Linux tools and examples
for OPTIGA™ Trust M1/M3 security solution

About
- Prerequisites
Getting Started
- Getting the Code from Github
- First time building the library
CLI Tools Usage
Trust M1/M3 OpenSSL Engine usage
AWS IoT C-SDK
Known observations

About

This is a Linux Tools for OPTIGA Trust M1/M3 on Linux platform that consist of:

Command Line Interface examples
OpenSSL Engine
AWS IoT C SDK example

Prerequisites

Following is the software component to build the tools :

GCC
OpenSSL development library (libssl-dev)
OpenSSL 1.1.1d
OPTIGA Trust M1/M3 library (source code)
pthread
rt

Hardware platforms and boards:

Raspberry PI 3/4 on Linux kernel >= 4.19
OPTIGA™ Trust M
Shield2Go Adapter for Raspberry Pi

Getting Started

Getting the Code from Github

Getting the initial code from Github with submodules

foo@bar:~$ git clone --recurse-submodules https://github.com/Infineon/linux-optiga-trust-m.git

Note: The following commands are optional and it is required only when switching between different branches.

foo@bar:~$ git checkout development_v3
foo@bar:~$ git submodule update -f

First time building the library

Run the commands below to install the required dependencies and Linux tools for optiga trust m

foo@bar:~$ cd linux-optiga-trust-m
foo@bar:~$ ./trustm_installation_script.sh

Note:

1)Enable I2C interface for Raspberry Pi to communicate with optiga trustm m

2)The patch applied inside trustm_installation_script.sh will change the reset type to use soft reset as follow in the header file at "linux-optiga-trust-m/trustm_lib/optiga/include/optiga/"

optiga_lib_config_m_v3.h for OPTIGA™ Trust M3

#define OPTIGA_COMMS_DEFAULT_RESET_TYPE     (1U)

To build for AARCH64, uncomment this Marco in Makefile

#~ Uncomment this for AARCH64 or pass it as argument in command line
#~ AARCH64 = YES

Or run the script below:

foo@bar:~$ ./trustm_installation_aarch64_script.sh

Note: AARCH64 = YES is passed as argument in trustm_installation_aarch64_script.sh.

CLI Tools Usage

Important Notes:

To pair the host with OPTIGA™ Trust M, please run the test script "write_default_shared_secret" inside "linux-optiga-trust-m/scripts/misc/" to write the default shared secret into OPTIGA™ Trust M.
For secuirty reason, all commands in the following examples are with "Shielded Connection Enabled" and hence will increase the security counter by one. It is at the user discretion to disable "Shielded Connection" by using "-X" option if required by the application.

trustm_cert

Read/Write/Clear certificate from/to certificate data object. Output and input certificate in PEM format.

foo@bar:~$ ./bin/trustm_cert
Help menu: trustm_cert <option> ...<option>
option:- 
-r <Cert OID>  	: Read Certificate from OID 0xNNNN 
-w <Cert OID>  	: Write Certificte to OID
-o <filename>  	: Output certificate to file 
-i <filename>  	: Input certificate to file 
-c <Cert OID>   : Clear cert OID data to zero 
-X              : Bypass Shielded Communication 
-h              : Print this help

Example : read OID 0xE0E0 and output the certification to teste0e0.crt

foo@bar:~$ ./bin/trustm_cert -r 0xe0e0 -o teste0e0.crt
========================================================
OID              : 0xE0E0 
Output File Name : teste0e0.crt 
Success!!!
========================================================

foo@bar:~$ cat teste0e0.crt 
-----BEGIN CERTIFICATE-----
MIIB2DCCAX6gAwIBAgIEERCFGjAKBggqhkjOPQQDAjByMQswCQYDVQQGEwJERTEh
MB8GA1UECgwYSW5maW5lb24gVGVjaG5vbG9naWVzIEFHMRMwEQYDVQQLDApPUFRJ
R0EoVE0pMSswKQYDVQQDDCJJbmZpbmVvbiBPUFRJR0EoVE0pIFRydXN0IE0gQ0Eg
MTAxMB4XDTE5MDYxODA2MzAxMFoXDTM5MDYxODA2MzAxMFowHDEaMBgGA1UEAwwR
SW5maW5lb24gSW9UIE5vZGUwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAQRjgnP
/Cuv2C6aEHEiIib60TBi8TU0GN6LXMKAShMUNd6yYosO3Cv3XExwWVqkbeAIrXRo
gM3bPK7w5CRWu8hqo1gwVjAOBgNVHQ8BAf8EBAMCAIAwDAYDVR0TAQH/BAIwADAV
BgNVHSAEDjAMMAoGCCqCFABEARQBMB8GA1UdIwQYMBaAFDwwjFzViuijXTKA5FSD
sv/Nhk0jMAoGCCqGSM49BAMCA0gAMEUCIQC5y2fv2p1VS41jSX72pl/B3am+Oboy
B1ItWszBjNzc0AIgEiPyApU78Oif0drcgQhH0qfxaKPJAFySCb2wpHYy6Uc=
-----END CERTIFICATE-----

Example : write certificate teste0e0.crt into OID 0xE0E1

foo@bar:~$ ./bin/trustm_cert -w 0xe0e1 -i teste0e0.crt 
========================================================
Success!!!
========================================================

Example : clear certificate store in OID 0xE0E1

foo@bar:~$ ./bin/trustm_cert -c 0xe0e1
========================================================
Cleared.
========================================================

trustm_chipinfo

Display the OPTIGA™ Trust M chip information

foo@bar:~$ ./bin/trustm_chipinfo 
Read Chip Info [0xE0C2]: Success.
========================================================
CIM Identifier             [bCimIdentifer]: 0xcd
Platform Identifer   [bPlatformIdentifier]: 0x16
Model Identifer         [bModelIdentifier]: 0x33
ID of ROM mask                  [wROMCode]: 0x8201
Chip Type                    [rgbChipType]: 0x00 0x1c 0x00 0x05 0x00 0x00
Batch Number              [rgbBatchNumber]: 0x0a 0x09 0x1b 0x5c 0x00 0x07
X-coordinate              [wChipPositionX]: 0x0020
Y-coordinate              [wChipPositionY]: 0x008e
Firmware Identifier [dwFirmwareIdentifier]: 0x80101071
Build Number                 [rgbESWBuild]: 08 09

