summaryrefslogtreecommitdiffstats
path: root/flounder_6.0.0.xml
blob: 47ca9923991c3a94e61295b6520dea57aeae58c5 (plain) 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35

<?xml version="1.0" encoding="UTF-8"?>
<manifest>
  <remote fetch="https://gerrit.automotivelinux.org/gerrit/" name="agl" pushurl="ssh://gerrit.automotivelinux.org:29418" review="https://gerrit.automotivelinux.org/gerrit/"/>
  <remote fetch="https://github.com/" name="github"/>
  <remote fetch="git://git.openembedded.org/" name="openembedded"/>
  <remote fetch="git://code.qt.io/" name="qt.io"/>
  <remote fetch="git://git.yoctoproject.org/" name="yocto"/>
  
  <default remote="agl" revision="refs/tags/flounder/6.0.0" sync-j="4"/>
  
  <project name="01org/meta-security-isafw" path="meta-security-isafw" remote="github" revision="489abdc65cefb566d696c8b218aa0b9b99a350ae" upstream="master"/>
  <project name="AGL/meta-agl" path="meta-agl"/>
  <project name="AGL/meta-agl-demo" path="meta-agl-demo"/>
  <project name="AGL/meta-agl-devel" path="meta-agl-devel"/>
  <project name="AGL/meta-agl-extra" path="meta-agl-extra"/>
  <project name="AGL/meta-renesas-rcar-gen3" path="meta-renesas-rcar-gen3"/>
  <project name="CogentEmbedded/meta-rcar" path="meta-rcar" remote="github" revision="a0551596548ef3a4c9132161f3d9c4ae538d6fdc" upstream="v3.7.0"/>
  <project name="advancedtelematic/meta-updater" path="meta-updater" remote="github" revision="ff555e8690eb47177ade42dc6912ae17a759cc45" upstream="rocko"/>
  <project name="advancedtelematic/meta-updater-qemux86-64" path="meta-updater-qemux86-64" remote="github" revision="697632ddd98ed7ae3dbd0bd84abb04079767bc56" upstream="rocko"/>
  <project name="boundarydevices/meta-boundary" path="meta-boundary" remote="github" revision="f96f41b2e5beda2b51acb702d082568898b36a68" upstream="rocko"/>
  <project name="kraj/meta-altera" path="meta-altera" remote="github" revision="14e08a419cb9d4017f40360c14fcc3c2c1ce8e42" upstream="rocko"/>
  <project name="meta-freescale" remote="yocto" revision="a4158e3425a79720ddc4c02e76251d567bdceb51" upstream="rocko"/>
  <project name="meta-gplv2" remote="yocto" revision="f875c60ecd6f30793b80a431a2423c4b98e51548" upstream="rocko"/>
  <project name="meta-intel" remote="yocto" revision="718bb384942675437c081f6795da7f421da1fee6" upstream="rocko"/>
  <project name="meta-oic" remote="yocto" revision="6e831e4bcdfa6ab8c26eb4fca4bdc98faf028818" upstream="1.2.1"/>
  <project name="meta-openembedded" remote="openembedded" revision="352531015014d1957d6444d114f4451e241c4d23" upstream="rocko"/>
  <project name="meta-qcom" remote="yocto" revision="955ce2625de5d8c7fe313bd4630c8a290e4b96f8" upstream="rocko"/>
  <project name="meta-qt5/meta-qt5" path="meta-qt5" remote="github" revision="682ad61c071a9710e9f9d8a32ab1b5f3c14953d1" upstream="rocko"/>
  <project name="meta-raspberrypi" remote="yocto" revision="8e4c537d84fdde8e3b4642d0dda2c0f4af76d52f" upstream="rocko"/>
  <project name="meta-security" remote="yocto" revision="8f6969a775fa6afbf553e72ba83e71197780b2d8" upstream="master"/>
  <project name="meta-ti" remote="yocto" revision="ed83a43c6a76875ee5f0388b3b60a28f2a373a10" upstream="rocko"/>
  <project name="meta-virtualization" remote="yocto" revision="bd77388f31929f38e7d4cc9c711f0f83f563007e" upstream="rocko"/>
  <project name="phongt/meta-sdl" path="meta-sdl" remote="github" revision="60c9fe8a4a9c6ca95f222685f8d6248f16236f2a" upstream="release/4.4.0"/>
  <project name="poky" remote="yocto" revision="refs/tags/yocto-2.4.3" upstream="rocko"/>
</manifest>
olor: #0000DD; font-weight: bold } /* Literal.Number.Integer.Long */ } 
REM #############################################################################
REM #										#
REM #			TPM2 regression test					#
REM #			     Written by Ken Goldman				#
REM #		       IBM Thomas J. Watson Research Center			#
REM #										#
REM # (c) Copyright IBM Corporation 2018 - 2020					#
REM # 										#
REM # All rights reserved.							#
REM # 										#
REM # Redistribution and use in source and binary forms, with or without	#
REM # modification, are permitted provided that the following conditions are	#
REM # met:									#
REM # 										#
REM # Redistributions of source code must retain the above copyright notice,	#
REM # this list of conditions and the following disclaimer.			#
REM # 										#
REM # Redistributions in binary form must reproduce the above copyright		#
REM # notice, this list of conditions and the following disclaimer in the	#
REM # documentation and/or other materials provided with the distribution.	#
REM # 										#
REM # Neither the names of the IBM Corporation nor the names of its		#
REM # contributors may be used to endorse or promote products derived from	#
REM # this software without specific prior written permission.			#
REM # 										#
REM # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS	#
REM # "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT		#
REM # LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR	#
REM # A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT	#
REM # HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,	#
REM # SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT		#
REM # LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,	#
REM # DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY	#
REM # THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT	#
REM # (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE	#
REM # OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.	#
REM #										#
REM #############################################################################

