Admin

name	type	size	perms	modified	actions
[parent directory]
CHANGELOG.md	file	87,694 B	0644	2024-04-26 11:31:00	edit
README.md	file	2,662 B	0644	2023-05-22 13:06:21	edit

editing: CHANGELOG.md

## Changelog

All notable changes to this project will be documented in this file.

Starting with release 5.4, The format is based on [Keep a Changelog](http://keepachangelog.com/).

## 5.7 - 2024-04-26
### Security
- Fixed CVE-2024-29038
- Fixed CVE-2024-29039

### Fixed
- Fix eventlog test
- Fix issues with reading NV indexes
- Fix context save error on tpm2_create
- tpm2_sessionconfig: fix handling of `--disable-continue session` so that the subsequent command will not fail
   when attempting to context save a flushed session.
- detection of functions within libcrypto when CRYPTO_LIBS is set and system has install libcrypto.
- tpm2_send: fix EOF detection on input stream.
- tpm2_policy.c fix compilation error caused by format directive for size_t on 32 bit systems.
- tpm2_nvread: fix input handling no nv index.
- Auth file: Ensure 0-termination when reading auths from a file.
- configure.ac: fix bashisms. configure scripts need to be runnable with a POSIX-compliant /bin/sh.
- cirrus.yml fix tss compilation with libtpms for FreeBSD.
- tpm2_tool.c Fix missing include for basename to enable compilation on netbsd.
- options: fix TCTI handling to avoid failures for commands that should work with no options.
- tpm2_getekcertificate.c Fix leak. ek_uri was not freed if get_ek_server_address failed.

### Added
- Add the possibility for autoflush (environment variable "TPM2TOOLS_AUTOFLUSH", or -R option)

### Removed
- Testing on Ubuntu 18.04 as it's near EOL (May 2023).m2_policy.c fix compilation error caused by format directive for size_t on 32 bit systems.
- tpm2_nvread: fix input handling no nv index.

## 5.6 - 2023-11-08

- Add safe directory in config

## 5.6-rc0 - 2023-09-26

*  tpm2_eventlog:
       - add H-CRTM event support
       - add support of efivar versions less than 38
       - Add support to check for efivar/efivar.h manually
       - Minor formatting fixes
       - tpm2_eventlog: add support for replay with different StartupLocality
       - Fix pcr extension for EV_NO_ACTION
       - Extend test of yaml string representation
       - Use helper for printing a string dump
       - Fix upper bound on unique data size
       - Fix YAML string formatting

*  tpm2_policy:
       - Add support for parsing forward seal TPM values
       - Use forward seal values in creating policies
       - Move dgst_size in evaluate_populate_pcr_digests()
       - Allow more than 8 PCRs for sealing
       - Move dgst_size in evaluate_populate_pcr_digests
       - Allow more than 8 PCRs for sealing
       - Make __wrap_Esys_PCR_Read() more dynamic to enable testing more PCRs

*  tpm2_encryptdecrypt: Fix pkcs7 padding stripping

*  tpm2_duplicate:
       - Support -a option for attributes
       - Add --key-algorithm option

*  tpm2_encodeobject:  Use the correct -O option instead of -C

*  tpm2_unseal:   Add qualifier static to enhance the privacy of unseal function

*  tpm2_sign:
       - Remove -m option which was added mistakenly
       - Revert sm2 sign and verifysignature

*  tpm2_createek:
	- Correct man page example
       - Fix usage of nonce
       - Fix integrating nonce

*  tpm2_clear: add more details about the action

*  tpm2_startauthsession:  allow the file attribute for policy authorization.

