---
name: "Fapi_Sign"
section: "3"
platform: "linux"
package: "tpm2-tss"
version: "4.2.0-2"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/Fapi_Sign"
---

# Fapi\_Sign(3)

Fapi\_Sign

## NAME

Fapi\_Sign - Fapi\_Sign

## SYNOPSIS

### Functions

TSS2\_RC **Fapi\_Sign** (**FAPI\_CONTEXT** \*context, char const \*keyPath, char const \*padding, uint8\_t const \*digest, size\_t digestSize, uint8\_t \*\*signature, size\_t \*signatureSize, char \*\*publicKey, char \*\*certificate)\
 TSS2\_RC **Fapi\_Sign\_Async** (**FAPI\_CONTEXT** \*context, char const \*keyPath, char const \*padding, uint8\_t const \*digest, size\_t digestSize)\
 TSS2\_RC **Fapi\_Sign\_Finish** (**FAPI\_CONTEXT** \*context, uint8\_t \*\*signature, size\_t \*signatureSize, char \*\*publicKey, char \*\*certificate)\

## Detailed Description

FAPI functions to invoke Sign either as one-call or in an asynchronous manner.

## Function Documentation

### TSS2\_RC Fapi\_Sign (FAPI\_CONTEXT \* context, char const \* keyPath, char const \* padding, uint8\_t const \* digest, size\_t digestSize, uint8\_t \*\* signature, size\_t \* signatureSize, char \*\* publicKey, char \*\* certificate)

One-Call function for Fapi\_Sign

Uses a key, identified by its path, to sign a digest and puts the result in a TPM2B bytestream.

**Parameters**

*context* The **FAPI\_CONTEXT** \
 *keyPath* The path of the signature key \
 *padding* A padding algorithm. Must be either "RSA\_SSA" or "RSA\_PSS" or NULL \
 *digest* The digest to sign. Must be already hashed \
 *digestSize* The size of the digest in bytes \
 *signature* The signature \
 *signatureSize* The size of signature in bytes. May be NULL \
 *publicKey* The public key that can be used to verify signature in PEM format. May be NULL \
 *certificate* The certificate associated with the signing key in PEM format. May be NULL

**Return values**

*TSS2\_RC\_SUCCESS* if the function call was a success. \
 *TSS2\_FAPI\_RC\_BAD\_REFERENCE* if context, keyPath, digest or signature is NULL. \
 *TSS2\_FAPI\_RC\_BAD\_CONTEXT* if context corruption is detected. \
 *TSS2\_FAPI\_RC\_KEY\_NOT\_FOUND* if keyPath does not map to a FAPI key. \
 *TSS2\_FAPI\_RC\_BAD\_KEY* if the object at keyPath is not a key, or is a key that is unsuitable for the requested operation. \
 *TSS2\_FAPI\_RC\_BAD\_VALUE* if the digestSize is zero. \
 *TSS2\_FAPI\_RC\_BAD\_SEQUENCE* if the context has an asynchronous operation already pending. \
 *TSS2\_FAPI\_RC\_IO\_ERROR* if the data cannot be saved. \
 *TSS2\_FAPI\_RC\_MEMORY* if the FAPI cannot allocate enough memory for internal operations or return parameters. \
 *TSS2\_FAPI\_RC\_NO\_TPM* if FAPI was initialized in no-TPM-mode via its config file. \
 *TSS2\_FAPI\_RC\_TRY\_AGAIN* if an I/O operation is not finished yet and this function needs to be called again. \
 *TSS2\_FAPI\_RC\_PATH\_NOT\_FOUND* if a FAPI object path was not found during authorization. \
 *TSS2\_FAPI\_RC\_GENERAL\_FAILURE* if an internal error occurred. \
 *TSS2\_FAPI\_RC\_AUTHORIZATION\_UNKNOWN* if a required authorization callback is not set. \
 *TSS2\_FAPI\_RC\_AUTHORIZATION\_FAILED* if the authorization attempt fails. \
 *TSS2\_FAPI\_RC\_POLICY\_UNKNOWN* if policy search for a certain policy digest was not successful. \
 *TSS2\_ESYS\_RC\_\** possible error codes of ESAPI. \
 *TSS2\_FAPI\_RC\_NOT\_PROVISIONED* FAPI was not provisioned. \
 *TSS2\_FAPI\_RC\_BAD\_PATH* if the path is used in inappropriate context or contains illegal characters.

