1 files changed, 143 insertions, 445 deletions

diff --git a/src/libimcv/pts/pts.c b/src/libimcv/pts/pts.c
index 3c5359193..e21f2d51c 100644
--- a/src/libimcv/pts/pts.c
+++ b/src/libimcv/pts/pts.c
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 2011-2012 Sansar Choinyambuu
- * Copyright (C) 2012-2014 Andreas Steffen
+ * Copyright (C) 2012-2016 Andreas Steffen
  * HSR Hochschule fuer Technik Rapperswil
  *
  * This program is free software; you can redistribute it and/or modify it
@@ -21,21 +21,8 @@
 #include <bio/bio_writer.h>
 #include <bio/bio_reader.h>
 
-#ifdef TSS_TROUSERS
-#ifdef _BASETSD_H_
-/* MinGW defines _BASETSD_H_, but TSS checks for _BASETSD_H */
-# define _BASETSD_H
-#endif
-#include <trousers/tss.h>
-#include <trousers/trousers.h>
-#else
-#ifndef TPM_TAG_QUOTE_INFO2
-#define TPM_TAG_QUOTE_INFO2 0x0036
-#endif
-#ifndef TPM_LOC_ZERO
-#define TPM_LOC_ZERO 0x01
-#endif
-#endif
+#include <tpm_tss.h>
+#include <tpm_tss_trousers.h>
 
 #include <sys/types.h>
 #include <sys/stat.h>
@@ -43,6 +30,13 @@
 #include <unistd.h>
 #include <errno.h>
 
+#ifndef TPM_TAG_QUOTE_INFO2
+#define TPM_TAG_QUOTE_INFO2 0x0036
+#endif
+#ifndef TPM_LOC_ZERO
+#define TPM_LOC_ZERO 0x01
+#endif
+
 typedef struct private_pts_t private_pts_t;
 
 /**
@@ -102,9 +96,9 @@ struct private_pts_t {
 	bool is_imc;
 
 	/**
-	 * Do we have an activated TPM
+	 * Active TPM
 	 */
-	bool has_tpm;
+	tpm_tss_t *tpm;
 
 	/**
 	 * Contains a TPM_CAP_VERSION_INFO struct
@@ -112,14 +106,14 @@ struct private_pts_t {
 	chunk_t tpm_version_info;
 
 	/**
-	 * Contains TSS Blob structure for AIK
+	 * AIK object handle
 	 */
-	chunk_t aik_blob;
+	uint32_t aik_handle;
 
 	/**
-	 * Contains a Attestation Identity Key or Certificate
+	 * Contains an Attestation Identity Key Certificate
 	 */
- 	certificate_t *aik;
+	certificate_t *aik_cert;
 
 	/**
 	 * Primary key referening AIK in database
@@ -191,7 +185,6 @@ METHOD(pts_t, set_dh_hash_algorithm, void,
 	}
 }
 
-
 METHOD(pts_t, create_dh_nonce, bool,
 	private_pts_t *this, pts_dh_group_t group, int nonce_len)
 {
@@ -306,41 +299,6 @@ METHOD(pts_t, calculate_secret, bool,
 	return TRUE;
 }
 
-#ifdef TSS_TROUSERS
-
-/**
- * Print TPM 1.2 Version Info
- */
-static void print_tpm_version_info(private_pts_t *this)
-{
-	TPM_CAP_VERSION_INFO *info;
-
-	info = (TPM_CAP_VERSION_INFO*)this->tpm_version_info.ptr;
-
-	if (this->tpm_version_info.len >=
-			sizeof(*info) - sizeof(info->vendorSpecific))
-	{
-		DBG2(DBG_PTS, "TPM Version Info: Chip Version: %u.%u.%u.%u, "
-			 "Spec Level: %u, Errata Rev: %u, Vendor ID: %.4s",
-			 info->version.major, info->version.minor,
-			 info->version.revMajor, info->version.revMinor,
-			 untoh16(&info->specLevel), info->errataRev, info->tpmVendorID);
-	}
-	else
-	{
-		DBG1(DBG_PTS, "could not parse tpm version info");
-	}
-}
-
-#else
-
-static void print_tpm_version_info(private_pts_t *this)
-{
-	DBG1(DBG_PTS, "unknown TPM version: no TSS implementation available");
-}
-
-#endif /* TSS_TROUSERS */
-
 METHOD(pts_t, get_platform_id, int,
 	private_pts_t *this)
 {
@@ -356,104 +314,135 @@ METHOD(pts_t, set_platform_id, void,
 METHOD(pts_t, get_tpm_version_info, bool,
 	private_pts_t *this, chunk_t *info)
 {
-	if (!this->has_tpm)
-	{
-		return FALSE;
-	}
-	*info = this->tpm_version_info;
-	print_tpm_version_info(this);
-	return TRUE;
+	*info = this->tpm ? this->tpm->get_version_info(this->tpm) :
+						this->tpm_version_info;
+	return info->len > 0;
 }
 
