FAPI: Add initial implementation of tss2-fapi.so

This implements a new interface and library for the
TCG TSS Feature API specification.

Co-authored-by: Andreas Fuchs <andreas.fuchs@sit.fraunhofer.de>
Co-authored-by: Lukas Jäger <lukas.jaeger@sit.fraunhofer.de>

Signed-off-by: Juergen Repp <juergen.repp@sit.fraunhofer.de>
Signed-off-by: Lukas Jäger <lukas.jaeger@sit.fraunhofer.de>
Signed-off-by: Andreas Fuchs <andreas.fuchs@sit.fraunhofer.de>

diff --git a/.ci/docker.run b/.ci/docker.run
index 00edb33..9e5783f 100755
--- a/.ci/docker.run
+++ b/.ci/docker.run

@@ -5,6 +5,8 @@
 
 source $TRAVIS_BUILD_DIR/.ci/docker-prelude.sh
 
+export CONFIGURE_OPTIONS=
+
 if [ -d build ]; then
   rm -rf build
 fi
@@ -24,6 +26,10 @@
     export WITH_CRYPTO="ossl"
 fi
 
+if [ "$WITH_CRYPTO" != "ossl" ]; then
+    export CONFIGURE_OPTIONS="$CONFIGURE_OPTIONS --disable-fapi"
+fi
+
 ./bootstrap
 
 # Is it a fuzz run, if so build the fuzz test and exit.
@@ -44,7 +50,7 @@
 echo "PWD: $(pwd)"
 echo "ls -la ../ $(ls -la ../)"
 
-../configure --enable-tcti-partial-reads=$WITH_TCTI_PARTIAL --enable-tcti-device-async=$WITH_TCTI_ASYNC --with-crypto=$WITH_CRYPTO
+../configure --enable-tcti-partial-reads=$WITH_TCTI_PARTIAL --enable-tcti-device-async=$WITH_TCTI_ASYNC --with-crypto=$WITH_CRYPTO $CONFIGURE_OPTIONS
 make -j$(nproc)
 popd
 
@@ -53,13 +59,13 @@
 pushd ./build
 
 if [ "$CC" == "gcc" ]; then
-  export CONFIGURE_OPTIONS="--enable-code-coverage";
+  export CONFIGURE_OPTIONS="$CONFIGURE_OPTIONS --enable-code-coverage";
 fi
 
 if [ "$SCANBUILD" == "yes" ]; then
   scan-build --status-bugs ../configure --enable-tcti-partial-reads=$WITH_TCTI_PARTIAL --enable-tcti-device-async=$WITH_TCTI_ASYNC --enable-unit --enable-integration --with-crypto=$WITH_CRYPTO $CONFIGURE_OPTIONS
 elif [ "$CC" == "clang" ]; then
-  ../configure --enable-tcti-partial-reads=$WITH_TCTI_PARTIAL --enable-tcti-device-async=$WITH_TCTI_ASYNC --enable-unit --enable-integration --with-crypto=$WITH_CRYPTO
+  ../configure --enable-tcti-partial-reads=$WITH_TCTI_PARTIAL --enable-tcti-device-async=$WITH_TCTI_ASYNC --enable-unit --enable-integration --with-crypto=$WITH_CRYPTO $CONFIGURE_OPTIONS
 else
   ../configure --with-sanitizer=undefined --enable-tcti-partial-reads=$WITH_TCTI_PARTIAL --enable-tcti-device-async=$WITH_TCTI_ASYNC --enable-unit --enable-integration --with-crypto=$WITH_CRYPTO $CONFIGURE_OPTIONS
 fi

diff --git a/.ci/download-deps.sh b/.ci/download-deps.sh
index 5094376..93283f2 100755
--- a/.ci/download-deps.sh
+++ b/.ci/download-deps.sh

@@ -3,5 +3,5 @@
 
 function get_deps() {
 
-    echo "no deps"
+	echo "no deps"
 }

diff --git a/Dockerfile b/Dockerfile
index 19301fb..61e07b9 100644
--- a/Dockerfile
+++ b/Dockerfile

@@ -4,6 +4,11 @@
 WORKDIR /tmp/tpm2-tss
 ENV LD_LIBRARY_PATH /usr/local/lib
 
+# Install libjson-c
+RUN apt-get update && apt-get install -y --no-install-recommends \
+       libjson-c-dev \
+       && rm -rf /var/lib/apt/lists/*
+
 # Fuzzing
 FROM base AS fuzzing
 ENV GEN_FUZZ 1

diff --git a/Doxyfile.in b/Doxyfile.in
index b626871..254ee71 100644
--- a/Doxyfile.in
+++ b/Doxyfile.in

@@ -782,6 +782,8 @@
                          @top_srcdir@/README.md \
                          @top_srcdir@/include/tss2/tss2_esys.h \
                          @top_srcdir@/src/tss2-esys \
+                         @top_srcdir@/include/tss2/tss2_fapi.h \
+                         @top_srcdir@/src/tss2-fapi \
                          @top_srcdir@/test/integration/esys-audit.int.c \
                          @top_srcdir@/test/integration/esys-certify-creation.int.c \
                          @top_srcdir@/test/integration/esys-certify.int.c \
@@ -847,7 +849,35 @@
                          @top_srcdir@/test/integration/esys-tr-getName-hierarchy.int.c \
                          @top_srcdir@/test/integration/esys-unseal-password-auth.int.c \
                          @top_srcdir@/test/integration/esys-verify-signature.int.c \
-                         @top_srcdir@/test/integration/esys-zgen-2phase.int.c
+                         @top_srcdir@/test/integration/esys-zgen-2phase.int.c \
+                         @top_srcdir@/test/integration/fapi-data-crypt-rsa.int.c \
+                         @top_srcdir@/test/integration/fapi-key-change-auth.int.c \
+                         @top_srcdir@/test/integration/fapi-key-create-policy-authorize-sign.int.c \
+                         @top_srcdir@/test/integration/fapi-key-create-policy-secret-nv-sign.int.c \
+                         @top_srcdir@/test/integration/fapi-key-create-sign-policy-provision.int.c \
+                         @top_srcdir@/test/integration/fapi-nv-set-bits.int.c \
+                         @top_srcdir@/test/integration/fapi-quote.int.c \
+                         @top_srcdir@/test/integration/fapi-ext-public-key.int.c \
+                         @top_srcdir@/test/integration/fapi-key-create-ecc-sign.int.c \
+                         @top_srcdir@/test/integration/fapi-key-create-policy-nv-sign.int.c \
+                         @top_srcdir@/test/integration/fapi-key-create-policy-signed.int.c \
+                         @top_srcdir@/test/integration/fapi-nv-extend.int.c \
+                         @top_srcdir@/test/integration/fapi-nv-written-policy.int.c \
+                         @top_srcdir@/test/integration/fapi-rsa-duplicate.int.c \
+                         @top_srcdir@/test/integration/fapi-get-random.int.c \
+                         @top_srcdir@/test/integration/fapi-key-create-policies-sign.int.c \
+                         @top_srcdir@/test/integration/fapi-key-create-policy-or-sign.int.c \
+                         @top_srcdir@/test/integration/fapi-key-create-sign.int.c \
+                         @top_srcdir@/test/integration/fapi-nv-increment.int.c \
+                         @top_srcdir@/test/integration/fapi-pcr-test.int.c \
+                         @top_srcdir@/test/integration/fapi-unseal.int.c \
+                         @top_srcdir@/test/integration/fapi-info.int.c \
+                         @top_srcdir@/test/integration/fapi-key-create-policy-authorize-nv-sign.int.c \
+                         @top_srcdir@/test/integration/fapi-key-create-policy-pcr-sign.int.c \
+                         @top_srcdir@/test/integration/fapi-key-create-sign-password-provision.int.c \
+                         @top_srcdir@/test/integration/fapi-nv-ordinary.int.c \
+                         @top_srcdir@/test/integration/fapi-platform-certificates.int.c
+
 # This tag can be used to specify the character encoding of the source files
 # that doxygen parses. Internally doxygen uses the UTF-8 encoding. Doxygen uses
 # libiconv (or the iconv built into libc) for the transcoding. See the libiconv

diff --git a/INSTALL.md b/INSTALL.md
index dc2b93a..d6aacb6 100644
--- a/INSTALL.md
+++ b/INSTALL.md

