---
name: "Tspi_TPM_GetPubEndorsementKey"
section: "3"
platform: "linux"
package: "libtspi-dev"
version: "0.3.15-0.4"
release: "Debian 13 (Trixie)"
platforms: ["linux"]
url: "https://new.carta.tech/Tspi_TPM_GetPubEndorsementKey"
---

# Tspi\_TPM\_GetPubEndorsementKey(3)

create a TSS key object from the TPM's public endorsement key

TCG Software Stack Developer's Reference

## NAME

Tspi\_TPM\_GetPubEndorsementKey - create a TSS key object from the TPM's public endorsement key

## SYNOPSIS

```
#include <tss/platform.h>
#include <tss/tcpa_defines.h>
#include <tss/tcpa_typedef.h>
#include <tss/tcpa_struct.h>
#include <tss/tss_typedef.h>
#include <tss/tss_structs.h>
#include <tss/tspi.h>

TSS_RESULT Tspi_TPM_GetPubEndorsementKey(TSS_HTPM        hTPM,            TSS_BOOL  fOwnerAuthorized,
                                         TSS_VALIDATION* pValidationData, TSS_HKEY* phEndorsementPubKey);
```

## DESCRIPTION

**Tspi\_TPM\_GetPubEndorsementKey** This function retrieves the public endorsement key (PubEK) from the TPM and creates a TSS key object for it, whose handle is returned in *phEndorsementPubKey*. Due to the fact that different TPM chips validate the PubEK in different ways, application verification of the PubEK (using a non-NULL *pValidationData* is **broken**. Tspi\_TPM\_GetPubEndorsementKey should be called with a NULL *pValidationData* parameter to allow the TSS to verify the PubEK itself.

## PARAMETERS

### hTPM

The *hTPM* parameter is used to specify the handle of the TPM object.

### fOwnerAuthorized

If TRUE, the TPM owner secret must be provided to get the public endorsement key. If FALSE, no TPM owner secret must be provided to get the public endorsement key.

### pValidationData

If non-NULL, the application should set the pValidationData-\>rgbExternalData parameter to 20 bytes of random data before calling Tspi\_TPM\_GetPubEndorsementKey. On successful completion of the command, the structure will provide buffers containing the validation data and the buffer the validation data was computed from.

### phEndorsementPubKey

Receives a handle to a key object representing the TPM's public endorsement key.

## RETURN CODES

**Tspi\_TPM\_GetPubEndorsementKey** returns TSS\_SUCCESS on success, otherwise one of the following values is returned:

- TSS\_E\_INVALID\_HANDLE

  *hTPM* is not a valid handle.

- TSS\_E\_INTERNAL\_ERROR

  An internal SW error has been detected.

- TSS\_E\_BAD\_PARAMETER

  One or more parameters is bad.

- TPM\_E\_DISABLED\_CMD

  Reading of PubEK from TPM has been disabled.

## CONFORMING TO

**Tspi\_TPM\_GetPubEndorsementKey** conforms to the Trusted Computing Group Software Specification version 1.1 Golden

## SEE ALSO

[**Tspi\_Key\_GetPubKey**(3)](/Tspi_Key_GetPubKey/3.md).