 METHOD(pts_t, set_tpm_version_info, void,
 	private_pts_t *this, chunk_t info)
 {
 	this->tpm_version_info = chunk_clone(info);
-	print_tpm_version_info(this);
-}
-
-/**
- * Load an AIK Blob (TSS_TSPATTRIB_KEYBLOB_BLOB attribute)
- */
-static void load_aik_blob(private_pts_t *this)
-{
-	char *path;
-	chunk_t *map;
-
-	path = lib->settings->get_str(lib->settings,
-						"%s.plugins.imc-attestation.aik_blob", NULL, lib->ns);
-	if (path)
-	{
-		map = chunk_map(path, FALSE);
-		if (map)
-		{
-			DBG2(DBG_PTS, "loaded AIK Blob from '%s'", path);
-			DBG3(DBG_PTS, "AIK Blob: %B", map);
-			this->aik_blob = chunk_clone(*map);
-			chunk_unmap(map);
-		}
-		else
-		{
-			DBG1(DBG_PTS, "unable to map AIK Blob file '%s': %s",
-				 path, strerror(errno));
-		}
-	}
-	else
-	{
-		DBG1(DBG_PTS, "AIK Blob is not available");
-	}
+	/* print_tpm_version_info(this); */
 }
 
 /**
- * Load an AIK certificate or public key
+ * Load an AIK handle and an optional AIK certificate and
+ * in the case of a TPM 1.2 an AIK private key blob plus matching public key,
  * the certificate having precedence over the public key if both are present
  */
 static void load_aik(private_pts_t *this)
 {
-	char *cert_path, *key_path;
+	char *handle_str, *cert_path, *key_path, *blob_path;
+	chunk_t aik_pubkey = chunk_empty;
 
+	handle_str = lib->settings->get_str(lib->settings,
+						"%s.plugins.imc-attestation.aik_handle", NULL, lib->ns);
 	cert_path = lib->settings->get_str(lib->settings,
 						"%s.plugins.imc-attestation.aik_cert", NULL, lib->ns);
 	key_path = lib->settings->get_str(lib->settings,
 						"%s.plugins.imc-attestation.aik_pubkey", NULL, lib->ns);
+	blob_path = lib->settings->get_str(lib->settings,
+						"%s.plugins.imc-attestation.aik_blob", NULL, lib->ns);
 