@@ -48,7 +48,8 @@
   uthash-dev \
   autoconf \
   doxygen \
-  libltdl-dev
+  libjson-c-dev \
+  libini-config-dev
 ```
 Note: In some Ubuntu versions, the lcov and autoconf-archive packages are incompatible with each other. It is recommended to download autoconf-archive directly from upstream and copy `ax_code_coverage.m4` and `ax_prog_doxygen.m4` to the `m4/` subdirectory of your tpm2-tss directory.
 

diff --git a/Makefile-test.am b/Makefile-test.am
index 531e045..6ad6390 100644
--- a/Makefile-test.am
+++ b/Makefile-test.am

@@ -4,7 +4,7 @@
 # All rights reserved.
 
 TESTS_CFLAGS = $(AM_CFLAGS) $(LIBCRYPTO_CFLAGS) -I$(srcdir)/src/tss2-mu \
-    -I$(srcdir)/src/tss2-sys -I$(srcdir)/src/tss2-esys \
+    -I$(srcdir)/src/tss2-sys -I$(srcdir)/src/tss2-esys  -I$(srcdir)/src/tss2-fapi \
     -Wno-unused-parameter -Wno-missing-field-initializers
 TESTS_LDADD = $(check_LTLIBRARIES) $(lib_LTLIBRARIES) \
     $(LIBCRYPTO_LIBS) $(libutil)
@@ -18,7 +18,9 @@
 else
 INT_LOG_COMPILER = $(srcdir)/script/int-log-compiler.sh
 endif
-EXTRA_DIST += $(srcdir)/script/int-log-compiler.sh $(srcdir)/script/int-log-compiler-ptpm.sh
+EXTRA_DIST += $(srcdir)/script/int-log-compiler.sh $(srcdir)/script/int-log-compiler-ptpm.sh \
+              $(srcdir)/script/ekca/create_ca.sh  $(srcdir)/script/ekca/ek.cnf \
+              $(srcdir)/script/ekca/intermed-ca.cnf $(srcdir)/script/ekca/root-ca.cnf
 AM_TESTS_ENVIRONMENT = PATH="$(PATH)"
 
 check-programs: $(check_PROGRAMS)
@@ -41,6 +43,22 @@
 test_helper_tpm_dumpstate_CFLAGS = $(TESTS_CFLAGS) -I$(srcdir)/test/integration
 test_helper_tpm_dumpstate_LDFLAGS = $(TESTS_LDFLAGS)
 test_helper_tpm_dumpstate_LDADD = $(TESTS_LDADD)
+
+check_PROGRAMS += test/helper/tpm_getek
+test_helper_tpm_getek_CFLAGS = $(TESTS_CFLAGS) -I$(srcdir)/test/integration
+test_helper_tpm_getek_LDFLAGS = $(TESTS_LDFLAGS) -lcrypto
+test_helper_tpm_getek_LDADD = $(TESTS_LDADD)
+
+check_PROGRAMS += test/helper/tpm_getek_ecc
+test_helper_tpm_getek_ecc_CFLAGS = $(TESTS_CFLAGS) -I$(srcdir)/test/integration
+test_helper_tpm_getek_ecc_LDFLAGS = $(TESTS_LDFLAGS) -lcrypto
+test_helper_tpm_getek_ecc_LDADD = $(TESTS_LDADD)
+
+
+check_PROGRAMS += test/helper/tpm_writeekcert
+test_helper_tpm_writeekcert_CFLAGS = $(TESTS_CFLAGS) -I$(srcdir)/test/integration
+test_helper_tpm_writeekcert_LDFLAGS = $(TESTS_LDFLAGS)
+test_helper_tpm_writeekcert_LDADD = $(TESTS_LDADD)
 endif #ENABLE_INTEGRATION
 
 if UNIT
@@ -81,6 +99,11 @@
     test/unit/esys-crypto
 
 endif ESAPI
+if FAPI
+fapiLDFLAGS = -ljson-c
+TESTS_UNIT += \
+    test/unit/fapi-json
+endif FAPI
 endif #UNIT
 
 if ENABLE_INTEGRATION
@@ -224,16 +247,74 @@
 
 else # TESTPTPM
 TESTS_INTEGRATION += $(ESYS_TESTS_INTEGRATION_MANDATORY) $(ESYS_TESTS_INTEGRATION_OPTIONAL) $(ESYS_TESTS_INTEGRATION_DESTRUCTIVE)
+
 endif # TESTPTPM
 
 endif #ESAPI
+
+if FAPI
+TESTS_CFLAGS +=  -DTOP_SOURCEDIR"=\"$(top_srcdir)\""
+FAPI_TESTS_INTEGRATION = \
+    test/integration/fapi-data-crypt-rsa.int \
+    test/integration/fapi-rsa-duplicate.int \
+    test/integration/fapi-ext-public-key.int \
+    test/integration/fapi-get-random.int \
+    test/integration/fapi-platform-certificates.int \
+    test/integration/fapi-key-create-sign.int \
+    test/integration/fapi-key-create-sign-password-provision.int \
+    test/integration/fapi-key-create-sign-ecc.int \
+    test/integration/fapi-key-create-policy-authorize-sign.int \
+    test/integration/fapi-key-create-policy-authorize-nv-sign.int \
+    test/integration/fapi-key-create-policy-secret-nv-sign.int \
+    test/integration/fapi-key-create-policy-pcr-sign.int \
+    test/integration/fapi-key-create-policy-signed.int \
+    test/integration/fapi-key-create-policy-nv-sign.int \
+    test/integration/fapi-key-create-policy-or-sign.int \
+    test/integration/fapi-key-create-policy-password-sign.int \
+    test/integration/fapi-key-create-policy-countertimer-sign.int \
+    test/integration/fapi-key-create-policy-physical-presence-sign.int \
+    test/integration/fapi-key-create-policy-locality-sign.int \
+    test/integration/fapi-key-create-policy-command-code-sign.int \
+    test/integration/fapi-key-create-policy-auth-value-sign.int \
+    test/integration/fapi-key-create-ecc-sign.int \
+    test/integration/fapi-key-change-auth.int \
+    test/integration/fapi-key-create-sign-persistent.int \
+    test/integration/fapi-key-create-sign-password.int \
+    test/integration/fapi-key-create-ecc-sign-password.int \
+    test/integration/fapi-key-create-sign-password-da.int \
+    test/integration/fapi-key-create-ecc-sign-password-da.int \
+    test/integration/fapi-nv-authorizenv-cphash.int \
+    test/integration/fapi-nv-ordinary.int \
+    test/integration/fapi-nv-written-policy.int \
+    test/integration/fapi-nv-extend.int \
+    test/integration/fapi-nv-increment.int \
+    test/integration/fapi-nv-set-bits.int \
+    test/integration/fapi-pcr-test.int \
+    test/integration/fapi-quote.int \
+    test/integration/fapi-info.int \
+    test/integration/fapi-unseal.int
+
+if TESTPTPM
+if PTPMDESTRUCTIVE
+FAPI_TESTS_INTEGRATION += test/integration/fapi-key-create-sign-policy-provision.int
+endif
+endif #TESTPTM
+
+TESTS_INTEGRATION += $(FAPI_TESTS_INTEGRATION)
+
+endif #FAPI
+
 endif #ENABLE_INTEGRATION
 
 CLEANFILES += \
     test/integration/*.int_state* \
     test/integration/*.log \
+    test/integration/*.int_ek* \
+    test/integration/*.int_*-ca.pem \
     test/tpmclient/*.int_state* \
     test/tpmclient/*.log \
+    test/tpmclient/*.int_ek* \
+    test/tpmclient/*.int_*-ca.pem \
     test/unit/*.log
 
 if UNIT
@@ -392,7 +473,7 @@
 test_unit_esys_nulltcti_CFLAGS = $(CMOCKA_CFLAGS) $(TESTS_CFLAGS) $(TSS2_ESYS_CFLAGS_CRYPTO)
 test_unit_esys_nulltcti_LDADD = $(CMOCKA_LIBS)  $(TESTS_LDADD) $(LIBADD_DL)
 test_unit_esys_nulltcti_LDFLAGS = $(TESTS_LDFLAGS) $(TSS2_ESYS_LDFLAGS_CRYPTO) \
-    $(LIBDL_LDFLAGS) -Wl,--wrap=Tss2_TctiLdr_Initialize
+    $(LIBDL_LDFLAGS) -Wl,--wrap=Tss2_TctiLdr_Initialize -Wl,--wrap=Tss2_TctiLdr_Finalize
 test_unit_esys_nulltcti_SOURCES = test/unit/esys-nulltcti.c \
                                   src/tss2-esys/esys_context.c \
                                   src/tss2-esys/esys_iutil.c \
@@ -410,6 +491,21 @@
                                 src/tss2-esys/esys_crypto.c \
                                 $(TSS2_ESYS_SRC_CRYPTO)
 endif # ESAPI
+
+if FAPI
+
+test_unit_fapi_json_CFLAGS = $(CMOCKA_CFLAGS) $(TESTS_CFLAGS)
+test_unit_fapi_json_LDADD = $(CMOCKA_LIBS)  $(TESTS_LDADD)
+test_unit_fapi_json_LDFLAGS = $(TESTS_LDFLAGS) -ljson-c
+test_unit_fapi_json_SOURCES = test/unit/fapi-json.c \
+                              src/tss2-fapi/ifapi_json_deserialize.c \
+                              src/tss2-fapi/ifapi_json_serialize.c \
+                              src/tss2-fapi/ifapi_policy_json_deserialize.c \
+                              src/tss2-fapi/ifapi_policy_json_serialize.c \
+                              src/tss2-fapi/tpm_json_deserialize.c \
+                              src/tss2-fapi/tpm_json_serialize.c
+
+endif # FAPI
 endif # UNIT
 
 if ENABLE_INTEGRATION
@@ -1203,6 +1299,303 @@
 test_integration_sapi_command_cancel_int_LDADD   = $(TESTS_LDADD)
 test_integration_sapi_command_cancel_int_SOURCES = test/integration/main-sapi.c \
     test/integration/sapi-command-cancel.int.c src/util/log.c
+
+if FAPI
+test_integration_fapi_get_random_int_CFLAGS  = $(TESTS_CFLAGS)
+test_integration_fapi_get_random_int_LDADD   = $(TESTS_LDADD)
+test_integration_fapi_get_random_int_LDFLAGS = $(TESTS_LDFLAGS)
+test_integration_fapi_get_random_int_SOURCES = \
+    test/integration/fapi-get-random.int.c \
+    test/integration/main-fapi.c test/integration/test-fapi.h
+
+test_integration_fapi_platform_certificates_int_CFLAGS  = $(TESTS_CFLAGS)
+test_integration_fapi_platform_certificates_int_LDADD   = $(TESTS_LDADD)
+test_integration_fapi_platform_certificates_int_LDFLAGS = $(TESTS_LDFLAGS)
+test_integration_fapi_platform_certificates_int_SOURCES = \
+    test/integration/fapi-platform-certificates.int.c \
+    test/integration/main-fapi.c test/integration/test-fapi.h
+
+test_integration_fapi_key_create_sign_int_CFLAGS  = $(TESTS_CFLAGS)
+test_integration_fapi_key_create_sign_int_LDADD   = $(TESTS_LDADD)
+test_integration_fapi_key_create_sign_int_LDFLAGS = $(TESTS_LDFLAGS)
+test_integration_fapi_key_create_sign_int_SOURCES = \
+    test/integration/fapi-key-create-sign.int.c \
+    test/integration/main-fapi.c test/integration/test-fapi.h
+
+test_integration_fapi_key_create_sign_password_provision_int_CFLAGS  = $(TESTS_CFLAGS)
+test_integration_fapi_key_create_sign_password_provision_int_LDADD   = $(TESTS_LDADD)
+test_integration_fapi_key_create_sign_password_provision_int_LDFLAGS = $(TESTS_LDFLAGS)
+test_integration_fapi_key_create_sign_password_provision_int_SOURCES = \
+    test/integration/fapi-key-create-sign-password-provision.int.c \
+    test/integration/main-fapi.c test/integration/test-fapi.h
+
+test_integration_fapi_key_create_sign_policy_provision_int_CFLAGS  = $(TESTS_CFLAGS) \
+ -DFAPI_PROFILE=\"P_RSA_sh_policy\"
+test_integration_fapi_key_create_sign_policy_provision_int_LDADD   = $(TESTS_LDADD)
+test_integration_fapi_key_create_sign_policy_provision_int_LDFLAGS = $(TESTS_LDFLAGS)
+test_integration_fapi_key_create_sign_policy_provision_int_SOURCES = \
+    test/integration/fapi-key-create-sign-policy-provision.int.c \
+    test/integration/main-fapi.c test/integration/test-fapi.h
+
+test_integration_fapi_key_create_sign_ecc_int_CFLAGS  = $(TESTS_CFLAGS) \
+ -DFAPI_PROFILE=\"P_ECC\"
+test_integration_fapi_key_create_sign_ecc_int_LDADD   = $(TESTS_LDADD)
+test_integration_fapi_key_create_sign_ecc_int_LDFLAGS = $(TESTS_LDFLAGS)
+test_integration_fapi_key_create_sign_ecc_int_SOURCES = \
+    test/integration/fapi-key-create-sign.int.c \
+    test/integration/main-fapi.c test/integration/test-fapi.h
+
+test_integration_fapi_key_create_sign_password_int_CFLAGS  = $(TESTS_CFLAGS) \
+ -DFAPI_PASSWORD
+test_integration_fapi_key_create_sign_password_int_LDADD   = $(TESTS_LDADD)
+test_integration_fapi_key_create_sign_password_int_LDFLAGS = $(TESTS_LDFLAGS)
+test_integration_fapi_key_create_sign_password_int_SOURCES = \
+    test/integration/fapi-key-create-sign.int.c \
+    test/integration/main-fapi.c test/integration/test-fapi.h
+
+test_integration_fapi_key_create_sign_password_da_int_CFLAGS  = $(TESTS_CFLAGS) \
+ -DFAPI_PASSWORD -DFAPI_DA
+test_integration_fapi_key_create_sign_password_da_int_LDADD   = $(TESTS_LDADD)
+test_integration_fapi_key_create_sign_password_da_int_LDFLAGS = $(TESTS_LDFLAGS)
+test_integration_fapi_key_create_sign_password_da_int_SOURCES = \
+    test/integration/fapi-key-create-sign.int.c \
+    test/integration/main-fapi.c test/integration/test-fapi.h
+
+test_integration_fapi_key_create_sign_persistent_int_CFLAGS  = $(TESTS_CFLAGS) \
+   -DFAPI_PROFILE=\"P_RSA_EK_persistent\"
+test_integration_fapi_key_create_sign_persistent_int_LDADD   = $(TESTS_LDADD)
+test_integration_fapi_key_create_sign_persistent_int_LDFLAGS = $(TESTS_LDFLAGS)
+test_integration_fapi_key_create_sign_persistent_int_SOURCES = \
+    test/integration/fapi-key-create-sign.int.c \
+    test/integration/main-fapi.c test/integration/test-fapi.h
+
+test_integration_fapi_key_create_policy_authorize_sign_int_CFLAGS  = $(TESTS_CFLAGS) \
+    -DFAPI_PROFILE=\"P_RSA256\"
+test_integration_fapi_key_create_policy_authorize_sign_int_LDADD   = $(TESTS_LDADD)
+test_integration_fapi_key_create_policy_authorize_sign_int_LDFLAGS = $(TESTS_LDFLAGS)
+test_integration_fapi_key_create_policy_authorize_sign_int_SOURCES = \
+    test/integration/fapi-key-create-policy-authorize-sign.int.c \
+    test/integration/main-fapi.c test/integration/test-fapi.h
+
+test_integration_fapi_key_create_policy_authorize_nv_sign_int_CFLAGS  = $(TESTS_CFLAGS)
+test_integration_fapi_key_create_policy_authorize_nv_sign_int_LDADD   = $(TESTS_LDADD)
+test_integration_fapi_key_create_policy_authorize_nv_sign_int_LDFLAGS = $(TESTS_LDFLAGS)
+test_integration_fapi_key_create_policy_authorize_nv_sign_int_SOURCES = \
+    test/integration/fapi-key-create-policy-authorize-nv-sign.int.c \
+    test/integration/main-fapi.c test/integration/test-fapi.h
+
+test_integration_fapi_key_create_policy_secret_nv_sign_int_CFLAGS  = $(TESTS_CFLAGS) \
+    -DFAPI_PROFILE=\"P_RSA256\"
+test_integration_fapi_key_create_policy_secret_nv_sign_int_LDADD   = $(TESTS_LDADD)
+test_integration_fapi_key_create_policy_secret_nv_sign_int_LDFLAGS = $(TESTS_LDFLAGS)
+test_integration_fapi_key_create_policy_secret_nv_sign_int_SOURCES = \
+    test/integration/fapi-key-create-policy-secret-nv-sign.int.c \
+    test/integration/main-fapi.c test/integration/test-fapi.h
+
+test_integration_fapi_key_create_policy_pcr_sign_int_CFLAGS  = $(TESTS_CFLAGS)
+test_integration_fapi_key_create_policy_pcr_sign_int_LDADD   = $(TESTS_LDADD)
+test_integration_fapi_key_create_policy_pcr_sign_int_LDFLAGS = $(TESTS_LDFLAGS)
+test_integration_fapi_key_create_policy_pcr_sign_int_SOURCES = \
+    test/integration/fapi-key-create-policy-pcr-sign.int.c \
+    test/integration/main-fapi.c test/integration/test-fapi.h
+
+test_integration_fapi_key_create_policy_signed_int_CFLAGS  = $(TESTS_CFLAGS)
+test_integration_fapi_key_create_policy_signed_int_LDADD   = $(TESTS_LDADD)
+test_integration_fapi_key_create_policy_signed_int_LDFLAGS = $(TESTS_LDFLAGS)
+test_integration_fapi_key_create_policy_signed_int_SOURCES = \
+    test/integration/fapi-key-create-policy-signed.int.c \
+    test/integration/main-fapi.c test/integration/test-fapi.h
+
+
+test_integration_fapi_key_create_policy_nv_sign_int_CFLAGS  = $(TESTS_CFLAGS)
+test_integration_fapi_key_create_policy_nv_sign_int_LDADD   = $(TESTS_LDADD)
+test_integration_fapi_key_create_policy_nv_sign_int_LDFLAGS = $(TESTS_LDFLAGS)
+test_integration_fapi_key_create_policy_nv_sign_int_SOURCES = \
+    test/integration/fapi-key-create-policy-nv-sign.int.c \
+    test/integration/main-fapi.c test/integration/test-fapi.h
+
+test_integration_fapi_key_create_policy_or_sign_int_CFLAGS  = $(TESTS_CFLAGS)
+test_integration_fapi_key_create_policy_or_sign_int_LDADD   = $(TESTS_LDADD)
+test_integration_fapi_key_create_policy_or_sign_int_LDFLAGS = $(TESTS_LDFLAGS)
+test_integration_fapi_key_create_policy_or_sign_int_SOURCES = \
+    test/integration/fapi-key-create-policy-or-sign.int.c \
+    test/integration/main-fapi.c test/integration/test-fapi.h
+
+test_integration_fapi_key_create_policy_password_sign_int_CFLAGS  = $(TESTS_CFLAGS) \
+    -DTEST_POLICY_PASSWORD -DTEST_PASSWORD
+test_integration_fapi_key_create_policy_password_sign_int_LDADD   = $(TESTS_LDADD)
+test_integration_fapi_key_create_policy_password_sign_int_LDFLAGS = $(TESTS_LDFLAGS)
+test_integration_fapi_key_create_policy_password_sign_int_SOURCES = \
+    test/integration/fapi-key-create-policies-sign.int.c \
+    test/integration/main-fapi.c test/integration/test-fapi.h
+
+test_integration_fapi_key_create_policy_countertimer_sign_int_CFLAGS  = $(TESTS_CFLAGS) \
+    -DTEST_POLICY_COUNTERTIMER
+test_integration_fapi_key_create_policy_countertimer_sign_int_LDADD   = $(TESTS_LDADD)
+test_integration_fapi_key_create_policy_countertimer_sign_int_LDFLAGS = $(TESTS_LDFLAGS)
+test_integration_fapi_key_create_policy_countertimer_sign_int_SOURCES = \
+    test/integration/fapi-key-create-policies-sign.int.c \
+    test/integration/main-fapi.c test/integration/test-fapi.h
+
+test_integration_fapi_key_create_policy_physical_presence_sign_int_CFLAGS  = $(TESTS_CFLAGS) \
+    -DTEST_POLICY_PHYSICAL_PRESENCE
+test_integration_fapi_key_create_policy_physical_presence_sign_int_LDADD   = $(TESTS_LDADD)
+test_integration_fapi_key_create_policy_physical_presence_sign_int_LDFLAGS = $(TESTS_LDFLAGS)
+test_integration_fapi_key_create_policy_physical_presence_sign_int_SOURCES = \
+    test/integration/fapi-key-create-policies-sign.int.c \
+    test/integration/main-fapi.c test/integration/test-fapi.h
+
+test_integration_fapi_key_create_policy_locality_sign_int_CFLAGS  = $(TESTS_CFLAGS) \
+    -DTEST_POLICY_LOCALITY
+test_integration_fapi_key_create_policy_locality_sign_int_LDADD   = $(TESTS_LDADD)
+test_integration_fapi_key_create_policy_locality_sign_int_LDFLAGS = $(TESTS_LDFLAGS)
+test_integration_fapi_key_create_policy_locality_sign_int_SOURCES = \
+    test/integration/fapi-key-create-policies-sign.int.c \
+    test/integration/main-fapi.c test/integration/test-fapi.h
+
+test_integration_fapi_key_create_policy_command_code_sign_int_CFLAGS  = $(TESTS_CFLAGS) \
+    -DTEST_POLICY_COMMAND_CODE
+test_integration_fapi_key_create_policy_command_code_sign_int_LDADD   = $(TESTS_LDADD)
+test_integration_fapi_key_create_policy_command_code_sign_int_LDFLAGS = $(TESTS_LDFLAGS)
+test_integration_fapi_key_create_policy_command_code_sign_int_SOURCES = \
+    test/integration/fapi-key-create-policies-sign.int.c \
+    test/integration/main-fapi.c test/integration/test-fapi.h
+
+test_integration_fapi_key_create_policy_auth_value_sign_int_CFLAGS  = $(TESTS_CFLAGS) \
+ -DTEST_POLICY_AUTH_VALUE -DTEST_PASSWORD
+test_integration_fapi_key_create_policy_auth_value_sign_int_LDADD   = $(TESTS_LDADD)
+test_integration_fapi_key_create_policy_auth_value_sign_int_LDFLAGS = $(TESTS_LDFLAGS)
+test_integration_fapi_key_create_policy_auth_value_sign_int_SOURCES = \
+    test/integration/fapi-key-create-policies-sign.int.c \
+    test/integration/main-fapi.c test/integration/test-fapi.h
+
+test_integration_fapi_key_create_ecc_sign_int_CFLAGS  = $(TESTS_CFLAGS) \
+ -DFAPI_PROFILE=\"P_ECC\"
+test_integration_fapi_key_create_ecc_sign_int_LDADD   = $(TESTS_LDADD)
+test_integration_fapi_key_create_ecc_sign_int_LDFLAGS = $(TESTS_LDFLAGS)
+test_integration_fapi_key_create_ecc_sign_int_SOURCES = \
+    test/integration/fapi-key-create-ecc-sign.int.c \
+    test/integration/main-fapi.c test/integration/test-fapi.h
+
+test_integration_fapi_key_create_ecc_sign_password_int_CFLAGS  = $(TESTS_CFLAGS) \
+ -DFAPI_PASSWORD  -DFAPI_PROFILE=\"P_ECC\"
+test_integration_fapi_key_create_ecc_sign_password_int_LDADD   = $(TESTS_LDADD)
+test_integration_fapi_key_create_ecc_sign_password_int_LDFLAGS = $(TESTS_LDFLAGS)
+test_integration_fapi_key_create_ecc_sign_password_int_SOURCES = \
+    test/integration/fapi-key-create-ecc-sign.int.c \
+    test/integration/main-fapi.c test/integration/test-fapi.h
+
+test_integration_fapi_key_create_ecc_sign_password_da_int_CFLAGS  = $(TESTS_CFLAGS) \
+ -DFAPI_PASSWORD -DFAPI_DA  -DFAPI_PROFILE=\"P_ECC\"
+test_integration_fapi_key_create_ecc_sign_password_da_int_LDADD   = $(TESTS_LDADD)
+test_integration_fapi_key_create_ecc_sign_password_da_int_LDFLAGS = $(TESTS_LDFLAGS)
+test_integration_fapi_key_create_ecc_sign_password_da_int_SOURCES = \
+    test/integration/fapi-key-create-ecc-sign.int.c \
+    test/integration/main-fapi.c test/integration/test-fapi.h
+
+test_integration_fapi_key_change_auth_int_CFLAGS  = $(TESTS_CFLAGS)
+test_integration_fapi_key_change_auth_int_LDADD   = $(TESTS_LDADD)
+test_integration_fapi_key_change_auth_int_LDFLAGS = $(TESTS_LDFLAGS)
+test_integration_fapi_key_change_auth_int_SOURCES = \
+    test/integration/fapi-key-change-auth.int.c \
+    test/integration/main-fapi.c test/integration/test-fapi.h
+
+test_integration_fapi_nv_ordinary_int_CFLAGS  = $(TESTS_CFLAGS)
+test_integration_fapi_nv_ordinary_int_LDADD   = $(TESTS_LDADD)
+test_integration_fapi_nv_ordinary_int_LDFLAGS = $(TESTS_LDFLAGS)
+test_integration_fapi_nv_ordinary_int_SOURCES = \
+    test/integration/fapi-nv-ordinary.int.c \
+    test/integration/main-fapi.c test/integration/test-fapi.h
+
+test_integration_fapi_nv_authorizenv_cphash_int_CFLAGS  = $(TESTS_CFLAGS)
+test_integration_fapi_nv_authorizenv_cphash_int_LDADD   = $(TESTS_LDADD)
+test_integration_fapi_nv_authorizenv_cphash_int_LDFLAGS = $(TESTS_LDFLAGS)
+test_integration_fapi_nv_authorizenv_cphash_int_SOURCES = \
+    test/integration/fapi-nv-authorizenv-cphash.int.c \
+    test/integration/main-fapi.c test/integration/test-fapi.h
+
+test_integration_fapi_nv_extend_int_CFLAGS  = $(TESTS_CFLAGS)
+test_integration_fapi_nv_extend_int_LDADD   = $(TESTS_LDADD)
+test_integration_fapi_nv_extend_int_LDFLAGS = $(TESTS_LDFLAGS)
+test_integration_fapi_nv_extend_int_SOURCES = \
+    test/integration/fapi-nv-extend.int.c \
+    test/integration/main-fapi.c test/integration/test-fapi.h
+
+test_integration_fapi_nv_increment_int_CFLAGS  = $(TESTS_CFLAGS)
+test_integration_fapi_nv_increment_int_LDADD   = $(TESTS_LDADD)
+test_integration_fapi_nv_increment_int_LDFLAGS = $(TESTS_LDFLAGS)
+test_integration_fapi_nv_increment_int_SOURCES = \
+    test/integration/fapi-nv-increment.int.c \
+    test/integration/main-fapi.c test/integration/test-fapi.h
+
+test_integration_fapi_nv_set_bits_int_CFLAGS  = $(TESTS_CFLAGS)
+test_integration_fapi_nv_set_bits_int_LDADD   = $(TESTS_LDADD)
+test_integration_fapi_nv_set_bits_int_LDFLAGS = $(TESTS_LDFLAGS)
+test_integration_fapi_nv_set_bits_int_SOURCES = \
+    test/integration/fapi-nv-set-bits.int.c \
+    test/integration/main-fapi.c test/integration/test-fapi.h
+
+test_integration_fapi_nv_written_policy_int_CFLAGS  = $(TESTS_CFLAGS)
+test_integration_fapi_nv_written_policy_int_LDADD   = $(TESTS_LDADD)
+test_integration_fapi_nv_written_policy_int_LDFLAGS = $(TESTS_LDFLAGS)
+test_integration_fapi_nv_written_policy_int_SOURCES = \
+    test/integration/fapi-nv-written-policy.int.c \
+    test/integration/main-fapi.c test/integration/test-fapi.h
+
+test_integration_fapi_ext_public_key_int_CFLAGS  = $(TESTS_CFLAGS) \
+  -DFAPI_NONTPM
+test_integration_fapi_ext_public_key_int_LDADD   = $(TESTS_LDADD)
+test_integration_fapi_ext_public_key_int_LDFLAGS = $(TESTS_LDFLAGS)
+test_integration_fapi_ext_public_key_int_SOURCES = \
+    test/integration/fapi-ext-public-key.int.c \
+    test/integration/main-fapi.c test/integration/test-fapi.h