setlocal enableDelayedExpansion

echo ""
echo "TPM2_CertifyX509"
echo ""

rem # basic test

rem # sign%%Arpriv.bin is a restricted signing key
rem # sign%%Apriv.bin is an unrestricted signing key

set SALG=rsa ecc
set SKEY=rsa2048 ecc

set i=0
for %%a in (!SALG!) do set /A i+=1 & set SALG[!i!]=%%a
set i=0
for %%b in (!SKEY!) do set /A i+=1 & set SKEY[!i!]=%%b
set L=!i!

for /L %%i in (1,1,!L!) do (

    echo "Load the !SALG[%%i]! issuer key 80000001 under the primary key"
    %TPM_EXE_PATH%load -hp 80000000 -ipr sign!SKEY[%%i]!rpriv.bin -ipu sign!SKEY[%%i]!rpub.bin -pwdp sto > run.out
    IF !ERRORLEVEL! NEQ 0 (
	exit /B 1
    )

    echo "Load the !SALG[%%i]! subject key 80000002 under the primary key"
    %TPM_EXE_PATH%load -hp 80000000 -ipr sign!SKEY[%%i]!priv.bin -ipu sign!SKEY[%%i]!pub.bin -pwdp sto > run.out
    IF !ERRORLEVEL! NEQ 0 (
	exit /B 1
    )

    echo "Signing Key Self Certify CA Root !SKEY[%%i]!"
    %TPM_EXE_PATH%certifyx509 -hk 80000001 -ho 80000001 -halg sha256 -pwdk sig -pwdo sig -opc tmppart1.bin -os tmpsig1.bin -oa tmpadd1.bin -otbs tmptbs1.bin -ocert tmpx5091.bin -salg !SALG[%%i]! -sub -v -iob 00050472 > run.out
    IF !ERRORLEVEL! NEQ 0 (
	exit /B 1
    )