+	if (handle_str)
+	{
+		this->aik_handle = strtoll(handle_str, NULL, 16);
+	}
 	if (cert_path)
 	{
-		this->aik = lib->creds->create(lib->creds, CRED_CERTIFICATE,
+		this->aik_cert = lib->creds->create(lib->creds, CRED_CERTIFICATE,
 									   CERT_X509, BUILD_FROM_FILE,
 									   cert_path, BUILD_END);
-		if (this->aik)
+		if (this->aik_cert)
 		{
 			DBG2(DBG_PTS, "loaded AIK certificate from '%s'", cert_path);
-			return;
 		}
 	}
-	if (key_path)
+
+	if (this->tpm->get_version(this->tpm) == TPM_VERSION_1_2)
 	{
-		this->aik = lib->creds->create(lib->creds, CRED_CERTIFICATE,
-									   CERT_TRUSTED_PUBKEY, BUILD_FROM_FILE,
-									   key_path, BUILD_END);
-		if (this->aik)
+		tpm_tss_trousers_t *tpm_12;
+		chunk_t aik_blob = chunk_empty;
+		chunk_t *map;
+
+		/* get AIK private key blob */
+		if (blob_path)
+		{
+			map = chunk_map(blob_path, FALSE);
+			if (map)
+			{
+				DBG2(DBG_PTS, "loaded AIK Blob from '%s'", blob_path);
+				DBG3(DBG_PTS, "AIK Blob: %B", map);
+				aik_blob = chunk_clone(*map);
+				chunk_unmap(map);
+			}
+			else
+			{
+				DBG1(DBG_PTS, "unable to map AIK Blob file '%s': %s",
+							   blob_path, strerror(errno));
+			}
+		}
+		else
+		{
+			DBG1(DBG_PTS, "AIK Blob is not available");
+		}
+
+		/* get AIK public key */
+		if (key_path)
+		{
+			map = chunk_map(key_path, FALSE);
+			if (map)
+			{
+				DBG2(DBG_PTS, "loaded AIK public key from '%s'", key_path);
+				aik_pubkey = chunk_clone(*map);
+				chunk_unmap(map);
+			}
+			else
+			{
+				DBG1(DBG_PTS, "unable to map AIK public key file '%s': %s",
+							   key_path, strerror(errno));
+			}
+		}
+		else
 		{
-			DBG2(DBG_PTS, "loaded AIK public key from '%s'", key_path);
-			return;
+			DBG1(DBG_PTS, "AIK public key is not available");
 		}
+
+		/* Load AIK item into TPM 1.2 object */
+		tpm_12 = (tpm_tss_trousers_t *)this->tpm;
+		tpm_12->load_aik(tpm_12, aik_blob, aik_pubkey, this->aik_handle);
 	}
 
-	DBG1(DBG_PTS, "neither AIK certificate nor public key is available");
+	/* if no signed X.509 AIK certificate is available use public key instead */
+	if (!this->aik_cert)
+	{
+		aik_pubkey = this->tpm->get_public(this->tpm, this->aik_handle);
+		if (aik_pubkey.len > 0)
+		{
+			this->aik_cert = lib->creds->create(lib->creds, CRED_CERTIFICATE,
+									   CERT_TRUSTED_PUBKEY, BUILD_BLOB,
+									   aik_pubkey, BUILD_END);
+			chunk_free(&aik_pubkey);
+		}
+		else
+		{
+			DBG1(DBG_PTS, "neither AIK certificate nor public key is available");
+		}
+	}
 }
 
 METHOD(pts_t, get_aik, certificate_t*,
 	private_pts_t *this)
 {
-	return this->aik;
+	return this->aik_cert;
 }
 
 METHOD(pts_t, set_aik, void,
 	private_pts_t *this, certificate_t *aik, int aik_id)
 {
-	DESTROY_IF(this->aik);
-	this->aik = aik->get_ref(aik);
+	DESTROY_IF(this->aik_cert);
+	this->aik_cert = aik->get_ref(aik);
 	this->aik_id = aik_id;
 }
 
@@ -611,290 +600,61 @@ METHOD(pts_t, get_metadata, pts_file_meta_t*,
 	return metadata;
 }
 
-
-#ifdef TSS_TROUSERS
-
 METHOD(pts_t, read_pcr, bool,
-	private_pts_t *this, uint32_t pcr_num, chunk_t *pcr_value)
+	private_pts_t *this, uint32_t pcr_num, chunk_t *pcr_value,
+	hash_algorithm_t alg)
 {
-	TSS_HCONTEXT hContext;
-	TSS_HTPM hTPM;
-	TSS_RESULT result;
-	BYTE *buf;
-	UINT32 len;
-
-	bool success = FALSE;
-
-	result = Tspi_Context_Create(&hContext);
-	if (result != TSS_SUCCESS)
-	{
-		DBG1(DBG_PTS, "TPM context could not be created: tss error 0x%x", result);
-		return FALSE;
-	}
-
-	result = Tspi_Context_Connect(hContext, NULL);
-	if (result != TSS_SUCCESS)
-	{
-		goto err;
-	}
-	result = Tspi_Context_GetTpmObject (hContext, &hTPM);
-	if (result != TSS_SUCCESS)
-	{
-		goto err;
-	}
-	result = Tspi_TPM_PcrRead(hTPM, pcr_num, &len, &buf);
-	if (result != TSS_SUCCESS)
-	{
-		goto err;
-	}
-	*pcr_value = chunk_clone(chunk_create(buf, len));
-	DBG3(DBG_PTS, "PCR %d value:%B", pcr_num, pcr_value);
-	success = TRUE;
-
-err:
-	if (!success)
-	{
-		DBG1(DBG_PTS, "TPM not available: tss error 0x%x", result);
-	}
-	Tspi_Context_FreeMemory(hContext, NULL);
-	Tspi_Context_Close(hContext);
-
-	return success;
+	return this->tpm ? this->tpm->read_pcr(this->tpm, pcr_num, pcr_value, alg)
+				     : FALSE;
 }
 
