# cryptography

class tpm2_pytss.cryptography.tpm_ecc_private_key(ectx, handle, session=255)

  Interface to a TPM ECC key for use with the cryptography module.

  Parameters:

    - ectx (ESAPI) – The ESAPI instance to use.

    - handle (ESYS_TR) – The key handle.

    - session (ESYS_TR) – The session to authorize usage of the key, default is ESYS_TR.PASSWORD

  Notes

  It is recommended to use the `get_digest_algorithm()` and `get_signature_algorithm()` methods for highest compatibility.

  Raises:

    ValueError – If the key has the restricted bit set, the curve isn’t supported or if the handle doesn’t reference an ECC key.

  property curve

    The ECC curve.

  exchange(algorithm, peer_public_key)

    Implements the exchange interface.

    See `exchange()` for documentationen.

    Raises:

      ValueError – If the curves does not match or the decrypt bit isn’t set.

  get_digest_algorithm()

    Get an usable digest algorithm for use with the key.

    If any scheme with a specified digest algorithm is specified return that algorithm. Otherwise the name digest algorithm is returned.

    The returned digest algorithm can be used with different cryptography functions.

    Returns:

      The digest algorithm as a `HashAlgorithm` subclass.

    Raises:

      ValueError – If the digest algorithm is not supported.

  get_signature_algorithm()

    Get a padding configuration for use with the sign method.

    If the key has a scheme specified, use that scheme. Otherwise, use ECDSA as the default

    Returns: an instance of `EllipticCurveSignatureAlgorithm`

    Raises:

      ValueError – If the either the scheme or digest algorithm is unsupported.

  property key_size

    The ECC key size.

  private_bytes(encoding, format, encryption_algorithm)

    Always raises a NotImplementedError.

  private_numbers()

    Always raises a NotImplementedError.

  public_key()

    Get the public key.

    Returns: the public part of the ECC key as a `EllipticCurvePublicKey`

  sign(data, signature_algorithm)

    Implements the sign interface.

    See `sign()`: for documentation.

    Raises:

      ValueError – if the requested signature algorithm isn’t supported by the key or the sign_encrypt bit isn’t set.

class tpm2_pytss.cryptography.tpm_rsa_private_key(ectx, handle, session=255)

  Interface to a TPM RSA key for use with the cryptography module.

  Parameters:

    - ectx (ESAPI) – The ESAPI instance to use.

    - handle (ESYS_TR) – The key handle.

    - session (ESYS_TR) – The session to authorize usage of the key, default is ESYS_TR.PASSWORD

  Notes

  It is recommended to use the `get_digest_algorithm()`, `get_decryption_padding()` and `get_signature_padding()` methods for highest compatibility.

  Raises:

    ValueError – If the key has the restricted bit set or if the handle doesn’t reference an RSA key.

  decrypt(ciphertext, padding)

    Implements the decrypt interface.

    See `decrypt()` for documentation.

    Notes

    If a non-empty label is used with OAEP padding, this will fail.

    Raises:

      ValueError – if the requested padding isn’t supported by the key.

  get_decryption_padding()

    Get a padding configuration for use with the decrypt method.

    If the key has a scheme specified, use that scheme. Otherwise, use OAEP as the default.

    Returns:

      An instance of `AsymmetricPadding`.

    Raises:

      ValueError – If the either the scheme or digest algorithm is unsupported.

  get_digest_algorithm()

    Get an usable digest algorithm for use with the key.

    If any scheme with a specified digest algorithm is specified return that algorithm. Otherwise the name digest algorithm is returned.

    The returned digest algorithm can be used with different cryptography functions.

    Returns:

      The digest algorithm as a `HashAlgorithm` subclass.

    Raises:

      ValueError – If the digest algorithm is not supported.

  get_signature_padding()

    Get a padding configuration for use with the sign method.

    If the key has a scheme specified, use that scheme. Otherwise, use PSS as the default.

    Returns:

      An instance of `AsymmetricPadding`.

    Raises: ValueError if the either the scheme or digest algorithm is unsupported.

  property key_size

    The RSA key size

  private_bytes(encoding, format, encryption_algorithm)

    Always raises a NotImplementedError.

  private_numbers()

    Always raises a NotImplementedError.

  public_key()

    Get the public key.

    Returns: the public part of the RSA key as a `RSAPublicKey`.

  sign(data, padding, algorithm)

    Implements the sign interface.

    See `sign()` for documentationen.

    Notes

    For PSS padding, the salt length should be set to the length of the digest as that is the only setup the TPM uses.

    Raises:

      ValueError – If the requested padding isn’t supported by the key or the sign_encrypt bit isn’t set.