 utils/man/man1/tsscreateloaded.1              | 2 ++
 utils/man/man1/tsscreateprimary.1             | 2 ++
 utils/man/man1/tssgetcommandauditdigest.1     | 2 ++
 utils/man/man1/tssgetsessionauditdigest.1     | 2 ++
 utils/man/man1/tssgettime.1                   | 2 ++
 utils/man/man1/tsshash.1                      | 2 ++
 utils/man/man1/tsshashsequencestart.1         | 2 ++
 utils/man/man1/tsshmac.1                      | 2 ++
 utils/man/man1/tsshmacstart.1                 | 2 ++
 utils/man/man1/tssimportpem.1                 | 2 ++
 utils/man/man1/tssloadexternal.1              | 2 ++
 utils/man/man1/tssnvcertify.1                 | 2 ++
 utils/man/man1/tssnvdefinespace.1             | 2 ++
 utils/man/man1/tsspolicysigned.1              | 2 ++
 utils/man/man1/tssquote.1                     | 2 ++
 utils/man/man1/tssrsadecrypt.1                | 2 ++
 utils/man/man1/tsssetcommandcodeauditstatus.1 | 2 ++
 utils/man/man1/tsssetprimarypolicy.1          | 2 ++
 utils/man/man1/tsssign.1                      | 2 ++
 utils/man/man1/tssstartauthsession.1          | 2 ++
 utils/man/man1/tssverifysignature.1           | 2 ++
 utils/nvcertify.c                             | 2 ++
 utils/nvdefinespace.c                         | 2 ++
 utils/policysigned.c                          | 2 ++
 utils/quote.c                                 | 2 ++
 utils/rsadecrypt.c                            | 2 ++
 utils/setcommandcodeauditstatus.c             | 2 ++
 utils/setprimarypolicy.c                      | 2 ++
 utils/sign.c                                  | 2 ++
 utils/startauthsession.c                      | 2 ++
 utils/verifysignature.c                       | 2 ++
 48 files changed, 96 insertions(+)
 diff --git a/utils/certify.c b/utils/certify.c
 index f1f54d0..f9a07c5 100644
 --- a/utils/certify.c
 +++ b/utils/certify.c
@@ -407,5 +407,7 @@ static void printUsage(void)
     printf("\t01\tcontinue\n");
     printf("\t20\tcommand decrypt\n");
     printf("\t40\tresponse encrypt\n");
 +    printf("\n");
 +    printf("Depending on the build configuration, some hash algorithms may not be available.\n");
     exit(1);	
 }
 diff --git a/utils/certifycreation.c b/utils/certifycreation.c
 index ab54c0a..b4fa095 100644
 --- a/utils/certifycreation.c
 +++ b/utils/certifycreation.c
@@ -449,5 +449,7 @@ static void printUsage(void)
     printf("\t01\tcontinue\n");
     printf("\t20\tcommand decrypt\n");
     printf("\t40\tresponse encrypt\n");
 +    printf("\n");
 +    printf("Depending on the build configuration, some hash algorithms may not be available.\n");
     exit(1);	
 }
 diff --git a/utils/create.c b/utils/create.c
 index a8b805c..880af28 100644
 --- a/utils/create.c
 +++ b/utils/create.c
@@ -710,5 +710,7 @@ static void printUsage(void)
     printf("\t01\tcontinue\n");
     printf("\t20\tcommand decrypt\n");
     printf("\t40\tresponse encrypt\n");
 +    printf("\n");
 +    printf("Depending on the build configuration, some hash algorithms may not be available.\n");
     exit(1);	
 }
 diff --git a/utils/createloaded.c b/utils/createloaded.c
 index d54f791..5bcf69e 100644
 --- a/utils/createloaded.c
 +++ b/utils/createloaded.c
@@ -628,5 +628,7 @@ static void printUsage(void)
     printf("\t01\tcontinue\n");
     printf("\t20\tcommand decrypt\n");
     printf("\t40\tresponse encrypt\n");
 +    printf("\n");
 +    printf("Depending on the build configuration, some hash algorithms may not be available.\n");
     exit(1);	
 }
 diff --git a/utils/createprimary.c b/utils/createprimary.c
 index 52ae083..81cc91d 100644
 --- a/utils/createprimary.c
 +++ b/utils/createprimary.c
@@ -799,5 +799,7 @@ static void printUsage(void)
     printf("\t01\tcontinue\n");
     printf("\t20\tcommand decrypt\n");
     printf("\t40\tresponse encrypt\n");
 +    printf("\n");
 +    printf("Depending on the build configuration, some hash algorithms may not be available.\n");
     exit(1);	
 }
 diff --git a/utils/getcommandauditdigest.c b/utils/getcommandauditdigest.c
 index a219785..6412d90 100644
 --- a/utils/getcommandauditdigest.c
 +++ b/utils/getcommandauditdigest.c
@@ -391,5 +391,7 @@ static void printUsage(void)
     printf("\t01\tcontinue\n");
     printf("\t20\tcommand decrypt\n");
     printf("\t40\tresponse encrypt\n");
 +    printf("\n");
 +    printf("Depending on the build configuration, some hash algorithms may not be available.\n");
     exit(1);	
 }
 diff --git a/utils/getsessionauditdigest.c b/utils/getsessionauditdigest.c
 index 61b12e6..4138bc7 100644
 --- a/utils/getsessionauditdigest.c
 +++ b/utils/getsessionauditdigest.c
@@ -387,5 +387,7 @@ static void printUsage(void)
     printf("\t01\tcontinue\n");
     printf("\t20\tcommand decrypt\n");
     printf("\t40\tresponse encrypt\n");
 +    printf("\n");
 +    printf("Depending on the build configuration, some hash algorithms may not be available.\n");
     exit(1);	
 }
 diff --git a/utils/gettime.c b/utils/gettime.c
 index b07baf1..547faa9 100644
 --- a/utils/gettime.c
 +++ b/utils/gettime.c
@@ -391,5 +391,7 @@ static void printUsage(void)
     printf("\t01\tcontinue\n");
     printf("\t20\tcommand decrypt\n");
     printf("\t40\tresponse encrypt\n");
 +    printf("\n");
 +    printf("Depending on the build configuration, some hash algorithms may not be available.\n");
     exit(1);	
 }
 diff --git a/utils/hash.c b/utils/hash.c
 index 71b8a7c..5a0df6a 100644
 --- a/utils/hash.c
 +++ b/utils/hash.c
@@ -306,5 +306,7 @@ static void printUsage(void)
     printf("\t[-ns\tno space, no text, no newlines]\n");
     printf("\t[-oh\thash file name (default do not save)]\n");
     printf("\t[-tk\tticket file name (default do not save)]\n");
 +    printf("\n");
 +    printf("Depending on the build configuration, some hash algorithms may not be available.\n");
     exit(1);	
 }
 diff --git a/utils/hashsequencestart.c b/utils/hashsequencestart.c
 index d54fadd..88d15fc 100644
 --- a/utils/hashsequencestart.c
 +++ b/utils/hashsequencestart.c
@@ -249,5 +249,7 @@ static void printUsage(void)
     printf("\t-se[0-2] session handle / attributes (default NULL)\n");
     printf("\t01\tcontinue\n");
     printf("\t20\tcommand decrypt\n");
 +    printf("\n");
 +    printf("Depending on the build configuration, some hash algorithms may not be available.\n");
     exit(1);	
 }
 diff --git a/utils/hmac.c b/utils/hmac.c
 index be63e1b..7ab2b34 100644
 --- a/utils/hmac.c
 +++ b/utils/hmac.c
@@ -352,5 +352,7 @@ static void printUsage(void)
     printf("\t01\tcontinue\n");
     printf("\t20\tcommand decrypt\n");
     printf("\t40\tresponse encrypt\n");
 +    printf("\n");
 +    printf("Depending on the build configuration, some hash algorithms may not be available.\n");
     exit(1);	
 }
 diff --git a/utils/hmacstart.c b/utils/hmacstart.c
 index 3fdd0f9..171af6c 100644
 --- a/utils/hmacstart.c
 +++ b/utils/hmacstart.c
@@ -274,5 +274,7 @@ static void printUsage(void)
     printf("\n");
     printf("\t-se[0-2] session handle / attributes (default PWAP)\n");
     printf("\t01\tcontinue\n");
 +    printf("\n");
 +    printf("Depending on the build configuration, some hash algorithms may not be available.\n");
     exit(1);	
 }
 diff --git a/utils/importpem.c b/utils/importpem.c
 index 38ad125..75c8cb2 100644
 --- a/utils/importpem.c
 +++ b/utils/importpem.c
@@ -486,5 +486,7 @@ static void printUsage(void)
     printf("\t01\tcontinue\n");
     printf("\t20\tcommand decrypt\n");
     printf("\t40\tresponse encrypt\n");
 +    printf("\n");
 +    printf("Depending on the build configuration, some hash algorithms may not be available.\n");
     exit(1);	
 }
 diff --git a/utils/loadexternal.c b/utils/loadexternal.c
 index 877501c..ff4b46f 100644
 --- a/utils/loadexternal.c
 +++ b/utils/loadexternal.c
@@ -538,5 +538,7 @@ static void printUsage(void)
     printf("\t20\tcommand decrypt\n");
     printf("\t40\tresponse encrypt\n");
     printf("\t80\taudit\n");
 +    printf("\n");
 +    printf("Depending on the build configuration, some hash algorithms may not be available.\n");
     exit(1);	
 }
 diff --git a/utils/man/man1/tsscertify.1 b/utils/man/man1/tsscertify.1
 index 6895ee7..7b34e2f 100644
 --- a/utils/man/man1/tsscertify.1
 +++ b/utils/man/man1/tsscertify.1
@@ -44,3 +44,5 @@ command decrypt
 .TP
 40
 response encrypt
 +.PP
 +Depending on the build configuration, some hash algorithms may not be available.
