Copyright © TCG 2021 TSS Enhanced System API (ESAPI) Specification Version 1.00 Revision 14
Version 1.00, Revision 14 Page 16 of 123 October 1, 2021
2 TSS Enhanced System API Overview
ESAPI Overview
The Enhanced System API (ESAPI) is an interface that is intended to sit directly above the System API.
The primary purpose of the ESAPI is to reduce the programming complexity of applications that desire to
send individual “system level” TPM calls to the TPM, but that also require cryptographic operations on the
data being passed to and from the TPM. In particular, applications that wish to utilize secure sessions to
perform Hash-based Message Authentication Code (HMAC) operations, parameter encryption, parameter
decryption, TPM command audit and TPM policy operations could benefit from using the ESAPI.
Additionally, context and object management are provided by the ESAPI.
While the ESAPI is significantly less complex to use than the System API for cryptographically protected
communications with the TPM, it still requires in-depth understanding about the interface to a TPM 2.0. It
is therefore envisioned that only expert applications will utilize the ESAPI and that typical applications
would utilize a higher-level interface such as the Feature API. It is, however, expected that Feature API
implementations would utilize the ESAPI as appropriate.
ESAPI Functional Description
The ESAPI layer of TSS 2.0 has three primary purposes:
• It provides cryptographic functionality for applications wishing to encrypt the data stream from
TSS 2.0 to the TPM (thus defeating sideband attacks involving probing of the data bus to the
TPM 2.0).
• It provides enhanced session management functionality on top of the base SAPI functionality.
• It provides 100% TPM functionality
NOTE: The FAPI layer provides only about 80% of the TPM’s functionality.
To use the ESAPI, applications (and their programmers) need to understand part 2 and part 3 of the TCG
TPM 2.0 specification. The differences between ESAPI and SAPI are as follows.
剩余122页未读，继续阅读