+
+test_integration_fapi_data_crypt_rsa_int_CFLAGS  = $(TESTS_CFLAGS)
+test_integration_fapi_data_crypt_rsa_int_LDADD   = $(TESTS_LDADD)
+test_integration_fapi_data_crypt_rsa_int_LDFLAGS = $(TESTS_LDFLAGS)
+test_integration_fapi_data_crypt_rsa_int_SOURCES = \
+    test/integration/fapi-data-crypt-rsa.int.c \
+    test/integration/main-fapi.c test/integration/test-fapi.h
+
+test_integration_fapi_rsa_duplicate_int_CFLAGS  = $(TESTS_CFLAGS)
+test_integration_fapi_rsa_duplicate_int_LDADD   = $(TESTS_LDADD)
+test_integration_fapi_rsa_duplicate_int_LDFLAGS = $(TESTS_LDFLAGS)
+test_integration_fapi_rsa_duplicate_int_SOURCES = \
+    test/integration/fapi-rsa-duplicate.int.c \
+    test/integration/main-fapi.c test/integration/test-fapi.h
+
+
+test_integration_fapi_pcr_test_int_CFLAGS  = $(TESTS_CFLAGS)
+test_integration_fapi_pcr_test_int_LDADD   = $(TESTS_LDADD)
+test_integration_fapi_pcr_test_int_LDFLAGS = $(TESTS_LDFLAGS)
+test_integration_fapi_pcr_test_int_SOURCES = \
+    test/integration/fapi-pcr-test.int.c \
+    test/integration/main-fapi.c test/integration/test-fapi.h
+
+test_integration_fapi_quote_int_CFLAGS  = $(TESTS_CFLAGS)
+test_integration_fapi_quote_int_LDADD   = $(TESTS_LDADD)
+test_integration_fapi_quote_int_LDFLAGS = $(TESTS_LDFLAGS) -ljson-c
+test_integration_fapi_quote_int_SOURCES = \
+    test/integration/fapi-quote.int.c \
+    test/integration/main-fapi.c test/integration/test-fapi.h
+
+test_integration_fapi_info_int_CFLAGS  = $(TESTS_CFLAGS)
+test_integration_fapi_info_int_LDADD   = $(TESTS_LDADD)
+test_integration_fapi_info_int_LDFLAGS = $(TESTS_LDFLAGS)
+test_integration_fapi_info_int_SOURCES = \
+    test/integration/fapi-info.int.c \
+    test/integration/main-fapi.c test/integration/test-fapi.h
+
+test_integration_fapi_unseal_int_CFLAGS  = $(TESTS_CFLAGS)
+test_integration_fapi_unseal_int_LDADD   = $(TESTS_LDADD)
+test_integration_fapi_unseal_int_LDFLAGS = $(TESTS_LDFLAGS)
+test_integration_fapi_unseal_int_SOURCES = \
+    test/integration/fapi-unseal.int.c \
+    test/integration/main-fapi.c test/integration/test-fapi.h
+
+
+endif #FAPI
+
 endif #ENABLE_INTEGRATION
 
 check-ptpm:

diff --git a/Makefile.am b/Makefile.am
index 9867e22..8115be5 100644
--- a/Makefile.am
+++ b/Makefile.am

@@ -382,6 +382,151 @@
 endif # HAVE_LD_VERSION_SCRIPT
 src_tss2_rc_libtss2_rc_la_SOURCES = $(TSS2_RC_SRC)
 
+
+### TCG TSS FAPI spec library ###
+if FAPI
+fapiconfdir = @sysconfdir@/tpm2-tss
+fapiconf_DATA = fapi-config.json
+
+EXTRA_DIST += dist/fapi-config.json.in
+CLEANFILES += fapi-config.json
+
+# We have to do this ourselves, in order to get absolute paths
+fapi-config.json: dist/fapi-config.json.in
+	$(AM_V_GEN) $(SED) \
+		-e 's|[@]prefix@|$(prefix)|g' \
+		-e 's|[@]datarootdir@|$(datarootdir)|g' \
+		-e 's|[@]datadir@|$(datadir)|g' \
+		-e 's|[@]sysconfdir@|$(sysconfdir)|g' \
+		-e 's|[@]sharedstatedir@|$(sharedstatedir)|g' \
+		-e 's|[@]localstatedir@|$(localstatedir)|g' \
+		-e 's|[@]runstatedir@|$(runstatedir)|g' \
+		-e 's|[@]userstatedir@|$(userstatedir)|g' \
+		< "$<" > "$@"
+
+tmpfilesddir = @tmpfilesdir@
+tmpfilesd_DATA = fapi-tmpfiles.conf
+
+EXTRA_DIST += dist/fapi-tmpfiles.conf.in
+CLEANFILES += fapi-tmpfiles.conf
+
+# We have to do this ourselves, in order to get absolute paths
+fapi-tmpfiles.conf: dist/fapi-tmpfiles.conf.in
+	$(AM_V_GEN) $(SED) \
+		-e 's|[@]runstatedir@|$(runstatedir)|g' \
+		< "$<" > "$@"
+
+EXTRA_DIST += dist/fapi-profiles/P_RSA2048SHA256.json \
+              dist/fapi-profiles/P_ECCP256SHA256.json
+
+fapiprofilesdir = @sysconfdir@/tpm2-tss/fapi-profiles
+fapiprofiles_DATA = dist/fapi-profiles/P_RSA2048SHA256.json \
+                    dist/fapi-profiles/P_ECCP256SHA256.json
+
+EXTRA_DIST += dist/keep
+
+fapikeystoredir = @localstatedir@/tpm2-tss/system/keystore
+fapikeystore_DATA = dist/keep
+
+fapieventlogdir = @runstatedir@/tpm2-tss/eventlog
+fapieventlog_DATA = dist/keep
+
+libtss2_fapi = src/tss2-fapi/libtss2-fapi.la
+tss2_HEADERS += $(srcdir)/include/tss2/tss2_fapi.h
+lib_LTLIBRARIES += $(libtss2_fapi)
+pkgconfig_DATA += lib/tss2-fapi.pc
+EXTRA_DIST +=  \
+    lib/tss2-fapi.map \
+    lib/tss2-fapi.def \
+    test/data/fapi/P_RSA_EK_persistent.json \
+    test/data/fapi/P_RSA.json \
+    test/data/fapi/P_RSA_sh_policy.json \
+    test/data/fapi/P_RSA256.json \
+    test/data/fapi/P_ECC.json \
+    test/data/fapi/policy/pol_pcr16_0.json \
+    test/data/fapi/policy/pol_pcr16_0_fail.json \
+    test/data/fapi/policy/pol_pcr16_0_or.json \
+    test/data/fapi/policy/pol_nv.json \
+    test/data/fapi/policy/pol_nv_written.json \
+    test/data/fapi/policy/pol_signed.json \
+    test/data/fapi/policy/pol_authorize.json \
+    test/data/fapi/policy/pol_authorize_nv.json \
+    test/data/fapi/policy/pol_secret.json \
+    test/data/fapi/policy/pol_password.json \
+    test/data/fapi/policy/pol_auth_value.json \
+    test/data/fapi/policy/pol_command_code.json \
+    test/data/fapi/policy/pol_locality.json \
+    test/data/fapi/policy/pol_physical_presence.json \
+    test/data/fapi/policy/pol_duplicate.json \
+    test/data/fapi/policy/pol_nv_change_auth.json \
+    test/data/fapi/policy/pol_countertimer.json \
+    test/data/fapi/policy/pol_name_hash.json \
+    test/data/fapi/policy/pol_pcr16_read.json \
+    test/data/fapi/policy/pol_action.json \
+    test/data/fapi/policy/pol_cphash.json
+
+src_tss2_fapi_libtss2_fapi_la_LIBADD  = $(libtss2_sys) $(libtss2_mu) $(libtss2_esys) \
+    $(libutil) $(libtss2_tctildr)
+
+src_tss2_fapi_libtss2_fapi_la_SOURCES = $(TSS2_FAPI_SRC)
+src_tss2_fapi_libtss2_fapi_la_CFLAGS  = $(AM_CFLAGS) -I$(srcdir)/src/tss2-fapi
+src_tss2_fapi_libtss2_fapi_la_LDFLAGS = $(AM_LDFLAGS) -ldl  -lssl -lcrypto C -ljson-c $(CURL_LIBS)
+if HAVE_LD_VERSION_SCRIPT
+src_tss2_fapi_libtss2_fapi_la_LDFLAGS += -Wl,--version-script=$(srcdir)/lib/tss2-fapi.map
+endif # HAVE_LD_VERSION_SCRIPT
+
+
+if DOXYMAN
+DOXYMAN3 += \
+    doxygen-doc/man/Fapi_AuthorizePolicy.3 \
+    doxygen-doc/man/Fapi_ChangeAuth.3 \
+    doxygen-doc/man/Fapi_CreateKey.3 \
+    doxygen-doc/man/Fapi_CreateNv.3 \
+    doxygen-doc/man/Fapi_CreateSeal.3 \
+    doxygen-doc/man/Fapi_Decrypt.3 \
+    doxygen-doc/man/Fapi_Delete.3 \
+    doxygen-doc/man/Fapi_Encrypt.3 \
+    doxygen-doc/man/Fapi_ExportKey.3 \
+    doxygen-doc/man/Fapi_ExportPolicy.3 \
+    doxygen-doc/man/Fapi_Finalize.3 \
+    doxygen-doc/man/Fapi_Free.3 \
+    doxygen-doc/man/Fapi_GetAppData.3 \
+    doxygen-doc/man/Fapi_GetCertificate.3 \
+    doxygen-doc/man/Fapi_GetDescription.3 \
+    doxygen-doc/man/Fapi_GetInfo.3 \
+    doxygen-doc/man/Fapi_GetPlatformCertificates.3 \
+    doxygen-doc/man/Fapi_GetPollHandles.3 \
+    doxygen-doc/man/Fapi_GetRandom.3 \
+    doxygen-doc/man/Fapi_GetTcti.3 \
+    doxygen-doc/man/Fapi_GetTpmBlobs.3 \
+    doxygen-doc/man/Fapi_Import.3 \
+    doxygen-doc/man/Fapi_Initialize.3 \
+    doxygen-doc/man/Fapi_List.3 \
+    doxygen-doc/man/Fapi_NvExtend.3 \
+    doxygen-doc/man/Fapi_NvIncrement.3 \
+    doxygen-doc/man/Fapi_NvRead.3 \
+    doxygen-doc/man/Fapi_NvSetBits.3 \
+    doxygen-doc/man/Fapi_NvWrite.3 \
+    doxygen-doc/man/Fapi_PcrExtend.3 \
+    doxygen-doc/man/Fapi_PcrRead.3 \
+    doxygen-doc/man/Fapi_Provision.3 \
+    doxygen-doc/man/Fapi_Quote.3 \
+    doxygen-doc/man/Fapi_SetAppData.3 \
+    doxygen-doc/man/Fapi_SetAuthCB.3 \
+    doxygen-doc/man/Fapi_SetBranchCB.3 \
+    doxygen-doc/man/Fapi_SetCertificate.3 \
+    doxygen-doc/man/Fapi_SetDescription.3 \
+    doxygen-doc/man/Fapi_SetSignCB.3 \
+    doxygen-doc/man/Fapi_Sign.3 \
+    doxygen-doc/man/FapiTestgroup.3 \
+    doxygen-doc/man/Fapi_Unseal.3 \
+    doxygen-doc/man/Fapi_VerifyQuote.3 \
+    doxygen-doc/man/Fapi_VerifySignature.3 \
+    doxygen-doc/man/Fapi_WriteAuthorizeNv.3
+endif #DOXYMAN
+
+endif #FAPI
+
 ### Man Pages
 man3_MANS = \
     man/man3/Tss2_Tcti_Device_Init.3 \
@@ -416,6 +561,11 @@
 	-rm $(DESTDIR)$(udevrulesdir)/$(udevrulesprefix)tpm-udev.rules
 endif
 
+install-exec-hook:
+	[ -d "$(DESTDIR)$(fapikeystoredir)" ] && \
+		chown tss:tss "$(DESTDIR)$(fapikeystoredir)" && \
+		chmod 775 "$(DESTDIR)$(fapikeystoredir)" || true
+
 uninstall-hook:
 	cd $(DESTDIR)$(man3dir) && \
 		[ -L Tss2_TctiLdr_Initialize_Ex.3 ] && \

diff --git a/bootstrap b/bootstrap
index d3efce1..39c8508 100755
--- a/bootstrap
+++ b/bootstrap

@@ -58,6 +58,10 @@
   src_esys_listvar "src/tss2-esys/" "*.c" "TSS2_ESYS_C" src/tss2-esys/esys_crypto_ossl.c  src/tss2-esys/esys_crypto_gcrypt.c
   printf "TSS2_ESYS_SRC = \$(TSS2_ESYS_H) \$(TSS2_ESYS_C)\n"
 
+  src_listvar "src/tss2-fapi/" "*.h" "TSS2_FAPI_H"
+  src_listvar "src/tss2-fapi/" "*.c" "TSS2_FAPI_C"
+  printf "TSS2_FAPI_SRC = \$(TSS2_FAPI_H) \$(TSS2_FAPI_C)\n"
+
   src_listvar "src/tss2-mu" "*.c" "TSS2_MU_C"
   src_listvar "src/tss2-mu" "*.h" "TSS2_MU_H"
   printf "TSS2_MU_SRC = \$(TSS2_MU_C) \$(TSS2_MU_H)\n"

diff --git a/configure.ac b/configure.ac
index a1c88f6..cd50451 100644
--- a/configure.ac
+++ b/configure.ac

@@ -15,7 +15,7 @@
 
 AC_CONFIG_HEADERS([config.h])
 
-AC_CONFIG_FILES([Makefile Doxyfile lib/tss2-sys.pc lib/tss2-esys.pc lib/tss2-mu.pc lib/tss2-tcti-device.pc lib/tss2-tcti-mssim.pc lib/tss2-rc.pc lib/tss2-tctildr.pc])
+AC_CONFIG_FILES([Makefile Doxyfile lib/tss2-sys.pc lib/tss2-esys.pc lib/tss2-mu.pc lib/tss2-tcti-device.pc lib/tss2-tcti-mssim.pc lib/tss2-rc.pc lib/tss2-tctildr.pc lib/tss2-fapi.pc])
 
 # propagate configure arguments to distcheck
 AC_SUBST([DISTCHECK_CONFIGURE_FLAGS],[$ac_configure_args])
@@ -45,6 +45,21 @@
 esac
 AC_SUBST([LIBSOCKET_LDFLAGS])
 
+AC_DEFINE_UNQUOTED([SYSCONFDIR], ["${sysconfdir}"], [System config dir])
+AC_SUBST(confdir, $sysconfdir/tpm2-tss)
+
+AC_ARG_WITH([userstatedir],
+            [AS_HELP_STRING([--with-userstatedir=<dir>],
+                            [sets the relative path in the user's home (default is ".local/share")])],,
+            [with_userstatedir=.local/share])
+AC_SUBST(userstatedir, $with_userstatedir)
+
+AC_ARG_WITH([tmpfilesdir],
+            [AS_HELP_STRING([--with-tmpfilesdir=<dir>],
+                            [sets the tpmfiles.d directory (default is "${sysconfdir}/tmpfiles.d")])],,
+            [with_tmpfilesdir="${sysconfdir}/tmpfiles.d"])
+AC_SUBST(tmpfilesdir, $with_tmpfilesdir)
+
 AC_CHECK_FUNCS([strndup])
 AC_ARG_ENABLE([unit],
             [AS_HELP_STRING([--enable-unit],
@@ -65,6 +80,24 @@
 
 AM_CONDITIONAL(ESAPI, test "x$enable_esapi" = "xyes")
 
+AC_CHECK_FUNCS([reallocarray])
+AC_ARG_ENABLE([fapi],
+            [AS_HELP_STRING([--enable-fapi],
+                            [build the fapi layer (default is yes)])],
+            [enable_fapi=$enableval],
+            [enable_fapi=yes])
+
+AM_CONDITIONAL(FAPI, test "x$enable_fapi" = "xyes")
+
+AC_ARG_ENABLE([fapi-async-tests],
+    AS_HELP_STRING([--enable-fapi-async-tests],
+               [Force fapi to spin asynchronously. (NOT FOR PRODUCTION!)]),,
+    [enable_fapi_async_tests=no])
+AS_IF([test "x$enable_fapi_async_tests" = "xyes"],
+    AC_DEFINE([TEST_FAPI_ASYNC], [1], [FAPI forced async spinning]))
+AS_IF([test "x$enable_fapi_async_tests" = "xyes"],
+    AC_MSG_WARN("FAPI compiled with asynchronous spinning testing. NOT FOR PRODUCTION!"))
+
 AC_ARG_ENABLE([tcti-device-async],
     AS_HELP_STRING([--enable-tcti-device-async],
 	           [Enable asynchronus operation on TCTI device
@@ -107,6 +140,18 @@
 AC_SUBST([TSS2_ESYS_CFLAGS_CRYPTO])
 AC_SUBST([TSS2_ESYS_LDFLAGS_CRYPTO])
 
+AS_IF([test "x$enable_fapi" != xno -a "x$enable_esapi" = "xno"],
+    AC_MSG_ERROR([ESAPI has to be enabled to compile FAPI.]))
+
+AS_IF([test "x$enable_fapi" != xno -a "x$with_crypto" != "xossl"],
+    AC_MSG_ERROR([FAPI has to be compiled with OpenSSL]))
+
+AS_IF([test "x$enable_fapi" = xyes ],
+    AC_CHECK_HEADER([json-c/json.h], [], [AC_MSG_ERROR([libjson-c (header) not found])], []))
+
+AS_IF([test "x$enable_fapi" = xyes ],
+    PKG_CHECK_MODULES([CURL], [libcurl]))
+
 AC_ARG_WITH([tctidefaultmodule],
             [AS_HELP_STRING([--with-tctidefaultmodule],
 [The default TCTI module for ESAPI. (Default: libtss2-tcti-default.so)])],
@@ -387,6 +432,7 @@
 AC_MSG_RESULT([
     $PACKAGE_NAME $VERSION
     esapi:              $enable_esapi
+    fapi:               $enable_fapi
     tctidefaultmodule:  $with_tctidefaultmodule
     tctidefaultconfig:  $with_tctidefaultconfig
     unit:               $enable_unit
@@ -397,4 +443,9 @@
     tcti-device-async:  $enable_tcti_device_async
     tcti-partial-read:  $enable_tcti_partial_reads
     crypto backend:     $with_crypto
+    sysconfdir:         $sysconfdir
+    localstatedir:      $localstatedir
+    runstatedir:        $runstatedir
+    tmpfilesdir:        $tmpfilesdir
+    userstatedir:       [\$HOME/]$with_userstatedir
 ])

diff --git a/dist/fapi-config.json.in b/dist/fapi-config.json.in
new file mode 100644
index 0000000..a76b6b2
--- /dev/null
+++ b/dist/fapi-config.json.in

@@ -0,0 +1,9 @@
+{
+     "profile_name": "P_RSA2048SHA256",
+     "profile_dir": "@sysconfdir@/tpm2-tss/fapi-profiles/",
+     "user_dir": "~/@userstatedir@/tpm2-tss/user/keystore",
+     "system_dir": "@localstatedir@/tpm2-tss/system/keystore",
+     "tcti": "",
+     "system_pcrs" : [],
+     "log_dir" : "@runstatedir@/tpm2-tss/eventlog/",
+}

diff --git a/dist/fapi-profiles/P_ECCP256SHA256.json b/dist/fapi-profiles/P_ECCP256SHA256.json
new file mode 100644
index 0000000..5b099d8
--- /dev/null
+++ b/dist/fapi-profiles/P_ECCP256SHA256.json

@@ -0,0 +1,38 @@
+{
+    "type": "TPM2_ALG_ECC",
+    "nameAlg":"TPM2_ALG_SHA256",
+    "srk_template": "system,restricted,decrypt",
+    "srk_persistent": 0,
+    "ek_template":  "system,restricted,decrypt",
+    "ecc_signing_scheme": {
+        "scheme":"TPM2_ALG_ECDSA",
+        "details":{
+            "hashAlg":"TPM2_ALG_SHA1"
+        },
+    },
+    "rsa_signing_scheme": {
+        "scheme":"TPM2_ALG_NULL"
+    },
+    "rsa_decrypt_scheme": {
+        "scheme":"TPM2_ALG_OAEP",
+        "details":{
+            "hashAlg":"TPM2_ALG_SHA1"
+        }
+    },
+    "sym_mode":"TPM2_ALG_CFB",
+    "sym_parameters": {
+        "algorithm":"TPM2_ALG_AES",
+        "keyBits":"128",
+        "mode":"TPM2_ALG_CFB"
+    },
+    "sym_block_size": 16,
+    "pcr_selection": [
+       { "hash": "TPM2_ALG_SHA1",
+         "pcrSelect": [ 9, 15 , 13]
+       },
+       { "hash": "TPM2_ALG_SHA256",
+         "pcrSelect": [ 8, 16, 14 ]
+       }
+    ],
+    "curveID": "TPM2_ECC_NIST_P256"
+}

diff --git a/dist/fapi-profiles/P_RSA2048SHA256.json b/dist/fapi-profiles/P_RSA2048SHA256.json
new file mode 100644
index 0000000..659ba1d
--- /dev/null
+++ b/dist/fapi-profiles/P_RSA2048SHA256.json

@@ -0,0 +1,42 @@
+{
+    "type": "TPM2_ALG_RSA",
+    "nameAlg":"TPM2_ALG_SHA256",
+    "srk_template": "system,restricted,decrypt",
+    "srk_persistent": 0,
+    "ek_template":  "system,restricted,decrypt",
+    "ecc_signing_scheme": {
+        "scheme":"TPM2_ALG_ECDSA",
+        "details":{
+            "hashAlg":"TPM2_ALG_SHA256"
+        },
+    },
+    "rsa_signing_scheme": {
+        "scheme":"TPM2_ALG_RSAPSS",
+        "details":{
+            "hashAlg":"TPM2_ALG_SHA256"
+        }
+    },
+    "rsa_decrypt_scheme": {
+        "scheme":"TPM2_ALG_OAEP",
+        "details":{
+            "hashAlg":"TPM2_ALG_SHA256"
+        }
+    },
+    "sym_mode":"TPM2_ALG_CFB",
+    "sym_parameters": {
+        "algorithm":"TPM2_ALG_AES",
+        "keyBits":"128",
+        "mode":"TPM2_ALG_CFB"
+    },
+    "sym_block_size": 16,
+    "pcr_selection": [
+        { "hash": "TPM2_ALG_SHA1",
+          "pcrSelect": [ 9, 15, 13 ]
+        },
+        { "hash": "TPM2_ALG_SHA256",
+          "pcrSelect": [ 8, 16, 14 ]
+        }
+    ],
+    "exponent": 0,
+    "keyBits": 2048
+}

diff --git a/dist/fapi-tmpfiles.conf.in b/dist/fapi-tmpfiles.conf.in
new file mode 100644
index 0000000..c49a874
--- /dev/null
+++ b/dist/fapi-tmpfiles.conf.in

@@ -0,0 +1,2 @@
+#Type   Path                                    Mode User Group Age         Argument
+d       @runstatedir@/tpm2-tss/eventlog/        775  tss  tss   -           -

diff --git a/dist/keep b/dist/keep
new file mode 100644
index 0000000..58293ad
--- /dev/null
+++ b/dist/keep

@@ -0,0 +1 @@
+Placeholder to create and keep directory

diff --git a/doc/doxygen.dox b/doc/doxygen.dox
index 8872b7b..a7b7c2c 100644
--- a/doc/doxygen.dox
+++ b/doc/doxygen.dox

@@ -1013,8 +1013,8 @@
 /*!
  \defgroup iesys_crypto Internal Cryptographic Backend
  \ingroup iesys
- The types and functions used internally be ESAPI for cryptographic operations.
- There may exist multiple implementations of these functions for different
+ The types and functions used internally by ESAPI for cryptographic operations.
+ Multiple implementations of these functions may exist for different
  cryptographic backends.
  \{
  \def IESYS_CRYPTO_CONTEXT_BLOB
@@ -1057,6 +1057,12 @@
 
 /*!
  \defgroup Testgroup Testing
+ Description of the test plan.
+*/
+
+/*!
+ \defgroup EsysTestgroup Esys-Testing
+ \ingroup Testgroup
  \{
  @brief \{
  For every integration test a function with a name corresponding to the name of the source code
@@ -1149,3 +1155,437 @@
  \}
  \}
 */
+
+/*!
+ \defgroup fapi Feature API
+ Feature API (FAPI) as described in the [TSS 2.0 Feature API (FAPI) Specification](https://trustedcomputinggroup.org/wp-content/uploads/todo.pdf).
+ This API provides a very abstract view on TPM functionalities most suitable for 80 percent of applications. In mostly uses standard types in its parameter list. Policies are encoded in JSON, whereas most key material is encoded as PEM.
+ Both the synchronous and asynchronous API are exposed through a single library: libtss2-fapi.
+ In order to perform an asynchronous invocation of FAPI functions, the following code serves as a template:
+ do { r = Fapi_GetPollHandles(fc, &ph, &nph);
+      if (r == TSS2_RC_SUCCESS) { poll(ph, nph, -1); Fapi_Free(ph); }
+      r = Fapi_*_Finish(fc, ...); } while (r == TSS2_FAPI_RC_TRY_AGAIN);
+ \{
+ \typedef FAPI_CONTEXT
+ Reference to the FAPI_CONTEXT that holds data for the connection to the TPM as
+ well as the metadata for TPM Resource as well as links to the key- and policy
+ store or key material for encrypted sessions.
+ \defgroup Fapi_Initialize Fapi_Initialize
+ FAPI functions to invoke Initialize either as one-call or in an asynchronous manner.
+ \{
+ \fn Fapi_Initialize(FAPI_CONTEXT **context, char const *uri)
+ \fn Fapi_Initialize_Async(FAPI_CONTEXT **context, char const *uri)
+ \fn Fapi_Initialize_Finish(FAPI_CONTEXT **context)
+ \}
+ \defgroup Fapi_Finalize Fapi_Finalize
+ FAPI function to invoke Finalize.
+ \{
+ \fn Fapi_Finalize(FAPI_CONTEXT **context)
+ \}
+ \defgroup Fapi_GetTcti Fapi_GetTcti
+ FAPI function to retrieve the TSS2_TCTI_CONTEXT currently used by the corresponding FAPI_CONTEXT.
+ \{
+ \fn Fapi_GetTcti(FAPI_CONTEXT *context, TSS2_TCTI_CONTEXT **tcti)
+ \}
+ \defgroup Fapi_GetPollHandles Fapi_GetPollHandles
+ FAPI function to retrieve the poll handles currently used by the corresponding FAPI_CONTEXT.
+ \{
+ \fn Fapi_GetPollHandles(FAPI_CONTEXT *context, FAPI_POLL_HANDLE **handles, size_t *num_handles)
+ \}
+ \defgroup Fapi_Free Fapi_Free
+ FAPI function to invoke Free.
+ \{
+ \fn Fapi_Free( \fn *ptr)
+ \}
+ \defgroup Fapi_GetInfo Fapi_GetInfo
+ FAPI functions to invoke GetInfo either as one-call or in an asynchronous manner.
+ \{
+ \fn Fapi_GetInfo(FAPI_CONTEXT *context, char **info)
+ \fn Fapi_GetInfo_Async(FAPI_CONTEXT *context)
+ \fn Fapi_GetInfo_Finish(FAPI_CONTEXT *context, char **info)
+ \}
+ \defgroup Fapi_Provision Fapi_Provision
+ FAPI functions to invoke Provision either as one-call or in an asynchronous manner.
+ \{
+ \fn Fapi_Provision(FAPI_CONTEXT *context, char const *policyPathEh, char const *authValueEh, char const *policyPathSh, char const *authValueSh, char const *authValueLockout)
+ \fn Fapi_Provision_Async(FAPI_CONTEXT *context, char const *policyPathEh, char const *authValueEh, char const *policyPathSh, char const *authValueSh, char const *authValueLockout)
+ \fn Fapi_Provision_Finish(FAPI_CONTEXT *context)
+ \}
+ \defgroup Fapi_GetPlatformCertificates Fapi_GetPlatformCertificates
+ FAPI functions to invoke GetPlatformCertificates either as one-call or in an asynchronous manner.
+ \{
+ \fn Fapi_GetPlatformCertificates(FAPI_CONTEXT *context, uint8_t **certificates, size_t *certificatesSize)
+ \fn Fapi_GetPlatformCertificates_Async(FAPI_CONTEXT *context)
+ \fn Fapi_GetPlatformCertificates_Finish(FAPI_CONTEXT *context, uint8_t **certificates, size_t *certificatesSize)
+ \}
+ \defgroup Fapi_GetRandom Fapi_GetRandom
+ FAPI functions to invoke GetRandom either as one-call or in an asynchronous manner.
+ \{
+ \fn Fapi_GetRandom(FAPI_CONTEXT *context, size_t numBytes, uint8_t **data)
+ \fn Fapi_GetRandom_Async(FAPI_CONTEXT *context, size_t numBytes)
+ \fn Fapi_GetRandom_Finish(FAPI_CONTEXT *context, uint8_t **data)
+ \}
+ \defgroup Fapi_Import Fapi_Import
+ FAPI functions to invoke Import either as one-call or in an asynchronous manner.
+ \{
+ \fn Fapi_Import(FAPI_CONTEXT *context, char const *path, char const *importData)
+ \fn Fapi_Import_Async(FAPI_CONTEXT *context, char const *path, char const *importData)
+ \fn Fapi_Import_Finish(FAPI_CONTEXT *context)
+ \}
+ \defgroup Fapi_List Fapi_List
+ FAPI functions to invoke List either as one-call or in an asynchronous manner.
+ \{
+ \fn Fapi_List(FAPI_CONTEXT *context, char const *searchPath, char **pathList)
+ \fn Fapi_List_Async(FAPI_CONTEXT *context, char const *searchPath)
+ \fn Fapi_List_Finish(FAPI_CONTEXT *context, char **pathlist)
+ \}
+ \defgroup Fapi_Delete Fapi_Delete
+ FAPI functions to invoke Delete either as one-call or in an asynchronous manner.
+ \{
+ \fn Fapi_Delete(FAPI_CONTEXT *context, char const *path)
+ \fn Fapi_Delete_Async(FAPI_CONTEXT *context, char const *path)
+ \fn Fapi_Delete_Finish(FAPI_CONTEXT *context)
+ \}
+ \defgroup Fapi_ChangeAuth Fapi_ChangeAuth