Chip software build: 
OPTIGA(TM) Trust M rev.1; Firmware Version: 1.30.809
========================================================

trustm_data

Read/Write/Erase OID data object in raw format.

foo@bar:~$ ./bin/trustm_data 
Help menu: trustm_data <option> ...<option>
option:- 
-r <OID>      : Read from OID 0xNNNN 
-w <OID>      : Write to OID
-i <filename> : Input file 
-I <value>    : Input byte value 
-o <filename> : Output file 
-p <offset>   : Offset position 
-e            : Erase and wirte 
-X            : Bypass Shielded Communication 
-h            : Print this help

Example : writing text file 1234.txt into OID 0xE0E1 and reading after writing

foo@bar:~$ cat 1234.txt 
1234

foo@bar:~$ ./bin/trustm_data -w 0xe0e1 -i 1234.txt
========================================================
Device Public Key           [0xE0E1] Offset: 0
Input data : 
	31 32 33 34 0a 
Write Success.
========================================================

foo@bar:~$ ./bin/trustm_data -r 0xe0e1
========================================================
Device Public Key           [0xE0E1] [Size 0005] : 
	31 32 33 34 0a 
========================================================

Example : erase with offset OID 0xE0E1

foo@bar:~$ ./bin/trustm_data -w 0xe0e1 -e -p 10 -i 1234.txt
========================================================
Device Public Key           [0xE0E1] Offset: 10
Input data : 
	31 32 33 34 0a 
Write Success.
========================================================

foo@bar:~$ ./bin/trustm_data -r 0xe0e1
========================================================
Device Public Key           [0xE0E1] [Size 0015] : 
	00 00 00 00 00 00 00 00 00 00 31 32 33 34 0a 
========================================================

trustm_ecc_keygen

Generate OPTIGA™ Trust M ECC key pair. Key type can be or together to form multiple type.

foo@bar:~$ ./bin/trustm_ecc_keygen 
Help menu: trustm_ecc_keygen <option> ...<option>
option:- 
-g <Key OID>    : Generate ECC Key in OID 0xNNNN 
-t <key type>   : Key type Auth:0x01 Enc :0x02 HFWU:0x04
                           DevM:0X08 Sign:0x10 Agmt:0x20
                           [default Auth]
-k <key size>   : Key size ECC256:0x03 ECC384:0x04 ECC521:0x05
                           BRAINPOOL256:0x13 BRAINPOOL384:0x15 BRAINPOOL512:0x16
                           [default ECC256]
-o <filename>   : Output Pubkey to file in PEM format
-s              : Save Pubkey in <Key OID + 0x10E0>
                  For ECC521/BRAINPOOL512: 
                  Save Pubkey in <Key OID + 0x10EF>
-X              : Bypass Shielded Communication 
-h              : Print this help

Note: For ECC521/BRAINPOOL512 keygen with "-s", the private key slot can only be chosen from 0xE0F1 and 0xE0F2 if you want to save the public key into the data objects. User may make use of "-o" option to output public key to file.

For private key slot 0xE0F1, the public key will be stored in 0xF1E0.

For private key slot 0xE0F2, the public key will be stored in 0xF1E1.

Example : generate an ECC256 key with type Auth/Enc/# OID 0xE0F3 and save pubkey in OID 0xF1D3.

foo@bar:~$ ./bin/trustm_ecc_keygen -g 0xe0f3 -t 0x13 -k 0x03 -o test_e0f3_pub.pem -s
========================================================
Generating Key to 0xE0F3
Output File Name : test_e0f3_pub.pem 
Pubkey :
	30 59 30 13 06 07 2A 86 48 CE 3D 02 01 06 08 2A 
	86 48 CE 3D 03 01 07 03 42 00 04 F1 55 65 CB 42 
	FB 3E 58 DB C6 9F 67 E8 FC D3 48 F6 AA 5F 13 2D 
	F6 3B A7 90 22 B4 B6 D3 4E 5B BB 98 AB 46 97 BD 
	2A 03 A6 27 A5 4D FB 95 C2 BB 9A D3 AF A9 4E A7 
	D6 A1 63 9F 93 B6 71 57 07 E6 00 
Write Success to OID: 0xF1D3.
========================================================

foo@bar:~$ cat test_e0f3_pub.pem 
-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE8VVly0L7Pljbxp9n6PzTSPaqXxMt
9junkCK0ttNOW7uYq0aXvSoDpielTfuVwrua06+pTqfWoWOfk7ZxVwfmAA==
-----END PUBLIC KEY-----

foo@bar:~$ ./bin/trustm_data -r 0xf1d3
========================================================
App DataStrucObj type 3     [0xF1D3] [Size 0091] : 
	30 59 30 13 06 07 2A 86 48 CE 3D 02 01 06 08 2A 
	86 48 CE 3D 03 01 07 03 42 00 04 F1 55 65 CB 42 
	FB 3E 58 DB C6 9F 67 E8 FC D3 48 F6 AA 5F 13 2D 
	F6 3B A7 90 22 B4 B6 D3 4E 5B BB 98 AB 46 97 BD 
	2A 03 A6 27 A5 4D FB 95 C2 BB 9A D3 AF A9 4E A7 
	D6 A1 63 9F 93 B6 71 57 07 E6 00 
========================================================

trustm_ecc_sign

Simple demo to show the process to sign using OPTIGA™ Trust M ECC key.

