Announcing wolfTPM Rust Support with the wolftpm 1.0.0 Crate

    • We are excited to announce version 1.0.0 of wolftpm, the official Rust crate for wolfTPM, available on crates.io.

    wolfTPM is our highly portable TPM 2.0 library designed for embedded use. The new crate gives Rust developers a safe, idiomatic interface to it. TPM handles, sessions, and secrets are cleaned up automatically through RAII, key lifetimes are tied to the device that owns them, and sensitive output is zeroized when it goes out of scope.

    What Is in the Crate

    The wolftpm crate wraps the wolfTPM C API through bindgen-generated FFI and exposes a safe Rust layer on top of it. The core types are:

    • Device: An open TPM context that closes on drop. It autodetects the transport, and open_swtpm() connects to a swtpm or fwTPM socket.
    • Key<'d> and KeyBlob<'d>: Loaded keys that unload their handle on drop, and created but unloaded key blobs that can be serialized and reloaded later.
    • Template: Ready-made key templates for SRK, AIK, EK, signing, RSA decryption, HMAC, AES, and ECDH keys.
    • Session<'d>: A salted parameter encryption session with RAII cleanup.
    • Secret: An owned buffer for sensitive output (unsealed data, decrypted plaintext, shared secrets) that zeroizes on drop.
    • TpmError: A typed error carrying the raw TPM or wolfCrypt return code.

    API Coverage

    The 1.0.0 release covers the most common TPM 2.0 workflows:

    • Keys: Primary and child key creation for RSA and ECC P-256, Endorsement Key creation, key blob save and load, import of external RSA and ECC private keys, and public key export as DER or PEM.
    • Signing: Digest signing and verification with sign_hash and verify_hash.
    • Encryption: RSA-OAEP encrypt and decrypt (including an explicit OAEP hash for Microsoft enrollment flows) and AES-CFB with TPM-resident symmetric keys.
    • Key agreement: ECDH ephemeral key generation and Z point agreement with a peer.
    • HMAC: One-shot raw-key HMAC and HMAC with a TPM-resident keyed-hash key.
    • Sealing: Seal and unseal with auth, plus PCR-policy-bound sealing.
    • PCRs: PCR read and extend.
    • NV storage: Define, write, read, and delete NV indices, and read EK certificates from NV.
    • Attestation: Certify and quote with an AIK, plus MakeCredential and ActivateCredential.
    • Persistence: Persist keys to NV handles, read them back, and evict them.
    • Sessions and utilities: Encrypted parameter sessions, hardware RNG, self-test, and capability queries.

    The crate detects how your wolfTPM library was configured at build time, so the APIs available to Rust match the features enabled in the C build.

    Getting Started

    The crate links against the wolfTPM and wolfSSL C libraries, so build and install both first. See the crate README for linking details. Then add the crate to your Cargo.toml:

    [dependencies]
wolftpm = "1.0.0"

    Two examples ship with the crate. examples/create_primary.rs shows a minimal open, RNG, and primary key flow, and examples/full_flow.rs walks through the major APIs end-to-end.

    Resources and Links

    If you have questions about any of the above, please contact us at facts@wolfssl.com or call us at +1 425 245 8247.