+ FAPI functions to invoke ChangeAuth either as one-call or in an asynchronous manner.
+ \{
+ \fn Fapi_ChangeAuth(FAPI_CONTEXT *context, char const *entityPath, char const *authValue)
+ \fn Fapi_ChangeAuth_Async(FAPI_CONTEXT *context, char const *entityPath, char const *authValue)
+ \fn Fapi_ChangeAuth_Finish(FAPI_CONTEXT *context)
+ \}
+ \defgroup Fapi_SetDescription Fapi_SetDescription
+ FAPI functions to invoke SetDescription either as one-call or in an asynchronous manner.
+ \{
+ \fn Fapi_SetDescription(FAPI_CONTEXT *context, char const *path, char const *description)
+ \fn Fapi_SetDescription_Async(FAPI_CONTEXT *context, char const *path, char const *description)
+ \fn Fapi_SetDescription_Finish(FAPI_CONTEXT *context)
+ \}
+ \defgroup Fapi_GetDescription Fapi_GetDescription
+ FAPI functions to invoke GetDescription either as one-call or in an asynchronous manner.
+ \{
+ \fn Fapi_GetDescription(FAPI_CONTEXT *context, char const *path, char **description)
+ \fn Fapi_GetDescription_Async(FAPI_CONTEXT *context, char const *path)
+ \fn Fapi_GetDescription_Finish(FAPI_CONTEXT *context, char **description)
+ \}
+ \defgroup Fapi_SetAppData Fapi_SetAppData
+ FAPI functions to invoke SetAppData either as one-call or in an asynchronous manner.
+ \{
+ \fn Fapi_SetAppData(FAPI_CONTEXT *context, char const *path, uint8_t const *appData, size_t appDataSize)
+ \fn Fapi_SetAppData_Async(FAPI_CONTEXT *context, char const *path, uint8_t const *appData, size_t appDataSize)
+ \fn Fapi_SetAppData_Finish(FAPI_CONTEXT *context)
+ \}
+ \defgroup Fapi_GetAppData Fapi_GetAppData
+ FAPI functions to invoke GetAppData either as one-call or in an asynchronous manner.
+ \{
+ \fn Fapi_GetAppData(FAPI_CONTEXT *context, char const *path, uint8_t **appData, size_t *appDataSize)
+ \fn Fapi_GetAppData_Async(FAPI_CONTEXT *context, char const *path)
+ \fn Fapi_GetAppData_Finish(FAPI_CONTEXT *context, uint8_t **appData, size_t *appDataSize)
+ \}
+ \defgroup Fapi_GetTpmBlobs Fapi_GetTpmBlobs
+ FAPI functions to invoke GetTPMBlobs either as one-call or in an asynchronous manner.
+ \{
+ \fn Fapi_GetTpmBlobs(FAPI_CONTEXT *context, char const *path, uint8_t **tpm2bPublic, size_t *tpm2bPublicSize, uint8_t **tpm2bPrivate, size_t *tpm2bPrivateSize, char **policy)
+ \fn Fapi_GetTpmBlobs_Async(FAPI_CONTEXT *context, char const *path)
+ \fn Fapi_GetTpmBlobs_Finish(FAPI_CONTEXT *context, uint8_t **tpm2bPublic, size_t *tpm2bPublicSize, uint8_t **tpm2bPrivate, size_t *tpm2bPrivateSize, char **policy)
+ \}
+ \defgroup Fapi_CreateKey Fapi_CreateKey
+ FAPI functions to invoke CreateKey either as one-call or in an asynchronous manner.
+ \{
+ \fn Fapi_CreateKey(FAPI_CONTEXT *context, char const *path, char const *type, char const *policyPath, char const *authvalue)
+ \fn Fapi_CreateKey_Async(FAPI_CONTEXT *context, char const *keyPath, char const *type, char const *policyPath, char const *authvalue)
+ \fn Fapi_CreateKey_Finish(FAPI_CONTEXT *context)
+ \}
+ \defgroup Fapi_Sign Fapi_Sign
+ FAPI functions to invoke Sign either as one-call or in an asynchronous manner.
+ \{
+ \fn Fapi_Sign(FAPI_CONTEXT *context, char const *keyPath, char const *padding, uint8_t const *digest, size_t digestSize, uint8_t **signature, size_t *signatureSize, char **publicKey, char **certificate)
+ \fn Fapi_Sign_Async(FAPI_CONTEXT *context, char const *keyPath, char const *padding, uint8_t const *digest, size_t digestSize)
+ \fn Fapi_Sign_Finish(FAPI_CONTEXT *context, uint8_t **signature, size_t *signatureSize, char **publicKey, char **certificate)
+ \}
+ \defgroup Fapi_VerifySignature Fapi_VerifySignature
+ FAPI functions to invoke VerifySignature either as one-call or in an asynchronous manner.
+ \{
+ \fn Fapi_VerifySignature(FAPI_CONTEXT *context, char const *keyPath, uint8_t const *digest, size_t digestSize, uint8_t const *signature, size_t signatureSize)
+ \fn Fapi_VerifySignature_Async(FAPI_CONTEXT *context, char const *keyPath, uint8_t const *digest, size_t digestSize, uint8_t const *signature, size_t signatureSize)
+ \fn Fapi_VerifySignature_Finish(FAPI_CONTEXT *context)
+ \}
+ \defgroup Fapi_Encrypt Fapi_Encrypt
+ FAPI functions to invoke Encrypt either as one-call or in an asynchronous manner.
+ \{
+ \fn Fapi_Encrypt(FAPI_CONTEXT *context, char const *keyPath, char const *policyPath, uint8_t const *plaintext, size_t plaintextSize, char **cipherText)
+ \fn Fapi_Encrypt_Async(FAPI_CONTEXT *context, char const *keyPath, char const *policyPath, uint8_t const *plaintext, size_t plaintextSize)
+ \fn Fapi_Encrypt_Finish(FAPI_CONTEXT *context, char **cipherText)
+ \}
+ \defgroup Fapi_Decrypt Fapi_Decrypt
+ FAPI functions to invoke Decrypt either as one-call or in an asynchronous manner.
+ \{
+ \fn Fapi_Decrypt(FAPI_CONTEXT *context, char const *cipherText, uint8_t **plainText, size_t *plainTextSize)
+ \fn Fapi_Decrypt_Async(FAPI_CONTEXT *context, char const *cipherText)
+ \fn Fapi_Decrypt_Finish(FAPI_CONTEXT *context, uint8_t **plainText, size_t *plainTextSize)
+ \}
+ \defgroup Fapi_SetCertificate Fapi_SetCertificate
+ FAPI functions to invoke SetCertificate either as one-call or in an asynchronous manner.
+ \{
+ \fn Fapi_SetCertificate(FAPI_CONTEXT *context, char const *path, char const *x509certData)
+ \fn Fapi_SetCertificate_Async(FAPI_CONTEXT *context, char const *path, char const *x509certData)
+ \fn Fapi_SetCertificate_Finish(FAPI_CONTEXT *context)
+ \}
+ \defgroup Fapi_GetCertificate Fapi_GetCertificate
+ FAPI functions to invoke GetCertificate either as one-call or in an asynchronous manner.
+ \{
+ \fn Fapi_GetCertificate(FAPI_CONTEXT *context, char const *path, char **x509certData)
+ \fn Fapi_GetCertificate_Async(FAPI_CONTEXT *context, char const *path)
+ \fn Fapi_GetCertificate_Finish(FAPI_CONTEXT *context, char **x509certData)
+ \}
+ \defgroup Fapi_ExportKey Fapi_ExportKey
+ FAPI functions to invoke ExportKey either as one-call or in an asynchronous manner.
+ \{
+ \fn Fapi_ExportKey(FAPI_CONTEXT *context, char const *pathOfKeyToDuplicate, char const *pathToPublicKeyOfNewParent, char **exportedData)
+ \fn Fapi_ExportKey_Async(FAPI_CONTEXT *context, char const *pathOfKeyToDuplicate, char const *pathToPublicKeyOfNewParent)
+ \fn Fapi_ExportKey_Finish(FAPI_CONTEXT *context, char **exportedData)
+ \}
+ \defgroup Fapi_CreateSeal Fapi_CreateSeal
+ FAPI functions to invoke CreateSeal either as one-call or in an asynchronous manner.
+ \{
+ \fn Fapi_CreateSeal(FAPI_CONTEXT *context, char const *path, char const *type, size_t size, char const *policyPath, char const *authValue, uint8_t const *data)
+ \fn Fapi_CreateSeal_Async(FAPI_CONTEXT *context, char const *path, char const *type, size_t size, char const *policyPath, char const *authValue, uint8_t const *data)
+ \fn Fapi_CreateSeal_Finish(FAPI_CONTEXT *context)
+ \}
+ \defgroup Fapi_Unseal Fapi_Unseal
+ FAPI functions to invoke Unseal either as one-call or in an asynchronous manner.
+ \{
+ \fn Fapi_Unseal(FAPI_CONTEXT *context, char const *path, uint8_t **data, size_t *size)
+ \fn Fapi_Unseal_Async(FAPI_CONTEXT *context, char const *path)
+ \fn Fapi_Unseal_Finish(FAPI_CONTEXT *context, uint8_t **data, size_t *size)
+ \}
+ \defgroup Fapi_ExportPolicy Fapi_ExportPolicy
+ FAPI functions to invoke ExportPolicy either as one-call or in an asynchronous manner.
+ \{
+ \fn Fapi_ExportPolicy(FAPI_CONTEXT *context, char const *path, char **jsonPolicy)
+ \fn Fapi_ExportPolicy_Async(FAPI_CONTEXT *context, char const *path)
+ \fn Fapi_ExportPolicy_Finish(FAPI_CONTEXT *context, char **jsonPolicy)
+ \}
+ \defgroup Fapi_AuthorizePolicy Fapi_AuthorizePolicy
+ FAPI functions to invoke AuthorizePolicy either as one-call or in an asynchronous manner.
+ \{
+ \fn Fapi_AuthorizePolicy(FAPI_CONTEXT *context, char const *policyPath, char const *keyPath, uint8_t const *policyRef, size_t policyRefSize)
+ \fn Fapi_AuthorizePolicy_Async(FAPI_CONTEXT *context, char const *policyPath, char const *keyPath, uint8_t const *policyRef, size_t policyRefSize)
+ \fn Fapi_AuthorizePolicy_Finish(FAPI_CONTEXT *context)
+ \}
+ \defgroup Fapi_WriteAuthorizeNv Fapi_WriteAuthorizeNv
+ FAPI functions to invoke WriteAuthorizeNv either as one-call or in an asynchronous manner.
+ \{
+ \fn Fapi_WriteAuthorizeNv(FAPI_CONTEXT *context, char const *nvPath, char const *policyPath)
+ \fn Fapi_WriteAuthorizeNv_Async(FAPI_CONTEXT *context, char const *nvPath, char const *policyPath)
+ \fn Fapi_WriteAuthorizeNv_Finish(FAPI_CONTEXT *context)
+ \}
+ \defgroup Fapi_PcrRead Fapi_PcrRead
+ FAPI functions to invoke PcrRead either as one-call or in an asynchronous manner.
+ \{
+ \fn Fapi_PcrRead(FAPI_CONTEXT *context, uint32_t pcrIndex, uint8_t **pcrValue, size_t *pcrValueSize, char **pcrLog)
+ \fn Fapi_PcrRead_Async(FAPI_CONTEXT *context, uint32_t pcrIndex)
+ \fn Fapi_PcrRead_Finish(FAPI_CONTEXT *context, uint8_t **pcrValue, size_t *pcrValueSize, char **pcrLog)
+ \}
+ \defgroup Fapi_PcrExtend Fapi_PcrExtend
+ FAPI functions to invoke PcrExtend either as one-call or in an asynchronous manner.
+ \{
+ \fn Fapi_PcrExtend(FAPI_CONTEXT *context, uint32_t pcr, uint8_t const *data, size_t dataSize, char const *logData)
+ \fn Fapi_PcrExtend_Async(FAPI_CONTEXT *context, uint32_t pcr, uint8_t const *data, size_t dataSize, char const *logData)
+ \fn Fapi_PcrExtend_Finish(FAPI_CONTEXT *context)
+ \}
+ \defgroup Fapi_Quote Fapi_Quote
+ FAPI functions to invoke Quote either as one-call or in an asynchronous manner.
+ \{
+ \fn Fapi_Quote(FAPI_CONTEXT *context, uint32_t *pcrList, size_t pcrListSize, char const *keyPath, char const *quoteType, uint8_t const *qualifyingData, size_t qualifyingDataSize, char **quoteInfo, uint8_t **signature, size_t *signatureSize, char **pcrLog, char **certificate)
+ \fn Fapi_Quote_Async(FAPI_CONTEXT *context, uint32_t *pcrList, size_t pcrListSize, char const *keyPath, char const *quoteType, uint8_t const *qualifyingData, size_t qualifyingDataSize)
+ \fn Fapi_Quote_Finish(FAPI_CONTEXT *context, char **quoteInfo, uint8_t **signature, size_t *signatureSize, char **pcrLog, char **certificate)
+ \}
+ \defgroup Fapi_VerifyQuote Fapi_VerifyQuote
+ FAPI functions to invoke VerifyQuote either as one-call or in an asynchronous manner.
+ \{
+ \fn Fapi_VerifyQuote(FAPI_CONTEXT *context, char const *publicKeyPath, uint8_t const *qualifyingData, size_t qualifyingDataSize, char const *quoteInfo, uint8_t const *signature, size_t signatureSize, char const *pcrLog)
+ \fn Fapi_VerifyQuote_Async(FAPI_CONTEXT *context, char const *publicKeyPath, uint8_t const *qualifyingData, size_t qualifyingDataSize, char const *quoteInfo, uint8_t const *signature, size_t signatureSize, char const *pcrLog)
+ \fn Fapi_VerifyQuote_Finish(FAPI_CONTEXT *context)
+ \}
+ \defgroup Fapi_CreateNv Fapi_CreateNv
+ FAPI functions to invoke CreateNv either as one-call or in an asynchronous manner.
+ \{
+ \fn Fapi_CreateNv(FAPI_CONTEXT *context, char const *path, char const *type, size_t size, char const *policyPath, char const *authValue)
+ \fn Fapi_CreateNv_Async(FAPI_CONTEXT *context, char const *path, char const *type, size_t size, char const *policyPath, char const *authValue)
+ \fn Fapi_CreateNv_Finish(FAPI_CONTEXT *context)
+ \}
+ \defgroup Fapi_NvRead Fapi_NvRead
+ FAPI functions to invoke NvRead either as one-call or in an asynchronous manner.
+ \{
+ \fn Fapi_NvRead(FAPI_CONTEXT *context, char const *path, uint8_t **data, size_t *size)
+ \fn Fapi_NvRead_Async(FAPI_CONTEXT *context, char const *path)
+ \fn Fapi_NvRead_Finish(FAPI_CONTEXT *context, uint8_t **data, size_t *size)
+ \}
+ \defgroup Fapi_NvWrite Fapi_NvWrite
+ FAPI functions to invoke NvWrite either as one-call or in an asynchronous manner.
+ \{
+ \fn Fapi_NvWrite(FAPI_CONTEXT *context, char const *path, uint8_t const *data, size_t size)
+ \fn Fapi_NvWrite_Async(FAPI_CONTEXT *context, char const *path, uint8_t const *data, size_t size)
+ \fn Fapi_NvWrite_Finish(FAPI_CONTEXT *context)
+ \}
+ \defgroup Fapi_NvExtend Fapi_NvExtend
+ FAPI functions to invoke NvExtend either as one-call or in an asynchronous manner.
+ \{
+ \fn Fapi_NvExtend(FAPI_CONTEXT *context, char const *path, uint8_t const *data, size_t size)
+ \fn Fapi_NvExtend_Async(FAPI_CONTEXT *context, char const *path, uint8_t const *data, size_t size)
+ \fn Fapi_NvExtend_Finish(FAPI_CONTEXT *context)
+ \}
+ \defgroup Fapi_NvIncrement Fapi_NvIncrement
+ FAPI functions to invoke NvIncrement either as one-call or in an asynchronous manner.
+ \{
+ \fn Fapi_NvIncrement(FAPI_CONTEXT *context, char const *path)
+ \fn Fapi_NvIncrement_Async(FAPI_CONTEXT *context, char const *path)
+ \fn Fapi_NvIncrement_Finish(FAPI_CONTEXT *context)
+ \}
+ \defgroup Fapi_NvSetBits Fapi_NvSetBits
+ FAPI functions to invoke NvSetBits either as one-call or in an asynchronous manner.
+ \{
+ \fn Fapi_NvSetBits(FAPI_CONTEXT *context, char const *path, uint64_t bitmap)
+ \fn Fapi_NvSetBits_Async(FAPI_CONTEXT *context, char const *path, uint64_t bitmap)
+ \fn Fapi_NvSetBits_Finish(FAPI_CONTEXT *context)
+ \}
+ \defgroup Fapi_SetAuthCB Fapi_SetAuthCB
+ FAPI functions to invoke SetAuthCB.
+ \{
+ \fn Fapi_SetAuthCB(FAPI_CONTEXT *context, Fapi_CB_Auth callback,  \fn *userData)
+ \typedef (*Fapi_CB_Auth)(FAPI_CONTEXT *context, char const *description, char **auth,  \fn *userData)
+ \}
+ \defgroup Fapi_SetBranchCB Fapi_SetBranchCB
+ FAPI functions to invoke SetBranchCB.
+ \{
+ \fn Fapi_SetBranchCB(FAPI_CONTEXT *context, Fapi_CB_Branch callback,  \fn *userData)
+ \typedef (*Fapi_CB_Branch)(FAPI_CONTEXT *context, char const *description, char const **branchNames, size_t numBranches, size_t *selectedBranch,  \fn *userData)
+ \}
+ \defgroup Fapi_SetSignCB Fapi_SetSignCB
+ FAPI functions to invoke SetSignCB.
+ \{
+ \fn Fapi_SetSignCB(FAPI_CONTEXT *context, Fapi_CB_Sign callback,  \fn *userData)
+ \typedef (*Fapi_CB_Sign)(FAPI_CONTEXT *context, char const *description, char const *publicKey, char const *publicKeyHint, uint32_t hashAlg, uint8_t const *dataToSign, size_t dataToSignSize, uint8_t **signature, size_t *signatureSize,  \fn *userData)
+ \}
+ \}
+*/
+
+/*!
+ \defgroup ifapi Internals of Feature API
+ \ingroup fapi
+ This module holds internal APIs of the FAPI implementation.
+
+ Async programming style:
+
+ The tss2-fapi implementation uses an asynchronous programming style internally.
+ This means that whenever a piece of code performs a potentially blocking operation
+ it will instead return TSS2_FAPI_RC_TRY_AGAIN (similarly to ESAPI). Then this function
+ is called again once the Poll returns ok.
+ In order to carry the state of execution information over between the different invocation
+ of the same function, the current state is stored in a state variable and all variables
+ are stored in some kind of context variables.
+ On the next entry to the function the state is evaluated using a swtich() statement and
+ execution is resumed.
+
+ In order to understand the functional flow of code in FAPI, one can read the functions
+ continuously over all fallthrough; and statecase(); statements. The statecase
+ statements are the re-entry points of each function. The return_try_again() and FAPI_SYNC()
+ statements are the preempt statements.
+ \{
+ \}
+*/
+
+/*!
+ \defgroup fapi_crypto Internal Cryptographic Backend
+ \ingroup ifapi
+ The types and functions used internally by FAPI for cryptographic operations.
+ Multiple implementations of these functions for different
+ cryptographic backends may exist.
+ \{
+ \def IFAPI_CRYPTO_CONTEXT_BLOB
+ \fn TPMI_ALG_HASH ifapi_get_sig_hash_alg(const IFAPI_KEY_PROFILE *profile,
+    TPMT_PUBLIC *tpmPublic)
+ \fn TPMI_ALG_HASH ifapi_get_sig_hash_alg(const IFAPI_KEY_PROFILE *profile,
+    TPMT_PUBLIC *tpmPublic)
+ \fn TSS2_RC ifapi_get_profile_sig_scheme(const IFAPI_KEY_PROFILE *profile,
+    const TPMT_PUBLIC *tpmPublic, TPMT_SIG_SCHEME *signatureScheme)
+ \fn TSS2_RC ifapi_der_sig_to_tpm(const TPMT_PUBLIC *tpmPublic,
+    const unsigned char *signature, size_t signatureSize,
+    TPMI_ALG_HASH hashAlgorithm, TPMT_SIGNATURE *tpmSignature)
+ \fn TSS2_RC ifapi_tpm_ecc_sig_to_der(const TPMT_SIGNATURE *tpmSignature,
+    uint8_t **signature, size_t *signatureSize)
+ \fn TSS2_RC ifapi_pub_pem_key_from_tpm(const TPM2B_PUBLIC *tpmPublicKey,
+    char **pemKey, int *pemKeySize)
+ \fn TSS2_RC ifapi_verify_signature(const IFAPI_OBJECT *keyObject,
+    const uint8_t *signature, size_t signatureSize, const uint8_t *digest,
+    size_t digestSize)
+ \fn TSS2_RC ifapi_verify_signature_quote(const IFAPI_OBJECT *keyObject,
+    const uint8_t *signature, size_t signatureSize, const uint8_t *digest,
+    size_t digestSize, const TPMT_SIG_SCHEME *signatureScheme)
+ \fn TSS2_RC ifapi_crypto_hash_start(IFAPI_CRYPTO_CONTEXT_BLOB **context,
+    TPM2_ALG_ID hashAlgorithm)
+ \fn TSS2_RC ifapi_crypto_hash_update(IFAPI_CRYPTO_CONTEXT_BLOB *context,
+    const uint8_t *buffer, size_t size)
+ \fn TSS2_RC ifapi_crypto_hash_finish(IFAPI_CRYPTO_CONTEXT_BLOB **context,
+    uint8_t *digest, size_t *digestSize);
+ \fn void ifapi_crypto_hash_abort(IFAPI_CRYPTO_CONTEXT_BLOB **context)
+ \fn TSS2_RC ifapi_cert_to_pem(const uint8_t *certBuffer, size_t certBufferSize,
+    char **pemCert, TPM2_ALG_ID *certAlgorithmId)
+ \fn size_t ifapi_hash_get_digest_size(TPM2_ALG_ID hashAlgorithm)
+ \fn TSS2_RC ifapi_get_tpm2b_public_from_pem(const IFAPI_KEY_PROFILE *profile,
+    const char *pemKey, TPM2B_PUBLIC *tpmPublic)
+ \fn TSS2_RC ifapi_crypto_aes_encrypt(const uint8_t *key, size_t keySize,
+    const uint8_t *iv, uint8_t *buffer, size_t bufferSize)
+ \fn TSS2_RC ifapi_crypto_aes_decrypt(const uint8_t *key, size_t keySize,
+    const uint8_t *iv, uint8_t *buffer, size_t bufferSize)
+ \fn TSS2_RC ifapi_get_hash_alg_for_size(uint16_t size, TPMI_ALG_HASH *hashAlgorithm)
+ \fn TPM2_ALG_ID ifapi_get_signature_algorithm_from_pem(const char *pemKey)
+\}
+*/
+
+/*!
+ \defgroup ifapi_config FAPI configuration module
+ \ingroup ifapi
+ Provides functions and types for the FAPI configuration and its initialization
+ \{
+  \def IFAPI_CONFIG
+  \fn TSS2_RC ifapi_config_initialize_async(IFAPI_IO *io)
+  \fn TSS2_RC ifapi_config_initialize_finish(IFAPI_IO *io, IFAPI_CONFIG *config)
+ \}
+*/
+
+/*!
+ \defgroup FapiTestgroup Fapi-Testing
+ Testing of FAPI functionality. The tested FAPI functions are listed in each
+ of the testcase functions' descriptions.
+ \ingroup Testgroup
+ \{
+ \fn test_fapi_info(FAPI_CONTEXT *context)
+ \fn test_fapi_data_crypt_rsa(FAPI_CONTEXT *context)
+ \fn test_fapi_duplicate(FAPI_CONTEXT *context)
+ \fn test_fapi_change_key_auth(FAPI_CONTEXT *context)
+ \fn test_fapi_key_create_policy_signed(FAPI_CONTEXT *context)
+ \fn test_fapi_key_create_sign_password_provision(FAPI_CONTEXT *context)
+ \fn test_fapi_key_create_ecc(FAPI_CONTEXT *context)
+ \fn test_fapi_nv_ordinary(FAPI_CONTEXT *context)
+ \fn test_fapi_quote(FAPI_CONTEXT *context)
+ \fn test_fapi_key_create_policy_authorize_sign(FAPI_CONTEXT *context)
+ \fn test_fapi_policy_authorize_nv(FAPI_CONTEXT *context)
+ \fn test_fapi_nv_set_bits(FAPI_CONTEXT *context)
+ \fn test_fapi_policy_secret(FAPI_CONTEXT *context)
+ \fn test_fapi_nv_written(FAPI_CONTEXT *context)
+ \fn test_fapi_nv_increment(FAPI_CONTEXT *context)
+ \fn test_fapi_get_random(FAPI_CONTEXT *context)
+ \fn test_fapi_pcr_test(FAPI_CONTEXT *context)
+ \fn test_fapi_policy_password(FAPI_CONTEXT *context)
+ \fn test_fapi_key_create_policy_or_sign(FAPI_CONTEXT *context)
+ \fn test_fapi_key_create_policy_nv_sign(FAPI_CONTEXT *context)
+ \fn test_fapi_nv_extend(FAPI_CONTEXT *context)
+ \fn test_fapi_ext_public_key(FAPI_CONTEXT *context)
+ \fn test_fapi_get_platform_certificates(FAPI_CONTEXT *context)
+ \fn test_fapi_seal(FAPI_CONTEXT *context)
+ \fn test_fapi_key_create_sign_policy_provision(FAPI_CONTEXT *context)
+ \fn test_fapi_key_create(FAPI_CONTEXT *context)
+ \fn test_fapi_key_create_policy_pcr_sign(FAPI_CONTEXT *context)
+ \}
+*/

diff --git a/include/tss2/tss2_common.h b/include/tss2/tss2_common.h
index 587866d..9206ba2 100644
--- a/include/tss2/tss2_common.h
+++ b/include/tss2/tss2_common.h

@@ -95,6 +95,30 @@
 #define TSS2_BASE_RC_MULTIPLE_DECRYPT_SESSIONS 25U /* More than one session with TPMA_SESSION_DECRYPT bit set */
 #define TSS2_BASE_RC_MULTIPLE_ENCRYPT_SESSIONS 26U /* More than one session with TPMA_SESSION_ENCRYPT bit set */
 #define TSS2_BASE_RC_RSP_AUTH_FAILED           27U /* Response HMAC from TPM did not verify */
+#define TSS2_BASE_RC_NO_CONFIG                 28U
+#define TSS2_BASE_RC_BAD_PATH                  29U
+#define TSS2_BASE_RC_NOT_DELETABLE             30U
+#define TSS2_BASE_RC_PATH_ALREADY_EXISTS       31U
+#define TSS2_BASE_RC_KEY_NOT_FOUND             32U
+#define TSS2_BASE_RC_SIGNATURE_VERIFICATION_FAILED 33U
+#define TSS2_BASE_RC_HASH_MISMATCH             34U
+#define TSS2_BASE_RC_KEY_NOT_DUPLICABLE        35U
+#define TSS2_BASE_RC_PATH_NOT_FOUND            36U
+#define TSS2_BASE_RC_NO_CERT                   37U
+#define TSS2_BASE_RC_NO_PCR                    38U
+#define TSS2_BASE_RC_PCR_NOT_RESETTABLE        39U
+#define TSS2_BASE_RC_BAD_TEMPLATE              40U
+#define TSS2_BASE_RC_AUTHORIZATION_FAILED      41U
+#define TSS2_BASE_RC_AUTHORIZATION_UNKNOWN     42U
+#define TSS2_BASE_RC_NV_NOT_READABLE           43U
+#define TSS2_BASE_RC_NV_TOO_SMALL              44U
+#define TSS2_BASE_RC_NV_NOT_WRITEABLE          45U
+#define TSS2_BASE_RC_POLICY_UNKNOWN            46U
+#define TSS2_BASE_RC_NV_WRONG_TYPE             47U
+#define TSS2_BASE_RC_NAME_ALREADY_EXISTS       48U
+#define TSS2_BASE_RC_NO_TPM                    49U
+#define TSS2_BASE_RC_BAD_KEY                   50U
+#define TSS2_BASE_RC_NO_HANDLE                 51U
 
 /* Base return codes in the range 0xf800 - 0xffff are reserved for
  * implementation-specific purposes.
@@ -228,4 +252,76 @@
 #define TSS2_ESYS_RC_RSP_AUTH_FAILED             ((TSS2_RC)(TSS2_ESAPI_RC_LAYER | \