    rem # dumpasn1 -a -l -d     tmpx509i.bin > tmpx509i1.dump
    rem # dumpasn1 -a -l -d -hh tmpx509i.bin > tmpx509i1.dumphh
    rem # dumpasn1 -a -l -d     tmppart1.bin > tmppart1.dump
    rem # dumpasn1 -a -l -d -hh tmppart1.bin > tmppart1.dumphh
    rem # dumpasn1 -a -l -d     tmpadd1.bin  > tmpadd1.dump
    rem # dumpasn1 -a -l -d -hh tmpadd1.bin  > tmpadd1.dumphh
    rem # dumpasn1 -a -l -d     tmpx5091.bin > tmpx5091.dump
    rem # dumpasn1 -a -l -d -hh tmpx5091.bin > tmpx5091.dumphh
    rem # openssl x509 -text -inform der -in tmpx5091.bin -noout > tmpx5091.txt

    echo "Convert issuer X509 DER to PEM"
    openssl x509 -inform der -in tmpx5091.bin -out tmpx5091.pem

    echo "Verify !SKEY[%%i]! self signed issuer root" 
    openssl verify -CAfile tmpx5091.pem tmpx5091.pem

    echo "Signing Key Certify !SALG[%%i]!"
    %TPM_EXE_PATH%certifyx509 -hk 80000001 -ho 80000002 -halg sha256 -pwdk sig -pwdo sig -opc tmppart2.bin -os tmpsig2.bin -oa tmpadd2.bin -otbs tmptbs2.bin -ocert tmpx5092.bin -salg !SALG[%%i]! -iob 00040472 > run.out
    IF !ERRORLEVEL! NEQ 0 (
	exit /B 1
    )

rem     # dumpasn1 -a -l -d     tmpx509i.bin > tmpx509i2.dump
rem     # dumpasn1 -a -l -d -hh tmpx509i.bin > tmpx509i2.dumphh
rem     # dumpasn1 -a -l -d     tmppart2.bin > tmppart2.dump
rem     # dumpasn1 -a -l -d -hh tmppart2.bin > tmppart2.dumphhe 
rem     # dumpasn1 -a -l -d     tmpadd2.bin  > tmpadd2.dump
rem     # dumpasn1 -a -l -d -hh tmpadd2.bin  > tmpadd2.dumphh
rem     # dumpasn1 -a -l -d     tmpx5092.bin > tmpx5092.dump
rem     # dumpasn1 -a -l -d -hh tmpx5092.bin > tmpx5092.dumphh
rem     # openssl x509 -text -inform der -in tmpx5092.bin -noout > tmpx5092.txt

    echo "Convert subject X509 DER to PEM"
    openssl x509 -inform der -in tmpx5092.bin -out tmpx5092.pem

    echo "Verify !SKEY[%%i]! subject against issuer" 
    openssl verify -CAfile tmpx5091.pem tmpx5092.pem


    echo "Signing Key Certify !SALG[%%i]! with bad OID"
    %TPM_EXE_PATH%certifyx509 -hk 80000001 -ho 80000002 -halg sha256 -pwdk sig -pwdo sig -opc tmppart2.bin -os tmpsig2.bin -oa tmpadd2.bin -otbs tmptbs2.bin -ocert tmpx5092.bin -salg !SALG[%%i]! -iob ffffffff > run.out
    IF !ERRORLEVEL! EQU 0 (
       exit /B 1
    )
rem # bad der, test bits for 250 bytes
rem # better to get size from tmppart2.bin

rem     # for bit in {0..2}
rem     # do
rem     # 	echo "Signing Key Certify !SKEY[%%i]! testing bit $bit"
rem     # 	%TPM_EXE_PATH%certifyx509 -hk 80000001 -ho 80000002 -halg sha256 -pwdk sig -pwdo sig -opc tmppart2.bin -os tmpsig2.bin -oa tmpadd2.bin -otbs tmptbs2.bin -ocert tmpx5092.bin -salg !SALG[%%i]! -bit $bit > run.out
    rem IF !ERRORLEVEL! NEQ 0 (
    rem 	exit /B 1
    rem )