*  tpm2_getekcertificate:  Add AMD EK support

*  tpm2_ecdhzgen: Add public-key parameter

*  tpm2_nvreadpublic: Prevent free of unallocated pointers on failure

*  Bug-fixes:

* The readthedocs build failed with module 'jinja2' has no attribute 'contextfilter'
       a requirement file was added to fix this problem

* An error caused by the flags -flto -_FORTIFY_SOURCE=3 in kdfa implementation.
       This error can be avoided by switching off the optimization with pragma

* Changed wrong function name of "Esys_Load" to  "Esys_Load"

* Function names beginning with Esys_ are wrongly written as Eys_

* Reading and writing a serialized persistent ESYS_TR handles

* cirrus-ci update image-family to freebsd-13-2 from 13-1

*  misc:
     - Change the default Python version to Python3 in the helper's code

- Skip test which uses the sign operator for comparison in abrmd_policynv.sh

- tools/tr_encode: Add a tool that can encode serialized ESYS_TR for persistent handles
       from the TPM2B_PUBLIC and the raw persistent TPM2_HANDLE

## 5.5 - 2022-02-13

### Added
  * tpm2_createek:
      - SM2 EK Support

* misc:
    - SM2 support to internal OSSL format key routines. Fixes --format
      flags for conversions.

### Fixed:
  * echo_tcti.py: set to use python3 named executable in shebang.

## 5.4 - 2022-12-05

### Added:
  * tpm2_policyrestart:
      - Added option **--cphash** to output the cpHash for the command
        TPM2_CC_PolicyRestart.

* tpm2_policynvwritten:
      - Added option **--cphash** to output the cpHash for the command
        TPM2_CC_PolicyNvWritten.

* tpm2_policylocality:
      - Added option **--cphash** to output the cpHash for the command
        TPM2_CC_PolicyLocality.

* tpm2_policycountertimer:
      - Added option **--cphash** to output the cpHash for the command
        TPM2_CC_PolicyCounterTimer.

* tpm2_policycommandcode:
      - Added option **--cphash** to output the cpHash for the command
        TPM2_CC_PolicyCommandCode.

* tpm2_policypassword:
      - Added option **--cphash** to output the cpHash for the command
        TPM2_CC_PolicyPassword.

* tpm2_policyauthvalue:
      - Added option **--cphash** to output the cpHash for the command
        TPM2_CC_PolicyAuthValue.

* tpm2_policyauthorize:
      - Added option **--cphash** to output the cpHash for the command
        TPM2_CC_PolicyAuthorize.

* tpm2_print:
     - Support printing serialized ESYS_TR's

* tpm2_create:
     - Add a clarifying message to usage of `-c` when TPM2_CreateLoaded
       is not supported.

* tpm2_getcap:
     - Add support for vendor agnostic capabilites. Requires tpm2-tss version 4.0
       and higher to enable.

* Add a script, check_endorsement_cert.sh, to validate the endorsement
    certificate chain. It takes two inputs - A TPM2B_PUBLIC format EKpublic and
    a PEM format EKcertificate specified in that order as arguments.

### 5.3 2022-09-27

* .ci/download-deps.sh: update tpm2-abrmd dependency version to 2.4.1

* .cirrus.yml: updated the freebsd version to 13.1 in the CI.

### 5.3-rc1 2022-09-12

* tools/tpm2_pcrreset.c: fix build errors in 32bit systems.

* Fix tssprivkey formatted PEM generation and load errors on 32 bit systems.

* CI: Add testing of 32bit systems with multiarch/qemu-user-static containers.

* Known issue: FAPI tools will not work on 32bit user-static qemu on 64bit
    host because readdir returns NULL. Follow the issue on
    https://gitlab.com/qemu-project/qemu/-/issues/263

### 5.3-rc0 2022-08-02

* tpm2_nvextend: fix for including ESYS_TR handle to calculate object name.

* tpm2_nv(read/write): allow policy authorization only for single iterations
    for a maximum buffer size of TPM2_PT_NV_BUFFER_MAX.

* tpm2_policylocality: fix logical inversion that caused any argument to be
    interpreted as zero, except "zero" would be interpreted as one.

* tpm2_nvdefine: fixed to set TPMA_NV_PLATFORMCREATE attribute default when
    authorizing with platform hierarchy.

* tpm2_getekcertificate: fixed the url/link for retrieving ek
    certificates from ekop.intel.com.

* tools/tpm2_tool.c: fix an issue where LOG_WARN messages were displayed
    despite setting the quite flag.

* tpm2_import: fix an issue where openssl load function resets a specified
    scheme with TPM2_ALG_NULL.

* tpm2_sign, tpm2_verifysignature: fixes for sm2 signing and verification.