                                                         TSS2_BASE_RC_RSP_AUTH_FAILED))
 
+/* FAPI Error Codes */
+
+#define TSS2_FAPI_RC_GENERAL_FAILURE             ((TSS2_RC)(TSS2_FEATURE_RC_LAYER | \
+                                                      TSS2_BASE_RC_GENERAL_FAILURE))
+#define TSS2_FAPI_RC_NOT_IMPLEMENTED             ((TSS2_RC)(TSS2_FEATURE_RC_LAYER | \
+                                                      TSS2_BASE_RC_NOT_IMPLEMENTED))
+#define TSS2_FAPI_RC_BAD_REFERENCE               ((TSS2_RC)(TSS2_FEATURE_RC_LAYER | \
+                                                      TSS2_BASE_RC_BAD_REFERENCE))
+#define TSS2_FAPI_RC_BAD_SEQUENCE                ((TSS2_RC)(TSS2_FEATURE_RC_LAYER | \
+                                                      TSS2_BASE_RC_BAD_SEQUENCE))
+#define TSS2_FAPI_RC_IO_ERROR                    ((TSS2_RC)(TSS2_FEATURE_RC_LAYER | \
+                                                      TSS2_BASE_RC_IO_ERROR))
+#define TSS2_FAPI_RC_BAD_VALUE                   ((TSS2_RC)(TSS2_FEATURE_RC_LAYER | \
+                                                      TSS2_BASE_RC_BAD_VALUE))
+#define TSS2_FAPI_RC_NO_DECRYPT_PARAM            ((TSS2_RC)(TSS2_FEATURE_RC_LAYER | \
+                                                      TSS2_BASE_RC_NO_DECRYPT_PARAM))
+#define TSS2_FAPI_RC_NO_ENCRYPT_PARAM            ((TSS2_RC)(TSS2_FEATURE_RC_LAYER | \
+                                                      TSS2_BASE_RC_NO_ENCRYPT_PARAM))
+#define TSS2_FAPI_RC_MEMORY                      ((TSS2_RC)(TSS2_FEATURE_RC_LAYER | \
+                                                      TSS2_BASE_RC_MEMORY))
+#define TSS2_FAPI_RC_BAD_CONTEXT                 ((TSS2_RC)(TSS2_FEATURE_RC_LAYER | \
+                                                        TSS2_BASE_RC_BAD_CONTEXT))
+#define TSS2_FAPI_RC_NO_CONFIG                   ((TSS2_RC)(TSS2_FEATURE_RC_LAYER | \
+                                                        TSS2_BASE_RC_NO_CONFIG))
+#define TSS2_FAPI_RC_BAD_PATH                    ((TSS2_RC)(TSS2_FEATURE_RC_LAYER | \
+                                                        TSS2_BASE_RC_BAD_PATH))
+#define TSS2_FAPI_RC_NOT_DELETABLE               ((TSS2_RC)(TSS2_FEATURE_RC_LAYER | \
+                                                        TSS2_BASE_RC_NOT_DELETABLE))
+#define TSS2_FAPI_RC_PATH_ALREADY_EXISTS         ((TSS2_RC)(TSS2_FEATURE_RC_LAYER | \
+                                                        TSS2_BASE_RC_PATH_ALREADY_EXISTS))
+#define TSS2_FAPI_RC_KEY_NOT_FOUND               ((TSS2_RC)(TSS2_FEATURE_RC_LAYER | \
+                                                        TSS2_BASE_RC_KEY_NOT_FOUND))
+#define TSS2_FAPI_RC_SIGNATURE_VERIFICATION_FAILED ((TSS2_RC)(TSS2_FEATURE_RC_LAYER | \
+                                                        TSS2_BASE_RC_SIGNATURE_VERIFICATION_FAILED))
+#define TSS2_FAPI_RC_HASH_MISMATCH               ((TSS2_RC)(TSS2_FEATURE_RC_LAYER | \
+                                                        TSS2_BASE_RC_HASH_MISMATCH))
+#define TSS2_FAPI_RC_KEY_NOT_DUPLICABLE          ((TSS2_RC)(TSS2_FEATURE_RC_LAYER | \
+                                                        TSS2_BASE_RC_KEY_NOT_DUPLICABLE))
+#define TSS2_FAPI_RC_PATH_NOT_FOUND              ((TSS2_RC)(TSS2_FEATURE_RC_LAYER | \
+                                                        TSS2_BASE_RC_PATH_NOT_FOUND))
+#define TSS2_FAPI_RC_NO_CERT                     ((TSS2_RC)(TSS2_FEATURE_RC_LAYER | \
+                                                        TSS2_BASE_RC_NO_CERT))
+#define TSS2_FAPI_RC_NO_PCR                      ((TSS2_RC)(TSS2_FEATURE_RC_LAYER | \
+                                                        TSS2_BASE_RC_NO_PCR))
+#define TSS2_FAPI_RC_PCR_NOT_RESETTABLE          ((TSS2_RC)(TSS2_FEATURE_RC_LAYER | \
+                                                        TSS2_BASE_RC_PCR_NOT_RESETTABLE))
+#define TSS2_FAPI_RC_BAD_TEMPLATE                ((TSS2_RC)(TSS2_FEATURE_RC_LAYER | \
+                                                        TSS2_BASE_RC_BAD_TEMPLATE))
+#define TSS2_FAPI_RC_AUTHORIZATION_FAILED        ((TSS2_RC)(TSS2_FEATURE_RC_LAYER | \
+                                                        TSS2_BASE_RC_AUTHORIZATION_FAILED))
+#define TSS2_FAPI_RC_AUTHORIZATION_UNKNOWN       ((TSS2_RC)(TSS2_FEATURE_RC_LAYER | \
+                                                        TSS2_BASE_RC_AUTHORIZATION_UNKNOWN))
+#define TSS2_FAPI_RC_NV_NOT_READABLE             ((TSS2_RC)(TSS2_FEATURE_RC_LAYER | \
+                                                        TSS2_BASE_RC_NV_NOT_READABLE))
+#define TSS2_FAPI_RC_NV_TOO_SMALL                ((TSS2_RC)(TSS2_FEATURE_RC_LAYER | \
+                                                        TSS2_BASE_RC_NV_TOO_SMALL))
+#define TSS2_FAPI_RC_NV_NOT_WRITEABLE            ((TSS2_RC)(TSS2_FEATURE_RC_LAYER | \
+                                                        TSS2_BASE_RC_NV_NOT_WRITEABLE))
+#define TSS2_FAPI_RC_POLICY_UNKNOWN              ((TSS2_RC)(TSS2_FEATURE_RC_LAYER | \
+                                                        TSS2_BASE_RC_POLICY_UNKNOWN))
+#define TSS2_FAPI_RC_NV_WRONG_TYPE               ((TSS2_RC)(TSS2_FEATURE_RC_LAYER | \
+                                                        TSS2_BASE_RC_NV_WRONG_TYPE))
+#define TSS2_FAPI_RC_NAME_ALREADY_EXISTS         ((TSS2_RC)(TSS2_FEATURE_RC_LAYER | \
+                                                        TSS2_BASE_RC_NAME_ALREADY_EXISTS))
+#define TSS2_FAPI_RC_NO_TPM                      ((TSS2_RC)(TSS2_FEATURE_RC_LAYER | \
+                                                        TSS2_BASE_RC_NO_TPM))
+#define TSS2_FAPI_RC_TRY_AGAIN                   ((TSS2_RC)(TSS2_FEATURE_RC_LAYER | \
+                                                        TSS2_BASE_RC_TRY_AGAIN))
+#define TSS2_FAPI_RC_BAD_KEY                     ((TSS2_RC)(TSS2_FEATURE_RC_LAYER | \
+                                                        TSS2_BASE_RC_BAD_KEY))
+#define TSS2_FAPI_RC_NO_HANDLE                   ((TSS2_RC)(TSS2_FEATURE_RC_LAYER | \
+                                                        TSS2_BASE_RC_NO_HANDLE))
 #endif /* TSS2_COMMON_H */

diff --git a/include/tss2/tss2_fapi.h b/include/tss2/tss2_fapi.h
new file mode 100644
index 0000000..c706f6e
--- /dev/null
+++ b/include/tss2/tss2_fapi.h

@@ -0,0 +1,706 @@
+/* SPDX-License-Identifier: BSD-2-Clause */
+/*******************************************************************************
+ * Copyright 2017-2018, Fraunhofer SIT sponsored by Infineon Technologies AG
+ * All rights reserved.
+ *******************************************************************************/
+#ifndef TSS2_FAPI_H
+#define TSS2_FAPI_H
+
+#include "tss2_tcti.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/* Type definitions */
+
+typedef struct FAPI_CONTEXT FAPI_CONTEXT;
+
+/* Context functions */
+
+TSS2_RC Fapi_Initialize(
+    FAPI_CONTEXT  **context,
+    char     const *uri);
+
+TSS2_RC Fapi_Initialize_Async(
+    FAPI_CONTEXT  **context,
+    char     const *uri);
+
+TSS2_RC Fapi_Initialize_Finish(
+    FAPI_CONTEXT  **context);
+
+void Fapi_Finalize(
+    FAPI_CONTEXT  **context);
+
+TSS2_RC Fapi_GetTcti(
+    FAPI_CONTEXT       *context,
+    TSS2_TCTI_CONTEXT **tcti);
+
+void Fapi_Free(
+    void           *ptr);
+
+#if defined(__linux__) || defined(__unix__) || defined(__APPLE__) || defined (__QNXNTO__) || defined (__VXWORKS__)
+#if defined (__VXWORKS__)
+#include <sys/poll.h>
+#else
+#include <poll.h>
+#endif
+typedef struct pollfd FAPI_POLL_HANDLE;
+#elif defined(_WIN32)
+#include <windows.h>
+typedef HANDLE FAPI_POLL_HANDLE;
+#else
+typedef void FAPI_POLL_HANDLE;
+#ifndef FAPI_SUPPRESS_POLL_WARNINGS
+#pragma message "Info: Platform not supported for FAPI_POLL_HANDLES"
+#endif
+#endif
+
+TSS2_RC Fapi_GetPollHandles(
+    FAPI_CONTEXT      *context,
+    FAPI_POLL_HANDLE **handles,
+    size_t            *num_handles);
+
+TSS2_RC Fapi_GetInfo(
+    FAPI_CONTEXT   *context,
+    char          **info);
+
+TSS2_RC Fapi_GetInfo_Async(
+    FAPI_CONTEXT   *context);
+
+TSS2_RC Fapi_GetInfo_Finish(
+    FAPI_CONTEXT   *context,
+    char          **info);
+
+/* General functions */
+
+TSS2_RC Fapi_Provision(
+    FAPI_CONTEXT   *context,
+    char     const *authValueEh,
+    char     const *authValueSh,
+    char     const *authValueLockout);
+
+TSS2_RC Fapi_Provision_Async(
+    FAPI_CONTEXT   *context,
+    char     const *authValueEh,
+    char     const *authValueSh,
+    char     const *authValueLockout);
+
+TSS2_RC Fapi_Provision_Finish(
+    FAPI_CONTEXT   *context);
+
+TSS2_RC Fapi_GetPlatformCertificates(
+    FAPI_CONTEXT   *context,
+    uint8_t       **certificates,
+    size_t         *certificatesSize);
+
+TSS2_RC Fapi_GetPlatformCertificates_Async(
+    FAPI_CONTEXT   *context);
+
+TSS2_RC Fapi_GetPlatformCertificates_Finish(
+    FAPI_CONTEXT   *context,
+    uint8_t       **certificates,
+    size_t         *certificatesSize);
+
+TSS2_RC Fapi_GetRandom(
+    FAPI_CONTEXT   *context,
+    size_t          numBytes,
+    uint8_t       **data);
+
+TSS2_RC Fapi_GetRandom_Async(
+    FAPI_CONTEXT   *context,
+    size_t          numBytes);
+
+TSS2_RC Fapi_GetRandom_Finish(
+    FAPI_CONTEXT   *context,
+    uint8_t       **data);
+
+TSS2_RC Fapi_Import(
+    FAPI_CONTEXT   *context,
+    char     const *path,
+    char     const *importData);
+
+TSS2_RC Fapi_Import_Async(
+    FAPI_CONTEXT   *context,
+    char     const *path,
+    char     const *importData);
+
+TSS2_RC Fapi_Import_Finish(
+    FAPI_CONTEXT   *context);
+
+TSS2_RC Fapi_List(
+    FAPI_CONTEXT   *context,
+    char     const *searchPath,
+    char          **pathList);
+
+TSS2_RC Fapi_List_Async(
+    FAPI_CONTEXT   *context,
+    char     const *searchPath);
+
+TSS2_RC Fapi_List_Finish(
+    FAPI_CONTEXT   *context,
+    char          **pathList);
+
+TSS2_RC Fapi_Delete(
+    FAPI_CONTEXT   *context,
+    char     const *path);
+
+TSS2_RC Fapi_Delete_Async(
+    FAPI_CONTEXT   *context,
+    char     const *path);
+
+TSS2_RC Fapi_Delete_Finish(
+    FAPI_CONTEXT   *context);
+
+TSS2_RC Fapi_ChangeAuth(
+    FAPI_CONTEXT   *context,
+    char     const *entityPath,
+    char     const *authValue);
+
+TSS2_RC Fapi_ChangeAuth_Async(
+    FAPI_CONTEXT   *context,
+    char     const *entityPath,
+    char     const *authValue);
+
+TSS2_RC Fapi_ChangeAuth_Finish(
+    FAPI_CONTEXT   *context);
+
+TSS2_RC Fapi_SetDescription(
+    FAPI_CONTEXT   *context,
+    char     const *path,
+    char     const *description);
+
+TSS2_RC Fapi_SetDescription_Async(
+    FAPI_CONTEXT   *context,
+    char     const *path,
+    char     const *description);
+
+TSS2_RC Fapi_SetDescription_Finish(
+    FAPI_CONTEXT   *context);
+
+TSS2_RC Fapi_GetDescription(
+    FAPI_CONTEXT   *context,
+    char     const *path,
+    char          **description);
+
+TSS2_RC Fapi_GetDescription_Async(
+    FAPI_CONTEXT   *context,
+    char     const *path);
+
+TSS2_RC Fapi_GetDescription_Finish(
+    FAPI_CONTEXT   *context,
+    char          **description);
+
+TSS2_RC Fapi_SetAppData(
+    FAPI_CONTEXT   *context,
+    char     const *path,
+    uint8_t  const *appData,
+    size_t          appDataSize);
+
+TSS2_RC Fapi_SetAppData_Async(
+    FAPI_CONTEXT   *context,
+    char     const *path,
+    uint8_t  const *appData,
+    size_t          appDataSize);
+
+TSS2_RC Fapi_SetAppData_Finish(
+    FAPI_CONTEXT   *context);
+
+TSS2_RC Fapi_GetAppData(
+    FAPI_CONTEXT   *context,
+    char     const *path,
+    uint8_t       **appData,
+    size_t         *appDataSize);
+
+TSS2_RC Fapi_GetAppData_Async(
+    FAPI_CONTEXT   *context,
+    char     const *path);
+
+TSS2_RC Fapi_GetAppData_Finish(
+    FAPI_CONTEXT   *context,
+    uint8_t       **appData,
+    size_t         *appDataSize);
+
+TSS2_RC Fapi_GetTpmBlobs(
+    FAPI_CONTEXT   *context,
+    char     const *path,
+    uint8_t       **tpm2bPublic,
+    size_t         *tpm2bPublicSize,
+    uint8_t       **tpm2bPrivate,
+    size_t         *tpm2bPrivateSize,
+    char          **policy);
+
+TSS2_RC Fapi_GetTpmBlobs_Async(
+    FAPI_CONTEXT   *context,
+    char     const *path);
+
+TSS2_RC Fapi_GetTpmBlobs_Finish(
+    FAPI_CONTEXT   *context,
+    uint8_t       **tpm2bPublic,
+    size_t         *tpm2bPublicSize,
+    uint8_t       **tpm2bPrivate,
+    size_t         *tpm2bPrivateSize,
+    char          **policy);
+
+/* Key functions */
+
+TSS2_RC Fapi_CreateKey(
+    FAPI_CONTEXT   *context,
+    char     const *path,
+    char     const *type,
+    char     const *policyPath,
+    char     const *authValue);
+
+TSS2_RC Fapi_CreateKey_Async(
+    FAPI_CONTEXT   *context,
+    char     const *path,
+    char     const *type,
+    char     const *policyPath,
+    char     const *authValue);
+
+TSS2_RC Fapi_CreateKey_Finish(
+    FAPI_CONTEXT   *context);
+
+TSS2_RC Fapi_Sign(
+    FAPI_CONTEXT   *context,
+    char     const *keyPath,
+    char     const *padding,
+    uint8_t  const *digest,
+    size_t          digestSize,
+    uint8_t       **signature,
+    size_t         *signatureSize,
+    char          **publicKey,
+    char          **certificate);
+
+TSS2_RC Fapi_Sign_Async(
+    FAPI_CONTEXT   *context,
+    char     const *keyPath,
+    char     const *padding,
+    uint8_t  const *digest,
+    size_t         digestSize);
+
+TSS2_RC Fapi_Sign_Finish(
+    FAPI_CONTEXT   *context,
+    uint8_t       **signature,
+    size_t         *signatureSize,
+    char          **publicKey,
+    char          **certificate);
+
+TSS2_RC Fapi_VerifySignature(
+    FAPI_CONTEXT   *context,
+    char     const *keyPath,
+    uint8_t  const *digest,
+    size_t          digestSize,
+    uint8_t  const *signature,
+    size_t          signatureSize);
+
+TSS2_RC Fapi_VerifySignature_Async(
+    FAPI_CONTEXT   *context,
+    char     const *keyPath,
+    uint8_t  const *digest,
+    size_t          digestSize,
+    uint8_t  const *signature,
+    size_t          signatureSize);
+
+TSS2_RC Fapi_VerifySignature_Finish(
+    FAPI_CONTEXT   *context);
+
+TSS2_RC Fapi_Encrypt(
+    FAPI_CONTEXT   *context,
+    char     const *keyPath,
+    char     const *policyPath,
+    uint8_t  const *plainText,
+    size_t          plainTextSize,
+    char          **cipherText);
+
+TSS2_RC Fapi_Encrypt_Async(
+    FAPI_CONTEXT   *context,
+    char     const *keyPath,
+    char     const *policyPath,
+    uint8_t  const *plainText,
+    size_t          plainTextSize);
+
+TSS2_RC Fapi_Encrypt_Finish(
+    FAPI_CONTEXT   *context,
+    char          **cipherText);
+
+TSS2_RC Fapi_Decrypt(
+    FAPI_CONTEXT   *context,
+    char     const *cipherText,
+    uint8_t       **plainText,
+    size_t         *plainTextSize);
+
+TSS2_RC Fapi_Decrypt_Async(
+    FAPI_CONTEXT   *context,
+    char     const *cipherText);
+
+TSS2_RC Fapi_Decrypt_Finish(
+    FAPI_CONTEXT   *context,
+    uint8_t       **plainText,
+    size_t         *plainTextSize);
+
+TSS2_RC Fapi_SetCertificate(
+    FAPI_CONTEXT   *context,
+    char     const *path,
+    char     const *x509certData);
+
+TSS2_RC Fapi_SetCertificate_Async(
+    FAPI_CONTEXT   *context,
+    char     const *path,
+    char     const *x509certData);
+
+TSS2_RC Fapi_SetCertificate_Finish(
+    FAPI_CONTEXT   *context);
+
+TSS2_RC Fapi_GetCertificate(
+    FAPI_CONTEXT   *context,
+    char     const *path,
+    char          **x509certData);
+
+TSS2_RC Fapi_GetCertificate_Async(
+    FAPI_CONTEXT   *context,
+    char     const *path);
+
+TSS2_RC Fapi_GetCertificate_Finish(
+    FAPI_CONTEXT   *context,
+    char          **x509certData);
+
+TSS2_RC Fapi_ExportKey(
+    FAPI_CONTEXT   *context,
+    char     const *pathOfKeyToDuplicate,
+    char     const *pathToPublicKeyOfNewParent,
+    char          **exportedData);
+
+TSS2_RC Fapi_ExportKey_Async(
+    FAPI_CONTEXT   *context,
+    char     const *pathOfKeyToDuplicate,
+    char     const *pathToPublicKeyOfNewParent);
+
+TSS2_RC Fapi_ExportKey_Finish(
+    FAPI_CONTEXT   *context,
+    char          **exportedData);
+
+/* Seal functions */
+
+TSS2_RC Fapi_CreateSeal(
+    FAPI_CONTEXT   *context,
+    char     const *path,
+    char     const *type,
+    size_t          size,
+    char     const *policyPath,
+    char     const *authValue,
+    uint8_t  const *data);
+
+TSS2_RC Fapi_CreateSeal_Async(
+    FAPI_CONTEXT   *context,
+    char     const *path,
+    char     const *type,
+    size_t          size,
+    char     const *policyPath,
+    char     const *authValue,
+    uint8_t  const *data);
+
+TSS2_RC Fapi_CreateSeal_Finish(
+    FAPI_CONTEXT   *context);
+
+TSS2_RC Fapi_Unseal(
+    FAPI_CONTEXT   *context,
+    char     const *path,
+    uint8_t       **data,
+    size_t         *size);
+
+TSS2_RC Fapi_Unseal_Async(
+    FAPI_CONTEXT   *context,
+    char     const *path);
+
+TSS2_RC Fapi_Unseal_Finish(
+    FAPI_CONTEXT   *context,
+    uint8_t       **data,
+    size_t         *size);
+
+/* Policy functions */
+
+TSS2_RC Fapi_ExportPolicy(
+    FAPI_CONTEXT   *context,
+    char     const *path,
+    char          **jsonPolicy);
+
+TSS2_RC Fapi_ExportPolicy_Async(
+    FAPI_CONTEXT   *context,
+    char     const *path);
+
+TSS2_RC Fapi_ExportPolicy_Finish(
+    FAPI_CONTEXT   *context,
+    char          **jsonPolicy);
+
+TSS2_RC Fapi_AuthorizePolicy(
+    FAPI_CONTEXT   *context,
+    char     const *policyPath,
+    char     const *keyPath,
+    uint8_t  const *policyRef,
+    size_t          policyRefSize);
+
+TSS2_RC Fapi_AuthorizePolicy_Async(
+    FAPI_CONTEXT   *context,
+    char     const *policyPath,
+    char     const *keyPath,
+    uint8_t  const *policyRef,
+    size_t          policyRefSize);
+
+TSS2_RC Fapi_AuthorizePolicy_Finish(
+    FAPI_CONTEXT   *context);
+
+TSS2_RC Fapi_WriteAuthorizeNv(
+    FAPI_CONTEXT   *context,
+    char     const *nvPath,
+    char     const *policyPath);
+
+TSS2_RC Fapi_WriteAuthorizeNv_Async(
+    FAPI_CONTEXT   *context,
+    char     const *nvPath,
+    char     const *policyPath);
+
+TSS2_RC Fapi_WriteAuthorizeNv_Finish(
+    FAPI_CONTEXT   *context);
+
+/* Attestation functions */
+
+TSS2_RC Fapi_PcrRead(
+    FAPI_CONTEXT   *context,
+    uint32_t        pcrIndex,
+    uint8_t       **pcrValue,
+    size_t         *pcrValueSize,
+    char          **pcrLog);
+
+TSS2_RC Fapi_PcrRead_Async(
+    FAPI_CONTEXT   *context,
+    uint32_t        pcrIndex);
+
+TSS2_RC Fapi_PcrRead_Finish(
+    FAPI_CONTEXT   *context,
+    uint8_t       **pcrValue,
+    size_t         *pcrValueSize,
+    char          **pcrLog);
+
+TSS2_RC Fapi_PcrExtend(
+    FAPI_CONTEXT   *context,
+    uint32_t        pcr,
+    uint8_t  const *data,
+    size_t          dataSize,
+    char     const *logData);
+
+TSS2_RC Fapi_PcrExtend_Async(
+    FAPI_CONTEXT   *context,
+    uint32_t        pcr,
+    uint8_t  const *data,
+    size_t          dataSize,
+    char     const *logData);
+
+TSS2_RC Fapi_PcrExtend_Finish(
+    FAPI_CONTEXT   *context);
+
+
+TSS2_RC Fapi_Quote(
+    FAPI_CONTEXT   *context,
+    uint32_t       *pcrList,
+    size_t          pcrListSize,
+    char     const *keyPath,
+    char     const *quoteType,
+    uint8_t  const *qualifyingData,
+    size_t          qualifyingDataSize,
+    char          **quoteInfo,
+    uint8_t       **signature,
+    size_t         *signatureSize,
+    char          **pcrLog,
+    char          **certificate);
+
+TSS2_RC Fapi_Quote_Async(
+    FAPI_CONTEXT   *context,
+    uint32_t       *pcrList,
+    size_t          pcrListSize,
+    char     const *keyPath,
+    char     const *quoteType,
+    uint8_t  const *qualifyingData,
+    size_t          qualifyingDataSize);
+
+TSS2_RC Fapi_Quote_Finish(
+    FAPI_CONTEXT  *context,
+    char         **quoteInfo,
+    uint8_t      **signature,
+    size_t        *signatureSize,
+    char          **pcrLog,
+    char          **certificate);
+
+TSS2_RC Fapi_VerifyQuote(
+    FAPI_CONTEXT   *context,
+    char     const *publicKeyPath,
+    uint8_t  const *qualifyingData,
+    size_t          qualifyingDataSize,
+    char     const *quoteInfo,
+    uint8_t  const *signature,
+    size_t          signatureSize,
+    char     const *pcrLog);
+
+TSS2_RC Fapi_VerifyQuote_Async(
+    FAPI_CONTEXT   *context,
+    char     const *publicKeyPath,
+    uint8_t  const *qualifyingData,
+    size_t          qualifyingDataSize,
+    char     const *quoteInfo,
+    uint8_t  const *signature,
+    size_t          signatureSize,
+    char     const *pcrLog);
+
+TSS2_RC Fapi_VerifyQuote_Finish(
+    FAPI_CONTEXT   *context);
+
+/* NV functions */
+
+TSS2_RC Fapi_CreateNv(
+    FAPI_CONTEXT *context,
+    char   const *path,
+    char   const *type,
+    size_t        size,
+    char   const *policyPath,
+    char   const *authValue);
+
+TSS2_RC Fapi_CreateNv_Async(
+    FAPI_CONTEXT *context,
+    char   const *path,
+    char   const *type,
+    size_t        size,
+    char   const *policyPath,
+    char   const *authValue);
+
+TSS2_RC Fapi_CreateNv_Finish(
+    FAPI_CONTEXT *context);
+
+TSS2_RC Fapi_NvRead(
+    FAPI_CONTEXT   *context,
+    char     const *path,
+    uint8_t      **data,
+    size_t        *size,
+    char         **logData);
+
+TSS2_RC Fapi_NvRead_Async(
+    FAPI_CONTEXT   *context,
+    char     const *path);
+
+TSS2_RC Fapi_NvRead_Finish(
+    FAPI_CONTEXT   *context,
+    uint8_t       **data,
+    size_t         *size,
+    char          **logData);
+
+TSS2_RC Fapi_NvWrite(
+    FAPI_CONTEXT  *context,
+    char    const *path,
+    uint8_t const *data,
+    size_t         size);
+
+TSS2_RC Fapi_NvWrite_Async(
+    FAPI_CONTEXT  *context,
+    char    const *path,
+    uint8_t const *data,
+    size_t         size);
+
+TSS2_RC Fapi_NvWrite_Finish(
+    FAPI_CONTEXT   *context);
+
+TSS2_RC Fapi_NvExtend(
+    FAPI_CONTEXT  *context,
+    char    const *path,
