The following definitions pertain to both commands and responses:
• Authorization: Proves the right to access some entity in the TPM. TPM 2.0 uses three types of authorizations:
• Password authorization: this is a one shot clear text authorization.
• HMAC authorization: Uses a hash message authentication code (HMAC) for the authorization. The HMAC key is derived using a shared secret that is the basis of the authorization.
• Policy or enhanced authorization (EA): Uses policy assertions that must be satisfied in order to authorize an action on an object. Policy assertions are commands that are sent to the TPM before the command being authorized.
• Session: As defined in the TPM 2.0 specification, a “collection of TPM state that changes after each use.” Unfortunately, this definition is too general and not very informative. A better understanding of sessions comes from knowing how they are used. Sessions are used for authorizations and per-command actions (encryption, decryption, audit, and a few others) in
a session. In the case of HMAC and policy sessions, sessions are created and then used for multiple commands. Password authorizations are a special case of sessions that don't carry any state across multiple commands. The different types and uses of sessions are discussed at length in later chapters; for now it suffices to have a high-level understanding.
• Handle: An identifier that uniquely identifies a TPM resource that occupies TPM memory.
• Byte stream: On a command, the actual bytes sent to the TPM. On a response, the actual bytes received from the TPM.
• Canonicalized data: The command schematics in Part 3 describe the inputs and outputs from the TPM with C structures. These structures are often much larger than the data sent to the TPM. For instance, some structures contain unions consisting of elements
of widely varying sizes. For a given instance of one of these unions, only the data required by the particular union element being
used when sending the command is sent to the TPM. In addition, all data sent to and received from the TPM is in big-endian byte order. Data that meets these characteristics is canonicalized.
The aggregation and ordering of all the canonicalized inputs to a command forms the byte stream sent to the TPM. Response data from the TPM is also in canonicalized format.
• Unmarshalled data: Data in its C structure format.
• Marshalled data: Data in its canonicalized form—that is, the form sent to or received from the TPM.
Definitions of the Major Fields of the Command Byte Stream
The following items are described in the order in which they appear in the command byte stream:
• Command header: A common area for all commands. It consists of the tag, commandSize, and commandCode fields, described next.
• tag: Identifies whether the command contains sessions—that is, whether it contains an authorization area (defined shortly).
• commandSize: The size of the command byte stream, including all fields of the header.
• commandCode: Identifies the TPM command to be executed, and controls the interpretation of the rest of the command byte stream.
• Handle area: Contains between zero and three handles as specified by the Part 3 command schematics.
• Authorization area: Contains command session data. Multiple sessions can be associated with a single command, so this area can contain the parameters for between zero and three sessions. It contains authorization information, per-command session use modifiers, and some session state information that needs to be communicated between the application and the TPM.
• Parameter area: Contains command-specific parameters as described in Part 3 of the specification.
Definitions of the Major Fields of the Response Byte Stream
The following items are described in the order in which they appear in the response byte stream:
• Response header: A common area for all responses. It consists of the tag, responseSize, and responseCode fields, as described next:
• tag: Identifies whether the response contains sessions.
• responseSize: The size of the response byte stream, including all fields of the header.
• responseCode: Identifies the whether the TPM command succeeded and, if not, what specific error occurred.
• Handle area: Contains between zero and three handles, as specified by the Part 3 response schematics.
• Parameter area: Contains the command-specific response parameters, as described in Part 3 of the specification.
• Authorization area: Contains response session data. Multiple sessions can be associated with a single command, so this area can contain the parameters for between zero and three sessions. It contains authorization information, per-command session use modifiers, and some session state information that needs to be communicated between the application and the TPM.