Note : to output OpenSSL signature format used -o

foo@bar:~$ ./bin/trustm_ecc_sign 
Help menu: trustm_ecc_sign <option> ...<option>
option:- 
-k <OID Key>  : Select ECC key for signing OID (0xE0F0-0xE0F3) 
-o <filename> : Output to file with header
-O <filename> : Output to file without header
-i <filename> : Input Data file
-H            : Hash before sign
-X            : Bypass Shielded Communication 
-h            : Print this help

Example : Hash and sign the file helloworld.txt with key OID 0xE0F3 and output to testsignature.bin

foo@bar:~$ ./bin/trustm_ecc_sign -k 0xe0f3 -o testsignature.bin -i helloworld.txt -H
========================================================
OID Key          : 0xE0F3
Output File Name : testsignature.bin 
Input File Name  : helloworld.txt 
Hash Success : SHA256
	8C D0 7F 3A 5F F9 8F 2A 78 CF C3 66 C1 3F B1 23 
	EB 8D 29 C1 CA 37 C7 9D F1 90 42 5D 5B 9E 42 4D 
	
filesize: 11
Success
========================================================

foo@bar:~$ hd testsignature.bin 
00000000  30 44 02 20 14 ea 77 98  ed 26 89 40 22 bb a0 60  |0D. ..w..&.@"..`|
00000010  c5 1f 01 8f 65 21 7a 98  0d 63 73 03 4e ea 13 39  |....e!z..cs.N..9|
00000020  0c ed 58 8a 02 20 2a 7b  fc 7a dd 2e 75 86 41 f5  |..X.. *{.z..u.A.|
00000030  43 14 ec e8 14 34 6b 2a  20 68 23 eb 14 ec 59 2f  |C....4k* h#...Y/|
00000040  37 04 37 44 62 c9                                 |7.7Db.|
00000046

trustm_ecc_verify

Simple demo to show the process to verify using OPTIGA™ Trust M library.

foo@bar:~$ ./bin/trustm_ecc_verify 
Help menu: trustm_ecc_verify <option> ...<option>
option:- 
-k <OID Key>   : Use Certificate from OID [0xE0E1-E0E3]
-p <pubkey>    : Use Pubkey file
-i <filename>  : Input Data file
-s <signature> : Signature file
-H             : Hash input before verify
-X             : Bypass Shielded Communication 
-h             : Print this help

Example : verifying a signature using external public key.

foo@bar:~$ ./bin/trustm_ecc_verify -i helloworld.txt -s testsignature.bin -p test_e0f3_pub.pem -H
========================================================
Pubkey file         : test_e0f3_pub.pem
Input File Name     : helloworld.txt 
Signature File Name : testsignature.bin 
Hash Digest : 
	8C D0 7F 3A 5F F9 8F 2A 78 CF C3 66 C1 3F B1 23 
	EB 8D 29 C1 CA 37 C7 9D F1 90 42 5D 5B 9E 42 4D 
	
Signature : 
	02 20 14 EA 77 98 ED 26 89 40 22 BB A0 60 C5 1F 
	01 8F 65 21 7A 98 0D 63 73 03 4E EA 13 39 0C ED 
	58 8A 02 20 2A 7B FC 7A DD 2E 75 86 41 F5 43 14 
	EC E8 14 34 6B 2A 20 68 23 EB 14 EC 59 2F 37 04 
	37 44 62 C9 
Pub key : [256]
	03 42 00 04 F1 55 65 CB 42 FB 3E 58 DB C6 9F 67 
	E8 FC D3 48 F6 AA 5F 13 2D F6 3B A7 90 22 B4 B6 
	D3 4E 5B BB 98 AB 46 97 BD 2A 03 A6 27 A5 4D FB 
	95 C2 BB 9A D3 AF A9 4E A7 D6 A1 63 9F 93 B6 71 
	57 07 E6 00 
Verify Success.
========================================================

Example : verifying using certificate store in OID 0xE0E3.

Note : This example assume you have a valid x.509 certificate with key usage for signature store in OID 0xE0E3 and data is signed by the private key of the x.509 certificate.

foo@bar:~$ ./bin/trustm_ecc_verify -i helloworld.txt -s testsignature.bin -k 0xe0e3 -H
========================================================
OID Cert            : 0xE0E3
Input File Name     : helloworld.txt 
Signature File Name : testsignature.bin 
Hash Digest : 
	8C D0 7F 3A 5F F9 8F 2A 78 CF C3 66 C1 3F B1 23 
	EB 8D 29 C1 CA 37 C7 9D F1 90 42 5D 5B 9E 42 4D 
	
Signature : 
	02 20 14 EA 77 98 ED 26 89 40 22 BB A0 60 C5 1F 
	01 8F 65 21 7A 98 0D 63 73 03 4E EA 13 39 0C ED 
	58 8A 02 20 2A 7B FC 7A DD 2E 75 86 41 F5 43 14 
	EC E8 14 34 6B 2A 20 68 23 EB 14 EC 59 2F 37 04 
	37 44 62 C9 
Verify Success.

========================================================

trustm_errorcode

List all the known OPTIGA™ Trust M error code with description

trustm_metadata

Modify OPTIGA™ Trust M OID metadata.

Warning : Any manipuldation with the lifecycle state LcsO like -I, -O and -T option might lock the data/key slot permanently. Depending on the access condition cofiguration "locking" means you would be able to use it, but, for instance, not change..