    echo "Flush the root CA issuer signing key"
    %TPM_EXE_PATH%flushcontext -ha 80000001 > run.out
    IF !ERRORLEVEL! NEQ 0 (
	exit /B 1
    )

    echo "Flush the subject signing key"
    %TPM_EXE_PATH%flushcontext -ha 80000002 > run.out
    IF !ERRORLEVEL! NEQ 0 (
	exit /B 1
    )

)

rem # bad extensions for key type

echo ""
echo "TPM2_CertifyX509 Key Usage Extension for fixedTPM signing key"
echo ""

for /L %%i in (1,1,!L!) do (

    echo "Load the !SKEY[%%i]! issuer key 80000001 under the primary key"
    %TPM_EXE_PATH%load -hp 80000000 -ipr sign!SKEY[%%i]!rpriv.bin -ipu sign!SKEY[%%i]!rpub.bin -pwdp sto > run.out
    IF !ERRORLEVEL! NEQ 0 (
	exit /B 1
    )

    echo "Load the !SKEY[%%i]! subject key 80000002 under the primary key"
    %TPM_EXE_PATH%load -hp 80000000 -ipr sign!SKEY[%%i]!priv.bin -ipu sign!SKEY[%%i]!pub.bin -pwdp sto > run.out
    IF !ERRORLEVEL! NEQ 0 (
	exit /B 1
    )

    echo "Signing Key Certify !SALG[%%i]! digitalSignature"
    %TPM_EXE_PATH%certifyx509 -hk 80000001 -ho 80000002 -halg sha256 -pwdk sig -pwdo sig -opc tmppart2.bin -os tmpsig2.bin -oa tmpadd2.bin -otbs tmptbs2.bin -ocert tmpx5092.bin -salg !SALG[%%i]! -ku critical,digitalSignature > run.out
    IF !ERRORLEVEL! NEQ 0 (
	exit /B 1
    )

    echo "Signing Key Certify !SALG[%%i]! nonRepudiation"
    %TPM_EXE_PATH%certifyx509 -hk 80000001 -ho 80000002 -halg sha256 -pwdk sig -pwdo sig -opc tmppart2.bin -os tmpsig2.bin -oa tmpadd2.bin -otbs tmptbs2.bin -ocert tmpx5092.bin -salg !SALG[%%i]! -ku critical,nonRepudiation > run.out
    IF !ERRORLEVEL! NEQ 0 (
	exit /B 1
    )

    echo "Signing Key Certify !SALG[%%i]! keyEncipherment"
    %TPM_EXE_PATH%certifyx509 -hk 80000001 -ho 80000002 -halg sha256 -pwdk sig -pwdo sig -opc tmppart2.bin -os tmpsig2.bin -oa tmpadd2.bin -otbs tmptbs2.bin -ocert tmpx5092.bin -salg !SALG[%%i]! -ku critical,keyEncipherment > run.out
    IF !ERRORLEVEL! EQU 0 (
	exit /B 1
    )

   echo "Signing Key Certify !SALG[%%i]! dataEncipherment"
    %TPM_EXE_PATH%certifyx509 -hk 80000001 -ho 80000002 -halg sha256 -pwdk sig -pwdo sig -opc tmppart2.bin -os tmpsig2.bin -oa tmpadd2.bin -otbs tmptbs2.bin -ocert tmpx5092.bin -salg !SALG[%%i]! -ku critical,dataEncipherment > run.out
    IF !ERRORLEVEL! EQU 0 (
	exit /B 1
    )

