Skip to content

utils: add public API to get EK templates#686

Draft
whooo wants to merge 2 commits intotpm2-software:masterfrom
whooo:ek-templates-interface
Draft

utils: add public API to get EK templates#686
whooo wants to merge 2 commits intotpm2-software:masterfrom
whooo:ek-templates-interface

Conversation

@whooo
Copy link
Contributor

@whooo whooo commented Feb 22, 2026

Useful for when create_ek_template isn't a good fit.

Fixes #684

Useful for when create_ek_template isn't a good fit.

Fixes tpm2-software#684

Signed-off-by: Erik Larsson <who+github@cnackers.org>
@whooo whooo force-pushed the ek-templates-interface branch from 3158638 to 501017c Compare February 23, 2026 00:30
@whooo
Copy link
Contributor Author

whooo commented Mar 7, 2026

@salrashid123, would this work interface work for you?

@salrashid123
Copy link

thanks for this. works fine but do users have to know the string form of the template directly (eg, is there some sort of const string name for that anywhere eg ek_templates.EK_RSA2048?

from tpm2_pytss import *
from tpm2_pytss.utils import ek_templates, ek_template

ectx = ESAPI(tcti="swtpm:port=2321")
ectx.startup(TPM2_SU.CLEAR)

for k in ek_template.available_templates():
    print(k)

tmpl = ek_templates.get("ek-rsa2048")
#tmpl = ek_templates.get("L-1")

inSensitive = TPM2B_SENSITIVE_CREATE(TPMS_SENSITIVE_CREATE(userAuth=TPM2B_AUTH(''))) 
ek_handle, ek_pub, _, _, _ = ectx.create_primary(inSensitive, tmpl.template, ESYS_TR.ENDORSEMENT)

print(ek_pub.get_name())

ectx.flush_context(ek_handle)
ectx.close()

giving

$ python3 esapi_tpm2.py 
ek-rsa2048
l-1
ek-ecc256
l-2
ek-high-rsa2048
h-1
ek-high-ecc256
h-2
ek-high-ecc384
h-3
ek-high-ecc521
h-4
ek-high-eccsm2p256
h-5
ek-high-rsa3072
h-6
ek-high-rsa4096
h-7
000b7c65ad76d4ee1f1cf2f927ab371f24b295cb42bfb3a18c61cf2c66cbb80f8e50

@whooo
Copy link
Contributor Author

whooo commented Mar 7, 2026

´ek_templates.keys()´ should return the available templates by name

@salrashid123
Copy link

what i was mostly commenting on was having a const somewhere for the name and alias

eg to avoid someone doing this (eg omitting the hypen or having a typo on the .get() call)

tmpl = ek_templates.get("ekrsa2048")

also, i'm missing something but i can't seem to iterate using ek_templates.keys()

for k in ek_templates.keys():
    print(k)

TypeError: 'method' object is not iterable

Changes in upstream master sometimes breaks our jobs.
So use an release to avoid issues in upstream.

Signed-off-by: Erik Larsson <who+github@cnackers.org>
@whooo whooo force-pushed the ek-templates-interface branch from 501017c to 8b746e4 Compare March 7, 2026 13:40
@whooo
Copy link
Contributor Author

whooo commented Mar 7, 2026

what i was mostly commenting on was having a const somewhere for the name and alias

eg to avoid someone doing this (eg omitting the hypen or having a typo on the .get() call)

tmpl = ek_templates.get("ekrsa2048")

ek_templates["bad_name"] raises a KeyError if the template doesn't exists, you can also do "bad_name" in ek_templates to check if the template exists or not
The get method is mostly there so it behaves as dict or if you want do your own error handling

also, i'm missing something but i can't seem to iterate using ek_templates.keys()

for k in ek_templates.keys():
    print(k)

TypeError: 'method' object is not iterable

Fixed now

@salrashid123
Copy link

i can now iterate over the keys fine

for k in ek_templates.keys():
    print(k)

but i'm still missing something here

this supposed to work, correct?

try:
    tmpl = ek_templates["ek-rsa2048"]
except KeyError as e:
    print(e)
$ python3 --version
Python 3.13.12


$ python3 esapi_tpm2.py
    tmpl = ek_templates["ek-rsa2048"]
           ~~~~~~~~~~~~^^^^^^^^^^^^^^
TypeError: type 'ek_templates' is not subscriptable

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Expose EK and standard template classes

2 participants