 diff --git a/utils/man/man1/tsscertifycreation.1 b/utils/man/man1/tsscertifycreation.1
 index 4382ed9..5f51d05 100644
 --- a/utils/man/man1/tsscertifycreation.1
 +++ b/utils/man/man1/tsscertifycreation.1
@@ -47,3 +47,5 @@ command decrypt
 .TP
 40
 response encrypt
 +.PP
 +Depending on the build configuration, some hash algorithms may not be available.
 diff --git a/utils/man/man1/tsscreate.1 b/utils/man/man1/tsscreate.1
 index b4eda75..92f53a7 100644
 --- a/utils/man/man1/tsscreate.1
 +++ b/utils/man/man1/tsscreate.1
@@ -125,3 +125,5 @@ command decrypt
 .TP
 40
 response encrypt
 +.PP
 +Depending on the build configuration, some hash algorithms may not be available.
 diff --git a/utils/man/man1/tsscreateloaded.1 b/utils/man/man1/tsscreateloaded.1
 index ccd3d73..7e6c422 100644
 --- a/utils/man/man1/tsscreateloaded.1
 +++ b/utils/man/man1/tsscreateloaded.1
@@ -126,3 +126,5 @@ command decrypt
 .TP
 40
 response encrypt
 +.PP
 +Depending on the build configuration, some hash algorithms may not be available.
 diff --git a/utils/man/man1/tsscreateprimary.1 b/utils/man/man1/tsscreateprimary.1
 index 895a42e..c189f17 100644
 --- a/utils/man/man1/tsscreateprimary.1
 +++ b/utils/man/man1/tsscreateprimary.1
@@ -129,3 +129,5 @@ command decrypt
 .TP
 40
 response encrypt
 +.PP
 +Depending on the build configuration, some hash algorithms may not be available.
 diff --git a/utils/man/man1/tssgetcommandauditdigest.1 b/utils/man/man1/tssgetcommandauditdigest.1
 index 34711e0..e67adac 100644
 --- a/utils/man/man1/tssgetcommandauditdigest.1
 +++ b/utils/man/man1/tssgetcommandauditdigest.1
@@ -41,3 +41,5 @@ command decrypt
 .TP
 40
 response encrypt
 +.PP
 +Depending on the build configuration, some hash algorithms may not be available.
 diff --git a/utils/man/man1/tssgetsessionauditdigest.1 b/utils/man/man1/tssgetsessionauditdigest.1
 index d09c78b..272127e 100644
 --- a/utils/man/man1/tssgetsessionauditdigest.1
 +++ b/utils/man/man1/tssgetsessionauditdigest.1
@@ -44,3 +44,5 @@ command decrypt
 .TP
 40
 response encrypt
 +.PP
 +Depending on the build configuration, some hash algorithms may not be available.
 diff --git a/utils/man/man1/tssgettime.1 b/utils/man/man1/tssgettime.1
 index bec0627..1cb46f6 100644
 --- a/utils/man/man1/tssgettime.1
 +++ b/utils/man/man1/tssgettime.1
@@ -41,3 +41,5 @@ command decrypt
 .TP
 40
 response encrypt
 +.PP
 +Depending on the build configuration, some hash algorithms may not be available.
 diff --git a/utils/man/man1/tsshash.1 b/utils/man/man1/tsshash.1
 index 6eff929..0a9c54e 100644
 --- a/utils/man/man1/tsshash.1
 +++ b/utils/man/man1/tsshash.1
@@ -28,3 +28,5 @@ hash file name (default do not save)]
 .TP
 [\-tk
 ticket file name (default do not save)]
 +.PP
 +Depending on the build configuration, some hash algorithms may not be available.
 diff --git a/utils/man/man1/tsshashsequencestart.1 b/utils/man/man1/tsshashsequencestart.1
 index f6d7f52..663ae69 100644
 --- a/utils/man/man1/tsshashsequencestart.1
 +++ b/utils/man/man1/tsshashsequencestart.1
@@ -21,3 +21,5 @@ continue
 .TP
 20
 command decrypt
 +.PP
 +Depending on the build configuration, some hash algorithms may not be available.
 diff --git a/utils/man/man1/tsshmac.1 b/utils/man/man1/tsshmac.1
 index e64a861..70d2632 100644
 --- a/utils/man/man1/tsshmac.1
 +++ b/utils/man/man1/tsshmac.1
@@ -35,3 +35,5 @@ command decrypt
 .TP
 40
 response encrypt
 +.PP
 +Depending on the build configuration, some hash algorithms may not be available.
 diff --git a/utils/man/man1/tsshmacstart.1 b/utils/man/man1/tsshmacstart.1
 index 65d4ab6..64bcf2f 100644
 --- a/utils/man/man1/tsshmacstart.1
 +++ b/utils/man/man1/tsshmacstart.1
@@ -23,3 +23,5 @@ password for sequence (default empty)
 .TP
 01
 continue
 +.PP
 +Depending on the build configuration, some hash algorithms may not be available.
 diff --git a/utils/man/man1/tssimportpem.1 b/utils/man/man1/tssimportpem.1
 index 21c362e..bf79c92 100644
 --- a/utils/man/man1/tssimportpem.1
 +++ b/utils/man/man1/tssimportpem.1
@@ -67,3 +67,5 @@ command decrypt
 .TP
 40
 response encrypt
 +.PP
 +Depending on the build configuration, some hash algorithms may not be available.
 diff --git a/utils/man/man1/tssloadexternal.1 b/utils/man/man1/tssloadexternal.1
 index e32a251..2a9ba66 100644
 --- a/utils/man/man1/tssloadexternal.1
 +++ b/utils/man/man1/tssloadexternal.1
@@ -71,3 +71,5 @@ response encrypt
 .TP
 80
 audit
 +.PP
 +Depending on the build configuration, some hash algorithms may not be available.
 diff --git a/utils/man/man1/tssnvcertify.1 b/utils/man/man1/tssnvcertify.1
 index c55f6dc..83d2380 100644
 --- a/utils/man/man1/tssnvcertify.1
 +++ b/utils/man/man1/tssnvcertify.1
@@ -50,3 +50,5 @@ command decrypt
 .TP
 40
 response encrypt
 +.PP
 +Depending on the build configuration, some hash algorithms may not be available.