    echo "Signing Key Certify !SALG[%%i]! keyAgreement"
    %TPM_EXE_PATH%certifyx509 -hk 80000001 -ho 80000002 -halg sha256 -pwdk sig -pwdo sig -opc tmppart2.bin -os tmpsig2.bin -oa tmpadd2.bin -otbs tmptbs2.bin -ocert tmpx5092.bin -salg !SALG[%%i]! -ku critical,keyAgreement > run.out
    IF !ERRORLEVEL! EQU 0 (
	exit /B 1
    )

    echo "Signing Key Certify !SALG[%%i]! keyCertSign"
    %TPM_EXE_PATH%certifyx509 -hk 80000001 -ho 80000002 -halg sha256 -pwdk sig -pwdo sig -opc tmppart2.bin -os tmpsig2.bin -oa tmpadd2.bin -otbs tmptbs2.bin -ocert tmpx5092.bin -salg !SALG[%%i]! -ku critical,keyCertSign > run.out
    IF !ERRORLEVEL! NEQ 0 (
	exit /B 1
    )

    echo "Signing Key Certify !SALG[%%i]! cRLSign"
    %TPM_EXE_PATH%certifyx509 -hk 80000001 -ho 80000002 -halg sha256 -pwdk sig -pwdo sig -opc tmppart2.bin -os tmpsig2.bin -oa tmpadd2.bin -otbs tmptbs2.bin -ocert tmpx5092.bin -salg !SALG[%%i]! -ku critical,cRLSign > run.out
    IF !ERRORLEVEL! NEQ 0 (
	exit /B 1
    )

    echo "Signing Key Certify !SALG[%%i]! encipherOnly"
    %TPM_EXE_PATH%certifyx509 -hk 80000001 -ho 80000002 -halg sha256 -pwdk sig -pwdo sig -opc tmppart2.bin -os tmpsig2.bin -oa tmpadd2.bin -otbs tmptbs2.bin -ocert tmpx5092.bin -salg !SALG[%%i]! -ku critical,encipherOnly > run.out
    IF !ERRORLEVEL! EQU 0 (
	exit /B 1
    )

    echo "Signing Key Certify !SALG[%%i]! decipherOnly"
    %TPM_EXE_PATH%certifyx509 -hk 80000001 -ho 80000002 -halg sha256 -pwdk sig -pwdo sig -opc tmppart2.bin -os tmpsig2.bin -oa tmpadd2.bin -otbs tmptbs2.bin -ocert tmpx5092.bin -salg !SALG[%%i]! -ku critical,decipherOnly > run.out
    IF !ERRORLEVEL! EQU 0 (
	exit /B 1
    )

    echo "Flush the root CA issuer signing key"
    %TPM_EXE_PATH%flushcontext -ha 80000001 > run.out
    IF !ERRORLEVEL! NEQ 0 (
	exit /B 1
    )

    echo "Flush the subject signing key"
    %TPM_EXE_PATH%flushcontext -ha 80000002 > run.out
    IF !ERRORLEVEL! NEQ 0 (
	exit /B 1
    )

)

echo ""
echo "TPM2_CertifyX509 Key Usage Extension for not fixedTPM signing key"
echo ""

for /L %%i in (1,1,!L!) do (

    echo "Load the !SKEY[%%i]! issuer key 80000001 under the primary key"
    %TPM_EXE_PATH%load -hp 80000000 -ipr sign!SKEY[%%i]!nfpriv.bin -ipu sign!SKEY[%%i]!nfpub.bin -pwdp sto > run.out
    IF !ERRORLEVEL! NEQ 0 (
	exit /B 1
    )

    echo "Load the !SKEY[%%i]! subject key 80000002 under the primary key"
    %TPM_EXE_PATH%load -hp 80000000 -ipr sign!SKEY[%%i]!nfpriv.bin -ipu sign!SKEY[%%i]!nfpub.bin -pwdp sto > run.out
    IF !ERRORLEVEL! NEQ 0 (
	exit /B 1
    )