* Support alternative ECC curves for which default EK templates exist
    (NIST_P256, NIST_P384, NIST_P521, and SM2_P256).

* tools/misc/tpm2_checkquote: add sm2 verification of signature.

* tpm2_startauthsession:
    - Added option **-G**, **--key-algorithm=ALGORITHM** to specify the
      symmetric algorithm used in parameter encryption/decryption.

* tpm2_certify:
    - Added option **\--scheme**=_ALGORITHM_ for supporting signature schemes.
     Signing schemes should follow the "formatting standards", see section
     "Algorithm Specifiers".

* tpm2_getcommandauditdigest:
    - Added option **\--scheme**=_ALGORITHM_ for supporting signature schemes.
     Signing schemes should follow the "formatting standards", see section
     "Algorithm Specifiers".

* tpm2_getsessionauditdigest:
    - Added option **\--scheme**=_ALGORITHM_ for supporting signature schemes.
     Signing schemes should follow the "formatting standards", see section
     "Algorithm Specifiers".

* tpm2_quote:
    - Added option **\--scheme**=_ALGORITHM_ for supporting signature schemes.
     Signing schemes should follow the "formatting standards", see section
     "Algorithm Specifiers".

* lib/tpm2.c: flushcontext cphash calculation workaround for a system api bug
    where in the flush handle was erroneously placed in the handle area instead
    of parameter area.

* tpm2_flushcontext: options **-t**, **-l**, **-s** can now be simultaneously
    specified.

* tpm2_import: support restricted parent with an aes128cfb symmetric parameter.

* tpm2_nvreadpublic: drop ntoh on attributes because they get marshalled to
    the correct endianness by libmu to begin with.

* tpm2_print: remove unused **-i** option.

* tpm2_policyor: fix segfault when no options or arguments to specify the list
    of policies to be compounded.

* tpm2_certify: fix man page for short options and add tests The short
    options for the signing-key-auth and certified-key-auth were swapped. The
    case fix in the man page makes it less intuitive but have to go through with
    the change so that we don't break any existing scripts. This change does not
    affect the long options. Tests have been added to ensure the functionality.

* .cirrus.yml: updated the freebsd version to 13.

* VERSION: add version file - Generate the version file with bootstrap and
    include in the DIST tarball so endusers can call autoreconf on a dist
    tarball which doesn't have git. This alleviates git describe errors on
    release tarballs in the autoreconf case.

* tpm2_clear:
      - Added option **--cphash** to output the cpHash for the command
        TPM2_CC_Clear.

* tpm2_dictionarylockout:
      - Added option **--cphash** to output the cpHash for the command
        TPM2_CC_DictionaryAttackLockReset and TPM2_CC_DictionaryAttackParameters.

* tpm2_clearcontrol:
      - Added option **--cphash** to output the cpHash for the command
        TPM2_CC__ClearControl.

* tpm2_sign:
      - Added option **--cphash** to output the cpHash for the command
        TPM2_CC_Sign.

* tpm2_setprimarypolicy:
      - Added option **--cphash** to output the cpHash for the command
        TPM2_CC_SetPrimaryPolicy.

* tpm2_setclock:
      - Added option **--cphash** to output the cpHash for the command
        TPM2_CC_ClockSet.

* tpm2_rsadecrypt:
      - Added option **--cphash** to output the cpHash for the command
        TPM2_CC_RSA_Decrypt.

* tpm2_duplicate:
      - Added option **--cphash** to output the cpHash for the command
        TPM2_CC_Duplicate.

* tpm2_clockrateadjust:
      - Added option **--cphash** to output the cpHash for the command
        TPM2_CC_ClockRateAdjust.

* tpm2_createprimary:
      - Added option **--cphash** to output the cpHash for the command
        TPM2_CC_CreatePrimary.

* tpm2_quote:
      - Added option **--cphash** to output the cpHash for the command
        TPM2_CC_Quote.

* tpm2_policysecret:
      - Added option **--cphash** to output the cpHash for the command
        TPM2_CC_PolicySecret

* tpm2_policynv:
      - Added option **--cphash** to output the cpHash for the command
        TPM2_CC_PolicyNV.