 METHOD(pts_t, extend_pcr, bool,
-	private_pts_t *this, uint32_t pcr_num, chunk_t input, chunk_t *output)
+	private_pts_t *this, uint32_t pcr_num, chunk_t *pcr_value, chunk_t data,
+	hash_algorithm_t alg)
 {
-	TSS_HCONTEXT hContext;
-	TSS_HTPM hTPM;
-	TSS_RESULT result;
-	uint32_t pcr_length;
-	chunk_t pcr_value = chunk_empty;
-
-	result = Tspi_Context_Create(&hContext);
-	if (result != TSS_SUCCESS)
+	if (!this->tpm->extend_pcr(this->tpm, pcr_num, pcr_value, data, alg))
 	{
-		DBG1(DBG_PTS, "TPM context could not be created: tss error 0x%x",
-			 result);
 		return FALSE;
 	}
-	result = Tspi_Context_Connect(hContext, NULL);
-	if (result != TSS_SUCCESS)
-	{
-		goto err;
-	}
-	result = Tspi_Context_GetTpmObject (hContext, &hTPM);
-	if (result != TSS_SUCCESS)
-	{
-		goto err;
-	}
-
-	pcr_value = chunk_alloc(PTS_PCR_LEN);
-	result = Tspi_TPM_PcrExtend(hTPM, pcr_num, PTS_PCR_LEN, input.ptr,
-								NULL, &pcr_length, &pcr_value.ptr);
-	if (result != TSS_SUCCESS)
-	{
-		goto err;
-	}
-
-	*output = pcr_value;
-	*output = chunk_clone(*output);
-
-	DBG3(DBG_PTS, "PCR %d extended with:      %B", pcr_num, &input);
-	DBG3(DBG_PTS, "PCR %d value after extend: %B", pcr_num, output);
-
-	chunk_clear(&pcr_value);
-	Tspi_Context_FreeMemory(hContext, NULL);
-	Tspi_Context_Close(hContext);
+	DBG3(DBG_PTS, "PCR %d extended with:   %#B", pcr_num, &data);
+	DBG3(DBG_PTS, "PCR %d after extension: %#B", pcr_num, pcr_value);
 
 	return TRUE;
-
-err:
-	DBG1(DBG_PTS, "TPM not available: tss error 0x%x", result);
-
-	chunk_clear(&pcr_value);
-	Tspi_Context_FreeMemory(hContext, NULL);
-	Tspi_Context_Close(hContext);
-
-	return FALSE;
 }
 
 METHOD(pts_t, quote_tpm, bool,
-	private_pts_t *this, bool use_quote2, chunk_t *pcr_comp, chunk_t *quote_sig)
+	private_pts_t *this, bool use_quote2, bool use_version_info,
+	chunk_t *pcr_comp, chunk_t *quote_sig)
 {
-	TSS_HCONTEXT hContext;
-	TSS_HTPM hTPM;
-	TSS_HKEY hAIK;
-	TSS_HKEY hSRK;
-	TSS_HPOLICY srkUsagePolicy;
-	TSS_UUID SRK_UUID = TSS_UUID_SRK;
-	BYTE secret[] = TSS_WELL_KNOWN_SECRET;
-	TSS_HPCRS hPcrComposite;
-	TSS_VALIDATION valData;
-	TSS_RESULT result;
-	chunk_t quote_info;
-	BYTE* versionInfo;
-	uint32_t versionInfoSize, pcr;
+	chunk_t pcr_value;
+	uint32_t pcr, pcr_sel = 0;
 	enumerator_t *enumerator;
-	bool success = FALSE;
+	tpm_quote_mode_t quote_mode;
 