+    uint8_t const *data,
+    size_t         size,
+    char    const *logData);
+
+TSS2_RC Fapi_NvExtend_Async(
+    FAPI_CONTEXT  *context,
+    char    const *path,
+    uint8_t const *data,
+    size_t         size,
+    char    const *logData);
+
+TSS2_RC Fapi_NvExtend_Finish(
+    FAPI_CONTEXT  *context);
+
+TSS2_RC Fapi_NvIncrement(
+    FAPI_CONTEXT   *context,
+    char     const *path);
+
+TSS2_RC Fapi_NvIncrement_Async(
+    FAPI_CONTEXT   *context,
+    char     const *path);
+
+TSS2_RC Fapi_NvIncrement_Finish(
+    FAPI_CONTEXT   *context);
+
+TSS2_RC Fapi_NvSetBits(
+    FAPI_CONTEXT   *context,
+    char     const *path,
+    uint64_t        bitmap);
+
+TSS2_RC Fapi_NvSetBits_Async(
+    FAPI_CONTEXT   *context,
+    char     const *path,
+    uint64_t        bitmap);
+
+TSS2_RC Fapi_NvSetBits_Finish(
+    FAPI_CONTEXT   *context);
+
+typedef TSS2_RC (*Fapi_CB_Auth)(
+    FAPI_CONTEXT   *context,
+    char     const *description,
+    char          **auth,
+    void           *userData);
+
+TSS2_RC Fapi_SetAuthCB(
+    FAPI_CONTEXT   *context,
+    Fapi_CB_Auth    callback,
+    void           *userData);
+
+typedef TSS2_RC (*Fapi_CB_Branch)(
+    FAPI_CONTEXT   *context,
+    char     const *description,
+    char    const **branchNames,
+    size_t          numBranches,
+    size_t         *selectedBranch,
+    void           *userData);
+
+TSS2_RC Fapi_SetBranchCB(
+    FAPI_CONTEXT   *context,
+    Fapi_CB_Branch  callback,
+    void           *userData);
+
+typedef TSS2_RC (*Fapi_CB_Sign)(
+    FAPI_CONTEXT   *context,
+    char     const *description,
+    char     const *publicKey,
+    char     const *publicKeyHint,
+    uint32_t        hashAlg,
+    uint8_t  const *dataToSign,
+    size_t          dataToSignSize,
+    uint8_t       **signature,
+    size_t         *signatureSize,
+    void           *userData);
+
+TSS2_RC Fapi_SetSignCB(
+    FAPI_CONTEXT   *context,
+    Fapi_CB_Sign    callback,
+    void           *userData);
+
+typedef TSS2_RC (*Fapi_CB_PolicyAction)(
+    FAPI_CONTEXT   *context,
+    char     const *action,
+    void           *userData);
+
+TSS2_RC Fapi_SetPolicyActionCB(
+    FAPI_CONTEXT        *context,
+    Fapi_CB_PolicyAction callback,
+    void                *userData);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* TSS2_FAPI_H */

diff --git a/include/tss2/tss2_tpm2_types.h b/include/tss2/tss2_tpm2_types.h
index 69063cb..cfc92f7 100644
--- a/include/tss2/tss2_tpm2_types.h
+++ b/include/tss2/tss2_tpm2_types.h

@@ -71,6 +71,7 @@
 
 #define TPM2_ALG_ERROR               ((TPM2_ALG_ID) 0x0000)
 #define TPM2_ALG_RSA                 ((TPM2_ALG_ID) 0x0001)
+#define TPM2_ALG_TDES                ((TPM2_ALG_ID) 0x0003)
 #define TPM2_ALG_SHA                 ((TPM2_ALG_ID) 0x0004)
 #define TPM2_ALG_SHA1                ((TPM2_ALG_ID) 0x0004)
 #define TPM2_ALG_HMAC                ((TPM2_ALG_ID) 0x0005)
@@ -513,6 +514,7 @@
 #define TPM2_PT_VENDOR_COMMANDS          ((TPM2_PT) (TPM2_PT_FIXED + 43)) /* number of vendor commands that are implemented */
 #define TPM2_PT_NV_BUFFER_MAX            ((TPM2_PT) (TPM2_PT_FIXED + 44)) /* the maximum data size in one NV write command */
 #define TPM2_PT_MODES                    ((TPM2_PT) (TPM2_PT_FIXED + 45)) /* a TPMA_MODES value indicating that the TPM is designed for these modes. */
+#define TPM2_PT_MAX_CAP_BUFFER           ((TPM2_PT) (TPM2_PT_FIXED + 46)) /* the maximum size of a TPMS_CAPABILITY_DATA structure returned in TPM2_GetCapability(). */
 #define TPM2_PT_VAR                      ((TPM2_PT) (TPM2_PT_GROUP * 2)) /* the group of variable properties returned as TPMS_TAGGED_PROPERTY. The properties in this group change because of a Protected Capability other than a firmware update. The values are not necessarily persistent across all power transitions. */
 #define TPM2_PT_PERMANENT                ((TPM2_PT) (TPM2_PT_VAR + 0)) /* TPMA_PERMANENT */
 #define TPM2_PT_STARTUP_CLEAR            ((TPM2_PT) (TPM2_PT_VAR + 1)) /* TPMA_STARTUP_CLEAR */
@@ -538,7 +540,7 @@
 
 /* Definition of UINT32 TPM2_PT_PCR Constants <INOUT S> */
 typedef UINT32 TPM2_PT_PCR;
-#define TPM2_PT_TPM2_PCR_FIRST   ((TPM2_PT_PCR) 0x00000000) /* bottom of the range of TPM2_PT_PCR properties */
+#define TPM2_PT_TPM2_PCR_FIRST        ((TPM2_PT_PCR) 0x00000000) /* bottom of the range of TPM2_PT_PCR properties */
 #define TPM2_PT_PCR_SAVE         ((TPM2_PT_PCR) 0x00000000) /* a SET bit in the TPMS_PCR_SELECT indicates that the PCR is saved and restored by TPM2_SU_STATE */
 #define TPM2_PT_PCR_EXTEND_L0    ((TPM2_PT_PCR) 0x00000001) /* a SET bit in the TPMS_PCR_SELECT indicates that the PCR may be extended from locality 0This property is only present if a locality other than 0 is implemented. */
 #define TPM2_PT_PCR_RESET_L0     ((TPM2_PT_PCR) 0x00000002) /* a SET bit in the TPMS_PCR_SELECT indicates that the PCR may be reset by TPM2_PCR_Reset from locality 0 */
@@ -560,7 +562,7 @@
 #define TPM2_PT_PCR_DRTM_RESET   ((TPM2_PT_PCR) 0x00000012) /* a SET bit in the TPMS_PCR_SELECT indicates that the PCR is reset by a DRTM event. These PCR are reset to 1 on TPM2_Startup and reset to 0 on a _TPM_Hash_End event following a _TPM_Hash_Start event. */
 #define TPM2_PT_PCR_POLICY       ((TPM2_PT_PCR) 0x00000013) /* a SET bit in the TPMS_PCR_SELECT indicates that the PCR is controlled by policy. This property is only present if the TPM supports policy control of a PCR. */
 #define TPM2_PT_PCR_AUTH         ((TPM2_PT_PCR) 0x00000014) /* a SET bit in the TPMS_PCR_SELECT indicates that the PCR is controlled by an authorization value. This property is only present if the TPM supports authorization control of a PCR. */
-#define TPM2_PT_TPM2_PCR_LAST    ((TPM2_PT_PCR) 0x00000014) /* top of the range of TPM2_PT_PCR properties of the implementation. If the TPM receives a request for a PCR property with a value larger than this the TPM will return a zero length list and set the moreData parameter to NO. NOTE This is an implementation-specific value. The value shown reflects the reference code implementation. */
+#define TPM2_PT_TPM2_PCR_LAST         ((TPM2_PT_PCR) 0x00000014) /* top of the range of TPM2_PT_PCR properties of the implementation. If the TPM receives a request for a PCR property with a value larger than this the TPM will return a zero length list and set the moreData parameter to NO. NOTE This is an implementation-specific value. The value shown reflects the reference code implementation. */
 /* NOTE: The following values are reserved:
  * 0x00000015 is reserved for the next 2nd TPM2_PT_PCR_POLICY set.
  * 0x00000016 is reserved for the next 2nd TPM2_PT_PCR_AUTH set.

diff --git a/lib/tss2-fapi.def b/lib/tss2-fapi.def
new file mode 100644
index 0000000..04559ab
--- /dev/null
+++ b/lib/tss2-fapi.def

@@ -0,0 +1,121 @@
+LIBRARY tss2-fapi
+EXPORTS
+    Fapi_Initialize
+    Fapi_Initialize_Async
+    Fapi_Initialize_Finish
+    Fapi_Finalize
+    Fapi_Free
+    Fapi_GetTcti
+    Fapi_GetPollHandles
+    Fapi_GetInfo
+    Fapi_GetInfo_Async
+    Fapi_GetInfo_Finish
+    Fapi_Provision
+    Fapi_Provision_Async
+    Fapi_Provision_Finish
+    Fapi_GetPlatformCertificates
+    Fapi_GetPlatformCertificates_Async
+    Fapi_GetPlatformCertificates_Finish
+    Fapi_GetRandom
+    Fapi_GetRandom_Async
+    Fapi_GetRandom_Finish
+    Fapi_Import
+    Fapi_Import_Async
+    Fapi_Import_Finish
+    Fapi_List
+    Fapi_List_Async
+    Fapi_List_Finish
+    Fapi_Delete
+    Fapi_Delete_Async
+    Fapi_Delete_Finish
+    Fapi_ChangeAuth
+    Fapi_ChangeAuth_Async
+    Fapi_ChangeAuth_Finish
+    Fapi_SetDescription
+    Fapi_SetDescription_Async
+    Fapi_SetDescription_Finish
+    Fapi_GetDescription
+    Fapi_GetDescription_Async
+    Fapi_GetDescription_Finish
+    Fapi_SetAppData
+    Fapi_SetAppData_Async
+    Fapi_SetAppData_Finish
+    Fapi_GetAppData
+    Fapi_GetAppData_Async
+    Fapi_GetAppData_Finish
+    Fapi_GetTpmBlobs
+    Fapi_GetTpmBlobs_Async
+    Fapi_GetTpmBlobs_Finish
+    Fapi_CreateKey
+    Fapi_CreateKey_Async
+    Fapi_CreateKey_Finish
+    Fapi_Sign
+    Fapi_Sign_Async
+    Fapi_Sign_Finish
+    Fapi_VerifySignature
+    Fapi_VerifySignature_Async
+    Fapi_VerifySignature_Finish
+    Fapi_Encrypt
+    Fapi_Encrypt_Async
+    Fapi_Encrypt_Finish
+    Fapi_Decrypt
+    Fapi_Decrypt_Async
+    Fapi_Decrypt_Finish
+    Fapi_SetCertificate
+    Fapi_SetCertificate_Async
+    Fapi_SetCertificate_Finish
+    Fapi_GetCertificate
+    Fapi_GetCertificate_Async
+    Fapi_GetCertificate_Finish
+    Fapi_ExportKey
+    Fapi_ExportKey_Async
+    Fapi_ExportKey_Finish
+    Fapi_CreateSeal
+    Fapi_CreateSeal_Async
+    Fapi_CreateSeal_Finish
+    Fapi_Unseal
+    Fapi_Unseal_Async
+    Fapi_Unseal_Finish
+    Fapi_ExportPolicy
+    Fapi_ExportPolicy_Async
+    Fapi_ExportPolicy_Finish
+    Fapi_AuthorizePolicy
+    Fapi_AuthorizePolicy_Async
+    Fapi_AuthorizePolicy_Finish
+    Fapi_WriteAuthorizeNv
+    Fapi_WriteAuthorizeNv_Async
+    Fapi_WriteAuthorizeNv_Finish
+    Fapi_PcrRead
+    Fapi_PcrRead_Async
+    Fapi_PcrRead_Finish
+    Fapi_PcrExtend
+    Fapi_PcrExtend_Async
+    Fapi_PcrExtend_Finish
+    Fapi_Quote
+    Fapi_Quote_Async
+    Fapi_Quote_Finish
+    Fapi_VerifyQuote
+    Fapi_VerifyQuote_Async
+    Fapi_VerifyQuote_Finish
+    Fapi_CreateNv
+    Fapi_CreateNv_Async
+    Fapi_CreateNv_Finish
+    Fapi_NvRead
+    Fapi_NvRead_Async
+    Fapi_NvRead_Finish
+    Fapi_NvWrite
+    Fapi_NvWrite_Async
+    Fapi_NvWrite_Finish
+    Fapi_NvExtend
+    Fapi_NvExtend_Async
+    Fapi_NvExtend_Finish
+    Fapi_NvIncrement
+    Fapi_NvIncrement_Async
+    Fapi_NvIncrement_Finish
+    Fapi_NvSetBits
+    Fapi_NvSetBits_Async
+    Fapi_NvSetBits_Finish
+    Fapi_SetAuthCB
+    Fapi_SetBranchCB
+    Fapi_SetSignCB
+    Fapi_SetPolicyActionCB

diff --git a/lib/tss2-fapi.map b/lib/tss2-fapi.map
new file mode 100644
index 0000000..b1b1e31
--- /dev/null
+++ b/lib/tss2-fapi.map

@@ -0,0 +1,124 @@
+{
+    global:
+        Fapi_Initialize;
+        Fapi_Initialize_Async;
+        Fapi_Initialize_Finish;
+        Fapi_Finalize;
+        Fapi_Free;
+        Fapi_GetTcti;
+        Fapi_GetPollHandles;
+        Fapi_GetInfo;
+        Fapi_GetInfo_Async;
+        Fapi_GetInfo_Finish;
+        Fapi_Provision;
+        Fapi_Provision_Async;
+        Fapi_Provision_Finish;
+        Fapi_GetPlatformCertificates;
+        Fapi_GetPlatformCertificates_Async;
+        Fapi_GetPlatformCertificates_Finish;
+        Fapi_GetRandom;
+        Fapi_GetRandom_Async;
+        Fapi_GetRandom_Finish;
+        Fapi_Import;
+        Fapi_Import_Async;
+        Fapi_Import_Finish;
+        Fapi_List;
+        Fapi_List_Async;
+        Fapi_List_Finish;
+        Fapi_Delete;
+        Fapi_Delete_Async;
+        Fapi_Delete_Finish;
+        Fapi_ChangeAuth;
+        Fapi_ChangeAuth_Async;
+        Fapi_ChangeAuth_Finish;
+        Fapi_SetDescription;
+        Fapi_SetDescription_Async;
+        Fapi_SetDescription_Finish;
+        Fapi_GetDescription;
+        Fapi_GetDescription_Async;
+        Fapi_GetDescription_Finish;
+        Fapi_SetAppData;
+        Fapi_SetAppData_Async;
+        Fapi_SetAppData_Finish;
+        Fapi_GetAppData;
+        Fapi_GetAppData_Async;
+        Fapi_GetAppData_Finish;
+        Fapi_GetTpmBlobs;
+        Fapi_GetTpmBlobs_Async;
+        Fapi_GetTpmBlobs_Finish;
+        Fapi_CreateKey;
+        Fapi_CreateKey_Async;
+        Fapi_CreateKey_Finish;
+        Fapi_Sign;
+        Fapi_Sign_Async;
+        Fapi_Sign_Finish;
+        Fapi_VerifySignature;
+        Fapi_VerifySignature_Async;
+        Fapi_VerifySignature_Finish;
+        Fapi_Encrypt;
+        Fapi_Encrypt_Async;
+        Fapi_Encrypt_Finish;
+        Fapi_Decrypt;
+        Fapi_Decrypt_Async;
+        Fapi_Decrypt_Finish;
+        Fapi_SetCertificate;
+        Fapi_SetCertificate_Async;
+        Fapi_SetCertificate_Finish;
+        Fapi_GetCertificate;
+        Fapi_GetCertificate_Async;
+        Fapi_GetCertificate_Finish;
+        Fapi_ExportKey;
+        Fapi_ExportKey_Async;
+        Fapi_ExportKey_Finish;
+        Fapi_CreateSeal;
+        Fapi_CreateSeal_Async;
+        Fapi_CreateSeal_Finish;
+        Fapi_Unseal;
+        Fapi_Unseal_Async;
+        Fapi_Unseal_Finish;
+        Fapi_ExportPolicy;
+        Fapi_ExportPolicy_Async;
+        Fapi_ExportPolicy_Finish;
+        Fapi_AuthorizePolicy;
+        Fapi_AuthorizePolicy_Async;
+        Fapi_AuthorizePolicy_Finish;
+        Fapi_WriteAuthorizeNv;
+        Fapi_WriteAuthorizeNv_Async;
+        Fapi_WriteAuthorizeNv_Finish;
+        Fapi_PcrRead;
+        Fapi_PcrRead_Async;
+        Fapi_PcrRead_Finish;
+        Fapi_PcrExtend;
+        Fapi_PcrExtend_Async;
+        Fapi_PcrExtend_Finish;
+        Fapi_Quote;
+        Fapi_Quote_Async;
+        Fapi_Quote_Finish;
+        Fapi_VerifyQuote;
+        Fapi_VerifyQuote_Async;
+        Fapi_VerifyQuote_Finish;
+        Fapi_CreateNv;
+        Fapi_CreateNv_Async;
+        Fapi_CreateNv_Finish;
+        Fapi_NvRead;
+        Fapi_NvRead_Async;
+        Fapi_NvRead_Finish;
+        Fapi_NvWrite;
+        Fapi_NvWrite_Async;
+        Fapi_NvWrite_Finish;
+        Fapi_NvExtend;
+        Fapi_NvExtend_Async;
+        Fapi_NvExtend_Finish;
+        Fapi_NvIncrement;
+        Fapi_NvIncrement_Async;
+        Fapi_NvIncrement_Finish;
+        Fapi_NvSetBits;
+        Fapi_NvSetBits_Async;
+        Fapi_NvSetBits_Finish;
+        Fapi_SetAuthCB;
+        Fapi_SetBranchCB;
+        Fapi_SetSignCB;
+        Fapi_SetPolicyActionCB;
+    local:
+        *;
+};

diff --git a/lib/tss2-fapi.pc.in b/lib/tss2-fapi.pc.in
new file mode 100644
index 0000000..8fcc5cd
--- /dev/null
+++ b/lib/tss2-fapi.pc.in

@@ -0,0 +1,12 @@
+prefix=@prefix@
+exec_prefix=@exec_prefix@
+libdir=@libdir@
+includedir=@includedir@
+
+Name: tss2-FAPI
+Description: TPM2 Feature API library.
+URL: https://github.com/tpm2-software/tpm2-tss
+Version: @VERSION@
+Requires: tss2-mu tss2-esys tss2-tctildr
+Cflags: -I${includedir}
+Libs: -ltss2-fapi -L${libdir}

diff --git a/script/ekca/create_ca.sh b/script/ekca/create_ca.sh
new file mode 100755
index 0000000..aac18f4
--- /dev/null
+++ b/script/ekca/create_ca.sh

@@ -0,0 +1,185 @@
+#!/bin/bash
+
+# set -x
+
+set -euf
+
+echo "Creating ekcert for $1 => $3"
+echo "Creating ekcert for $2 => $4"
+
+EKCADIR="$(dirname $(realpath ${0}))/"
+
+CA_DIR="$(mktemp -d ekca-XXXXXX)"
+
+pushd "$CA_DIR"
+
+mkdir root-ca
+pushd root-ca
+
+mkdir certreqs certs crl newcerts private
+touch root-ca.index
+echo 00 > root-ca.crlnum
+echo 1000 > root-ca.serial
+echo "123456" > pass.txt
+
+cp "${EKCADIR}/root-ca.cnf" ./
+export OPENSSL_CONF=./root-ca.cnf
+
+openssl req -new -out root-ca.req.pem -passout file:pass.txt
+
+#openssl req -verify -in root-ca.req.pem \
+#    -noout -text \
+#    -reqopt no_version,no_pubkey,no_sigdump \
+#    -nameopt multiline -passin file:pass.txt
+
+openssl ca -selfsign \
+    -in root-ca.req.pem \
+    -out root-ca.cert.pem \
+    -extensions root-ca_ext \
+    -startdate `date +%y%m%d000000Z -u -d -1day` \
+    -enddate `date +%y%m%d000000Z -u -d +10years+1day` \
+    -passin file:pass.txt -batch
+
+#openssl x509 -in ./root-ca.cert.pem \
+#    -noout -text \
+#    -certopt no_version,no_pubkey,no_sigdump \
+#    -nameopt multiline
+
+openssl verify -verbose -CAfile root-ca.cert.pem \
+    root-ca.cert.pem
+
+popd #root-ca
+
+mkdir intermed-ca
+pushd intermed-ca
+
+mkdir certreqs certs crl newcerts private
+touch intermed-ca.index
+echo 00 > intermed-ca.crlnum
+echo 2000 > intermed-ca.serial
+echo "abcdef" > pass.txt
+
+cp "${EKCADIR}/intermed-ca.cnf" ./
+export OPENSSL_CONF=./intermed-ca.cnf
+
+openssl req -new -out intermed-ca.req.pem -passout file:pass.txt
+
+openssl req -new \
+    -key private/intermed-ca.key.pem \
+    -out intermed-ca.req.pem \
+    -passin file:pass.txt
+
+#openssl req  -verify -in intermed-ca.req.pem \
+#    -noout -text \
+#    -reqopt no_version,no_pubkey,no_sigdump \
+#    -nameopt multiline
+
+cp intermed-ca.req.pem  \
+    ../root-ca/certreqs/
+
+pushd ../root-ca
+export OPENSSL_CONF=./root-ca.cnf
+
+openssl ca \
+    -in certreqs/intermed-ca.req.pem \
+    -out certs/intermed-ca.cert.pem \
+    -extensions intermed-ca_ext \
+    -startdate `date +%y%m%d000000Z -u -d -1day` \
+    -enddate `date +%y%m%d000000Z -u -d +5years+1day` \
+    -passin file:pass.txt -batch
+
+#openssl x509 -in certs/intermed-ca.cert.pem \
+#    -noout -text \
+#    -certopt no_version,no_pubkey,no_sigdump \
+#    -nameopt multiline
+
+openssl verify -verbose -CAfile root-ca.cert.pem \
+    certs/intermed-ca.cert.pem
+
+cp certs/intermed-ca.cert.pem \
+    ../intermed-ca
+
+popd #root-ca
+
+popd #intermed-ca
+
+mkdir ek
+pushd ek
+
+cp "${EKCADIR}/ek.cnf" ./
+export OPENSSL_CONF=ek.cnf
+echo "abc123" > pass.txt
+
+cp "$1" ../intermed-ca/certreqs/ek.pub.pem
+
+openssl req -new -nodes -newkey rsa:2048 -passin file:pass.txt -out ../intermed-ca/certreqs/nonsense.csr.pem
+
+#openssl req  -verify -in ../intermed-ca/certreqs/nonsense.csr.pem \
+#    -noout -text \
+#    -reqopt no_version,no_pubkey,no_sigdump \
+#    -nameopt multiline
+
+pushd ../intermed-ca
+export OPENSSL_CONF=./intermed-ca.cnf
+
+openssl x509 -req -in certreqs/nonsense.csr.pem -force_pubkey certreqs/ek.pub.pem -out certs/ek.cert.der \
+    -outform DER -extfile ../ek/ek.cnf -extensions ek_ext -set_serial 12345 \
+    -CA intermed-ca.cert.pem -CAkey private/intermed-ca.key.pem -passin file:pass.txt
+
+#openssl x509 -req -in csrs/oemProvCertTPM.csr -extfile configs/oemProvCertTPM.cnf -extensions ext -CA certs/oemSubCA2Cert.pem -CAkey privateKeys/oemSubCA2.key -passin file:passphrase.txt -set_serial 12345 -days $validity_oem_prov_cert -force_pubkey pc.pub.pem -out certs/oemProvCertTPM.pem
+
+cp certs/ek.cert.der ../ek
+
+popd #intermed-ca
+
+#openssl x509 -in ek.cert.der -inform DER -text -noout
+#openssl rsa -in ek.pub.pem -pubin -text -noout
+#openssl asn1parse -in ek.cert.der -inform DER
+
+popd #EK
+
+# ECC Certificate
+
+mkdir ekecc
+pushd ekecc
+
+cp "${EKCADIR}/ek.cnf" ./
+export OPENSSL_CONF=ek.cnf
+echo "abc123" > pass.txt
+
+cp "$2" ../intermed-ca/certreqs/ekecc.pub.pem
+
+openssl req -new -nodes -newkey rsa:2048 -passin file:pass.txt -out ../intermed-ca/certreqs/nonsense.csr.pem
+
+#openssl req  -verify -in ../intermed-ca/certreqs/nonsense.csr.pem \
+#    -noout -text \
+#    -reqopt no_version,no_pubkey,no_sigdump \
+#    -nameopt multiline
+
+pushd ../intermed-ca
+export OPENSSL_CONF=./intermed-ca.cnf
+
+openssl x509 -req -in certreqs/nonsense.csr.pem -force_pubkey certreqs/ekecc.pub.pem -out certs/ekecc.cert.der \
+    -outform DER -extfile ../ek/ek.cnf -extensions ek_ext -set_serial 12345 \
+    -CA intermed-ca.cert.pem -CAkey private/intermed-ca.key.pem -passin file:pass.txt
+
+#openssl x509 -req -in csrs/oemProvCertTPM.csr -extfile configs/oemProvCertTPM.cnf -extensions ext -CA certs/oemSubCA2Cert.pem -CAkey privateKeys/oemSubCA2.key -passin file:passphrase.txt -set_serial 12345 -days $validity_oem_prov_cert -force_pubkey pc.pub.pem -out certs/oemProvCertTPM.pem
+
+cp certs/ekecc.cert.der ../ek
+
+popd #intermed-ca
+
+#openssl x509 -in ek.cert.der -inform DER -text -no out
+#openssl rsa -in ek.pub.pem -pubin -text -noout
+#openssl asn1parse -in ek.cert.der -inform DER
+
+popd #EK
+
+popd #CA_DIR
+
+cp "${CA_DIR}/ek/ek.cert.der" "$3"
+cp "${CA_DIR}/ek/ekecc.cert.der" "$4"
+cp "${CA_DIR}/intermed-ca/intermed-ca.cert.pem" "$5"
+cp "${CA_DIR}/root-ca/root-ca.cert.pem" "$6"
+
+rm -rf $CA_DIR

diff --git a/script/ekca/ek.cnf b/script/ekca/ek.cnf
new file mode 100644
index 0000000..60cd380
--- /dev/null
+++ b/script/ekca/ek.cnf

@@ -0,0 +1,64 @@
+oid_section = tcg_oids
+
+[ tcg_oids ]
+tcg-sv-tpm20            = 2.23.133.1.2
+tcg-at-tpmManufacturer  = 2.23.133.2.1
+tcg-at-tpmModel         = 2.23.133.2.2
+tcg-at-tpmVersion       = 2.23.133.2.3
+tcg-at-tpmSpecification = 2.23.133.2.16
+tcg-at-tpmSecurityAssertions = 2.23.133.2.18
+tcg-kp-EKCertificate    = 2.23.133.8.1
+
+[ req ]
+prompt                  = no
+distinguished_name      = distinguished_name
+subjectAltName          = subject_alt_name
+
+[ distinguished_name ]
+commonName              = this-tpm-sim
+organizationName        = tpm2-tss-testsuit
+
+[ req_ext ]
+subjectKeyIdentifier    = hash
+
+[ ek_ext ]
+certificatePolicies     = @polsect
+subjectAltName          = dirName:subAltName
+basicConstraints        = critical, CA:FALSE
+subjectDirectoryAttributes = ASN1:SEQUENCE:subDirAttr
+authorityKeyIdentifier  = keyid:always
+authorityInfoAccess     = caIssuers;URI.0:http://tpm2-software.github.io
+keyUsage                = critical, keyEncipherment
+#extendedKeyUsage        = tcg-kp-EKCertificate
+extendedKeyUsage        = 2.23.133.8.1
+
+[ polsect ]
+policyIdentifier = anyPolicy
+CPS.1="http://my.host.name/"
+
+[ subAltName ]
+#TPMManufacturer = 'TSS2'
+.2.23.133.2.1 = id:54535332
+.2.23.133.2.2 = tpmsimulator
+.2.23.133.2.3 = id:00020008
+
+#TODO: Remove
+[ subAltName1 ]
+C=DE
+O=Testing
+OU=whatever
+commonName=abc
+
+[ subDirAttr ]
+tcg-at-tpmSpecification = SEQUENCE:tpmspec
+#tcg-at-tpmSecurityAssertions = SEQUENCE:secassert
+
+[ tpmspec ]
+family = UTF8:2.0
+level = INT:0
+revision = INT:138
+
+#[ secassert ]
+#version = INT:0
+#fieldUpgradable = BOOL:false
+#...

diff --git a/script/ekca/intermed-ca.cnf b/script/ekca/intermed-ca.cnf
new file mode 100644
index 0000000..0b0853a
--- /dev/null
+++ b/script/ekca/intermed-ca.cnf

@@ -0,0 +1,153 @@
+#
+# OpenSSL configuration for the Intermediate Certification Authority.
+#
+
+#
+# This definition doesn't work if HOME isn't defined.
+CA_HOME                 = .
+RANDFILE                = $ENV::CA_HOME/private/.rnd
+oid_section             = new_oids
+
+#
+# XMPP address Support
+[ new_oids ]
+xmppAddr          = 1.3.6.1.5.5.7.8.5
+dnsSRV            = 1.3.6.1.5.5.7.8.7
+
+#