The Lcs is implemented in a way that the four primary states only progress in one direction from a lower value to a higher value(e.g. initialization(in)=>operational(op) state). Once Lcs0 is set to higher value, it is not reversible and can not be set to lower value any more.

foo@bar:~$ ./bin/trustm_metadata 
Help menu: trustm_metadata <option> ...<option>
option:- 
-r <OID>  : Read metadata of OID 0xNNNN 
-w <OID>  : Write metadata of OID
-C <data> : Set Change mode (a:ALW,
                             n:NEV,
                             i:Lsc0 < 0x03,
                             o:Lsc0 < 0x07,
                             t:Lsc0 < 0x0F,
                             f:<input file for complex setting>)
-R <data> : Set Read mode   (a:ALW,
                             n:NEV,
                             i:Lsc0 < 0x03,
                             o:Lsc0 < 0x07,
                             t:Lsc0 < 0x0F,
                             f:<input file for complex setting>)
-E <data> : Set Change mode (a:ALW,
                             n:NEV,
                             i:Lsc0 < 0x03,
                             o:Lsc0 < 0x07,
                             t:Lsc0 < 0x0F,
                             f:<input file for complex setting>)
-F <file> : Custom input
          : (Need to input the full Metadata to be written)
-I        : Set Initialization State (Lsc0: 0x03)
-O        : Set Operational State (Lsc0: 0x07)
-T        : Set Termination State (Lsc0: 0x0F)
-X        : Bypass Shielded Communication 
-h        : Print this help

Example : changing OID 0xE0E1 metadata to read only and reading the metadata after changing

foo@bar:~$ ./bin/trustm_metadata -w 0xe0e1 -Cn -Ra
========================================================
Device Public Key           [0xE0E1] 
	20 06 D0 01 FF D1 01 00 
	C:NEV, R:ALW, 
Write Success.
========================================================

foo@bar:~$ ./bin/trustm_metadata -r 0xe0e1
========================================================
Device Public Key           [0xE0E1] [Size 0025] : 
	20 17 c0 01 01 c4 02 06 c0 c5 02 01 dc d0 01 ff 
	d1 01 00 d3 01 00 e8 01 12 
	LcsO:0x01, Max:1728, Used:476, C:NEV, R:ALW, E:ALW, DType:DEVCERT, 

========================================================

Example : charging OID 0xE0E1 metadata using complex setting (LcsO>3||LcsG<4) for Change mode

foo@bar:~$ echo -e -n \\x07\\xe1\\xfb\\x03\\xfe\\x70\\xfc\\x04 > complexsetting.bin

foo@bar:~$ hd complexsetting.bin 
00000000  07 e1 fb 03 fe 70 fc 04                           |.....p..|
00000008

foo@bar:~$ ./bin/trustm_metadata -w 0xe0e1 -Cf:complexsetting.bin 
========================================================
Device Public Key           [0xE0E1] 
	20 09 D0 07 E1 FB 03 FE 70 FC 04 
	C:LcsO>3||LcsG<4, 
Write Success.
========================================================

foo@bar:~$ ./bin/trustm_metadata -r 0xe0e1
========================================================
Device Public Key           [0xE0E1] [Size 0031] : 
	20 1d c0 01 01 c4 02 06 c0 c5 02 01 dc d0 07 e1 
	fb 03 fe 70 fc 04 d1 01 00 d3 01 00 e8 01 12 
	LcsO:0x01, Max:1728, Used:476, C:LcsO>3||LcsG<4, R:ALW, E:ALW, DType:DEVCERT, 

========================================================

trustm_monotonic_counter

Simple demo to show the OPTIGA™ Trust M monotonic counter.

foo@bar:~$ ./bin/trustm_monotonic_counter 
Help menu: trustm_monotonic_counter <option> ...<option>
option:- 
-r <OID>      : Read from OID [0xE120-0xE123] 
-w <OID>      : Write to OID [0xE120-0xE123] 
-u <OID>      : Update Counter [0xE120-0xE123] 
-i <value>    : Input Value 
-s <value>    : Increment Steps 
-X            : Bypass Shielded Communication 
-h            : Print this help

Example : Setting the threshold value to 10 and resetting the counter to zero

foo@bar:~$ ./bin/trustm_monotonic_counter -w 0xe120 -i 10
========================================================
Input Value : 10 [0x0000000A]
	00 00 00 00 00 00 00 0a 
Write Success.
========================================================

Example : Count up the monotonic counter in steps of 2

foo@bar:~$ ./bin/trustm_monotonic_counter -u 0xe120 -s 2
========================================================
Steps Value : 2 [0x00000002]
Update Counter Success.
========================================================

foo@bar:~$ ./bin/trustm_monotonic_counter -r 0xe120
========================================================
Monotonic Counter x : [0xE120]
Threshold           : 0x0000000A [10]
Counter Value       : 0x00000002 [2]
========================================================

trustm_read_data

Read all data object listed below

oid : 0xE0E0-0xE0E3, 0xE0E8-0xE0E9, 0xE0EF,

0xE120-0xE123,

0xE140, 0xF1D0-0xF1DB, 0xF1E0-0xF1E1

trustm_readmetadata_data

Read all data object metadata listed below

oid : 0xE0E0-0xE0E3, 0xE0E8-0xE0E9, 0xE0EF,

0xE120-0xE123, 0xE200,

0xE140, 0xF1D0-0xF1DB, 0xF1E0-0xF1E1

trustm_readmetadata_private

Read all data object metadata listed below

oid : 0xE0F0-0xE0F3,

0xE0FC-0xE0FD

trustm_readmetadata_status

Read all data object metadata listed below

oid : 0xE0C0-0xE0C6,

0xF1C0-0xF1C2

trustm_read_status

Read all data object listed below

oid : 0xE0C0-0xE0C6,

0xF1C0-0xF1C2

trustm_rsa_dec

Simple demo to show the process to decrypt using OPTIGA™ Trust M RSA key.

