---
name: "Tspi_TPM_CMKSetRestrictions"
section: "3"
platform: "linux"
package: "libtspi-dev"
version: "0.3.15-0.4"
release: "Debian 13 (Trixie)"
platforms: ["linux"]
url: "https://new.carta.tech/Tspi_TPM_CMKSetRestrictions"
---

# Tspi\_TPM\_CMKSetRestrictions(3)

set restrictions on use of delegated Certified Migratable Keys

TCG Software Stack Developer's Reference

## NAME

Tspi\_TPM\_CMKSetRestrictions - set restrictions on use of delegated Certified Migratable Keys

## SYNOPSIS

```
#include <tss/tspi.h>

TSS_RESULT Tspi_TPM_CMKSetRestrictions(TSS_HTPM hTPM, TSS_CMK_DELEGATE CmkDelegate);
```

## DESCRIPTION

**Tspi\_TPM\_CMKSetRestrictions** is used to set restrictions on the delegated use of Certified Migratable Keys (CMKs).  Use of this command cannot itself be delegated.

## PARAMETERS

### hTPM

The *hTPM* parameter is used to specify the handle of the TPM object.

### CmkDelegate

The *CmkDelegate* parameter is a bitmask describing the kinds of CMKs that can be used in a delegated auth session.  Each bit represents a type of key.  If the bit of a key type is set, then the CMK can be used in a delegated authorization session, otherwise use of that key will result in a TPM\_E\_INVALID\_KEYUSAGE return code from the TPM.

The possible values of *CmkDelegate* are any combination of the following flags logically OR'd together:

- TSS\_CMK\_DELEGATE\_SIGNING

  Allow use of signing keys.

- TSS\_CMK\_DELEGATE\_STORAGE

  Allow use of storage keys.

- TSS\_CMK\_DELEGATE\_BIND

  Allow use of binding keys.

- TSS\_CMK\_DELEGATE\_LEGACY

  Allow use of legacy keys.

- TSS\_CMK\_DELEGATE\_MIGRATE

  Allow use of migratable keys.

## RETURN CODES

**Tspi\_TPM\_CMKSetRestrictions** returns TSS\_SUCCESS on success, otherwise one of the following values is returned:

- TSS\_E\_INVALID\_HANDLE

  *hTPM* is not a valid handle.

- TSS\_E\_INTERNAL\_ERROR

  An internal SW error has been detected.

## CONFORMING TO

**Tspi\_TPM\_CMKSetRestrictions** conforms to the Trusted Computing Group Software Specification version 1.2 Errata A

## SEE ALSO

**Tspi\_TPM\_CMKApproveMA**(3), **Tspi\_TPM\_CMKCreateTicket**(3), **Tspi\_Key\_CMKCreateBlob**(3)