+# Default Certification Authority
+[ ca ]
+default_ca              = intermed_ca
+
+#
+# Intermediate Certification Authority
+[ intermed_ca ]
+dir                     = $ENV::CA_HOME
+certs                   = $dir/certs
+serial                  = $dir/intermed-ca.serial
+database                = $dir/intermed-ca.index
+new_certs_dir           = $dir/newcerts
+certificate             = $dir/intermed-ca.cert.pem
+private_key             = $dir/private/intermed-ca.key.pem
+default_days            = 730 # Two years
+crl                     = $dir/crl/intermed-ca.crl
+crl_dir                 = $dir/crl
+crlnumber               = $dir/intermed-ca.crlnum
+name_opt                = multiline, align
+cert_opt                = no_pubkey
+copy_extensions         = copy
+crl_extensions          = crl_ext
+default_crl_days        = 30
+default_md              = sha256
+preserve                = no
+email_in_dn             = no
+policy                  = policy
+unique_subject          = no
+
+#
+# Distinguished Name Policy
+[ policy ]
+countryName             = optional
+stateOrProvinceName     = optional
+localityName            = optional
+organizationName        = optional
+organizationalUnitName  = optional
+commonName              = supplied
+
+#
+# Distinguished Name Policy for Personal Certificates
+[ user_policy ]
+countryName             = supplied
+stateOrProvinceName     = optional
+localityName            = supplied
+organizationName        = optional
+organizationalUnitName  = optional
+commonName              = supplied
+emailAddress            = supplied
+#xmppAddr               = optional # Added to SubjAltName by req
+
+#
+# Intermediate CA request options
+[ req ]
+default_bits            = 2048
+default_keyfile         = private/intermed-ca.key.pem
+encrypt_key             = yes
+default_md              = sha256
+string_mask             = utf8only
+utf8                    = yes
+prompt                  = no
+req_extensions          = req_ext
+distinguished_name      = distinguished_name
+subjectAltName          = subject_alt_name
+
+#
+# Intermediate CA Request Extensions
+[ req_ext ]
+subjectKeyIdentifier    = hash
+subjectAltName          = @subject_alt_name
+
+#
+# Distinguished Name (DN)
+[ distinguished_name ]
+organizationName        = tpm2-software
+commonName              = intermed ek ca
+
+#
+# Server Certificate Extensions
+[ server_ext ]
+basicConstraints        = CA:FALSE
+keyUsage                = critical, digitalSignature, keyEncipherment
+extendedKeyUsage        = critical, serverAuth, clientAuth
+subjectKeyIdentifier    = hash
+authorityKeyIdentifier  = keyid:always
+issuerAltName           = issuer:copy
+authorityInfoAccess     = @auth_info_access
+crlDistributionPoints   = crl_dist
+
+#
+# Client Certificate Extensions
+[ client_ext ]
+basicConstraints        = CA:FALSE
+keyUsage                = critical, digitalSignature
+extendedKeyUsage        = critical, clientAuth
+subjectKeyIdentifier    = hash
+authorityKeyIdentifier  = keyid:always
+issuerAltName           = issuer:copy
+authorityInfoAccess     = @auth_info_access
+crlDistributionPoints   = crl_dist
+
+#
+# User Certificate Extensions
+[ user_ext ]
+basicConstraints        = CA:FALSE
+keyUsage                = critical, digitalSignature
+extendedKeyUsage        = critical, clientAuth, emailProtection
+subjectKeyIdentifier    = hash
+authorityKeyIdentifier  = keyid:always
+issuerAltName           = issuer:copy
+authorityInfoAccess     = @auth_info_access
+crlDistributionPoints   = crl_dist
+
+#
+# CRL Certificate Extensions
+[ crl_ext ]
+authorityKeyIdentifier  = keyid:always
+issuerAltName           = issuer:copy
+
+#
+# Certificate Authorities Alternative Names
+[ subject_alt_name ]
+URI                     = http://ca.example.net/
+email                   = certmaster@example.net
+
+#
+# Certificate download addresses for the intermediate CA
+[ auth_info_access ]
+caIssuers;URI           = http://ca.example.net/certs/example.net_Intermediate_Certification_Authority.cert.pem
+
+#
+# CRL Download address for the intermediate CA
+[ crl_dist ]
+fullname                = URI:http://ca.example.net/crl/example.net_Intermediate_Certification_Authority.crl
+
+# EOF

diff --git a/script/ekca/root-ca.cnf b/script/ekca/root-ca.cnf
new file mode 100644
index 0000000..25b2770
--- /dev/null
+++ b/script/ekca/root-ca.cnf

@@ -0,0 +1,131 @@
+#
+# OpenSSL configuration for the Root Certification Authority.
+#
+
+#
+# This definition doesn't work if HOME isn't defined.
+CA_HOME                 = .
+RANDFILE                = $ENV::CA_HOME/private/.rnd
+
+#
+# Default Certification Authority
+[ ca ]
+default_ca              = root_ca
+
+#
+# Root Certification Authority
+[ root_ca ]
+dir                     = $ENV::CA_HOME
+certs                   = $dir/certs
+serial                  = $dir/root-ca.serial
+database                = $dir/root-ca.index
+new_certs_dir           = $dir/newcerts
+certificate             = $dir/root-ca.cert.pem
+private_key             = $dir/private/root-ca.key.pem
+default_days            = 1826 # Five years
+crl                     = $dir/root-ca.crl
+crl_dir                 = $dir/crl
+crlnumber               = $dir/root-ca.crlnum
+name_opt                = multiline, align
+cert_opt                = no_pubkey
+copy_extensions         = copy
+crl_extensions          = crl_ext
+default_crl_days        = 180
+default_md              = sha256
+preserve                = no
+email_in_dn             = no
+policy                  = policy
+unique_subject          = no
+
+#
+# Distinguished Name Policy for CAs
+[ policy ]
+countryName             = optional
+stateOrProvinceName     = optional
+localityName            = optional
+organizationName        = supplied
+organizationalUnitName  = optional
+commonName              = supplied
+
+#
+# Root CA Request Options
+[ req ]
+default_bits            = 4096
+default_keyfile         = private/root-ca.key.pem
+encrypt_key             = yes
+default_md              = sha256
+string_mask             = utf8only
+utf8                    = yes
+prompt                  = no
+req_extensions          = root-ca_req_ext
+distinguished_name      = distinguished_name
+subjectAltName          = @subject_alt_name
+
+#
+# Root CA Request Extensions
+[ root-ca_req_ext ]
+subjectKeyIdentifier    = hash
+subjectAltName          = @subject_alt_name
+
+#
+# Distinguished Name (DN)
+[ distinguished_name ]
+organizationName        = example.net
+commonName              = example.net Root Certification Authority
+
+#
+# Root CA Certificate Extensions
+[ root-ca_ext ]
+basicConstraints        = critical, CA:true
+keyUsage                = critical, keyCertSign, cRLSign
+nameConstraints         = critical, @name_constraints
+subjectKeyIdentifier    = hash
+subjectAltName          = @subject_alt_name
+authorityKeyIdentifier  = keyid:always
+issuerAltName           = issuer:copy
+authorityInfoAccess     = @auth_info_access
+crlDistributionPoints   = crl_dist
+
+#
+# Intermediate CA Certificate Extensions
+[ intermed-ca_ext ]
+basicConstraints        = critical, CA:true, pathlen:0
+keyUsage                = critical, keyCertSign, cRLSign
+subjectKeyIdentifier    = hash
+subjectAltName          = @subject_alt_name
+authorityKeyIdentifier  = keyid:always
+issuerAltName           = issuer:copy
+authorityInfoAccess     = @auth_info_access
+crlDistributionPoints   = crl_dist
+
+#
+# CRL Certificate Extensions
+[ crl_ext ]
+authorityKeyIdentifier  = keyid:always
+issuerAltName           = issuer:copy
+
+#
+# Certificate Authorities Alternative Names
+[ subject_alt_name ]
+URI                     = http://ca.example.net/
+email                   = certmaster@example.net
+
+#
+# Name Constraints
+[ name_constraints ]
+permitted;DNS.1         = example.net
+permitted;DNS.2         = example.org
+permitted;DNS.3         = lan
+permitted;DNS.4         = onion
+permitted;email.1       = example.net
+permitted;email.2       = example.org
+
+#
+# Certificate download addresses for the root CA
+[ auth_info_access ]
+caIssuers;URI           = http://ca.example.net/certs/example.net_Root_Certification_Authority.cert.pem
+
+#
+# CRL Download address for the root CA
+[ crl_dist ]
+fullname                = URI:http://ca.example.net/crl/example.net_Root_Certification_Authority.crl

diff --git a/script/int-log-compiler-ptpm.sh b/script/int-log-compiler-ptpm.sh
index 2dc45c9..63a5303 100755
--- a/script/int-log-compiler-ptpm.sh
+++ b/script/int-log-compiler-ptpm.sh

@@ -88,7 +88,7 @@
     G_MESSAGES_DEBUG=all ./test/helper/tpm_transientempty
 if [ $? -ne 0 ]; then
     echo "TPM transient area not empty => skipping"
-    ret=77
+    ret=99
     break
 fi
 
@@ -97,6 +97,7 @@
 
 env TPM20TEST_TCTI_NAME="device" \
     TPM20TEST_DEVICE_FILE=${PTPM} \
+    TPM20TEST_TCTI="device:${PTPM}" \
     G_MESSAGES_DEBUG=all ./test/helper/tpm_dumpstate>$TPMSTATE_FILE1
 if [ $? -ne 0 ]; then
     echo "Error during dumpstate"
@@ -107,12 +108,14 @@
 echo "Execute the test script"
 env TPM20TEST_TCTI_NAME="device" \
     TPM20TEST_DEVICE_FILE=${PTPM} \
+    TPM20TEST_TCTI="device:${PTPM}" \
     G_MESSAGES_DEBUG=all $@
 ret=$?
 echo "Script returned $ret"
 
 env TPM20TEST_TCTI_NAME="device" \
     TPM20TEST_DEVICE_FILE=${PTPM} \
+    TPM20TEST_TCTI="device:${PTPM}" \
     G_MESSAGES_DEBUG=all ./test/helper/tpm_dumpstate>$TPMSTATE_FILE2
 if [ $? -ne 0 ]; then
     echo "Error during dumpstate"

diff --git a/script/int-log-compiler.sh b/script/int-log-compiler.sh
index f5d622a..a7a17d7 100755
--- a/script/int-log-compiler.sh
+++ b/script/int-log-compiler.sh

@@ -228,6 +228,7 @@
 env TPM20TEST_TCTI_NAME="socket" \
     TPM20TEST_SOCKET_ADDRESS="127.0.0.1" \
     TPM20TEST_SOCKET_PORT="${SIM_PORT_DATA}" \
+    TPM20TEST_TCTI="mssim:host=127.0.0.1,port=${SIM_PORT_DATA}" \
     G_MESSAGES_DEBUG=all ./test/helper/tpm_startup
 if [ $? -ne 0 ]; then
     echo "TPM_StartUp failed"
@@ -235,13 +236,81 @@
     break
 fi
 
+EKPUB_FILE=${TEST_BIN}_ekpub.pem
+EKCERT_FILE=${TEST_BIN}_ekcert.crt
+INTERMEDCA_FILE=${TEST_BIN}_intermed-ca.pem
+ROOTCA_FILE=${TEST_BIN}_root-ca.pem
+
 env TPM20TEST_TCTI_NAME="socket" \
     TPM20TEST_SOCKET_ADDRESS="127.0.0.1" \
     TPM20TEST_SOCKET_PORT="${SIM_PORT_DATA}" \
+    TPM20TEST_TCTI="mssim:host=127.0.0.1,port=${SIM_PORT_DATA}" \
+    G_MESSAGES_DEBUG=all ./test/helper/tpm_getek>$EKPUB_FILE
+if [ $? -ne 0 ]; then
+    echo "TPM_getek failed"
+    ret=99
+    break
+fi
+
+EKECCPUB_FILE=${TEST_BIN}_ekeccpub.pem
+EKECCCERT_FILE=${TEST_BIN}_ekecccert.crt
+INTERMEDCA_FILE=${TEST_BIN}_intermedecc-ca.pem
+ROOTCA_FILE=${TEST_BIN}_root-ca.pem
+
+env TPM20TEST_TCTI_NAME="socket" \
+    TPM20TEST_SOCKET_ADDRESS="127.0.0.1" \
+    TPM20TEST_SOCKET_PORT="${SIM_PORT_DATA}" \
+    TPM20TEST_TCTI="mssim:host=127.0.0.1,port=${SIM_PORT_DATA}" \
+    G_MESSAGES_DEBUG=all ./test/helper/tpm_getek_ecc>$EKECCPUB_FILE
+if [ $? -ne 0 ]; then
+    echo "TPM_getek_ecc failed"
+    ret=99
+    break
+fi
+
+SCRIPTDIR="$(dirname $(realpath $0))/"
+${SCRIPTDIR}/ekca/create_ca.sh "${EKPUB_FILE}" "${EKECCPUB_FILE}" "${EKCERT_FILE}" \
+                               "${EKECCCERT_FILE}" "${INTERMEDCA_FILE}" "${ROOTCA_FILE}" >${TEST_BIN}_ca.log 2>&1
+if [ $? -ne 0 ]; then
+    echo "ek-cert ca failed"
+    ret=99
+    break
+fi
+
+#hd $EKCERT_FILE
+#openssl x509 -in $EKCERT_FILE -inform DER -text -noout
+
+cat $EKCERT_FILE | \
+env TPM20TEST_TCTI_NAME="socket" \
+    TPM20TEST_SOCKET_ADDRESS="127.0.0.1" \
+    TPM20TEST_SOCKET_PORT="${SIM_PORT_DATA}" \
+    TPM20TEST_TCTI="mssim:host=127.0.0.1,port=${SIM_PORT_DATA}" \
+    G_MESSAGES_DEBUG=all ./test/helper/tpm_writeekcert 1C00002
+if [ $? -ne 0 ]; then
+    echo "TPM_writeekcert failed"
+    ret=99
+    break
+fi
+
+cat $EKECCCERT_FILE | \
+env TPM20TEST_TCTI_NAME="socket" \
+    TPM20TEST_SOCKET_ADDRESS="127.0.0.1" \
+    TPM20TEST_SOCKET_PORT="${SIM_PORT_DATA}" \
+    TPM20TEST_TCTI="mssim:host=127.0.0.1,port=${SIM_PORT_DATA}" \
+    G_MESSAGES_DEBUG=all ./test/helper/tpm_writeekcert 1C0000A
+if [ $? -ne 0 ]; then
+    echo "TPM_writeekcert failed"
+    ret=99
+fi
+
+env TPM20TEST_TCTI_NAME="socket" \
+    TPM20TEST_SOCKET_ADDRESS="127.0.0.1" \
+    TPM20TEST_SOCKET_PORT="${SIM_PORT_DATA}" \
+    TPM20TEST_TCTI="mssim:host=127.0.0.1,port=${SIM_PORT_DATA}" \
     G_MESSAGES_DEBUG=all ./test/helper/tpm_transientempty
 if [ $? -ne 0 ]; then
     echo "TPM transient area not empty => skipping"
-    ret=77
+    ret=99
     break
 fi
 
@@ -251,6 +320,7 @@
 env TPM20TEST_TCTI_NAME="socket" \
     TPM20TEST_SOCKET_ADDRESS="127.0.0.1" \
     TPM20TEST_SOCKET_PORT="${SIM_PORT_DATA}" \
+    TPM20TEST_TCTI="mssim:host=127.0.0.1,port=${SIM_PORT_DATA}" \
     G_MESSAGES_DEBUG=all ./test/helper/tpm_dumpstate>$TPMSTATE_FILE1
 if [ $? -ne 0 ]; then
     echo "Error during dumpstate"
@@ -262,6 +332,9 @@
 env TPM20TEST_TCTI_NAME="socket" \
     TPM20TEST_SOCKET_ADDRESS="127.0.0.1" \
     TPM20TEST_SOCKET_PORT="${SIM_PORT_DATA}" \
+    TPM20TEST_TCTI="mssim:host=127.0.0.1,port=${SIM_PORT_DATA}" \
+    INTERMEDCA=$INTERMEDCA_FILE \
+    ROOTCA=$ROOTCA_FILE \
     G_MESSAGES_DEBUG=all $@
 ret=$?
 echo "Script returned $ret"
@@ -270,6 +343,7 @@
 env TPM20TEST_TCTI_NAME="socket" \
     TPM20TEST_SOCKET_ADDRESS="127.0.0.1" \
     TPM20TEST_SOCKET_PORT="${SIM_PORT_DATA}" \
+    TPM20TEST_TCTI="mssim:host=127.0.0.1,port=${SIM_PORT_DATA}" \
     G_MESSAGES_DEBUG=all ./test/helper/tpm_dumpstate>$TPMSTATE_FILE2
 if [ $? -ne 0 ]; then
     echo "Error during dumpstate"
@@ -295,6 +369,7 @@
 env TPM20TEST_TCTI_NAME="socket" \
     TPM20TEST_SOCKET_ADDRESS="127.0.0.1" \
     TPM20TEST_SOCKET_PORT="${SIM_PORT_DATA}" \
+    TPM20TEST_TCTI="mssim:host=127.0.0.1,port=${SIM_PORT_DATA}" \
     G_MESSAGES_DEBUG=all ./test/helper/tpm_dumpstate>$TPMSTATE_FILE2
 if [ $? -ne 0 ]; then
     echo "Error during dumpstate"
@@ -322,4 +397,5 @@
 # teardown
 daemon_stop ${SIM_PID_FILE}
 rm -rf ${SIM_TMP_DIR} ${SIM_PID_FILE}
+
 exit $ret

diff --git a/src/tss2-esys/esys_free.c b/src/tss2-esys/esys_free.c
index d5bac86..5a2ee64 100644
--- a/src/tss2-esys/esys_free.c
+++ b/src/tss2-esys/esys_free.c

@@ -15,4 +15,4 @@
     if (__ptr != NULL) {
         free(__ptr);
     }
-}
\ No newline at end of file
+}

diff --git a/src/tss2-esys/esys_tr.c b/src/tss2-esys/esys_tr.c
index e79f839..61b5440 100644
--- a/src/tss2-esys/esys_tr.c
+++ b/src/tss2-esys/esys_tr.c

@@ -604,7 +604,7 @@
  * PlolicyAuthValue are used for a session.
  * @param esys_context [in,out] The ESYS_CONTEXT.
  * @param esys_handle [in,out] The ESYS_TRsess for which to retrieve the nonce.
- * @param auth_needed [out] The boolean indicating whether auth value will be 
+ * @param neeed [out] The boolean indicating whether auth value will be
  *                    needed.
  * @retval TSS2_RC_SUCCESS on Success.
  * @retval TSS2_ESYS_RC_GENERAL_FAILURE for errors of the crypto library.
@@ -626,7 +626,7 @@
         return_if_error(TSS2_ESYS_RC_BAD_TR,
                         "Auth value needed for non-session object requested.");
     }
-    
+
     if (esys_object->rsrc.misc.rsrc_session.type_policy_session == POLICY_AUTH ||
         esys_object->rsrc.misc.rsrc_session.type_policy_session == POLICY_PASSWORD)
         *auth_needed = TPM2_YES;

diff --git a/src/tss2-fapi/api/Fapi_AuthorizePolicy.c b/src/tss2-fapi/api/Fapi_AuthorizePolicy.c
new file mode 100644
index 0000000..b776716
--- /dev/null
+++ b/src/tss2-fapi/api/Fapi_AuthorizePolicy.c

@@ -0,0 +1,329 @@
+/* SPDX-License-Identifier: BSD-2-Clause */
+/*******************************************************************************
+ * Copyright 2018-2019, Fraunhofer SIT sponsored by Infineon Technologies AG
+ * All rights reserved.
+ ******************************************************************************/
+
+#ifdef HAVE_CONFIG_H
+#include <config.h>
+#endif
+
+#include "tss2_fapi.h"
+#include "fapi_int.h"
+#include "fapi_util.h"
+#include "tss2_esys.h"
+#include "fapi_policy.h"
+#include "fapi_crypto.h"
+#define LOGMODULE fapi
+#include "util/log.h"
+#include "util/aux_util.h"
+
+/** One-Call function for Fapi_AuthorizePolicy
+ *
+ * If a current policy happens to be a PolicyAuthorize, then for it to be used,
+ * the user must first satisfy a policy authorized by a having been signed (and
+ * made into a ticket) by an authorized party.
+ *
+ * @param[in, out] context The FAPI context
+ * @param[in] policyPath The path to the policy file
+ * @param[in] keyPath The path to the signing key
+ * @param[in] policyRef A byte buffer that is included in the signature. May be
+ * 						NULL
+ * @param[in] policyRefSize The size of policyRef. Must be 0 if policyRef is
+ * 						NULL
+ *
+ * @retval TSS2_RC_SUCCESS: if the function call was a success.
+ * @retval TSS2_FAPI_RC_BAD_REFERENCE: if context, policyPath or keyPath
+ *         is NULL.
+ * @retval TSS2_FAPI_RC_BAD_CONTEXT: if context corruption is detected.
+ * @retval TSS2_FAPI_RC_BAD_PATH: if policyPath or keyPath does not
+ *         map to a FAPI policy or key object.
+ * @retval TSS2_FAPI_RC_BAD_SEQUENCE: if the context has an asynchronous
+ *         operation already pending.
+ * @retval TSS2_FAPI_RC_IO_ERROR: if the data cannot be saved.
+ * @retval TSS2_FAPI_RC_MEMORY: if the FAPI cannot allocate enough memory for
+ *         internal operations or return parameters.
+ */
+TSS2_RC
+Fapi_AuthorizePolicy(
+    FAPI_CONTEXT  *context,
+    char    const *policyPath,
+    char    const *keyPath,
+    uint8_t const *policyRef,
+    size_t         policyRefSize)
+{
+    TSS2_RC r, r2;
+
+    LOG_TRACE("called for context:%p", context);
+
+    /* Check for NULL parameters */
+    check_not_null(context);
+    check_not_null(policyPath);
+    check_not_null(keyPath);
+
+    /* Check whether TCTI and ESYS are initialized */
+    return_if_null(context->esys, "Command can't be executed in none TPM mode.",
+                   TSS2_FAPI_RC_NO_TPM);
+
+    /* If the async state automata of FAPI shall be tested, then we must not set
+       the timeouts of ESYS to blocking mode.
+       During testing, the mssim tcti will ensure multiple re-invocations.
+       Usually however the synchronous invocations of FAPI shall instruct ESYS
+       to block until a result is available. */
+#ifndef TEST_FAPI_ASYNC
+    r = Esys_SetTimeout(context->esys, TSS2_TCTI_TIMEOUT_BLOCK);
+    return_if_error_reset_state(r, "Set Timeout to blocking");
+#endif /* TEST_FAPI_ASYNC */
+
+    r = Fapi_AuthorizePolicy_Async(context, policyPath, keyPath,
+                                   policyRef, policyRefSize);
+    return_if_error_reset_state(r, "Policy_AuthorizeNewpolicy");
+
+    do {
+        /* We wait for file I/O to be ready if the FAPI state automata
+           are in a file I/O state. */
+        r = ifapi_io_poll(&context->io);
+        return_if_error(r, "Something went wrong with IO polling");
+
+        /* Repeatedly call the finish function, until FAPI has transitioned
+           through all execution stages / states of this invocation. */
+        r = Fapi_AuthorizePolicy_Finish(context);
+    } while ((r & ~TSS2_RC_LAYER_MASK) == TSS2_BASE_RC_TRY_AGAIN);
+
+    /* Reset the ESYS timeout to non-blocking, immediate response. */
+    r2 = Esys_SetTimeout(context->esys, 0);
+    return_if_error(r2, "Set Timeout to non-blocking");
+
+    return_if_error_reset_state(r, "PolicyAuthorizeNewPolicy");
+
+    return TSS2_RC_SUCCESS;
+}
+
+/** Asynchronous function for Fapi_AuthorizePolicy
+ *
+ * If a current policy happens to be a PolicyAuthorize, then for it to be used,
+ * the user must first satisfy a policy authorized by a having been signed (and
+ * made into a ticket) by an authorized party.
+ *
+ * Call Fapi_AuthorizePolicy_Finish to finish the execution of this command.
+ *
+ * @param[in, out] context The FAPI context
+ * @param[in] policyPath The path to the policy file
+ * @param[in] keyPath The path to the signing key
+ * @param[in] policyRef A byte buffer that is included in the signature. May be
+ * 						NULL
+ * @param[in] policyRefSize The size of policyRef. Must be 0 if policyRef is
+ * 						NULL
+ *
+ * @retval TSS2_RC_SUCCESS: if the function call was a success.
+ * @retval TSS2_FAPI_RC_BAD_REFERENCE: if context, policyPath or keyPath
+ *         is NULL.
+ * @retval TSS2_FAPI_RC_BAD_CONTEXT: if context corruption is detected.
+ * @retval TSS2_FAPI_RC_BAD_PATH: if policyPath or keyPath does not
+ *         map to a FAPI policy or key object.
+ * @retval TSS2_FAPI_RC_BAD_SEQUENCE: if the context has an asynchronous
+ *         operation already pending.
+ * @retval TSS2_FAPI_RC_IO_ERROR: if the data cannot be saved.
+ * @retval TSS2_FAPI_RC_MEMORY: if the FAPI cannot allocate enough memory for
+ *         internal operations or return parameters.
+ */
+TSS2_RC
+Fapi_AuthorizePolicy_Async(
+    FAPI_CONTEXT  *context,
+    char    const *policyPath,
+    char    const *keyPath,
+    uint8_t const *policyRef,
+    size_t         policyRefSize)
+{
+    LOG_TRACE("called for context:%p", context);
+    LOG_TRACE("policyPath: %s", policyPath);
+    LOG_TRACE("keyPath: %s", keyPath);
+    if (policyRef) {
+        LOGBLOB_TRACE(policyRef, policyRefSize, "policyRef");
+    } else {
+        LOG_TRACE("policyRef: (null) policyRefSize: %zi", policyRefSize);
+    }
+
+    TSS2_RC r;
+    IFAPI_Fapi_AuthorizePolicy *policy;
+
+    /* Check for NULL parameters */
+    check_not_null(context);
+    check_not_null(policyPath);
+    check_not_null(keyPath);
+
+    r = ifapi_session_init(context);
+    return_if_error(r, "Initialize AuthorizePolicy");
+
+    policy = &context->cmd.Policy_AuthorizeNewPolicy;
+    strdup_check(policy->policyPath, policyPath, r, error_cleanup);
+    strdup_check(policy->signingKeyPath, keyPath, r, error_cleanup);
+    if (policyRef) {
+        FAPI_COPY_DIGEST(&policy->policyRef.buffer[0],
