Generated seal unseal store and read scripts for TPM.

tpm-nv-read-password.sh

@@ -0,0 +1,37 @@
+#!/usr/bin/env bash
+#
+# Read a password previously stored with tpm-nv-store-password.sh from a
+# TPM 2.0 NV index.
+# Requires: tpm2-tools, access to /dev/tpmrm0 (tss group or root).
+
+set -euo pipefail
+
+HANDLE="0x1500016"
+
+usage() {
+	cat <<-EOF
+	Usage: $(basename "$0") [-H handle]
+
+	  -H handle   NV index the password was stored at (default: ${HANDLE})
+	EOF
+}
+
+while getopts "H:h" opt; do
+	case "$opt" in
+	H) HANDLE="$OPTARG" ;;
+	h) usage; exit 0 ;;
+	*) usage; exit 1 ;;
+	esac
+done
+
+command -v tpm2_nvread >/dev/null || {
+	echo "tpm2-tools is required (apt install tpm2-tools)" >&2
+	exit 1
+}
+
+if ! tpm2_nvreadpublic | grep -q "^${HANDLE}:"; then
+	echo "No NV index found at ${HANDLE}" >&2
+	exit 1
+fi
+
+tpm2_nvread -C o "$HANDLE"