    echo "Signing Key Certify !SALG[%%i]! digitalSignature"
    %TPM_EXE_PATH%certifyx509 -hk 80000001 -ho 80000002 -halg sha256 -pwdk sig -pwdo sig -opc tmppart2.bin -os tmpsig2.bin -oa tmpadd2.bin -otbs tmptbs2.bin -ocert tmpx5092.bin -salg !SALG[%%i]! -ku critical,digitalSignature > run.out
    IF !ERRORLEVEL! NEQ 0 (
	exit /B 1
    )

    echo "Signing Key Certify !SALG[%%i]! nonRepudiation"
    %TPM_EXE_PATH%certifyx509 -hk 80000001 -ho 80000002 -halg sha256 -pwdk sig -pwdo sig -opc tmppart2.bin -os tmpsig2.bin -oa tmpadd2.bin -otbs tmptbs2.bin -ocert tmpx5092.bin -salg !SALG[%%i]! -ku critical,nonRepudiation > run.out
    IF !ERRORLEVEL! EQU 0 (
	exit /B 1
    )

    echo "Signing Key Certify !SALG[%%i]! keyEncipherment"
    %TPM_EXE_PATH%certifyx509 -hk 80000001 -ho 80000002 -halg sha256 -pwdk sig -pwdo sig -opc tmppart2.bin -os tmpsig2.bin -oa tmpadd2.bin -otbs tmptbs2.bin -ocert tmpx5092.bin -salg !SALG[%%i]! -ku critical,keyEncipherment > run.out
    IF !ERRORLEVEL! EQU 0 (
	exit /B 1
    )

   echo "Signing Key Certify !SALG[%%i]! dataEncipherment"
    %TPM_EXE_PATH%certifyx509 -hk 80000001 -ho 80000002 -halg sha256 -pwdk sig -pwdo sig -opc tmppart2.bin -os tmpsig2.bin -oa tmpadd2.bin -otbs tmptbs2.bin -ocert tmpx5092.bin -salg !SALG[%%i]! -ku critical,dataEncipherment > run.out
    IF !ERRORLEVEL! EQU 0 (
	exit /B 1
    )

    echo "Signing Key Certify !SALG[%%i]! keyAgreement"
    %TPM_EXE_PATH%certifyx509 -hk 80000001 -ho 80000002 -halg sha256 -pwdk sig -pwdo sig -opc tmppart2.bin -os tmpsig2.bin -oa tmpadd2.bin -otbs tmptbs2.bin -ocert tmpx5092.bin -salg !SALG[%%i]! -ku critical,keyAgreement > run.out
    IF !ERRORLEVEL! EQU 0 (
	exit /B 1
    )

    echo "Signing Key Certify !SALG[%%i]! keyCertSign"
    %TPM_EXE_PATH%certifyx509 -hk 80000001 -ho 80000002 -halg sha256 -pwdk sig -pwdo sig -opc tmppart2.bin -os tmpsig2.bin -oa tmpadd2.bin -otbs tmptbs2.bin -ocert tmpx5092.bin -salg !SALG[%%i]! -ku critical,keyCertSign > run.out
    IF !ERRORLEVEL! NEQ 0 (
	exit /B 1
    )

    echo "Signing Key Certify !SALG[%%i]! cRLSign"
    %TPM_EXE_PATH%certifyx509 -hk 80000001 -ho 80000002 -halg sha256 -pwdk sig -pwdo sig -opc tmppart2.bin -os tmpsig2.bin -oa tmpadd2.bin -otbs tmptbs2.bin -ocert tmpx5092.bin -salg !SALG[%%i]! -ku critical,cRLSign > run.out
    IF !ERRORLEVEL! NEQ 0 (
	exit /B 1
    )

