#!/usr/bin/env bash
#
# Retrieve a password previously sealed into the TPM 2.0 with
# tpm-seal-password.sh. The TPM only releases the password if the current
# PCR values match those recorded when it was sealed.
# Requires: tpm2-tools, access to /dev/tpmrm0 (tss group or root).

set -euo pipefail

HANDLE="0x81010001"
PCR_LIST="sha256:7"

usage() {
	cat <<-EOF
	Usage: $(basename "$0") [-H handle] [-l pcr-list]

	  -H handle     Persistent TPM handle the password was sealed at
	                (default: ${HANDLE})
	  -l pcr-list   PCR bank and indices the password was bound to at
	                seal time (default: ${PCR_LIST})
	EOF
}

while getopts "H:l:h" opt; do
	case "$opt" in
	H) HANDLE="$OPTARG" ;;
	l) PCR_LIST="$OPTARG" ;;
	h) usage; exit 0 ;;
	*) usage; exit 1 ;;
	esac
done

command -v tpm2_unseal >/dev/null || {
	echo "tpm2-tools is required (apt install tpm2-tools)" >&2
	exit 1
}

if ! tpm2_readpublic -c "$HANDLE" >/dev/null 2>&1; then
	echo "No sealed object found at handle ${HANDLE}" >&2
	exit 1
fi

tpm2_unseal -c "$HANDLE" -p "pcr:${PCR_LIST}"