### TSS2\_RC Fapi\_Sign\_Async (FAPI\_CONTEXT \* context, char const \* keyPath, char const \* padding, uint8\_t const \* digest, size\_t digestSize)

Asynchronous function for Fapi\_Sign

Uses a key, identified by its path, to sign a digest and puts the result in a TPM2B bytestream.

Call Fapi\_Sign\_Finish to finish the execution of this command.

**Parameters**

*context* The **FAPI\_CONTEXT** \
 *keyPath* The path of the signature key \
 *padding* A padding algorithm. Must be either "RSA\_SSA" or "RSA\_PSS" or NULL \
 *digest* The digest to sign. Must be already hashed \
 *digestSize* The size of the digest in bytes

**Return values**

*TSS2\_RC\_SUCCESS* if the function call was a success. \
 *TSS2\_FAPI\_RC\_BAD\_REFERENCE* if context, keyPath or digest is NULL. \
 *TSS2\_FAPI\_RC\_BAD\_CONTEXT* if context corruption is detected. \
 *TSS2\_FAPI\_RC\_KEY\_NOT\_FOUND* if keyPath does not map to a FAPI key. \
 *TSS2\_FAPI\_RC\_BAD\_KEY* if the object at keyPath is not a key, or is a key that is unsuitable for the requested operation. \
 *TSS2\_FAPI\_RC\_BAD\_VALUE* if the digestSize is zero. \
 *TSS2\_FAPI\_RC\_BAD\_SEQUENCE* if the context has an asynchronous operation already pending. \
 *TSS2\_FAPI\_RC\_IO\_ERROR* if the data cannot be saved. \
 *TSS2\_FAPI\_RC\_MEMORY* if the FAPI cannot allocate enough memory for internal operations or return parameters. \
 *TSS2\_FAPI\_RC\_NO\_TPM* if FAPI was initialized in no-TPM-mode via its config file.

### TSS2\_RC Fapi\_Sign\_Finish (FAPI\_CONTEXT \* context, uint8\_t \*\* signature, size\_t \* signatureSize, char \*\* publicKey, char \*\* certificate)

Asynchronous finish function for Fapi\_Sign

This function should be called after a previous Fapi\_Sign\_Async.

**Parameters**

*context* The **FAPI\_CONTEXT** \
 *signature* The signature \
 *signatureSize* The size of signature in bytes. May be NULL \
 *publicKey* The public key that can be used to verify signature in PEM format. May be NULL \
 *certificate* The certificate associated with the signing key in PEM format. May be NULL

**Return values**

*TSS2\_RC\_SUCCESS* if the function call was a success. \
 *TSS2\_FAPI\_RC\_BAD\_REFERENCE* if context or signature is NULL. \
 *TSS2\_FAPI\_RC\_BAD\_CONTEXT* if context corruption is detected. \
 *TSS2\_FAPI\_RC\_BAD\_SEQUENCE* if the context has an asynchronous operation already pending. \
 *TSS2\_FAPI\_RC\_IO\_ERROR* if the data cannot be saved. \
 *TSS2\_FAPI\_RC\_MEMORY* if the FAPI cannot allocate enough memory for internal operations or return parameters. \
 *TSS2\_FAPI\_RC\_TRY\_AGAIN* if the asynchronous operation is not yet complete. Call this function again later. \
 *TSS2\_FAPI\_RC\_PATH\_NOT\_FOUND* if a FAPI object path was not found during authorization. \
 *TSS2\_FAPI\_RC\_KEY\_NOT\_FOUND* if a key was not found. \
 *TSS2\_FAPI\_RC\_BAD\_VALUE* if an invalid value was passed into the function. \
 *TSS2\_FAPI\_RC\_GENERAL\_FAILURE* if an internal error occurred. \
 *TSS2\_FAPI\_RC\_AUTHORIZATION\_UNKNOWN* if a required authorization callback is not set. \
 *TSS2\_FAPI\_RC\_AUTHORIZATION\_FAILED* if the authorization attempt fails. \
 *TSS2\_FAPI\_RC\_POLICY\_UNKNOWN* if policy search for a certain policy digest was not successful. \
 *TSS2\_ESYS\_RC\_\** possible error codes of ESAPI. \
 *TSS2\_FAPI\_RC\_NOT\_PROVISIONED* FAPI was not provisioned. \
 *TSS2\_FAPI\_RC\_BAD\_PATH* if the path is used in inappropriate context or contains illegal characters.

## Author

Generated automatically by Doxygen for tpm2-tss from the source code.