-	result = Tspi_Context_Create(&hContext);
-	if (result != TSS_SUCCESS)
-	{
-		DBG1(DBG_PTS, "TPM context could not be created: tss error 0x%x",
-			 result);
-		return FALSE;
-	}
-	result = Tspi_Context_Connect(hContext, NULL);
-	if (result != TSS_SUCCESS)
-	{
-		goto err1;
-	}
-	result = Tspi_Context_GetTpmObject (hContext, &hTPM);
-	if (result != TSS_SUCCESS)
-	{
-		goto err1;
-	}
-
-	/* Retrieve SRK from TPM and set the authentication to well known secret*/
-	result = Tspi_Context_LoadKeyByUUID(hContext, TSS_PS_TYPE_SYSTEM,
-									SRK_UUID, &hSRK);
-	if (result != TSS_SUCCESS)
-	{
-		goto err1;
-	}
-
-	result = Tspi_GetPolicyObject(hSRK, TSS_POLICY_USAGE, &srkUsagePolicy);
-	if (result != TSS_SUCCESS)
-	{
-		goto err1;
-	}
-	result = Tspi_Policy_SetSecret(srkUsagePolicy, TSS_SECRET_MODE_SHA1,
-					20, secret);
-	if (result != TSS_SUCCESS)
-	{
-		goto err1;
-	}
-
-	result = Tspi_Context_LoadKeyByBlob (hContext, hSRK, this->aik_blob.len,
-										 this->aik_blob.ptr, &hAIK);
-	if (result != TSS_SUCCESS)
-	{
-		goto err1;
-	}
-
-	/* Create PCR composite object */
-	result = use_quote2 ?
-			Tspi_Context_CreateObject(hContext, TSS_OBJECT_TYPE_PCRS,
-							TSS_PCRS_STRUCT_INFO_SHORT, &hPcrComposite) :
-			Tspi_Context_CreateObject(hContext, TSS_OBJECT_TYPE_PCRS,
-							TSS_PCRS_STRUCT_DEFAULT, &hPcrComposite);
-	if (result != TSS_SUCCESS)
-	{
-		goto err2;
-	}
-
-	/* Select PCRs */
+	/* select PCRs */
+	DBG2(DBG_PTS, "PCR values hashed into PCR Composite:");
 	enumerator = this->pcrs->create_enumerator(this->pcrs);
 	while (enumerator->enumerate(enumerator, &pcr))
 	{
-		result = use_quote2 ?
-				Tspi_PcrComposite_SelectPcrIndexEx(hPcrComposite, pcr,
-											TSS_PCRS_DIRECTION_RELEASE) :
-				Tspi_PcrComposite_SelectPcrIndex(hPcrComposite, pcr);
-		if (result != TSS_SUCCESS)
+		if (this->tpm->read_pcr(this->tpm, pcr, &pcr_value, HASH_SHA1))
 		{
-			break;
-		}
-	}
-	enumerator->destroy(enumerator);
+			DBG2(DBG_PTS, "PCR %2d %#B", pcr, &pcr_value);
+			chunk_free(&pcr_value);
+		};
 
-	if (result != TSS_SUCCESS)
-	{
-		goto err3;
+		/* add PCR to selection list */
+		pcr_sel |= (1 << pcr);
 	}
+	enumerator->destroy(enumerator);
 
-	/* Set the Validation Data */
-	valData.ulExternalDataLength = this->secret.len;
-	valData.rgbExternalData = (BYTE *)this->secret.ptr;
-
+	quote_mode = use_quote2 ? (use_version_info ? TPM_QUOTE2_VERSION_INFO :
+												  TPM_QUOTE2) : TPM_QUOTE;
 