    echo "Signing Key Certify !SALG[%%i]! encipherOnly"
    %TPM_EXE_PATH%certifyx509 -hk 80000001 -ho 80000002 -halg sha256 -pwdk sig -pwdo sig -opc tmppart2.bin -os tmpsig2.bin -oa tmpadd2.bin -otbs tmptbs2.bin -ocert tmpx5092.bin -salg !SALG[%%i]! -ku critical,encipherOnly > run.out
    IF !ERRORLEVEL! EQU 0 (
	exit /B 1
    )

    echo "Signing Key Certify !SALG[%%i]! decipherOnly"
    %TPM_EXE_PATH%certifyx509 -hk 80000001 -ho 80000002 -halg sha256 -pwdk sig -pwdo sig -opc tmppart2.bin -os tmpsig2.bin -oa tmpadd2.bin -otbs tmptbs2.bin -ocert tmpx5092.bin -salg!SALG[%%i]!A -ku critical,decipherOnly > run.out
    IF !ERRORLEVEL! EQU 0 (
	exit /B 1
    )

    echo "Flush the root CA issuer signing key"
    %TPM_EXE_PATH%flushcontext -ha 80000001 > run.out
    IF !ERRORLEVEL! NEQ 0 (
	exit /B 1
    )

    echo "Flush the subject signing key"
    %TPM_EXE_PATH%flushcontext -ha 80000002 > run.out
    IF !ERRORLEVEL! NEQ 0 (
	exit /B 1
    )

)

echo ""
echo "TPM2_CertifyX509 Key Usage Extension for fixedTpm restricted encryption key"
echo ""

for /L %%i in (1,1,!L!) do (

    echo "Load the !SKEY[%%i]! issuer key 80000001 under the primary key"
    %TPM_EXE_PATH%load -hp 80000000 -ipr sign!SKEY[%%i]!rpriv.bin -ipu sign!SKEY[%%i]!rpub.bin -pwdp sto > run.out
    IF !ERRORLEVEL! NEQ 0 (
	exit /B 1
    )

    echo "Load the !SKEY[%%i]! subject key 80000002 under the primary key"
    %TPM_EXE_PATH%load -hp 80000000 -ipr store!SKEY[%%i]!priv.bin -ipu store!SKEY[%%i]!pub.bin -pwdp sto > run.out
    IF !ERRORLEVEL! NEQ 0 (
	exit /B 1
    )

    echo "Signing Key Certify !SALG[%%i]! digitalSignature"
    %TPM_EXE_PATH%certifyx509 -hk 80000001 -ho 80000002 -halg sha256 -pwdk sig -pwdo sto -opc tmppart2.bin -os tmpsig2.bin -oa tmpadd2.bin -otbs tmptbs2.bin -ocert tmpx5092.bin -salg !SALG[%%i]! -ku critical,digitalSignature > run.out
    IF !ERRORLEVEL! EQU 0 (
	exit /B 1
    )

    echo "Signing Key Certify !SALG[%%i]! nonRepudiation"
    %TPM_EXE_PATH%certifyx509 -hk 80000001 -ho 80000002 -halg sha256 -pwdk sig -pwdo sto -opc tmppart2.bin -os tmpsig2.bin -oa tmpadd2.bin -otbs tmptbs2.bin -ocert tmpx5092.bin -salg !SALG[%%i]! -ku critical,nonRepudiation > run.out
    IF !ERRORLEVEL! NEQ 0 (
	exit /B 1
    )

    echo "Signing Key Certify !SALG[%%i]! keyEncipherment"
    %TPM_EXE_PATH%certifyx509 -hk 80000001 -ho 80000002 -halg sha256 -pwdk sig -pwdo sto -opc tmppart2.bin -os tmpsig2.bin -oa tmpadd2.bin -otbs tmptbs2.bin -ocert tmpx5092.bin -salg !SALG[%%i]! -ku critical,keyEncipherment > run.out
    IF !ERRORLEVEL! NEQ 0 (
	exit /B 1
    )