* tpm2_policyauthorizenv:
      - Added option **--cphash** to output the cpHash for the command
        TPM2_CC_PolicyAuthorizeNV.

* tpm2_import:
      - Added option **--cphash** to output the cpHash for the command
        TPM2_CC_Import.

* tpm2_hmac:
      - Added option **--cphash** to output the cpHash for the command
        TPM2_CC_HMAC.

* tpm2_hierarchycontrol:
      - Added option **--cphash** to output the cpHash for the command
        TPM2_CC_HierarchyControl.

* tpm2_load:
      - Added option **--cphash** to output the cpHash for the command
        TPM2_CC_Load.

* tpm2_gettime:
      - Added option **--cphash** to output the cpHash for the command
        TPM2_CC_GetTime.

* tpm2_evictcontrol:
      - Added option **--cphash** to output the cpHash for the command
        TPM2_CC_EvictControl.

* tpm2_encryptdecrypt:
      - Added option **--cphash** to output the cpHash for the command
        TPM2_CC_EncryptDecrypt.

* tpm2_getpolicydigest:
      - Added option **--cphash** to output the cpHash for the command
        TPM2_CC_GetPolicyDigest.

* tpm2_loadexternal:
      - Added option **--cphash** to output the cpHash for the command
        TPM2_CC_LoadExternal.

* tpm2_pcrreset:
      - Added option **--cphash** to output the cpHash for the command
        TPM2_CC_PCR_Reset.

* tpm2_pcrread:
      - Added option **--cphash** to output the cpHash for the command
        TPM2_CC_PCR_Read.

* tpm2_pcrevent:
      - Added option **--cphash** to output the cpHash for the command
        TPM2_CC_PCR_Event.

* tpm2_pcrallocate:
      - Added option **--cphash** to output the cpHash for the command
        TPM2_CC_PCR_Allocate.

* tpm2_loadexternal:
      - Added support to tpm2_loadexternal for parsing and loading the public
        portion of a TSS2 Privkey PEM file. The path to the PEM file must be
        specified using the **-r** option while skipping the **-G** option for
        key type.

* tpm2_print:
      - Added capability to parse out and print the public portion of a
        TSS Private Key in the PEM format with the arg option
        **TSSPRIVKEY_OBJ**.

* tpm2_geteccparameters:
      - Added option **--cphash** to output the cpHash for the command
        TPM2_CC_ECC_Parameters.

* tpm2_flushcontext:
      - Added option **--cphash** to output the cpHash for the command
        TPM2_CC_FlushContext.

* tpm2_ecephemeral:
      - Added option **--cphash** to output the cpHash for the command
        TPM2_CC_EC_Ephemeral.

* tpm2_ecdhzgen:
      - Added option **--cphash** to output the cpHash for the command
        TPM2_CC_ECDH_ZGen.

* tpm2_load:
      - Added capability to load pem files in TSS2-Private-Key format for
        interoperability with tpm2-tss-engine, tpm2-openssl provider,
        tpm2-pkcs11, and tpm2-pytss.

* tpm2_ecdhkeygen:
      - Added option to output the cpHash for the command TPM2_CC_ECDH_KeyGen.

* tpm2_commit:
      - Added option to output the cpHash for the command TPM2_CC_Commit.

* tpm2:
      - Added option to specify **--help=no-man**

* tpm2_nvreadpublic:
      - Added option **\--cphash**=_FILE_ to specify file path to record hash
        of the command parameters. This is commonly termed as cpHash.
      - Added option **\--rphash**=_FILE_ to specify file path to record the
        hash of the response parameters. This is commonly termed as rpHash.
      - Added option **-S**, **\--session** to specify to specify an auxiliary
        session for auditing and or encryption/decryption of the parameters.
      - Added option **-n**, **\--name** to specify the name of the nvindex in
        hex bytes. This is used when cpHash is calculated without dispatching
        the TPM2_NV_Write command to the TPM ie when **--tcti=none**

* tpm2_nvundefine:
      - Added option **\--rphash**=_FILE_ to specify file path to record the
        hash of the response parameters. This is commonly termed as rpHash.
      - Added option **-S**, **\--session** to specify to specify an auxiliary
        session for auditing and or encryption/decryption of the parameters.
      - Added option **-n**, **\--name** to specify the name of the nvindex in
        hex bytes. This is used when cpHash is calculated without dispatching
        the TPM2_NV_Write command to the TPM.
      - Added option **\--with-policydelete** when calculating cpHash with
        **\--tcti=none** there is no way to know if the attribute
        TPMA_NV_POLICYDELETE has been set from the NV index name alone.