 	/* TPM Quote */
-	result = use_quote2 ?
-			Tspi_TPM_Quote2(hTPM, hAIK, FALSE, hPcrComposite, &valData,
-							&versionInfoSize, &versionInfo):
-			Tspi_TPM_Quote(hTPM, hAIK, hPcrComposite, &valData);
-	if (result != TSS_SUCCESS)
-	{
-		goto err4;
-	}
-
-	/* Set output chunks */
-	*pcr_comp = chunk_alloc(HASH_SIZE_SHA1);
-
-	if (use_quote2)
-	{
-		/* TPM_Composite_Hash is last 20 bytes of TPM_Quote_Info2 structure */
-		memcpy(pcr_comp->ptr, valData.rgbData + valData.ulDataLength - HASH_SIZE_SHA1,
-			   HASH_SIZE_SHA1);
-	}
-	else
-	{
-		/* TPM_Composite_Hash is 8-28th bytes of TPM_Quote_Info structure */
-		memcpy(pcr_comp->ptr, valData.rgbData + 8, HASH_SIZE_SHA1);
-	}
-	DBG3(DBG_PTS, "Hash of PCR Composite: %#B", pcr_comp);
-
-	quote_info = chunk_create(valData.rgbData, valData.ulDataLength);
-	DBG3(DBG_PTS, "TPM Quote Info: %B",&quote_info);
-
-	*quote_sig = chunk_clone(chunk_create(valData.rgbValidationData,
-							  			   valData.ulValidationDataLength));
-	DBG3(DBG_PTS, "TPM Quote Signature: %B",quote_sig);
-
-	success = TRUE;
-
-	/* Cleanup */
-err4:
-	Tspi_Context_FreeMemory(hContext, NULL);
-
-err3:
-	Tspi_Context_CloseObject(hContext, hPcrComposite);
-
-err2:
-	Tspi_Context_CloseObject(hContext, hAIK);
-
-err1:
-	Tspi_Context_Close(hContext);
-	if (!success)
-	{
-		DBG1(DBG_PTS, "TPM not available: tss error 0x%x", result);
-	}
-	return success;
+	return this->tpm->quote(this->tpm, this->aik_handle, pcr_sel, HASH_SHA1,
+							this->secret, quote_mode, pcr_comp, quote_sig);
 }
 
-#else /* TSS_TROUSERS */
-
-METHOD(pts_t, read_pcr, bool,
-	private_pts_t *this, uint32_t pcr_num, chunk_t *pcr_value)
-{
-	return FALSE;
-}
-
-METHOD(pts_t, extend_pcr, bool,
-	private_pts_t *this, uint32_t pcr_num, chunk_t input, chunk_t *output)
-{
-	return FALSE;
-}
-
-METHOD(pts_t, quote_tpm, bool,
-	private_pts_t *this, bool use_quote2, chunk_t *pcr_comp, chunk_t *quote_sig)
-{
-	return FALSE;
-}
-
-#endif /* TSS_TROUSERS */
-
 /**
  * TPM_QUOTE_INFO structure:
  *	4 bytes of version
@@ -910,7 +670,7 @@ METHOD(pts_t, quote_tpm, bool,
  */
 
 METHOD(pts_t, get_quote_info, bool,
-	private_pts_t *this, bool use_quote2, bool use_ver_info,
+	private_pts_t *this, bool use_quote2, bool use_version_info,
 	pts_meas_algorithms_t comp_hash_algo,
 	chunk_t *out_pcr_comp, chunk_t *out_quote_info)
 {
@@ -930,7 +690,7 @@ METHOD(pts_t, get_quote_info, bool,
 					  "unable to construct TPM Quote Info");
 		return FALSE;
 	}
-	if (use_quote2 && use_ver_info && !this->tpm_version_info.ptr)
+	if (use_quote2 && use_version_info && !this->tpm_version_info.ptr)
 	{
 		DBG1(DBG_PTS, "TPM Version Information unavailable, ",
 					  "unable to construct TPM Quote Info2");
@@ -999,7 +759,7 @@ METHOD(pts_t, get_quote_info, bool,
 		/* PCR Composite Hash */
 		writer->write_data(writer, hash_pcr_comp);
 
-		if (use_ver_info)
+		if (use_version_info)
 		{
 			/* TPM version Info */
 			writer->write_data(writer, this->tpm_version_info);
@@ -1034,24 +794,24 @@ METHOD(pts_t, get_quote_info, bool,
 METHOD(pts_t, verify_quote_signature, bool,
 				private_pts_t *this, chunk_t data, chunk_t signature)
 {
-	public_key_t *aik_pub_key;
+	public_key_t *aik_pubkey;
 