Note : This example assume RSA key with usage Encryption has already been generated and data is encrypted by the pubkey

foo@bar:~$ ./bin/trustm_rsa_dec
Help menu: trustm_rsa_dec <option> ...<option>
option:- 
-k <OID Key>  : Select key to decrypt OID 0xNNNN 
-o <filename> : Output to file 
-i <filename> : Input Data file
-X            : Bypass Shielded Communication 
-h            : Print this help

Example : Decrypt using OID Key 0xE0FC, an encrypted file test_e0fc.enc and output to test_e0fc.dec

foo@bar:~$ ./bin/trustm_rsa_dec -k 0xe0fc -o test_e0fc.dec -i test_e0fc.enc 
========================================================
OID Key          : 0xE0FC 
Output File Name : test_e0fc.dec 
Input File Name  : test_e0fc.enc 
Input data : 
	35 38 AC E8 54 CA 02 92 A7 B4 72 0A 62 F9 7B DD 
	CC C7 E1 9C A4 52 D6 AF CC 04 E4 B4 54 19 85 DD 
	10 80 FA 8B 04 8E B0 5E 29 C5 F5 2F A7 99 BB EC 
	2E 69 D4 AB 35 80 BF F5 87 6D 80 65 60 3E A6 31 
	6E 05 80 F2 CB 9E 32 DA F2 82 DB 15 D6 9C 1E DF 
	FE 1C 5E 1F 7F E6 6D 2A EA B3 54 AD 41 AF C2 08 
	FE BF C7 B5 87 22 79 A2 AA F3 0D 71 BA DB 5D F7 
	CE 50 EA 89 D4 42 BD 0B 11 6A C8 11 2F 09 99 28 
	
Success
========================================================

foo@bar:~$ cat test_e0fc.dec 
helloworld!!!

trustm_rsa_enc

Simple demo to show the process to encrypt using OPTIGA™ Trust M RSA key.

foo@bar:~$ ./bin/trustm_rsa_enc 
Help menu: trustm_rsa_enc <option> ...<option>
option:- 
-k <OID Key>  : Select key for encrypt OID 0xNNNN 
-p <pubkey>   : Use Pubkey file
-o <filename> : Output to file 
-i <filename> : Input Data file
-X            : Bypass Shielded Communication 
-h            : Print this help

Example : Encrypt using external pubkey

foo@bar:~$ ./bin/trustm_rsa_enc -p test_e0fc_pub.pem -o test_e0fc.enc -i helloworld.txt 
========================================================
Pubkey file      : test_e0fc_pub.pem 
Output File Name : test_e0fc.enc 
Input File Name  : helloworld.txt 
Input data : 
	68 65 6C 6C 6F 77 6F 72 6C 64 21 21 21 0A 
Success
========================================================

Example : Encrypt using Certificate store in OID 0xE0E2

Note : This example assume you have a valid x.509 certificate with key usage for Key Encipherment store in OID 0xE0E2.

foo@bar:~$ ./bin/trustm_rsa_enc -k 0xe0e2 -o test_e0fc1.enc -i helloworld.txt 
========================================================
OID Key          : 0xE0E2 
Output File Name : test_e0fc1.enc 
Input File Name  : helloworld.txt 
Input data : 
	68 65 6C 6C 6F 77 6F 72 6C 64 21 21 21 0A 
Success
========================================================

trustm_rsa_keygen

Generate OPTIGA™ Trust M RSA key pair. Key type can be or together to form multiple type.

foo@bar:~$ ./bin/trustm_rsa_keygen 
Help menu: trustm_rsa_keygen <option> ...<option>
option:- 
-g <Key OID>    : Generate RSA Key in OID [0xE0FC-0xE0FD] 
-t <key type>   : Key type Auth:0x01 Enc :0x02 HFWU:0x04
                  DevM:0X08 Sign:0x10 Agmt:0x20
                  [default Auth]
-k <key size>   : Key size RSA1024:0x41 RSA2048:0x42 [default RSA1024]
-o <filename>   : Output Pubkey to file in PEM format
-s              : Save Pubkey with header in <Key OID + 0x10E4>
-X              : Bypass Shielded Communication 
-h              : Print this help

Example : generate an RSA1024 key with type Auth/Enc/# OID 0xe0fc and save pubkey in OID 0xF1E0.

foo@bar:~$ ./bin/trustm_rsa_keygen -g 0xe0fc -t 0x13 -k 0x41 -o test_e0fc_pub.pem -s
========================================================
Generating Key to 0xE0FC
Output File Name : test_e0fc_pub.pem 
Pubkey :
	30 81 9f 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 
	05 00 03 81 8d 00 30 81 89 02 81 81 00 9c 2d 6b 
	19 9c 8e d9 6c 59 0b bc 53 4a 1f 51 0c 87 14 71 
	09 21 55 d6 0c 1c 36 71 42 d9 dd db a2 f5 d8 de 
	df 80 d2 0f aa ae 31 6e 08 04 60 2d 32 ac 3c b7 
	e1 d0 d9 47 16 77 d7 ed d9 d3 e8 41 ed 6a e7 88 
	10 a6 2e 51 d2 cb d2 7d 9a 3b c8 09 c9 05 27 0d 
	85 39 c2 b6 4f 76 08 59 6e e7 51 07 9e 76 60 96 
	8d 63 ce 19 fc d0 a2 7c 28 c2 35 30 72 96 7d 3f 
	3c 48 95 bc 0a a5 5a 37 c6 64 e3 8e 31 02 03 01 
	00 01 
Write Success to OID: 0xF1E0.
========================================================

foo@bar:~$ cat test_e0fc_pub.pem 
-----BEGIN PUBLIC KEY-----
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCcLWsZnI7ZbFkLvFNKH1EMhxRx
CSFV1gwcNnFC2d3bovXY3t+A0g+qrjFuCARgLTKsPLfh0NlHFnfX7dnT6EHtaueI
EKYuUdLL0n2aO8gJyQUnDYU5wrZPdghZbudRB552YJaNY84Z/NCifCjCNTByln0/
PEiVvAqlWjfGZOOOMQIDAQAB
-----END PUBLIC KEY-----