* tpm2_nvreadlock:
      - Added option **\--rphash**=_FILE_ to specify file path to record the
        hash of the response parameters. This is commonly termed as rpHash.
      - Added option **-S**, **\--session** to specify to specify an auxiliary
        session for auditing and or encryption/decryption of the parameters.
      - Added option **-n**, **\--name** to specify the name of the nvindex in
        hex bytes. This is used when cpHash is calculated without dispatching
        the TPM2_NV_Write command to the TPM.

* tpm2_nvwritelock:
      - Added option **\--rphash**=_FILE_ to specify file path to record the
        hash of the response parameters. This is commonly termed as rpHash.
      - Added option **-S**, **\--session** to specify to specify an auxiliary
        session for auditing and or encryption/decryption of the parameters.

* tpm2_nvincrement:
      - Added option **\--rphash**=_FILE_ to specify file path to record the hash
        of the response parameters. This is commonly termed as rpHash.
      - Added option **-S**, **\--session** to specify to specify an auxiliary
        session for auditing and or encryption/decryption of the parameters.

* tpm2_nvcertify:
      - Added option **\--rphash**=_FILE_ to specify ile path to record the hash
        of the response parameters. This is commonly termed as rpHash.
      - Added option **-S**, **\--session** to specify to specify an auxiliary
        session for auditing and or encryption/decryption of the parameters.
      - Added option **-n**, **\--name** to specify the name of the nvindex in
        hex bytes. This is used when cpHash is calculated without dispatching
        the TPM2_NV_Write command to the TPM.
      - Added option **\-signer-name** to specify the signer name in hex bytes.
        This is used when cpHash is calculated without dispatching the
        TPM2_NV_Write command to the TPM.

* tpm2_nvwrite:
      - Added option **\--rphash**=_FILE_ to specify ile path to record the hash
        of the response parameters. This is commonly termed as rpHash.
      - Added option **-S**, **\--session** to specify to specify an auxiliary
        session for auditing and or encryption/decryption of the parameters.
      - Added option -n, --name to specify the name of the nvindex in hex bytes.
        This is used when cpHash is calculated without dispatching the
        TPM2_NV_Write command to the TPM.

* Minimum tpm2-tss version is now 3.2.0 to support openssl3 migration.

* Fix test harness leaving tpm servers running after a make check. Fixes sporadic
    hangs in testing.

### 5.2 2021-09-28
### 5.2-rc0 2021-09-01

* tpm2_nvextend:

* Added option -n, --name to specify the name of the nvindex in hex bytes.
    This is used when cpHash ought to be calculated without dispatching the
    TPM2_NV_Extend command to the TPM.

* tpm2_nvread:

* Added option **\--rphash**=_FILE_ to specify ile path to record the hash
    of the response parameters. This is commonly termed as rpHash.
  * Added option **\-n**, **\--name** to specify the name of the nvindex in
    hex bytes. This is used when cpHash ought to be calculated without
    dispatching the TPM2_NVRead command to the TPM.
  * Added option **-S**, **\--session** to specify to specify an auxiliary
    session for auditing and or encryption/decryption of the parameters.

* tpm2_nvsetbits:

* Added option **\--rphash**=_FILE_ to specify file path to record the hash
    of the response parameters. This is commonly termed as rpHash.
  * Added option **-S**, **\--session** to specify to specify an auxiliary
    session for auditing and or encryption/decryption of the parameters.
  * Added option **\-n**, **\--name** to specify the name of the nvindex in
    hex bytes. This is used when cpHash ought to be calculated without
    dispatching the TPM2_NV_SetBits command to the TPM.

* tpm2_createprimary:

* Support public-key output at creation time in various public-key formats.

