Module config 

Configuration model for the TPM 2.0 backend.

TpmConfig captures everything the backend needs to locate and authorise against a TPM: the device path, the hierarchy the parent key lives under, the parent key’s persistent handle, and the authorisation value for that parent. The wire form (the Options string map surfaced at the FFI boundary) is parsed by TpmConfig::from_options.

See TODO.roadmap/18-hardware-keystore-backends.md for the design.

Structs

ParentHandle

A persistent TPM handle. Wraps a u32 so the wire encoding (hex string) is localised here and the call site reads naturally.

TpmConfig

Resolved configuration for the TPM backend.

Enums

Hierarchy

A TPM 2.0 hierarchy. Maps to the three persistent hierarchies defined by the TPM 2.0 specification: owner, platform, and endorsement. The parent key under which Confium wraps its sealed objects lives in one of these.

Constants

DEFAULT_HIERARCHY

Default hierarchy when OPT_HIERARCHY is absent.

OPT_HIERARCHY

Options key naming the hierarchy (one of owner, platform, endorsement).

OPT_PARENT_HANDLE

Options key naming the persistent parent handle, as a hex string (e.g. 0x81000001).

OPT_PARENT_PASSWORD

Options key carrying the authorisation value for the parent key. Empty by default — typical for owner-hierarchy parent keys.

OPT_TPM_DEVICE

Options key naming the TPM device path.