 diff --git a/utils/man/man1/tssnvdefinespace.1 b/utils/man/man1/tssnvdefinespace.1
 index 0f378e9..642508b 100644
 --- a/utils/man/man1/tssnvdefinespace.1
 +++ b/utils/man/man1/tssnvdefinespace.1
@@ -99,3 +99,5 @@ continue
 .TP
 20
 command decrypt
 +.PP
 +Depending on the build configuration, some hash algorithms may not be available.
 diff --git a/utils/man/man1/tsspolicysigned.1 b/utils/man/man1/tsspolicysigned.1
 index f50b81a..2f745c0 100644
 --- a/utils/man/man1/tsspolicysigned.1
 +++ b/utils/man/man1/tsspolicysigned.1
@@ -44,3 +44,5 @@ ticket file name]
 .TP
 [\-to
 timeout file name]
 +.PP
 +Depending on the build configuration, some hash algorithms may not be available.
 diff --git a/utils/man/man1/tssquote.1 b/utils/man/man1/tssquote.1
 index 04a2e60..fef5c39 100644
 --- a/utils/man/man1/tssquote.1
 +++ b/utils/man/man1/tssquote.1
@@ -44,3 +44,5 @@ command decrypt
 .TP
 40
 response encrypt
 +.PP
 +Depending on the build configuration, some hash algorithms may not be available.
 diff --git a/utils/man/man1/tssrsadecrypt.1 b/utils/man/man1/tssrsadecrypt.1
 index 6c35e42..ab77103 100644
 --- a/utils/man/man1/tssrsadecrypt.1
 +++ b/utils/man/man1/tssrsadecrypt.1
@@ -31,3 +31,5 @@ command decrypt
 .TP
 40
 response encrypt
 +.PP
 +Depending on the build configuration, some hash algorithms may not be available.
 diff --git a/utils/man/man1/tsssetcommandcodeauditstatus.1 b/utils/man/man1/tsssetcommandcodeauditstatus.1
 index c4d19dc..7d44fb2 100644
 --- a/utils/man/man1/tsssetcommandcodeauditstatus.1
 +++ b/utils/man/man1/tsssetcommandcodeauditstatus.1
@@ -29,3 +29,5 @@ continue
 .TP
 20
 command decrypt
 +.PP
 +Depending on the build configuration, some hash algorithms may not be available.
 diff --git a/utils/man/man1/tsssetprimarypolicy.1 b/utils/man/man1/tsssetprimarypolicy.1
 index c67c1f9..a3db8d2 100644
 --- a/utils/man/man1/tsssetprimarypolicy.1
 +++ b/utils/man/man1/tsssetprimarypolicy.1
@@ -26,3 +26,5 @@ continue
 .TP
 20
 command decrypt
 +.PP
 +Depending on the build configuration, some hash algorithms may not be available.
 diff --git a/utils/man/man1/tsssign.1 b/utils/man/man1/tsssign.1
 index d5ad351..83d3cfa 100644
 --- a/utils/man/man1/tsssign.1
 +++ b/utils/man/man1/tsssign.1
@@ -46,3 +46,5 @@ continue
 .TP
 20
 command decrypt
 +.PP
 +Depending on the build configuration, some hash algorithms may not be available.
 diff --git a/utils/man/man1/tssstartauthsession.1 b/utils/man/man1/tssstartauthsession.1
 index 3e944bb..0bb5022 100644
 --- a/utils/man/man1/tssstartauthsession.1
 +++ b/utils/man/man1/tssstartauthsession.1
@@ -35,3 +35,5 @@ bind password for bind handle (default empty)]
 .TP
 [\-on
 nonceTPM file for policy session (default do not save)]
 +.PP
 +Depending on the build configuration, some hash algorithms may not be available.
 diff --git a/utils/man/man1/tssverifysignature.1 b/utils/man/man1/tssverifysignature.1
 index e2d6460..67b7ff5 100644
 --- a/utils/man/man1/tssverifysignature.1
 +++ b/utils/man/man1/tssverifysignature.1
@@ -57,3 +57,5 @@ command decrypt
 .TP
 80
 audit
 +.PP
 +Depending on the build configuration, some hash algorithms may not be available.
 diff --git a/utils/nvcertify.c b/utils/nvcertify.c
 index 81bde69..6882bfb 100644
 --- a/utils/nvcertify.c
 +++ b/utils/nvcertify.c
@@ -445,5 +445,7 @@ static void printUsage(void)
     printf("\t01\tcontinue\n");
     printf("\t20\tcommand decrypt\n");
     printf("\t40\tresponse encrypt\n");
 +    printf("\n");
 +    printf("Depending on the build configuration, some hash algorithms may not be available.\n");
     exit(1);	
 }
 diff --git a/utils/nvdefinespace.c b/utils/nvdefinespace.c
 index 18ce6ea..94e6cbd 100644
 --- a/utils/nvdefinespace.c
 +++ b/utils/nvdefinespace.c
@@ -590,5 +590,7 @@ static void printUsage(void)
     printf("\t-se[0-2] session handle / attributes (default PWAP)\n");
     printf("\t01\tcontinue\n");
     printf("\t20\tcommand decrypt\n");
 +    printf("\n");
 +    printf("Depending on the build configuration, some hash algorithms may not be available.\n");
     exit(1);	
 }
 diff --git a/utils/policysigned.c b/utils/policysigned.c
 index 469cec9..8283464 100644
 --- a/utils/policysigned.c
 +++ b/utils/policysigned.c
@@ -452,5 +452,7 @@ static void printUsage(void)
     printf("\t[-pwdk\tsigning key password (default null)]\n");
     printf("\t[-tk\tticket file name]\n");
     printf("\t[-to\ttimeout file name]\n");
 +    printf("\n");
 +    printf("Depending on the build configuration, some hash algorithms may not be available.\n");
     exit(1);	
 }
 diff --git a/utils/quote.c b/utils/quote.c
 index c29fad0..7523578 100644
 --- a/utils/quote.c
 +++ b/utils/quote.c
@@ -435,5 +435,7 @@ static void printUsage(void)
     printf("\t01\tcontinue\n");
     printf("\t20\tcommand decrypt\n");
     printf("\t40\tresponse encrypt\n");
 +    printf("\n");
 +    printf("Depending on the build configuration, some hash algorithms may not be available.\n");
     exit(1);	
 }
 diff --git a/utils/rsadecrypt.c b/utils/rsadecrypt.c
 index e2846af..fe5086a 100644
 --- a/utils/rsadecrypt.c
 +++ b/utils/rsadecrypt.c
@@ -507,5 +507,7 @@ static void printUsage(void)
     printf("\t01\tcontinue\n");
     printf("\t20\tcommand decrypt\n");
     printf("\t40\tresponse encrypt\n");
 +    printf("\n");
 +    printf("Depending on the build configuration, some hash algorithms may not be available.\n");
     exit(1);	
 }
 diff --git a/utils/setcommandcodeauditstatus.c b/utils/setcommandcodeauditstatus.c
 index 7a880ae..ddecad5 100644
 --- a/utils/setcommandcodeauditstatus.c
 +++ b/utils/setcommandcodeauditstatus.c
@@ -294,5 +294,7 @@ static void printUsage(void)
     printf("\t-se[0-2] session handle / attributes (default PWAP)\n");
     printf("\t01\tcontinue\n");
     printf("\t20\tcommand decrypt\n");
 +    printf("\n");
 +    printf("Depending on the build configuration, some hash algorithms may not be available.\n");
     exit(1);	
 }
 diff --git a/utils/setprimarypolicy.c b/utils/setprimarypolicy.c
 index 619937f..c03883f 100644
 --- a/utils/setprimarypolicy.c
 +++ b/utils/setprimarypolicy.c
@@ -296,5 +296,7 @@ static void printUsage(void)
     printf("\t-se[0-2] session handle / attributes (default PWAP)\n");
     printf("\t01\tcontinue\n");
     printf("\t20\tcommand decrypt\n");
 +    printf("\n");
 +    printf("Depending on the build configuration, some hash algorithms may not be available.\n");
     exit(1);	
 }
 diff --git a/utils/sign.c b/utils/sign.c
 index 0635366..f31196b 100644
 --- a/utils/sign.c
 +++ b/utils/sign.c