* tpm2_create:

* Support public-key output at creation time in various public-key formats.

* tpm2_print:

* Support outputing public key in various public key formats over the default
    YAML output. Supports taking `-u` output from `tpm2_create` and converting
    it to a PEM or DER file format.

* tpm2_import:

* Add support for importing keys with sealed-data-blobs.

* tpm2_rsaencrypt, tpm2_rsadecrypt:

* Add support for specifying the hash algorithm with oaep.

* tpm2_pcrread, tpm2_quote:

* Add option **-F**, **\--pcrs_format** to specify PCR format selection for
    the binary blob in the PCR output file. 'values' will output a binary blob
    of the PCR values. 'serialized' will output a binary blob of the PCR
    values in the form of serialized data structure in little endian format.

* tpm2_eventlog:

* Add support for decoding StartupLocality.
  * Add support for printing the partition information.
  * Add support for reading eventlogs longer than 64kb including from
    /sys/kernel/security/tpm0/binary_bios-measurements.

* tpm2_duplicate:

* Add option **-L**, **\--policy** to specify an authorization policy to be
    associated with the duplicated object.
  * Added support for external key duplication without needing the TCTI.

* tools:

* Enhance error message on invalid passwords when sessions cannot be used.

* lib/tpm2_options:

* Add option to specify fake tcti which is required in cases where sapi ctx
    is required to be initialized for retrieving command parameters without
    invoking the tcti to talk to the TPM.

* openssl:

* Dropped support for OpenSSL < 1.1.0
  * Add support for OpenSSL 3.0.0

* Support added to make the repository documentation and man pages available
  live on readthedocs.

* Bug-fixes:

* tpm2_import: Don't allow setting passwords for imported object with -p
    option as the tool doesn't modify the TPM2B_SENSITIVE structure. Added
    appropriate logging to indicate using **tpm2_changeauth** after import.

* lib/tpm2_util.c: The function to calculate pHash algorithm returned error
    when input session is a password session and the only session in the command.

* lib/tpm2_alg_util.c: Fix an error where oaep was parsed under ECC.

* tpm2_sign: Fix segfaults when tool does not find TPM resources (TPM or RM).

* tpm2_makecredential: Fix an issue where reading input from stdin could
    result in unsupported data size larger than the largest digest size.

* tpm2_loadexternal: Fix an issue where restricted attribute could not be set.

* lib/tpm2_nv_util.h: The NV index size is dependent on different data sets
    read from the GetCapability structures because there is a dependency on the
    NV operation type: Define vs Read vs Write vs Extend. Fix a sane default in
    the case where GetCapability fails or fails to report the specific property/
    data set. This is especially true because some properties are TPM
    implementation dependent.

* tpm2_createpolicy: Fix an issue where tool exited silently without reporting
    an error if wrong pcr string is specified.

* lib/tpm2_alg_util: add error message on public init to prevent tools from
    dying silently, add an error message.

* tpm2_import: fix an issue where an imported hmac object scheme was NULL.
    While allowed, it was inconsistent with other tools like tpm2_create which
    set the scheme as hmac->sha256 when generating a keyedhash object.

### 5.1.1 2021-06-21

* tpm2_import: fix fixed AES key CVE-2021-3565
      - tpm2_import used a fixed AES key for the inner wrapper, which means that
        a MITM attack would be able to unwrap the imported key. To fix this,
        ensure the key size is 16 bytes or bigger and use OpenSSL to generate a
        secure random AES key.

### 5.1 2021-05-24

* Build
      - Dependency-update: Minimum tpm2-tss version dependency bumped to 3.1.0
      - Dependency-update: Minimum tpm2-abrmd version dependency bumped to 2.4.0
      - tpm2_eventlog: Fix build errors on 64 bit arm systems.
      - tpm2_checkquote: Fix build on 32b little-endian platforms.
      - Fixes builds on CentOS 7 which notably has an ancient version of
        GCC: 4.8.5 and an older version of OSSL, 1.0.2
      - Configure handles searching for python executable more gracefully, thus
        just having python3, will work.
      - Moved to GitHub Actions for CI testing.
      - Added fedora-32 to CI testing configurations and related fixes.
      - FreeBSD testing is bumped up to version 12.2
      - Fix compiler and packaging warnings for OpenSuse builds.
      - configure: make build gnu99.
      - configure: make -Wbool-compare non fatal.
      - configure: only use -Werror for non-release builds

* tss2:
      - Support in tools for PolicyRef inclusion in policy search per latest TSS.
      - Support to use TPM objects protected by a policy with PolicySigned.
      - Enable backward compatibility to old Fapi callback API.
      - Fix PCR selection for tss2 quote.
      - Support policy signed policies by implementing Fapi_SetSignCB.