foo@bar:~$ ./bin/trustm_data -r 0xf1e0
========================================================
App DataStrucObj type 2     [0xF1E0] [Size 1500] : 
	03 81 8d 00 30 81 89 02 81 81 00 9c 2d 6b 19 9c 
	8e d9 6c 59 0b bc 53 4a 1f 51 0c 87 14 71 09 21 
	55 d6 0c 1c 36 71 42 d9 dd db a2 f5 d8 de df 80 
	d2 0f aa ae 31 6e 08 04 60 2d 32 ac 3c b7 e1 d0 
	d9 47 16 77 d7 ed d9 d3 e8 41 ed 6a e7 88 10 a6 
	2e 51 d2 cb d2 7d 9a 3b c8 09 c9 05 27 0d 85 39 
	c2 b6 4f 76 08 59 6e e7 51 07 9e 76 60 96 8d 63 
	ce 19 fc d0 a2 7c 28 c2 35 30 72 96 7d 3f 3c 48 
	95 bc 0a a5 5a 37 c6 64 e3 8e 31 02 03 01 00 01 
	47 1b 75 53 fd 53 88 72 5e 0b 83 04 29 4e 44 03 
	51 7a 50 ea f6 a7 a9 82 04 6e cb 1a fa 57 7e 17 
	b6 39 d8 76 e7 fe 76 84 59 bc e6 91 a3 f7 fc 75 
	e2 e3 f7 ec 2a d6 3e 36 c6 f0 7f fb a8 50 d5 a7 
	fc 7e c2 28 2e bf ea e2 8d c9 c9 6e 76 69 a3 a2 
	ec 2f 01 40 8f 65 ba 16 19 81 00 8f 74 17 31 da 
	0e 2f f4 19 a9 f3 00 15 8a 28 5e af 99 4e ab 96 
	7f c8 7f fd f6 ea 17 30 7f 71 8e 1f 27 a1 02 03 
	01 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 
	...
	(trucated for better view)
========================================================

trustm_rsa_sign

Simple demo to show the process to sign using OPTIGA™ Trust M RSA key.

foo@bar:~$ ./bin/trustm_rsa_sign 
Help menu: trustm_rsa_sign <option> ...<option>
option:- 
-k <OID Key>  : Select RSA key for signing OID (0xE0FC-0xE0FD) 
-o <filename> : Output to file 
-i <filename> : Input Data file
-H            : Hash before sign
-X            : Bypass Shielded Communication 
-h            : Print this help

Example : Hash and sign the file helloworld.txt with key OID 0xE0FC and output to testsignature.bin

foo@bar:~$ ./bin/trustm_rsa_sign -k 0xe0fc -o testsignature.bin -i helloworld.txt -H
========================================================
OID Key          : 0xE0FC
Output File Name : testsignature.bin 
Input File Name  : helloworld.txt 
Hash Success : SHA256
	E0 EE B7 C6 63 CC 5F 6F 45 26 13 E2 D7 AE FF 45 
	2A 26 95 A0 2F B4 AF 30 33 CC 5B C0 62 01 DE 70 
	
filesize: 14
Success
========================================================

foo@bar:~$ hd testsignature.bin
00000000  0f 20 5a d3 0f 8c ec 41  24 74 d9 e3 20 bf ba 75  |. Z....A$t.. ..u|
00000010  56 df a4 5b be 25 0e 0e  e5 32 1a f5 bf 24 45 e0  |V..[.%...2...$E.|
00000020  1d 4c f5 b7 99 0c 17 c2  49 88 52 e1 b8 b4 9e 7d  |.L......I.R....}|
00000030  da 48 6d 98 53 45 e0 12  e8 48 59 dc 80 35 cd 2f  |.Hm.SE...HY..5./|
00000040  e0 01 c1 e2 1e 1d 00 05  9a 32 3b 56 d7 90 72 a9  |.........2;V..r.|
00000050  30 06 72 c9 f4 19 62 eb  20 76 9f c8 12 cb 23 ff  |0.r...b. v....#.|
00000060  bf b1 56 80 89 ea fe 7b  52 5d f0 26 98 10 3e 82  |..V....{R].&..>.|
00000070  bf 8d a7 9b 5e 2b e9 ec  89 6f 46 f2 ee fa 03 83  |....^+...oF.....|
00000080

trustm_rsa_verify

Simple demo to show the process to verify using OPTIGA™ Trust M library.

foo@bar:~$ ./bin/trustm_rsa_verify 
Help menu: trustm_rsa_verify <option> ...<option>
option:- 
-k <OID Key>   : Use Certificate from Data OID 
-p <pubkey>    : Use Pubkey file
-i <filename>  : Input Data file
-s <signature> : Signature file
-H             : Hash input before verify
-X             : Bypass Shielded Communication 
-h             : Print this help

Example : verifying a signature using external public key.

foo@bar:~$ ./bin/trustm_rsa_verify -i helloworld.txt -s testsignature.bin -p test_e0fc_pub.pem -H
========================================================
Pubkey file         : test_e0fc_pub.pem
Input File Name     : helloworld.txt 
Signature File Name : testsignature.bin 
Hash Digest : 
	E0 EE B7 C6 63 CC 5F 6F 45 26 13 E2 D7 AE FF 45 
	2A 26 95 A0 2F B4 AF 30 33 CC 5B C0 62 01 DE 70 
	