@@ -485,5 +485,7 @@ static void printUsage(void)
     printf("\t-se[0-2] session handle / attributes (default PWAP)\n");
     printf("\t01\tcontinue\n");
     printf("\t20\tcommand decrypt\n");
 +    printf("\n");
 +    printf("Depending on the build configuration, some hash algorithms may not be available.\n");
     exit(1);	
 }
 diff --git a/utils/startauthsession.c b/utils/startauthsession.c
 index d47c731..e6ddd5a 100644
 --- a/utils/startauthsession.c
 +++ b/utils/startauthsession.c
@@ -297,5 +297,7 @@ static void printUsage(void)
     printf("\t[-pwdb\tbind password for bind handle (default empty)]\n");
     printf("\t[-sym\t(xor, aes) symmetric parameter encryption algorithm (default xor)]\n");
     printf("\t[-on\tnonceTPM file for policy session (default do not save)]\n");
 +    printf("\n");
 +    printf("Depending on the build configuration, some hash algorithms may not be available.\n");
     exit(1);	
 }
 diff --git a/utils/verifysignature.c b/utils/verifysignature.c
 index 57978d5..41ba05b 100644
 --- a/utils/verifysignature.c
 +++ b/utils/verifysignature.c
@@ -484,5 +484,7 @@ static void printUsage(void)
     printf("\t01\tcontinue\n");
     printf("\t20\tcommand decrypt\n");
     printf("\t80\taudit\n");
 +    printf("\n");
 +    printf("Depending on the build configuration, some hash algorithms may not be available.\n");
     exit(1);	
 }
 -- 
 2.34.3
--- a/0004-utils-Clean-up-certifyx509-memory-allocation.patch
+++ b/0004-utils-Clean-up-certifyx509-memory-allocation.patch
@ -0,0 +1,111 @@
 From d77514273aa88f67b85c398a222ab2195c42f5fd Mon Sep 17 00:00:00 2001
 From: Ken Goldman <kgold@linux.ibm.com>
 Date: Tue, 31 Aug 2021 13:45:21 -0400
 Subject: [PATCH 4/7] utils: Clean up certifyx509 memory allocation
 Make TPM_ADDTOCERT input const.  Annotate malloc and free calls.  Free
 TPM_PARTIAL_CERT.  Use TPM_ADDTOCERT_free.  Remove unused
 x509IssuerName and x509SubjectName and their frees.  Free
 TPM_PARTIAL_CERT issuer and subject because createX509Name() mallocs.
 Signed-off-by: Ken Goldman <kgold@linux.ibm.com>
 ---
 utils/certifyx509.c | 26 +++++++++++++++++---------
 1 file changed, 17 insertions(+), 9 deletions(-)
 diff --git a/utils/certifyx509.c b/utils/certifyx509.c
 index 5602f62..8ac5abd 100644
 --- a/utils/certifyx509.c
 +++ b/utils/certifyx509.c
@@ -147,7 +147,7 @@ TPM_RC createPartialCertificate(TPM_PARTIAL_CERT *certificate,
 TPM_RC reformCertificate(X509 			*x509Certificate,
 			 TPMI_ALG_HASH		halg,
 			 TPMI_ALG_SIG_SCHEME   	scheme,
 -			 TPM_ADDTOCERT		*addToCert,
 +			 const TPM_ADDTOCERT	*addToCert,
 			 TPMT_SIGNATURE 	*tSignature);
 TPM_RC addSignatureRsa(X509 		*x509Certificate,
 		       TPMI_ALG_HASH	halg,
@@ -618,7 +618,7 @@ int main(int argc, char *argv[])
     if (rc == 0) {
 	if (verbose) X509_print_fp(stdout, x509Certificate);	/* for debug */
 	rc = convertX509ToDer(&x509DerLength,
 -			      &x509Der,				/* freed @2 */
 +			      &x509Der,				/* freed @4 */
 			      x509Certificate);
     }
     if ((rc == 0) && (outCertificateFilename != NULL)) {
@@ -628,8 +628,13 @@ int main(int argc, char *argv[])
     if (x509Certificate != NULL) {
 	X509_free(x509Certificate);			/* @1 */
     }
 -    free(x509Der);					/* @2 */
 -    OPENSSL_free(addToCert);				/* @3 */
 +    if (partialCertificate != NULL) {
 +	TPM_PARTIAL_CERT_free(partialCertificate);	/* @2 */
 +    }
 +    if (addToCert != NULL) {
 +	TPM_ADDTOCERT_free(addToCert);			/* @3 */
 +    }
 +    free(x509Der);					/* @4 */
     return rc;
 }
@@ -683,8 +688,6 @@ TPM_RC createPartialCertificate(TPM_PARTIAL_CERT *partialCertificate,	/* input /
     int		irc;
     ASN1_TIME	*arc;			/* return code */
 -    X509_NAME 	*x509IssuerName = NULL;	/* composite issuer name, key/value pairs */
 -    X509_NAME 	*x509SubjectName = NULL;/* composite subject name, key/value pairs */
     size_t	issuerEntriesSize = sizeof(issuerEntries)/sizeof(char *);
     size_t	subjectEntriesSize = sizeof(subjectEntries)/sizeof(char *);
     uint8_t 	*tmpPartialDer = NULL;	/* for the i2d */
@@ -693,6 +696,9 @@ TPM_RC createPartialCertificate(TPM_PARTIAL_CERT *partialCertificate,	/* input /
     if (rc == 0) {
 	if (verbose) printf("createPartialCertificate: Adding issuer, size %lu\n",
 			    (unsigned long)issuerEntriesSize);
 +	/* _new allocates the member.  free it because createX509Name() allocates a new structure */
 +	X509_NAME_free(partialCertificate->issuer);
 +	partialCertificate->issuer = NULL;
 	rc = createX509Name(&partialCertificate->issuer,	/* freed @1 */
 			    issuerEntriesSize,
 			    issuerEntries);
@@ -746,6 +752,8 @@ TPM_RC createPartialCertificate(TPM_PARTIAL_CERT *partialCertificate,	/* input /
 	if (!subeqiss) {
 	    if (verbose) printf("createPartialCertificate: Adding subject, size %lu\n",
 				(unsigned long)subjectEntriesSize);
 +	    X509_NAME_free(partialCertificate->subject);
 +	    partialCertificate->subject = NULL;
 	    rc = createX509Name(&partialCertificate->subject,	/* freed @2 */
 				subjectEntriesSize,
 				subjectEntries);
@@ -754,6 +762,8 @@ TPM_RC createPartialCertificate(TPM_PARTIAL_CERT *partialCertificate,	/* input /
 	else {
 	    if (verbose) printf("createPartialCertificate: Adding subject (issuer), size %lu\n",
 				(unsigned long)issuerEntriesSize);
 +	    X509_NAME_free(partialCertificate->subject);
 +	    partialCertificate->subject = NULL;
 	    rc = createX509Name(&partialCertificate->subject,	/* freed @2 */
 				issuerEntriesSize,
 				issuerEntries);
@@ -806,8 +816,6 @@ TPM_RC createPartialCertificate(TPM_PARTIAL_CERT *partialCertificate,	/* input /
 	if (verbose) X509_print_fp(stdout, x509Certificate);
     }
 #endif
 -    X509_NAME_free(x509IssuerName);	/* @1 */
 -    X509_NAME_free(x509SubjectName);	/* @2 */
     OPENSSL_free(tmpPartialDer);	/* @3 */
     return rc;
 }
@@ -956,7 +964,7 @@ TPM_RC addPartialCertExtensionTpmaOid(TPM_PARTIAL_CERT  *partialCertificate,
 TPM_RC reformCertificate(X509 			*x509Certificate,
 			 TPMI_ALG_HASH		halg,
 			 TPMI_ALG_SIG_SCHEME   	scheme,
 -			 TPM_ADDTOCERT		*addToCert,
 +			 const TPM_ADDTOCERT	*addToCert,
 			 TPMT_SIGNATURE 	*tSignature)
 {
     TPM_RC 		rc = 0;
 -- 
 2.34.1
--- a/0005-utils-Fix-errors-detected-by-gcc-asan.patch
+++ b/0005-utils-Fix-errors-detected-by-gcc-asan.patch
@ -0,0 +1,91 @@
 From bcbc2f0400cfc2f596283e8c528aed4576bfea69 Mon Sep 17 00:00:00 2001
 From: Ken Goldman <kgold@linux.ibm.com>
 Date: Fri, 3 Sep 2021 14:58:20 -0400
 Subject: [PATCH 5/7] utils: Fix errors detected by gcc asan
 In Uint32_Convert(), case the byte to uint32_t before the left shift
 24 to suppress a warning.