-	aik_pub_key = this->aik->get_public_key(this->aik);
-	if (!aik_pub_key)
+	aik_pubkey = this->aik_cert->get_public_key(this->aik_cert);
+	if (!aik_pubkey)
 	{
 		DBG1(DBG_PTS, "failed to get public key from AIK certificate");
 		return FALSE;
 	}
 
-	if (!aik_pub_key->verify(aik_pub_key, SIGN_RSA_EMSA_PKCS1_SHA1,
+	if (!aik_pubkey->verify(aik_pubkey, SIGN_RSA_EMSA_PKCS1_SHA1,
 		data, signature))
 	{
 		DBG1(DBG_PTS, "signature verification failed for TPM Quote Info");
-		DESTROY_IF(aik_pub_key);
+		DESTROY_IF(aik_pubkey);
 		return FALSE;
 	}
 
-	aik_pub_key->destroy(aik_pub_key);
+	aik_pubkey->destroy(aik_pubkey);
 	return TRUE;
 }
 
@@ -1064,78 +824,17 @@ METHOD(pts_t, get_pcrs, pts_pcr_t*,
 METHOD(pts_t, destroy, void,
 	private_pts_t *this)
 {
+	DESTROY_IF(this->tpm);
 	DESTROY_IF(this->pcrs);
-	DESTROY_IF(this->aik);
+	DESTROY_IF(this->aik_cert);
 	DESTROY_IF(this->dh);
 	free(this->initiator_nonce.ptr);
 	free(this->responder_nonce.ptr);
 	free(this->secret.ptr);
-	free(this->aik_blob.ptr);
 	free(this->tpm_version_info.ptr);
 	free(this);
 }
 
-
-#ifdef TSS_TROUSERS
-
-/**
- * Check for a TPM by querying for TPM Version Info
- */
-static bool has_tpm(private_pts_t *this)
-{
-	TSS_HCONTEXT hContext;
-	TSS_HTPM hTPM;
-	TSS_RESULT result;
-	uint32_t version_info_len;
-
-	result = Tspi_Context_Create(&hContext);
-	if (result != TSS_SUCCESS)
-	{
-		DBG1(DBG_PTS, "TPM context could not be created: tss error 0x%x",
-			 result);
-		return FALSE;
-	}
-	result = Tspi_Context_Connect(hContext, NULL);
-	if (result != TSS_SUCCESS)
-	{
-		goto err;
-	}
-	result = Tspi_Context_GetTpmObject (hContext, &hTPM);
-	if (result != TSS_SUCCESS)
-	{
-		goto err;
-	}
-	result = Tspi_TPM_GetCapability(hTPM, TSS_TPMCAP_VERSION_VAL,  0, NULL,
-									&version_info_len,
-									&this->tpm_version_info.ptr);
-	this->tpm_version_info.len = version_info_len;
-	if (result != TSS_SUCCESS)
-	{
-		goto err;
-	}
-	this->tpm_version_info = chunk_clone(this->tpm_version_info);
-
-	Tspi_Context_FreeMemory(hContext, NULL);
-	Tspi_Context_Close(hContext);
-	return TRUE;
-
-	err:
-	DBG1(DBG_PTS, "TPM not available: tss error 0x%x", result);
-	Tspi_Context_FreeMemory(hContext, NULL);
-	Tspi_Context_Close(hContext);
-	return FALSE;
-}
-
-#else /* TSS_TROUSERS */
-
-static bool has_tpm(private_pts_t *this)
-{
-	return FALSE;
-}
-
-#endif /* TSS_TROUSERS */
-
-
 /**
  * See header
  */
@@ -1189,12 +888,11 @@ pts_t *pts_create(bool is_imc)
 
 	if (is_imc)
 	{
-		if (has_tpm(this))
+		this->tpm = tpm_tss_probe(TPM_VERSION_ANY);
+		if (this->tpm)
 		{
-			this->has_tpm = TRUE;
 			this->proto_caps |= PTS_PROTO_CAPS_T | PTS_PROTO_CAPS_D;
 			load_aik(this);
-			load_aik_blob(this);
 		}
 	}
 	else