* Command/ response parameter support for auditing and pHash policies:
      - lib/tpm2_util.c: Add method to determine hashing alg for cp/rphash
      - Add support to calculate rphash for tpm2_create, tpm2_activatecredential,
        tpm2_certify, tpm2_certifycreation, tpm2_changeauth, tpm2_changeeps,
        tpm2_changepps, tpm2_nvdefine, tpm2_nvextend, tpm2_unseal
      - Add support to calculate cphash for tpm2_changeeps, tpm2_changepps.

* Session-support:
      - tpm2_sessionconfig: Add tool to display and configure session attributes.
      - tpm2_getrandom: Fix— session input was hardcoded for audit-only
      - tpm2_startauthsession: Add option to specify the bind object  and its
        authorization value.
      - tpm2_startauthsession: support for bounded-only session.
      - tpm2_startauthsession: support for salted-only session.
      - tpm2_startauthsession: add option to specify an hmac session type.
      - Add support for specifying non-authorization sessions for audit and
        parameter encryption for tpm2_getrandom, tpm2_create, tpm2_nvextend,
        tpm2_nvdefine, tpm2_unseal, tpm2_activatecredential, tpm2_certify,
        tpm2_certifycreation, tpm2_changeauth, tpm2_changeeps, tpm2_changepps.

* tpm2_eventlog:
      - Support for event type: EV_IPL extensively used by the Shim and Grub.
      - Support for event type: EV_EFI_GPT_EVENT to parse.
        UEFI_PARTITION_TABLE_HEADER and UEFI_PARTITION_ENTRY.
      - Support for event type: EFI_SIGNATURE_LIST, which contains one or more
        EFI_SIGNATURE_DATA.
      - Support for event type EV_EFI_VARIABLE_AUTHORITY.
      - Parse UEFI_PLATFORM_FIRMWARE_BLOB structure that the CRTM MUST put into
        the Event Log entry TCG_PCR_EVENT2.event field for event types
        EV_POST_CODE, EV_S_CRTM_CONTENTS, and EV_EFI_PLATFORM_FIRMWARE_BLOB.
      - Parse secureboot variable to indicate enable as 'Yes'.
      - Parse BootOrder variable to a more readable format.
      - Parse Boot variables per EFI_LOAD_OPTION described in more details in
        UEFI Spec Section 3.1.3
      - Parse Device-path in a readable format using the efivar library.
      - Support for logs longer than 64 kilobytes.
      - Perform verification for event types where digest can be verified from
        their event payload.
      - Better support for multiline strings.
      - Fix handling of event log EV_POST_CODE data where field is empty and len
        is specified.

* scripts/utils: Add a utility to read the cert chain of embedded CA.

* tpm2_getekcertificate: Fix tool failing to return error/non-zero for HTTP 404.

* tpm2_nvdefine: allow setting hash algorithm by command line parameter for NV
    indices set in extend mode.

* tpm2_duplicate, tpm2_import: support duplicating non-TPM keys to a remote TPM
    without first requiring them to be loaded to a local TPM.

* tpm2_dictionarylockout: Fix issue where setting value for one parameter caused
    to reset the others.

* tpm2_getpolicydigest: Add new tool to enable TPM2_CC_PolicyGetDigest.

* Fix segfault where optind > argc.

* tools/tpm2_checkquote: fix missing initializer

* tpm2_convert: fix EVP_EncodeUpdate usage for OSSL < 1.1.0

* openssl: fix EVP_ENCODE_CTX_(new|free)

* test: Add support for swTPM simulator to the testing framework and make it the
  default if mssim isn't available.