 In TSS_EFI_GetNameIndex(), do not compare data if the length does not
 match, because this could cause a buffer overflow.  Test should be &&,
 not &.
 TSS_Delete should only memset sessionData if the pointer is not NULL.
 Signed-off-by: Ken Goldman <kgold@linux.ibm.com>
 ---
 utils/efilib.c   | 11 +++++++----
 utils/eventlib.c | 10 +++++-----
 utils/tss.c      |  6 ++++--
 3 files changed, 16 insertions(+), 11 deletions(-)
 diff --git a/utils/efilib.c b/utils/efilib.c
 index 201a1f5..ab8177b 100644
 --- a/utils/efilib.c
 +++ b/utils/efilib.c
@@ -399,16 +399,19 @@ static void TSS_EFI_GetNameIndex(size_t *index,
 				 const uint8_t *name,
 				 uint64_t nameLength)	/* half the total bytes in array */
 {
 -    int m1,m2;
 +    int m1 = 0;
 +    int m2 = 0;
     for (*index = 0 ;
 	 *index < sizeof(tagTable) / sizeof(TAG_TABLE)  ;
 	 (*index)++) {
 	/* length match */
 	m1 = (nameLength * 2) == tagTable[*index].nameLength;
 -	/* string match */
 -	m2 = memcmp(name, tagTable[*index].name, (size_t)(nameLength * 2)) == 0;
 -	if (m1 & m2) {
 +	if (m1) {
 +	    /* string match */
 +	    m2 = memcmp(name, tagTable[*index].name, (size_t)(nameLength * 2)) == 0;
 +	}
 +	if (m1 && m2) {
 	    return;
 	}
     }
 diff --git a/utils/eventlib.c b/utils/eventlib.c
 index 0c2801c..c56a22f 100644
 --- a/utils/eventlib.c
 +++ b/utils/eventlib.c
@@ -1346,12 +1346,12 @@ static uint32_t Uint32_Convert(uint32_t in)
 {
     uint32_t out = 0;
     unsigned char *inb = (unsigned char *)&in;
 -    
 +
     /* little endian input */
 -    out = (inb[0] <<  0) |
 -	  (inb[1] <<  8) |
 -	  (inb[2] << 16) |
 -	  (inb[3] << 24);
 +    out = ((((uint32_t)inb[0]) <<  0) |
 +	   (((uint32_t)inb[1]) <<  8) |
 +	   (((uint32_t)inb[2]) << 16) |
 +	   (((uint32_t)inb[3]) << 24));
     return out;
 }
 #endif /* TPM_TSS_NOFILE */
 diff --git a/utils/tss.c b/utils/tss.c
 index 574c448..6f0eede 100644
 --- a/utils/tss.c
 +++ b/utils/tss.c
@@ -179,8 +179,10 @@ TPM_RC TSS_Delete(TSS_CONTEXT *tssContext)
 	    for (i = 0 ; i < (sizeof(tssContext->sessions) / sizeof(TSS_SESSIONS)) ; i++) {
 		tssContext->sessions[i].sessionHandle = TPM_RH_NULL;
 		/* erase any secrets */
 -		memset(tssContext->sessions[i].sessionData,
 -		       0, tssContext->sessions[i].sessionDataLength);
 +		if (tssContext->sessions[i].sessionData != NULL) {
 +		    memset(tssContext->sessions[i].sessionData,
 +			   0, tssContext->sessions[i].sessionDataLength);
 +		}
 		free(tssContext->sessions[i].sessionData);
 		tssContext->sessions[i].sessionData = NULL;
 		tssContext->sessions[i].sessionDataLength = 0;
 -- 
 2.34.1
--- a/0006-tss-Port-HMAC-operations-to-openssl-3.0.patch
+++ b/0006-tss-Port-HMAC-operations-to-openssl-3.0.patch
@ -0,0 +1,103 @@
 From 7128994537a7103b25acb1df238db747d7cb3274 Mon Sep 17 00:00:00 2001
 From: Ken Goldman <kgold@linux.ibm.com>
 Date: Fri, 10 Sep 2021 16:33:10 -0400
 Subject: [PATCH 6/7] tss: Port HMAC operations to openssl 3.0
 Replace the deprecated APIs.
 - Compared to the next branch commit 6e22032d, changes related to HMAC are
  ommited.
 Signed-off-by: Ken Goldman <kgold@linux.ibm.com>
 ---
 utils/tsscrypto.c | 58 ++++++++++++++++++++++++++++++-----------------
 1 file changed, 37 insertions(+), 21 deletions(-)
 diff --git a/utils/tsscrypto.c b/utils/tsscrypto.c
 index 23d3b6e..1974563 100644
 --- a/utils/tsscrypto.c
 +++ b/utils/tsscrypto.c
@@ -79,6 +79,7 @@ extern int tssVerbose;
 /* local prototypes */
 +static TPM_RC TSS_Hash_GetOsslString(const char **str, TPMI_ALG_HASH hashAlg);
 static TPM_RC TSS_Hash_GetMd(const EVP_MD **md,
 			     TPMI_ALG_HASH hashAlg);
@@ -129,36 +130,51 @@ TPM_RC TSS_Crypto_Init(void)
   Digests
 */
 -static TPM_RC TSS_Hash_GetMd(const EVP_MD **md,
 -			     TPMI_ALG_HASH hashAlg)
 +/* TSS_Hash_GetString() maps from the TCG hash algorithm to the OpenSSL string */
 +
 +static TPM_RC TSS_Hash_GetOsslString(const char **str, TPMI_ALG_HASH hashAlg)
 {
 -    TPM_RC		rc = 0;
 +    TPM_RC	rc = 0;
 -    if (rc == 0) {
 -	switch (hashAlg) {
 +    switch (hashAlg) {
 #ifdef TPM_ALG_SHA1
 -	  case TPM_ALG_SHA1:
 -	    *md = EVP_get_digestbyname("sha1");
 -	    break;
 +      case TPM_ALG_SHA1:
 +	*str = "sha1";
 +	break;
 #endif
 -#ifdef TPM_ALG_SHA256	
 -	  case TPM_ALG_SHA256:
 -	    *md = EVP_get_digestbyname("sha256");
 -	    break;
 +#ifdef TPM_ALG_SHA256
 +      case TPM_ALG_SHA256:
 +	*str = "sha256";
 +	break;
 #endif
 #ifdef TPM_ALG_SHA384
 -	  case 	TPM_ALG_SHA384:
 -	    *md = EVP_get_digestbyname("sha384");
 -	    break;
 +      case TPM_ALG_SHA384:
 +	*str = "sha384";
 +	break;
 #endif
 #ifdef TPM_ALG_SHA512
 -	  case 	TPM_ALG_SHA512:
 -	    *md = EVP_get_digestbyname("sha512");
 -	    break;
 +      case TPM_ALG_SHA512:
 +	*str = "sha512";
 +	break;
 #endif
 -	  default:
 -	    rc = TSS_RC_BAD_HASH_ALGORITHM;
 -	}
 +      default:
 +	*str = NULL;
 +	rc = TSS_RC_BAD_HASH_ALGORITHM;
 +    }
 +    return rc;
 +}
 +
 +static TPM_RC TSS_Hash_GetMd(const EVP_MD **md,
 +			     TPMI_ALG_HASH hashAlg)
 +{
 +    TPM_RC		rc = 0;
 +    const char 		*str = NULL; 
 +
 +    if (rc == 0) {
 +	rc =  TSS_Hash_GetOsslString(&str, hashAlg);
 +    }
 +    if (rc == 0) {
 +	*md = EVP_get_digestbyname(str);
     }
     return rc;
 }
 -- 
 2.34.1
--- a/0007-utils-Port-to-openssl-3.0.0-replaces-RSA-with-EVP_PK.patch
+++ b/0007-utils-Port-to-openssl-3.0.0-replaces-RSA-with-EVP_PK.patch
--- a/SOURCES/0001-tss2-fix-bounds-check-in-IMA_Event_PcrExtend.patch
+++ b/SOURCES/0001-tss2-fix-bounds-check-in-IMA_Event_PcrExtend.patch
@ -1,31 +0,0 @@
 From 8f232900d3b8f8af65a029f49c17ee53d3cca122 Mon Sep 17 00:00:00 2001
 From: Jerry Snitselaar <jsnitsel@redhat.com>
 Date: Thu, 6 Jun 2019 14:53:18 -0700
 Subject: [PATCH] tss2: fix bounds check in IMA_Event_PcrExtend
 pcrs is declared with IMPLEMENTATION_PCR elements,
 so the index bounds check should be >= IMPLEMENTATION_PCR
 since indexing at value IMPLEMENTATION_PCR would be off the
 end of the array. This was flagged by coverity.
