Metadata-Version: 2.4
Name: pytbs
Version: 0.1.0
Summary: Windows TPM Base Services (TBS) CLI: seal, unseal, and read PCRs via tbs.dll
Author: Daniel C
License: MIT
Keywords: tpm,tbs,windows,pcr,seal,unseal,security
Classifier: Development Status :: 3 - Alpha
Classifier: Environment :: Console
Classifier: Intended Audience :: System Administrators
Classifier: License :: OSI Approved :: MIT License
Classifier: Operating System :: Microsoft :: Windows
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.8
Classifier: Programming Language :: Python :: 3.9
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Classifier: Programming Language :: Python :: 3.14
Classifier: Topic :: Security
Classifier: Topic :: System :: Hardware
Requires-Python: >=3.8
Description-Content-Type: text/markdown
License-File: LICENSE
Dynamic: license-file

# pytbs

A Windows CLI for sealing data to the TPM, unsealing it, and reading PCR
values -- talking directly to `tbs.dll` (Windows TPM Base Services) over raw
TPM 2.0 commands. No external dependencies, no `tpm2-tools` install required.

Sealed data can only be unsealed while the PCRs it was sealed against still
hold the same values (e.g. a policy over PCR 0 and 7 ties the secret to the
current firmware/Secure Boot state) -- if the machine's boot state changes,
unsealing fails.

## Requirements

- Windows with a TPM 2.0 device (`tbs.dll` present, which is true on any
  supported Windows release with TPM support enabled)
- Python 3.8+

## Install

```
pip install .
```

This installs a `pytbs` console command -- no `python -m` needed.

## Usage

```
pytbs pcrs [-p LIST] [-a {sha1,sha256}] [-f {table,hex,json}]
pytbs seal -p LIST [-a {sha1,sha256}] (-i PATH | -x HEX) [-o PATH]
pytbs unseal (-i PATH | -x HEX) [-o PATH | -X]
```

`LIST` is a comma-separated list of PCR indices and/or hyphenated ranges,
e.g. `0,2,7` or `0-4,7,9-10`.

### Read PCRs

```
pytbs pcrs -p 0,7
pytbs pcrs                      # all PCRs (0-23), sha256 bank
pytbs pcrs -a sha1 -f json
```

### Seal

```
pytbs seal -p 0,7 -i secret.bin -o sealed.blob
pytbs seal -p 0-2 -x deadbeef              # blob printed as hex to stdout
```

### Unseal

```
pytbs unseal -i sealed.blob -o secret.bin
pytbs unseal -i sealed.blob                # unsealed data printed as hex
```

If the current PCR values don't match what the blob was sealed against,
`unseal` fails with a TPM policy error.

## Notes

- Not every TPM has every PCR bank allocated -- if `sha256` reads come back
  empty, try `-a sha1` (`pytbs pcrs` will tell you which bank is missing).
- The sealed blob format is pytbs-specific (see `pytbs/container.py`); it is
  not compatible with `tpm2-tools`' sealed object files.
- This wraps only the small subset of the TPM 2.0 command set needed for
  seal/unseal/PCR read -- it isn't a general-purpose TPM library.

## Development

```
pip install -e .
pip install pytest
pytest
```