Signature : 
	0F 20 5A D3 0F 8C EC 41 24 74 D9 E3 20 BF BA 75 
	56 DF A4 5B BE 25 0E 0E E5 32 1A F5 BF 24 45 E0 
	1D 4C F5 B7 99 0C 17 C2 49 88 52 E1 B8 B4 9E 7D 
	DA 48 6D 98 53 45 E0 12 E8 48 59 DC 80 35 CD 2F 
	E0 01 C1 E2 1E 1D 00 05 9A 32 3B 56 D7 90 72 A9 
	30 06 72 C9 F4 19 62 EB 20 76 9F C8 12 CB 23 FF 
	BF B1 56 80 89 EA FE 7B 52 5D F0 26 98 10 3E 82 
	BF 8D A7 9B 5E 2B E9 EC 89 6F 46 F2 EE FA 03 83 
	
Pub key : [1024]
	03 81 8D 00 30 81 89 02 81 81 00 9C 2D 6B 19 9C 
	8E D9 6C 59 0B BC 53 4A 1F 51 0C 87 14 71 09 21 
	55 D6 0C 1C 36 71 42 D9 DD DB A2 F5 D8 DE DF 80 
	D2 0F AA AE 31 6E 08 04 60 2D 32 AC 3C B7 E1 D0 
	D9 47 16 77 D7 ED D9 D3 E8 41 ED 6A E7 88 10 A6 
	2E 51 D2 CB D2 7D 9A 3B C8 09 C9 05 27 0D 85 39 
	C2 B6 4F 76 08 59 6E E7 51 07 9E 76 60 96 8D 63 
	CE 19 FC D0 A2 7C 28 C2 35 30 72 96 7D 3F 3C 48 
	95 BC 0A A5 5A 37 C6 64 E3 8E 31 02 03 01 00 01 
	
Verify Success.
========================================================

Example : verifying using certificate store in OID 0xE0E2.

Note : This example assume you have a valid x.509 certificate with key usage for signature store in OID 0xE0E2 and data is signed by the private key of the x.509 certificate.

foo@bar:~$ ./bin/trustm_rsa_verify -i helloworld.txt -s testsignature.bin -k 0xe0e2 -H
========================================================
OID Cert            : 0xE0E2
Input File Name     : helloworld.txt 
Signature File Name : testsignature.bin 
Hash Digest : 
	E0 EE B7 C6 63 CC 5F 6F 45 26 13 E2 D7 AE FF 45 
	2A 26 95 A0 2F B4 AF 30 33 CC 5B C0 62 01 DE 70 
	
Signature : 
	0F 20 5A D3 0F 8C EC 41 24 74 D9 E3 20 BF BA 75 
	56 DF A4 5B BE 25 0E 0E E5 32 1A F5 BF 24 45 E0 
	1D 4C F5 B7 99 0C 17 C2 49 88 52 E1 B8 B4 9E 7D 
	DA 48 6D 98 53 45 E0 12 E8 48 59 DC 80 35 CD 2F 
	E0 01 C1 E2 1E 1D 00 05 9A 32 3B 56 D7 90 72 A9 
	30 06 72 C9 F4 19 62 EB 20 76 9F C8 12 CB 23 FF 
	BF B1 56 80 89 EA FE 7B 52 5D F0 26 98 10 3E 82 
	BF 8D A7 9B 5E 2B E9 EC 89 6F 46 F2 EE FA 03 83 
	
Verify Success.

========================================================

trustm_symmetric_keygen

Simple demo to show the process to generate symmetric key using OPTIGA™ Trust M library.

Note: The Access Condition CHA for OID 0xe200 must be set to "ALW"(Only executable when LcsO<op). Fore details, please refer to the test script AES_CBC.sh inside "linux-optiga-trust-m/scripts/misc/"

foo@bar:~$ ./bin/trustm_symmetric_keygen 
Help menu: trustm_symmetric_keygen <option> ...<option>
option:- 
-t <key type>   : Key type Auth:0x01 Enc :0x02 HFWU:0x04
                           DevM:0X08 Sign:0x10 Agmt:0x20
                           [default Enc]
-k <key size>   : Key size AES128:0x81 AES192:0x82 AES256:0x83
                           [default AES128]
-X              : Bypass Shielded Communication 
-h              : Print this help

Example : generate an AES256 key with type Enc in OID 0xe200.

foo@bar:~$ ./bin/trustm_symmetric_keygen -t 0x02 -k 0x83 
========================================================
Successfully Generated Symmetric Key in 0xE200 
========================================================

trustm_symmetric_enc

Simple demo to show the process to encrypt using OPTIGA™ Trust M library.

foo@bar:~$ ./bin/trustm_symmetric_enc 
Help menu: trustm_symmetric_enc <option> ...<option>
option:- 
-m <mode>     : Mode CBC:0x09 CBC_MAC:0X0A CMAC:0X0B 
                     [default CBC]
-o <filename> : Output to file 
-i <filename> : Input Data file
-v <filename> : Input IV Value
                Only needed for CBC mode
-X            : Bypass Shielded Communication 
-h            : Print this help

Example : Encrypt mydata.txt using AES256 CBC mode.

Note: Initialized value is only applicable for AES CBC mode.

foo@bar:~$ ./bin/trustm_symmetric_enc -m 0x09 -v iv_aes256.bin -i mydata.txt -o aes256.enc 
========================================================
mode             : 0x0009 
Output File Name : aes256.enc 
Input File Name  : mydata.txt 
Input data :    
	6D 79 64 61 74 61 31 32 33 34 35 36 37 38 39 0A 
	
IV File Name  : iv_aes256.bin 
Initialized value : 
	69 6E 69 74 69 61 6C 69 7A 65 64 76 32 35 36 0A 
	
Success
========================================================

trustm_symmetric_dec

Simple demo to show the process to decrypt using OPTIGA™ Trust M library.

foo@bar:~$ ./bin/trustm_symmetric_dec -h
Help menu: trustm_symmetric_dec <option> ...<option>
option:- 
-m <mode>     : Mode CBC:0x09 
                [only support CBC mode]
-o <filename> : Output to file 
-i <filename> : Input Data file
-v <filename> : Input IV Value
-X            : Bypass Shielded Communication 
-h            : Print this help

Example : decrypt aes256.enc using AES256 CBC mode.