 Signed-off-by: Jerry Snitselaar <jsnitsel@redhat.com>
 ---
 utils/imalib.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/utils/imalib.c b/utils/imalib.c
 index 4957c1b..a841cd6 100644
 --- a/utils/imalib.c
 +++ b/utils/imalib.c
@@ -1306,7 +1306,7 @@ uint32_t IMA_Event_PcrExtend(TPMT_HA pcrs[IMA_PCR_BANKS][IMPLEMENTATION_PCR],
     /* validate PCR number */
     if (rc == 0) {
 -	if (imaEvent->pcrIndex > IMPLEMENTATION_PCR) {
 +	if (imaEvent->pcrIndex >= IMPLEMENTATION_PCR) {
 	    printf("ERROR: IMA_Event_PcrExtend: PCR number %u out of range\n", imaEvent->pcrIndex);
 	    rc = TSS_RC_BAD_PROPERTY;
 	}
 -- 
 2.21.0
--- a/SOURCES/flags-fixup.patch
+++ b/SOURCES/flags-fixup.patch
@ -1,33 +0,0 @@
 diff -ur tss2-1234/utils/makefile-common tss2-1234-new/utils/makefile-common
 --- tss2-1234/utils/makefile-common	2018-05-29 12:00:46.000000000 -0700
 +++ tss2-1234-new/utils/makefile-common	2018-10-02 15:10:20.783078580 -0700
@@ -44,7 +44,7 @@
 CCFLAGS += 				\
 	-Wall -W -Wmissing-declarations -Wmissing-prototypes -Wnested-externs \
 	-Wformat=2 -Wold-style-definition -Wno-self-assign \
 -	-ggdb -O0 -c
 +	-ggdb -c
 # to compile with optimizations on (warning will result)
 #	-O3 -c
 diff -ur tss2-1234/utils/makefile.fedora tss2-1234-new/utils/makefile.fedora
 --- tss2-1234/utils/makefile.fedora	2018-05-15 10:07:20.000000000 -0700
 +++ tss2-1234-new/utils/makefile.fedora	2018-10-02 15:11:33.909083615 -0700
@@ -71,7 +71,7 @@
 # compile - common flags for TSS library and applications
 -CCFLAGS += 	-DTPM_POSIX
 +CCFLAGS += 	-DTPM_POSIX -DTPM_INTERFACE_TYPE_DEFAULT="\"dev\"" -DTPM_DEVICE_DEFAULT="\"/dev/tpmrm0\""
 # example of pointing to a locally built openssl 1.1
 # CCFLAGS += 	-I/home/kgold/openssl-1.1.0c/include
@@ -119,7 +119,7 @@
 LNLFLAGS += -shared -Wl,-z,now
 # This is an alternative to using the bfd linker on Ubuntu
 -# LNLLIBS += -lcrypto
 +LNLLIBS += -lcrypto
 # link - for applications, TSS path, TSS and OpenSSl libraries
--- a/SOURCES/hash_generate.patch
+++ b/SOURCES/hash_generate.patch
@ -1,18 +0,0 @@
 diff -ur tss2-1234/utils/policymaker.c tss2-1234-new/utils/policymaker.c
 --- tss2-1234/utils/policymaker.c	2018-10-18 12:16:59.742439220 -0700
 +++ tss2-1234-new/utils/policymaker.c	2018-10-18 12:34:34.991755536 -0700
@@ -208,10 +208,10 @@
 	}
 	/* hash extend */
 	if ((rc == 0) && (prc != NULL)) {
 -	    TSS_Hash_Generate(&digest,
 -			      startSizeInBytes, (uint8_t *)&digest.digest,	/* extend */
 -			      lineLength /2, lineBinary,
 -			      0, NULL);
 +	    rc = TSS_Hash_Generate(&digest,
 +				   startSizeInBytes, (uint8_t *)&digest.digest,	/* extend */
 +				   lineLength /2, lineBinary,
 +				   0, NULL);
 	}
 	if ((rc == 0) && (prc != NULL)) {
 	    if (verbose) TSS_PrintAll("intermediate policy digest",
--- a/SPECS/tss2.spec
+++ b/SPECS/tss2.spec
@ -1,170 +0,0 @@
 #
 # Spec file for IBM's TSS for the TPM 2.0
 #
 %{!?__global_ldflags: %global __global_ldflags -Wl,-z,relro}
 Name:		tss2
 Version:	1331
 Release:	2%{?dist}
 Summary:	IBM's TCG Software Stack (TSS) for TPM 2.0 and related utilities
 Group:		Applications/System	
 License:	BSD
 URL:		http://sourceforge.net/projects/ibmtpm20tss/
 Source0:	https://sourceforge.net/projects/ibmtpm20tss/files/ibmtss%{version}.tar.gz
 Patch4: flags-fixup.patch
 # reported upstream https://sourceforge.net/p/ibmtpm20tss/mailman/message/36444738/
 # and reported fixed, but not yet pushed to sourceforge.
 Patch5: hash_generate.patch
 # Submitted upstream
 Patch6: 0001-tss2-fix-bounds-check-in-IMA_Event_PcrExtend.patch
 BuildRequires:	openssl-devel
 BuildRequires:  gcc
 Requires:	openssl
 %description
 TSS2 is a user space Trusted Computing Group's Software Stack (TSS) for
 TPM 2.0.  It implements the functionality equivalent to the TCG TSS
 working group's ESAPI, SAPI, and TCTI layers (and perhaps more) but with
 a hopefully far simpler interface.
 It comes with about 80 "TPM tools" that can be used for rapid prototyping,
 education and debugging. 
 %package devel
 Summary:	Development libraries and headers for IBM's TSS 2.0
 Group:		Development/Libraries
 Requires:	%{name}%{?_isa} = %{version}-%{release}
 %description devel
 Development libraries and headers for IBM's TSS 2.0. You will need this in
 order to build TSS 2.0 applications.