    echo "Signing Key Certify !SALG[%%i]! dataEncipherment"
    %TPM_EXE_PATH%certifyx509 -hk 80000001 -ho 80000002 -halg sha256 -pwdk sig -pwdo sto -opc tmppart2.bin -os tmpsig2.bin -oa tmpadd2.bin -otbs tmptbs2.bin -ocert tmpx5092.bin -salg !SALG[%%i]! -ku critical,dataEncipherment > run.out
    IF !ERRORLEVEL! NEQ 0 (
	exit /B 1
    )

    echo "Signing Key Certify !SALG[%%i]! keyAgreement"
    %TPM_EXE_PATH%certifyx509 -hk 80000001 -ho 80000002 -halg sha256 -pwdk sig -pwdo sto -opc tmppart2.bin -os tmpsig2.bin -oa tmpadd2.bin -otbs tmptbs2.bin -ocert tmpx5092.bin -salg !SALG[%%i]! -ku critical,keyAgreement > run.out
    IF !ERRORLEVEL! NEQ 0 (
	exit /B 1
    )

    echo "Signing Key Certify !SALG[%%i]! keyCertSign"
    %TPM_EXE_PATH%certifyx509 -hk 80000001 -ho 80000002 -halg sha256 -pwdk sig -pwdo sto -opc tmppart2.bin -os tmpsig2.bin -oa tmpadd2.bin -otbs tmptbs2.bin -ocert tmpx5092.bin -salg !SALG[%%i]! -ku critical,keyCertSign > run.out
    IF !ERRORLEVEL! EQU 0 (
	exit /B 1
    )

    echo "Signing Key Certify !SALG[%%i]! cRLSign"
    %TPM_EXE_PATH%certifyx509 -hk 80000001 -ho 80000002 -halg sha256 -pwdk sig -pwdo sto -opc tmppart2.bin -os tmpsig2.bin -oa tmpadd2.bin -otbs tmptbs2.bin -ocert tmpx5092.bin -salg !SALG[%%i]! -ku critical,cRLSign > run.out
    IF !ERRORLEVEL! EQU 0 (
	exit /B 1
    )

    echo "Signing Key Certify !SALG[%%i]! encipherOnly"
    %TPM_EXE_PATH%certifyx509 -hk 80000001 -ho 80000002 -halg sha256 -pwdk sig -pwdo sto -opc tmppart2.bin -os tmpsig2.bin -oa tmpadd2.bin -otbs tmptbs2.bin -ocert tmpx5092.bin -salg !SALG[%%i]! -ku critical,encipherOnly > run.out
    IF !ERRORLEVEL! NEQ 0 (
	exit /B 1
    )

    echo "Signing Key Certify !SALG[%%i]! decipherOnly"
    %TPM_EXE_PATH%certifyx509 -hk 80000001 -ho 80000002 -halg sha256 -pwdk sig -pwdo sto -opc tmppart2.bin -os tmpsig2.bin -oa tmpadd2.bin -otbs tmptbs2.bin -ocert tmpx5092.bin -salg !SALG[%%i]! -ku critical,decipherOnly > run.out
    IF !ERRORLEVEL! NEQ 0 (
	exit /B 1
    )

    echo "Flush the root CA issuer signing key"
    %TPM_EXE_PATH%flushcontext -ha 80000001 > run.out
    IF !ERRORLEVEL! NEQ 0 (
	exit /B 1
    )

    echo "Flush the subject signing key"
    %TPM_EXE_PATH%flushcontext -ha 80000002 > run.out
    IF !ERRORLEVEL! NEQ 0 (
	exit /B 1
    )

)

rem # cleanup

rm tmppart1.bin
rm tmpadd1.bin
rm tmptbs1.bin
rm tmpsig1.bin
rm tmpx5091.bin
rm tmpx5091.pem
rm tmpx5092.pem
rm tmpx509i.bin
rm tmppart2.bin
rm tmpadd2.bin
rm tmptbs2.bin
rm tmpsig2.bin
rm tmpx5092.bin

exit /B 0