* tpm2_unseal:
      - Added option **\--rphash**=_FILE_ to specify ile path to record the hash
        of the response parameters. This is commonly termed as rpHash.

* tpm2_nvextend:
      - Added option **\--rphash**=_FILE_ to specify ile path to record the hash
        of the response parameters. This is commonly termed as rpHash.

* tpm2_nvdefine:
      - Added option **\--rphash**=_FILE_ to specify ile path to record the hash
        of the response parameters. This is commonly termed as rpHash.

* tpm2_changepps:
      - Added option **\--cphash**=_FILE_ to specify ile path to record the hash
        of the command parameters. This is commonly termed as cpHash.
      - Added option **\--rphash**=_FILE_ to specify ile path to record the hash
      - Added option **-S**, **\--session** to specify to specify an auxiliary
        session for auditing and or encryption/decryption of the parameters.

* tpm2_changeeps:
      - Added option **\--cphash**=_FILE_ to specify ile path to record the hash
        of the command parameters. This is commonly termed as cpHash.
      - Added option **\--rphash**=_FILE_ to specify ile path to record the hash
        of the response parameters. This is commonly termed as rpHash.
      - Added option **-S**, **\--session** to specify to specify an auxiliary
        session for auditing and or encryption/decryption of the parameters.

* tpm2_changeauth:
      - Added option **\--rphash**=_FILE_ to specify ile path to record the hash
        of the response parameters. This is commonly termed as rpHash.
      - Added option **-S**, **\--session** to specify to specify an auxiliary
        session for auditing and or encryption/decryption of the parameters.

* tpm2_certifycreation:
      - Added option **\--rphash**=_FILE_ to specify ile path to record the hash
        of the response parameters. This is commonly termed as rpHash.
      - Added option **-S**, **\--session** to specify to specify an auxiliary
        session for auditing and or encryption/decryption of the parameters.

* tpm2_certify:
      - Added option **\--rphash**=_FILE_ to specify ile path to record the hash
        of the response parameters. This is commonly termed as rpHash.
      - Added option **-S**, **\--session** to specify to specify an auxiliary
        session for auditing and or encryption/decryption of the parameters.

* tpm2_activatecredential:
      - Added option **\--rphash**=_FILE_ to specify ile path to record the hash
        of the response parameters. This is commonly termed as rpHash.
      - Added option **-S**, **\--session** to specify to specify an auxiliary
        session for auditing and or encryption/decryption of the parameters.

* tpm2_create:
       - Added option **\--rphash**=_FILE_ to specify ile path to record the hash
         of the response parameters. This is commonly termed as rpHash.

* tpm2_unseal:
      - Added option **-S**, **--session** to specify auxiliary sessions for
        audit and encryption.

* tpm2_nvdefine:
      - Added option **-S**, **--session** to specify auxiliary sessions for
        audit and encryption.

* tpm2_nvextend:
      - Added option **-S**, **--session** to specify auxilary sessions for
        audit and encryption.

### 5.1-rc1 2021-05-19

* scripts/utils: Add a utility to read the cert chain of embedded CA
* .ci/download-deps.sh: Bump tpm2-tss version to 3.1.0
* build: only use -Werror for non-release builds

### 5.1-rc0 2021-04-20

* Build
      - Dependency-update: Minimum tpm2-tss version dependency bumped to 3.0.3
      - Dependency-update: Minimum tpm2-abrmd version dependency bumped to 2.4.0
      - tpm2_eventlog: Fix build errors on 64 bit arm systems.
      - tpm2_checkquote: Fix build on 32b little-endian platforms.
      - Fixes builds on CentOS 7 which notably has an ancient version of
        GCC: 4.8.5 and an older version of OSSL, 1.0.2
      - Configure handles searching for python executable more gracefully, thus
        just having python3, will work.
      - Moved to GitHub Actions for CI testing.
      - Added fedora-32 to CI testing configurations and related fixes.
      - FreeBSD testing is bumped up to version 12.2
      - Fix compiler and packaging warnings for OpenSuse builds.
      - configure: make build gnu99.
      - configure: make -Wbool-compare non fatal.