 %define incname ibmtss
 %prep
 %autosetup -p1 -c %{name}-%{version}
 %build
 # nonstandard variable names are used in place of CFLAGS and LDFLAGS
 pushd utils
 CCFLAGS="%{optflags}" \
 LNFLAGS="%{__global_ldflags}" \
 make -f makefile.fedora %{?_smp_mflags} 
 popd
 %install
 # Prefix for namespacing
 BIN_PREFIX=tss
 mkdir -p %{buildroot}/%{_bindir}
 mkdir -p %{buildroot}/%{_libdir}
 mkdir -p %{buildroot}/%{_includedir}/%{incname}/
 mkdir -p %{buildroot}/%{_mandir}/man1
 pushd utils
 # Pick out executables and copy with namespacing
 for f in *; do
 	if [[ -x $f && -f $f && ! $f =~ .*\..* ]]; then
 		cp -p $f %{buildroot}/%{_bindir}/${BIN_PREFIX}$f
 	fi;
 done
 cp -p *.so.1.1 %{buildroot}/%{_libdir}
 cp -p %{incname}/*.h %{buildroot}/%{_includedir}/%{incname}/
 cp -p man/man1/tss*.1 %{buildroot}/%{_mandir}/man1/
 popd
 # Make symbolic links to the shared lib
 pushd %{buildroot}/%{_libdir}
 rm -f libibmtss.so.1
 ln -sf libibmtss.so.1.1 libibmtss.so.1
 rm -f libibmtss.so
 ln -sf libibmtss.so.1 libibmtss.so
 popd
 %post -p /sbin/ldconfig 
 %postun -p /sbin/ldconfig
 %files
 %license LICENSE
 %{_bindir}/tss*
 %{_libdir}/libibmtss.so.1
 %{_libdir}/libibmtss.so.1.*
 %attr(0644, root, root) %{_mandir}/man1/tss*.1*
 %files devel
 %{_includedir}/%{incname}
 %{_libdir}/libibmtss.so
 %doc ibmtss.doc
 %changelog
 * Thu Jun 06 2019 Jerry Snitselaar <jsnitsel@redhat.com> - 1331-2
 - Fix bounds check in IMA_Event_PcrExtend
 resolves: rhbz#1669239
 * Thu May 30 2019 Jerry Snitselaar <jsnitsel@redhat.com> - 1331-1
 - Rebase to v1331
 - Add initial CI gating support
 resolves: rhbz#1669239
 * Fri Oct 05 2018 Jerry Snitselaar <jsnitsel@redhat.com> - 1234-5
 - Move header files to ibmtss directory.
 - Check return value of TSS_Hash_Generate.
 resolves: rhbz#1636245
 * Tue Oct 02 2018 Jerry Snitselaar <jsnitsel@redhat.com> - 1234-4
 - Fix compile and link flags
 resolves: rhbz#1624182
 * Thu Jul 19 2018 Jerry Snitselaar <jsnitsel@redhat.com> - 1234-3
 - Clean up covscan issues.
 * Sat Jul 14 2018 Fedora Release Engineering <releng@fedoraproject.org> - 1234-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
 * Mon Jun 18 2018 Jerry Snitselaar <jsnitsel@redhat.com> - 1234-1
 - Version bump.
 * Fri Feb 09 2018 Fedora Release Engineering <releng@fedoraproject.org> - 1027-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
 * Fri Jan 19 2018 Merlin Mathesius <mmathesi@redhat.com> - 1027-1
 - Version bump. Now supported for all architectures.
 - Generate man pages since they are no longer included in source archive.
 * Thu Aug 03 2017 Fedora Release Engineering <releng@fedoraproject.org> - 713-10
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
 * Thu Jul 27 2017 Fedora Release Engineering <releng@fedoraproject.org> - 713-9
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
 * Sat Feb 11 2017 Fedora Release Engineering <releng@fedoraproject.org> - 713-8
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
 * Wed Oct 05 2016 Hon Ching(Vicky) Lo <lo1@us.ibm.com> - 713-7
 - Removed defattr from the devel subpackage 
 * Mon Sep 26 2016 Hon Ching(Vicky) Lo <lo1@us.ibm.com> - 713-6
 - Added s390x arch as another "ExcludeArch"
 * Mon Sep 26 2016 Hon Ching(Vicky) Lo <lo1@us.ibm.com> - 713-5
 - Replaced ExclusiveArch with ExcludeArch 
 * Mon Sep 19 2016 Hon Ching(Vicky) Lo <lo1@us.ibm.com> - 713-4
 - Used ExclusiveArch instead of BuildArch tag
 - Removed attr from symlink in devel subpackage 
 - Added manpages and modified the Source0
 - Added CCFLAGS and LNFLAGS to enforce hardening and optimization
 * Wed Aug 17 2016 Hon Ching(Vicky) Lo <lo1@us.ibm.com> - 713-3
 - Modified supported arch to ppc64le
 * Sat Aug 13 2016 Hon Ching(Vicky) Lo <lo1@us.ibm.com> - 713-2
 - Minor spec fixes 
 * Tue Aug 09 2016 Hon Ching(Vicky) Lo <lo1@us.ibm.com> - 713-1
 - Updated for initial submission 
 * Fri Mar 20 2015 George Wilson <gcwilson@us.ibm.com>
 - Initial implementation
--- a/gating.yaml
+++ b/gating.yaml
@ -0,0 +1,6 @@
 --- !Policy
 product_versions:
  - rhel-9
 decision_context: osci_compose_gate
 rules:
  - !PassingTestCaseRule {test_case_name: osci.brew-build.tier0.functional}
--- a/1
+++ b/1
@ -0,0 +1 @@
 SHA512 (ibmtss1.6.0.tar.gz) = 0bbe5282df56790dc2b63f4916977e15818704f6acdc18ee815fdf233d5a5955edfe285131a1e64c1c49d6f0fdde8e8baf97b633866e595df902dccbd4c61d5f
--- a/tests/runtest.sh
+++ b/tests/runtest.sh
@ -0,0 +1,58 @@
 #!/bin/bash
 # get tpm simulator code
 IBMTPM_VERSION=1661
 wget --no-check-certificate https://downloads.sourceforge.net/project/ibmswtpm2/ibmtpm$IBMTPM_VERSION.tar.gz
 res="$?"
 if [[ "$res" -ne 0 ]]; then
    echo "wget failed"
    exit 1
 fi
 # unpackage and build the source
 mkdir ibmtpm
 pushd ibmtpm
 tar xf ../ibmtpm$IBMTPM_VERSION.tar.gz
 pushd src
 # fixup for openssl 3
 sed -i -e "s|OPENSSL_VERSION_NUMBER >= 0x10200000L|OPENSSL_VERSION_NUMBER > 0x30000010L|" TpmToOsslMath.h
 sed -i -e "s|CCFLAGS = -Wall|CCFLAGS = -Wall -Wno-error=deprecated-declarations|" makefile
 make
 res="$?"
 if [[ "$res" -ne 0 ]]; then
    echo "make of ibmtpm failed"
    popd
    popd
    rm -rf ibmtpm ibmtpm$IBMTPM_VERSION.tar.gz
    exit 1
 fi
 (./tpm_server)&
 popd
 popd
 sleep 10
 export TPM_INTERFACE_TYPE=socsim
 # use the tss2 tests from the sources
 pushd ./source/utils
 # fix python calls to use rhel name for python3
 sed -i -e 's/^PREFIX=\.\//PREFIX=tss/g' reg.sh
 # fix paths in rootcerts.txt
 c=`pwd`
 sed -i -e "s|/gsa/yktgsa/home/k/g/kgold/tpm2/utils|${c}|g" certificates/rootcerts.txt
 # run the tests
 TPM_TSS_NODEPRECATEDALGS=1 ./reg.sh -a
 res="$?"
 popd
 # clean up
 pkill tpm_server
 rm -rf ibmtpm tss
 exit $res
--- a/tests/tests.yml
+++ b/tests/tests.yml
@ -0,0 +1,22 @@
 - hosts: localhost
  roles:
  - role: standard-test-source
    tags:
    - always
  - role: standard-test-basic
    tags:
    - classic
    required_packages:
    - gcc
    - make
    - wget
    - openssl
    - openssl-devel
    - sed
    - tss2
    - git
    tests:
    - ibm-tss2:
        dir: .