Note: Initialized value is only applicable for AES CBC mode.

foo@bar:~$ ./bin/trustm_symmetric_dec -m 0x09 -v iv_aes256.bin -i aes256.enc -o mydata.txt.dec
========================================================
mode             : 0x0009 
Output File Name : mydata.txt.dec 
Input File Name  : aes256.enc 
Input data : 
	E5 4E C6 9E 33 51 0F 3D 81 8C 0D 58 34 04 49 D6 
	
IV File Name  : iv_aes256.bin 
Initialized value : 
	69 6E 69 74 69 61 6C 69 7A 65 64 76 32 35 36 0A 
	
Success
========================================================

trustm_hkdf

Simple demo to show the process to derive key using OPTIGA™ Trust M library.

Note: For detailed use case, please refer to the test script hkdf.sh inside "linux-optiga-trust-m/scripts/misc/"

foo@bar:~$ ./bin/trustm_hkdf
Help menu: trustm_hkdf <option> ...<option>
option:- 
-i <OID>      : Input secret OID 0xNNNN 
                [default 0xF1D0]
-H <SHA>      : SHA256:0x08 SHA384 :0x09 SHA512:0x0A
                [default SHA256]
-f <filename> : Import Info 
-s <filename> : Import Salt 
-o <filename> : Export Derived Key 
-X            : Bypass Shielded Communication 
-h            : Print this help

Example : derive key using HKDF SHA256 with shared secret in 0xF1D0.

Precondition: Write shared secret into the data object and change the metadata of this data object to PRESSEC.

foo@bar:~$ ./bin/trustm_hkdf -i 0xF1D0 -H 0X08 -f info.bin -s salt.bin -o hkdf_f1d0_256.txt
========================================================
Run HKDF SHA256 command to derive the key

Input Secret OID: 0xF1D0
HKDF Type 0x0008
Output Derived key. 
========================================================
HKDF Type        : 0x0008 
Info File Name   : info.bin 
Salt File Name   : salt.bin 
Output File Name : hkdf_f1d0_256.txt 
salt data : 
	73 61 6C 74 31 32 33 34 35 36 37 38 39 61 62 31 
	32 33 34 35 36 37 38 39 0A 
Info data : 
	69 6E 66 6F 76 61 6C 75 65 31 32 33 0A 
Success
Decryption Key :
	D6 8B 57 18 C3 E8 F7 82 5F 1C A5 19 A7 59 26 8B 
	
========================================================

trustm_hmac

Simple demo to show the process to generate the MAC for the given input data using the secret installed in OPTIGA™ Trust M.

Note: For detailed use case, please refer to the test script hmac.sh inside "linux-optiga-trust-m/scripts/misc/"

foo@bar:~$ ./bin/trustm_hmac
Help menu: trustm_hmac <option> ...<option>
option:- 
-I <OID>      : Input secret OID 0xNNNN 
                [default 0xF1D0]
-H <SHA>      : hmac_SHA256:0x20 hmac_SHA384 :0x21 hmac_SHA512:0x22
                [default hmac_SHA256]
-o <filename> : Output MAC Data 
-i <filename> : Input Data file
-X            : Bypass Shielded Communication 
-h            : Print this help

Example : generate MAC value using HMAC SHA256 with shared secret in 0xF1D0.

Precondition: Write shared secret into the data object and change the metadata of this data object to PRESSEC.

foo@bar:~$ ./bin/trustm_hmac -I 0xF1D0 -H 0X20 -i hmac.txt -o hmac_data.txt
========================================================
Input Secret OID: 0xF1D0
SHA Type 0x0020
output the MAC data. 
========================================================
HMAC Type         : 0x0020 
Output File Name : hmac_data.txt 
Input File Name  : hmac.txt 
Input data : 
	68 6D 61 63 74 65 73 74 31 32 33 34 35 36 37 38 
	0A 
MAC data :
	1A 36 BA 85 4F B1 CC A5 4C 83 98 CD 5B CB EB 67 
	7D D5 07 B6 BD 9A E0 73 15 0D F6 63 6B 57 E1 6F 
	
========================================================

trustm_hmac_verify_Auth

Simple demo to show the process to do hmac verification with authorization reference(the secret installed in OPTIGA™ Trust M).

foo@bar:~$ ./bin/trustm_hmac_verify_Auth -h
Help menu: trustm_hmac_verify_Auth <option> ...<option>
option:- 
-I <OID>      : Input secret OID 0xNNNN 
                [default 0xF1D0]
-s <filename> : Input user secret 
-r <OID>      : Read from target OID
-w <OID>      : Write into target OID 0xNNNN 
-o <filename> : Output Data stored inside target OID
-X            : Bypass Shielded Communication 
-h            : Print this help

Precondition: Write shared secret into the data object and change the metadata of this data object to AUTHREF.

Note: For detailed use case, please refer to the sample test scripts inside "linux-optiga-trust-m/scripts/hmac_secure_storage/"

Run hmac_authenticated_storage_provisioning_step1.sh to do the provision for secret OID and Target OID.

Run hmac_authenticated_read_write_step2.sh to write in or readout the data in target OID after hmac verify successfully.

trustm_protected_update

Simple demo to show the process to do protected update for metadata of target OID by using the trust Anchor installed in OPTIGA™ Trust M and/or the secret installed in OPTIGA™ Trust M .

foo@bar:~$ ./bin/trustm_protected_update -h
Help menu: trustm_protected_update <option> ...<option>
option:- 
-k <OID>       : Target OID 
-f <filename>  : Fragment file
-m <filename>  : Manifest file
-X             : Bypass Shielded Communication 
-h             : Print this help

For detailed example for Integrity and Confidentiality Protected Update, Go to the subsection at Integrity and Confidentiality Protected Update example