        run: ./runtest.sh
        timeout: 30m
--- a/tss2-1.6.0-manpage-cleanup.patch
+++ b/tss2-1.6.0-manpage-cleanup.patch
--- a/tss2.spec
+++ b/tss2.spec
@ -0,0 +1,192 @@
 #
 # Spec file for IBM's TSS for the TPM 2.0
 #
 %{!?__global_ldflags: %global __global_ldflags -Wl,-z,relro}
 %global incname ibmtss
 Name:		tss2
 Version:	1.6.0
 Release:	7%{?dist}
 Epoch:	        1
 Summary:	IBM's TCG Software Stack (TSS) for TPM 2.0 and related utilities
 License:	BSD
 URL:		http://sourceforge.net/projects/ibmtpm20tss/
 Source0:	https://sourceforge.net/projects/ibmtpm20tss/files/ibmtss%{version}.tar.gz
 Patch0:         tss2-1.6.0-manpage-cleanup.patch
 Patch1:		0001-utils-Update-certifyx509-for-Openssl-3.0.0.patch
 Patch2:		0002-utils-Remove-unused-variables-from-certifyx509.patch
 Patch3:		0003-Update-certifyx509-for-Windows.patch
 Patch4:		0004-utils-Clean-up-certifyx509-memory-allocation.patch
 Patch5:		0005-utils-Fix-errors-detected-by-gcc-asan.patch
 Patch6:		0006-tss-Port-HMAC-operations-to-openssl-3.0.patch
 Patch7:		0007-utils-Port-to-openssl-3.0.0-replaces-RSA-with-EVP_PK.patch
 Patch8:		0001-utils-Generate-X509-certificate-serial-number-using-.patch
 Patch9:		0001-tss-Add-missing-parameter-union-members.patch
 Patch10:	0002-regtest-Update-to-SHA-256-without-restricting-the-sc.patch
 Patch11:	0003-tss-Restrict-usage-of-SHA-1.patch
 Patch12:	0004-man-Include-information-about-possible-hash-restrict.patch
 BuildRequires: automake
 BuildRequires: autoconf
 BuildRequires: libtool
 BuildRequires:  gcc
 BuildRequires:	openssl-devel
 BuildRequires:	git
 Requires:	openssl
 %description
 TSS2 is a user space Trusted Computing Group's Software Stack (TSS) for
 TPM 2.0.  It implements the functionality equivalent to the TCG TSS
 working group's ESAPI, SAPI, and TCTI layers (and perhaps more) but with
 a hopefully far simpler interface.
 It comes with about 80 "TPM tools" that can be used for rapid prototyping,
 education and debugging. 
 %package devel
 Summary:	Development libraries and headers for IBM's TSS 2.0
 Requires:	%{name}%{?_isa} = %{epoch}:%{version}-%{release}
 %description devel
 Development libraries and headers for IBM's TSS 2.0. You will need this in
 order to build TSS 2.0 applications.
 %prep
 %autosetup -S git -p1 -c %{name}-%{version}
 %build
 autoreconf -vi
 %configure --disable-static --disable-tpm-1.2 --program-prefix=tss --enable-nodeprecatedalgs
 CCFLAGS="%{optflags}" \
 LNFLAGS="%{__global_ldflags}" \
 %{make_build}
 %install
 %make_install
 find %{buildroot} -type f -name "*.la" -delete -print
 %ldconfig_scriptlets
 %files
 %license LICENSE
 %{_bindir}/tss*
 %{_libdir}/libibmtss.so.*
 %{_libdir}/libibmtssutils.so.*
 %attr(0644, root, root) %{_mandir}/man1/tss*.1*
 %files devel
 %{_includedir}/%{incname}
 %{_libdir}/libibmtss.so
 %{_libdir}/libibmtssutils.so
 %doc ibmtss.doc
 %changelog
 * Fri Jul 8 2022 Stepan Horacek <shoracek@redhat.com> - 1:1.6.0-7
 - Version bump
  Resolves: rhbz#2060768
 * Wed Jun 29 2022 Stepan Horacek <shoracek@redhat.com> - 1:1.6.0-6
 - Restrict SHA-1 usage
  Resolves: rhbz#2060768
 * Fri Jan 28 2022 Stepan Horacek <shoracek@redhat.com> - 1:1.6.0-5
 - Fix failures introduced with OpenSSL 3
  Resolves: rhbz#1984621
  Resolves: rhbz#1992339
 * Tue Aug 10 2021 Mohan Boddu <mboddu@redhat.com> - 1:1.6.0-4
 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags
  Related: rhbz#1991688
 * Wed Jun 16 2021 Mohan Boddu <mboddu@redhat.com> - 1:1.6.0-3
 - Rebuilt for RHEL 9 BETA for openssl 3.0
  Related: rhbz#1971065
 * Fri Apr 16 2021 Mohan Boddu <mboddu@redhat.com> - 1:1.6.0-2
 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937
 * Mon Feb 8 2021 Jerry Snitselaar <jsnitsel@redhat.com> - 1.6.0-1
 - Rebase to v1.6.0 release.
 - Manpage cleanup.
 * Wed Jan 27 2021 Fedora Release Engineering <releng@fedoraproject.org> - 1331-7
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
 * Wed Jul 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1331-6
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
 * Fri Feb 14 2020 Tom Stellard <tstellar@redhat.com> - 1331-5
 - Use make_build macro
 - https://docs.fedoraproject.org/en-US/packaging-guidelines/#_parallel_make
 * Fri Jan 31 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1331-4
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
 * Fri Jan 17 2020 Jeff Law <law@redhat.com> - 1331-3
 - Ensure tssprintcmd has the compilation compilation flags,
  PIC in particular
 * Sat Jul 27 2019 Fedora Release Engineering <releng@fedoraproject.org> - 1331-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
 * Thu May 30 2019 Jerry Snitselaar <jsnitsel@redhat.com> - 1331-1
 - Rebase to version 1331
 * Tue May 28 2019 Jerry Snitselaar <jsnitsel@redhat.com> - 1234-4
 - Fix covscan issues
 - Fix compile and linker flag issues
 * Sun Feb 03 2019 Fedora Release Engineering <releng@fedoraproject.org> - 1234-3
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
 * Sat Jul 14 2018 Fedora Release Engineering <releng@fedoraproject.org> - 1234-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
 * Mon Jun 18 2018 Jerry Snitselaar <jsnitsel@redhat.com> - 1234-1
 - Version bump.
 * Fri Feb 09 2018 Fedora Release Engineering <releng@fedoraproject.org> - 1027-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
 * Fri Jan 19 2018 Merlin Mathesius <mmathesi@redhat.com> - 1027-1
 - Version bump. Now supported for all architectures.
 - Generate man pages since they are no longer included in source archive.
 * Thu Aug 03 2017 Fedora Release Engineering <releng@fedoraproject.org> - 713-10
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
 * Thu Jul 27 2017 Fedora Release Engineering <releng@fedoraproject.org> - 713-9
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
 * Sat Feb 11 2017 Fedora Release Engineering <releng@fedoraproject.org> - 713-8
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
 * Wed Oct 05 2016 Hon Ching(Vicky) Lo <lo1@us.ibm.com> - 713-7
 - Removed defattr from the devel subpackage 
 * Mon Sep 26 2016 Hon Ching(Vicky) Lo <lo1@us.ibm.com> - 713-6
 - Added s390x arch as another "ExcludeArch"
 * Mon Sep 26 2016 Hon Ching(Vicky) Lo <lo1@us.ibm.com> - 713-5
 - Replaced ExclusiveArch with ExcludeArch 
 * Mon Sep 19 2016 Hon Ching(Vicky) Lo <lo1@us.ibm.com> - 713-4
 - Used ExclusiveArch instead of BuildArch tag
 - Removed attr from symlink in devel subpackage 
 - Added manpages and modified the Source0
 - Added CCFLAGS and LNFLAGS to enforce hardening and optimization
 * Wed Aug 17 2016 Hon Ching(Vicky) Lo <lo1@us.ibm.com> - 713-3
 - Modified supported arch to ppc64le
 * Sat Aug 13 2016 Hon Ching(Vicky) Lo <lo1@us.ibm.com> - 713-2
 - Minor spec fixes 
 * Tue Aug 09 2016 Hon Ching(Vicky) Lo <lo1@us.ibm.com> - 713-1
 - Updated for initial submission 
 * Fri Mar 20 2015 George Wilson <gcwilson@us.ibm.com>
 - Initial implementation
		`@ -1 +0,0 @@`
			`39a13864ad42cafae27683fa52bc1d5d21dad39c SOURCES/ibmtss1331.tar.gz`
		`@ -0,0 +1 @@`
							`SHA512 (ibmtss1.6.0.tar.gz) = 0bbe5282df56790dc2b63f4916977e15818704f6acdc18ee815fdf233d5a5955edfe285131a1e64c1c49d6f0fdde8e8baf97b633866e595df902dccbd4c61d5f`