+                         policy->policyRef.size, policyRef, policyRefSize);
+    } else {
+        policy->policyRef.size = 0;
+    }
+    r = ifapi_session_init(context);
+    goto_if_error(r, "Initialize PolicyAuthorizeNewPolicy", error_cleanup);
+
+    context->state = AUTHORIZE_NEW_LOAD_KEY;
+
+    LOG_TRACE("finsihed");
+    return TSS2_RC_SUCCESS;
+error_cleanup:
+    SAFE_FREE(policy->policyPath);
+    SAFE_FREE(policy->signingKeyPath);
+    return r;
+}
+
+/** Asynchronous finish function for Fapi_AuthorizePolicy
+ *
+ * This function should be called after a previous Fapi_AuthorizePolicy_Async.
+ *
+ * @param [in, out] context The FAPI_CONTEXT
+ *
+ * @retval TSS2_RC_SUCCESS: if the function call was a success.
+ * @retval TSS2_FAPI_RC_BAD_REFERENCE: if context is NULL.
+ * @retval TSS2_FAPI_RC_BAD_CONTEXT: if context corruption is detected.
+ * @retval TSS2_FAPI_RC_BAD_SEQUENCE: if the context has an asynchronous
+ *         operation already pending.
+ * @retval TSS2_FAPI_RC_IO_ERROR: if the data cannot be saved.
+ * @retval TSS2_FAPI_RC_MEMORY: if the FAPI cannot allocate enough memory for
+ *         internal operations or return parameters.
+ * @retval TSS2_FAPI_RC_TRY_AGAIN: if the asynchronous operation is not yet
+ *         complete. Call this function again later.
+ */
+TSS2_RC
+Fapi_AuthorizePolicy_Finish(
+    FAPI_CONTEXT *context)
+{
+    LOG_TRACE("called for context:%p", context);
+
+    TSS2_RC r;
+    TPMI_ALG_HASH hashAlg;
+    IFAPI_CRYPTO_CONTEXT_BLOB *cryptoContext;
+    size_t hashSize;
+    size_t digestIdx;
+    TPM2B_DIGEST aHash;
+    char *publicKey = NULL;
+
+    /* Check for NULL parameters */
+    check_not_null(context);
+
+    /* Helpful alias pointers */
+    IFAPI_Fapi_AuthorizePolicy * command =
+        &context->cmd.Policy_AuthorizeNewPolicy;
+    TPMS_POLICYAUTHORIZATION *authorization = &command->authorization;
+    TPMS_POLICY_HARNESS *policyHarness = &context->policy.harness;
+    TPMT_SIGNATURE *signature;
+    IFAPI_OBJECT ** keyObject = &context->Key_Sign.key_object;
+
+    switch (context->state) {
+        statecase(context->state, AUTHORIZE_NEW_LOAD_KEY);
+            r = ifapi_load_key(context, command->signingKeyPath,
+                               keyObject);
+            return_try_again(r);
+            goto_if_error(r, "Fapi sign.", cleanup);
+
+            context->state = AUTHORIZE_NEW_CALCULATE_POLICY;
+            fallthrough;
+
+        statecase(context->state, AUTHORIZE_NEW_CALCULATE_POLICY);
+            /*
+             * NameAlg of signing key will be used to compute the aHash digest.
+             * This NameAlg will also be used to compute the policy digest.
+             * Thus the NameAlg must be equal to the NameAlg of the object to
+             * be authorized.
+             */
+            hashAlg = (*keyObject)->misc.key.public.publicArea.nameAlg;
+
+            if (!(hashSize = ifapi_hash_get_digest_size(hashAlg))) {
+                goto_error(r, TSS2_ESYS_RC_NOT_IMPLEMENTED,
+                           "Unsupported hash algorithm (%" PRIu16 ")",
+                           cleanup, hashAlg);
+            }
+
+            r = ifapi_calculate_tree(context,
+                                     command->policyPath, policyHarness,
+                                     hashAlg, &digestIdx, &hashSize);
+            return_try_again(r);
+            goto_if_error(r, "Fapi calculate tree.", cleanup);
+
+            /* Compute aHash from policy digest and policyRef */
+            r = ifapi_crypto_hash_start(&cryptoContext, hashAlg);
+            goto_if_error(r, "crypto hash start", cleanup);
+
+            HASH_UPDATE_BUFFER(cryptoContext,
+                               &policyHarness->
+                               policyDigests.digests[digestIdx].digest, hashSize,
+                               r, cleanup);
+            if (command->policyRef.size > 0) {
+                HASH_UPDATE_BUFFER(cryptoContext,
+                                   &command->policyRef.buffer[0],
+                                   command->policyRef.size, r, cleanup);
+            }
+            r = ifapi_crypto_hash_finish(&cryptoContext,
+                                         (uint8_t *) & aHash.buffer[0], &hashSize);
+            goto_if_error(r, "crypto hash finish", cleanup);
+
+            aHash.size = hashSize;
+            context->state = AUTHORIZE_NEW_KEY_SIGN_POLICY;
+            fallthrough;
+
+        statecase(context->state, AUTHORIZE_NEW_KEY_SIGN_POLICY);
+            r = ifapi_key_sign(context, *keyObject, NULL,
+                               &aHash, &signature, &publicKey, NULL);
+            return_try_again(r);
+            goto_if_error(r, "Fapi sign.", cleanup);
+
+            SAFE_FREE(publicKey);
+            authorization->signature = *signature;
+            authorization->policyRef = command->policyRef;
+            strdup_check(authorization->type, "tpm", r, cleanup);
+            authorization->key =
+                (*keyObject)->misc.key.public.publicArea;
+            SAFE_FREE(signature);
+            ifapi_cleanup_ifapi_object(*keyObject);
+
+            ifapi_extend_authorization(policyHarness, authorization);
+            goto_if_null(policyHarness->policyAuthorizations,
+                         "Out of memory", TSS2_FAPI_RC_MEMORY, cleanup);
+            context->state = AUTHORIZE_NEW_WRITE_POLICY;
+            fallthrough;
+
+        statecase(context->state, AUTHORIZE_NEW_WRITE_POLICY_PREPARE);
+            r = ifapi_policy_store_store_async(&context->pstore, &context->io,
+                                               command->policyPath, policyHarness);
+            goto_if_error_reset_state(r, "Could not open: %s", cleanup,
+                    command->policyPath);
+            fallthrough;
+
+        statecase(context->state, AUTHORIZE_NEW_WRITE_POLICY);
+            /* Save policy with computed digest */
+            r = ifapi_policy_store_store_finish(&context->pstore, &context->io);
+            return_try_again(r);
+            return_if_error_reset_state(r, "write_finish failed");
+            fallthrough;
+
+        statecase(context->state, AUTHORIZE_NEW_CLEANUP)
+            r = ifapi_cleanup_session(context);
+            try_again_or_error_goto(r, "Cleanup", cleanup);
+
+            context->state = _FAPI_STATE_INIT;
+            break;
+
+       statecasedefault(context->state);
+    }
+
+cleanup:
+    ifapi_session_clean(context);
+    ifapi_cleanup_policy_harness(policyHarness);
+    ifapi_cleanup_ifapi_object(&context->createPrimary.pkey_object);
+    ifapi_cleanup_ifapi_object(context->loadKey.key_object);
+    ifapi_cleanup_ifapi_object(&context->loadKey.auth_object);
+    SAFE_FREE(command->policyPath);
+    SAFE_FREE(command->signingKeyPath);
+    LOG_TRACE("finsihed");
+    return r;
+}

diff --git a/src/tss2-fapi/api/Fapi_ChangeAuth.c b/src/tss2-fapi/api/Fapi_ChangeAuth.c
new file mode 100644
index 0000000..ddb2325
--- /dev/null
+++ b/src/tss2-fapi/api/Fapi_ChangeAuth.c

@@ -0,0 +1,475 @@
+/* SPDX-License-Identifier: BSD-2-Clause */
+/*******************************************************************************
+ * Copyright 2018-2019, Fraunhofer SIT sponsored by Infineon Technologies AG
+ * All rights reserved.
+ ******************************************************************************/
+
+#ifdef HAVE_CONFIG_H
+#include <config.h>
+#endif
+
+#include <stdlib.h>
+#include <errno.h>
+#include <unistd.h>
+#include <errno.h>
+#include <string.h>
+
+#include "tss2_fapi.h"
+#include "fapi_int.h"
+#include "fapi_util.h"
+#include "tss2_esys.h"
+#define LOGMODULE fapi
+#include "util/log.h"
+#include "util/aux_util.h"
+#include "fapi_crypto.h"
+
+/** One-Call function for Fapi_ChangeAuth
+ *
+ * Changes the Authorization data of an entity found at keyPath. The parameter
+ * authValue is a 0-terminated UTF-8 encoded password.
+ * If it is longer than the digest size of the entity's nameAlg, it will be
+ * hashed according the the TPM specification part 1, rev 138, section 19.6.4.3.
+ *
+ * @param [in, out] context The FAPI_CONTEXT
+ * @param [in] entityPath The path to the entity to modify
+ * @param [in] authValue The new 0-terminated password to set for the entity.
+ *             May be NULL
+ *
+ * @retval TSS2_RC_SUCCESS: if the function call was a success.
+ * @retval TSS2_FAPI_RC_BAD_REFERENCE: if context or entityPath is NULL.
+ * @retval TSS2_FAPI_RC_BAD_CONTEXT: if context corruption is detected.
+ * @retval TSS2_FAPI_RC_BAD_PATH: if entityPath does not map to a FAPI entity.
+ * @retval TSS2_FAPI_RC_BAD_SEQUENCE: if the context has an asynchronous
+ *         operation already pending.
+ * @retval TSS2_FAPI_RC_STORAGE_ERROR: If the entity with the new password
+ *         cannot be saved.
+ * @retval TSS2_FAPI_RC_IO_ERROR: if the data cannot be saved.
+ * @retval TSS2_FAPI_RC_MEMORY: if the FAPI cannot allocate enough memory for
+ *         internal operations or return parameters.
+ */
+TSS2_RC
+Fapi_ChangeAuth(
+    FAPI_CONTEXT *context,
+    char   const *entityPath,
+    char   const *authValue)
+{
+    LOG_TRACE("called for context:%p", context);
+
+    TSS2_RC r, r2;
+
+    /* Check for NULL parameters */
+    check_not_null(context);
+    check_not_null(entityPath);
+
+    /* Check whether TCTI and ESYS are initialized */
+    return_if_null(context->esys, "Command can't be executed in none TPM mode.",
+                   TSS2_FAPI_RC_NO_TPM);
+
+    /* If the async state automata of FAPI shall be tested, then we must not set
+       the timeouts of ESYS to blocking mode.
+       During testing, the mssim tcti will ensure multiple re-invocations.
+       Usually however the synchronous invocations of FAPI shall instruct ESYS
+       to block until a result is available. */
+#ifndef TEST_FAPI_ASYNC
+    r = Esys_SetTimeout(context->esys, TSS2_TCTI_TIMEOUT_BLOCK);
+    return_if_error_reset_state(r, "Set Timeout to blocking");
+#endif /* TEST_FAPI_ASYNC */
+
+    r = Fapi_ChangeAuth_Async(context, entityPath, authValue);
+    return_if_error_reset_state(r, "Entity_ChangeAuth");
+
+    do {
+        /* We wait for file I/O to be ready if the FAPI state automata
+           are in a file I/O state. */
+        r = ifapi_io_poll(&context->io);
+        return_if_error(r, "Something went wrong with IO polling");
+
+        /* Repeatedly call the finish function, until FAPI has transitioned
+           through all execution stages / states of this invocation. */
+        r = Fapi_ChangeAuth_Finish(context);
+    } while ((r & ~TSS2_RC_LAYER_MASK) == TSS2_BASE_RC_TRY_AGAIN);
+
+    /* Reset the ESYS timeout to non-blocking, immediate response. */
+    r2 = Esys_SetTimeout(context->esys, 0);
+    return_if_error(r2, "Set Timeout to non-blocking");
+
+    return_if_error_reset_state(r, "Entity_ChangeAuth");
+
+    LOG_TRACE("finsihed");
+    return TSS2_RC_SUCCESS;
+}
+
+/** Asynchronous function for Fapi_ChangeAuth
+ *
+ * Changes the Authorization data of an entity found at keyPath. The parameter
+ * authValue is a 0-terminated UTF-8 encoded password.
+ * If it is longer than the digest size of the entity's nameAlg, it will be
+ * hashed according the the TPM specification part 1, rev 138, section 19.6.4.3.
+ *
+ * Call Fapi_ChangeAuth_Finish to finish the execution of this command.
+
+ * @param [in, out] context The FAPI_CONTEXT
+ * @param [in] entityPath The path to the entity to modify
+ * @param [in] authValue The new 0-terminated password to set for the entity.
+ *         May be NULL
+ *
+ * @retval TSS2_RC_SUCCESS: if the function call was a success.
+ * @retval TSS2_FAPI_RC_BAD_REFERENCE: if context or entityPath is NULL.
+ * @retval TSS2_FAPI_RC_BAD_CONTEXT: if context corruption is detected.
+ * @retval TSS2_FAPI_RC_BAD_PATH: if entityPath does not map to a FAPI entity.
+ * @retval TSS2_FAPI_RC_BAD_SEQUENCE: if the context has an asynchronous
+ *         operation already pending.
+ * @retval TSS2_FAPI_RC_STORAGE_ERROR: If the entity with the new password
+ *         cannot be saved.
+ * @retval TSS2_FAPI_RC_IO_ERROR: if the data cannot be saved.
+ * @retval TSS2_FAPI_RC_MEMORY: if the FAPI cannot allocate enough memory for
+ *         internal operations or return parameters.
+ */
+TSS2_RC
+Fapi_ChangeAuth_Async(
+    FAPI_CONTEXT  *context,
+    char    const *entityPath,
+    char    const *authValue)
+{
+    LOG_TRACE("called for context:%p", context);
+    LOG_TRACE("entityPath: %s", entityPath);
+    LOG_TRACE("authValue: %s", authValue);
+
+    TSS2_RC r;
+
+    /* Check for NULL parameters */
+    check_not_null(context);
+    check_not_null(entityPath);
+
+    /* Helpful pointers */
+    IFAPI_Entity_ChangeAuth * command = &(context->cmd.Entity_ChangeAuth);
+
+    r = ifapi_session_init(context);
+    return_if_error(r, "Initialize Entity_ChangeAuth");
+
+    context->loadKey.parent_handle = ESYS_TR_NONE;
+    command->handle = ESYS_TR_NONE;
+    memset(&command->object, 0, sizeof(IFAPI_OBJECT));
+    strdup_check(command->entityPath, entityPath, r, error_cleanup);
+    if(authValue != NULL) {
+        strdup_check(command->authValue, authValue, r, error_cleanup);
+    } else {
+        strdup_check(command->authValue, "", r, error_cleanup);
+    }
+    command->handle = ESYS_TR_NONE;
+
+    r = ifapi_get_sessions_async(context,
+                                 IFAPI_SESSION_GENEK | IFAPI_SESSION1,
+                                 TPMA_SESSION_DECRYPT, 0);
+    goto_if_error_reset_state(r, "Create sessions", error_cleanup);
+
+    if (strlen(command->authValue) > sizeof(TPMU_HA)) {
+        LOG_ERROR("authValue to big. (Should be <= %zu", sizeof(TPMU_HA));
+        r = TSS2_FAPI_RC_BAD_VALUE;
+        goto error_cleanup;
+    }
+
+    /* Copy new auth value to appropriate structure in context */
+    if (command->authValue) {
+        command->newAuthValue.size =
+            strlen(command->authValue);
+        memcpy(&command->newAuthValue.buffer[0],
+               command->authValue,
+               command->newAuthValue.size);
+    } else {
+        command->newAuthValue.size = 0;
+    }
+
+    context->state = ENTITY_CHANGE_AUTH_WAIT_FOR_SESSION;
+    LOG_TRACE("finsihed");
+    return TSS2_RC_SUCCESS;
+
+error_cleanup:
+    SAFE_FREE(command->entityPath);
+    SAFE_FREE(command->authValue);
+    return r;
+}
+
+/** Asynchronous finish function for Fapi_ChangeAuth
+ *
+ * This function should be called after a previous Fapi_ChangeAuth_Async.
+ *
+ * @param [in, out] context The FAPI_CONTEXT
+ *
+ * @retval TSS2_RC_SUCCESS: if the function call was a success.
+ * @retval TSS2_FAPI_RC_BAD_REFERENCE: if context is NULL.
+ * @retval TSS2_FAPI_RC_BAD_CONTEXT: if context corruption is detected.
+ * @retval TSS2_FAPI_RC_BAD_SEQUENCE: if the context has an asynchronous
+ *         operation already pending.
+ * @retval TSS2_FAPI_RC_IO_ERROR: if the data cannot be saved.
+ * @retval TSS2_FAPI_RC_MEMORY: if the FAPI cannot allocate enough memory for
+ *         internal operations or return parameters.
+ * @retval TSS2_FAPI_RC_TRY_AGAIN: if the asynchronous operation is not yet
+ *         complete. Call this function again later.
+ */
+TSS2_RC
+Fapi_ChangeAuth_Finish(
+    FAPI_CONTEXT *context)
+{
+    LOG_TRACE("called for context:%p", context);
+
+    TSS2_RC r;
+    ESYS_TR auth_session;
+
+    /* Check for NULL parameters */
+    check_not_null(context);
+
+    /* Helpful pointers */
+    IFAPI_Entity_ChangeAuth * command = &(context->cmd.Entity_ChangeAuth);
+    IFAPI_OBJECT * object = &command->object;
+    const IFAPI_PROFILE *profile;
+
+    switch (context->state) {
+        statecase(context->state, ENTITY_CHANGE_AUTH_WAIT_FOR_SESSION)
+            r = ifapi_profiles_get(&context->profiles, command->entityPath,
+                    &profile);
+            goto_if_error_reset_state(r, " FAPI create session", error_cleanup);
+
+            r = ifapi_get_sessions_finish(context, profile);
+            return_try_again(r);
+
+            goto_if_error_reset_state(r, " FAPI create session", error_cleanup);
+
+            if (ifapi_path_type_p(command->entityPath,
+                    IFAPI_NV_PATH)) {
+                r = ifapi_keystore_load_async(&context->keystore, &context->io,
+                        command->entityPath);
+                return_if_error_reset_state(r, "Could not open: %s",
+                        command->entityPath);
+
+                context->state = ENTITY_CHANGE_AUTH_WAIT_FOR_NV_READ;
+                return TSS2_FAPI_RC_TRY_AGAIN;
+            }
+
+            command->hierarchy_handle =
+                ifapi_get_hierary_handle(command->entityPath);
+
+            if (command->hierarchy_handle) {
+                context->state = ENTITY_CHANGE_AUTH_HIERARCHY_READ;
+                r = ifapi_keystore_load_async(&context->keystore, &context->io,
+                        command->entityPath);
+                return_if_error_reset_state(r, "Could not open: %s",
+                        command->entityPath);
+
+                return TSS2_FAPI_RC_TRY_AGAIN;
+            }
+
+            r = ifapi_load_keys_async(context, command->entityPath);
+            goto_if_error(r, "Load keys.", error_cleanup);
+
+            context->state = ENTITY_CHANGE_AUTH_WAIT_FOR_KEY;
+            fallthrough;
+
+        statecase(context->state, ENTITY_CHANGE_AUTH_WAIT_FOR_KEY)
+            r = ifapi_load_keys_finish(context, IFAPI_NOT_FLUSH_PARENT,
+                    &command->handle,
+                    &command->key_object);
+            return_try_again(r);
+
+            context->state = ENTITY_CHANGE_AUTH_WAIT_FOR_KEY_AUTH;
+            fallthrough;
+
+        statecase(context->state, ENTITY_CHANGE_AUTH_WAIT_FOR_KEY_AUTH)
+            /* Authorize the object with the old authorization */
+            object = command->key_object;
+            r = ifapi_authorize_object(context, object, &auth_session);
+
+            return_try_again(r);
+            goto_if_error_reset_state(r, "Authorize key.", error_cleanup);
+
+            r = Esys_ObjectChangeAuth_Async(context->esys,
+                    command->handle,
+                    context->loadKey.parent_handle,
+                    auth_session,
+                    ESYS_TR_NONE, ESYS_TR_NONE,
+                    &command->newAuthValue);
+            goto_if_error(r, "Error: Sign", error_cleanup);
+
+            context->state = ENTITY_CHANGE_AUTH_AUTH_SENT;
+            fallthrough;
+
+        statecase(context->state, ENTITY_CHANGE_AUTH_AUTH_SENT)
+            r = Esys_ObjectChangeAuth_Finish(context->esys,
+                    &command->newPrivate);
+            return_try_again(r);
+
+            goto_if_error(r, "Error: Entity ChangeAuth", error_cleanup);
+
+            object = command->key_object;
+            object->misc.key.private.size = command->newPrivate->size;
+
+            /* Old private buffer will be overwritten*/
+            free(object->misc.key.private.buffer);
+            object->misc.key.private.buffer = malloc(object->misc.key.private.size);
+            goto_if_null2(object->misc.key.private.buffer, "Out of memory.",
+                    r, TSS2_FAPI_RC_MEMORY, error_cleanup);
+
+            memcpy(object->misc.key.private.buffer,
+                    &command->newPrivate->buffer[0],
+                    object->misc.key.private.size);
+            free(command->newPrivate);
+            r = Esys_FlushContext_Async(context->esys,
+                    command->handle);
+            goto_if_error(r, "Error: FlushContext", error_cleanup);
+
+            command->handle = ESYS_TR_NONE;
+            context->state = ENTITY_CHANGE_AUTH_WAIT_FOR_FLUSH;
+            return TSS2_FAPI_RC_TRY_AGAIN;
+
+        statecase(context->state, ENTITY_CHANGE_AUTH_WAIT_FOR_FLUSH)
+            r = Esys_FlushContext_Finish(context->esys);
+            return_try_again(r);
+
+            goto_if_error(r, "Error: ObjectChangeAuth", error_cleanup);
+
+            if (! context->loadKey.parent_handle_persistent
+                    && context->loadKey.parent_handle != ESYS_TR_NONE) {
+                r = Esys_FlushContext_Async(context->esys, context->loadKey.parent_handle);
+                goto_if_error(r, "Flush parent", error_cleanup);
+
+                context->loadKey.parent_handle = ESYS_TR_NONE;
+                return TSS2_FAPI_RC_TRY_AGAIN;
+            }
+
+            /* Serialize key with new private data */
+            object = command->key_object;
+
+            if (strlen(command->authValue) > 0)
+                object->misc.key.with_auth = TPM2_YES;
+            else
+                object->misc.key.with_auth = TPM2_NO;
+            fallthrough;
+
+        statecase(context->state, ENTITY_CHANGE_AUTH_WRITE_PREPARE)
+            /* Perform esys serialization if necessary */
+            r = ifapi_esys_serialize_object(context->esys, object);
+            goto_if_error(r, "Prepare serialization", error_cleanup);
+
+            /* Start writing the NV object to the key store */
+            r = ifapi_keystore_store_async(&context->keystore, &context->io,
+                    command->entityPath,
+                    object);
+            goto_if_error_reset_state(r, "Could not open: %sh", error_cleanup,
+                    command->entityPath);
+            fallthrough;
+
+        statecase(context->state, ENTITY_CHANGE_AUTH_WRITE)
+            /* Finish writing the object to the key store */
+            r = ifapi_keystore_store_finish(&context->keystore, &context->io);
+            return_try_again(r);
+            return_if_error_reset_state(r, "write_finish failed");
+
+            fallthrough;
+
+        statecase(context->state, ENTITY_CHANGE_AUTH_CLEANUP)
+            r = ifapi_cleanup_session(context);
+            try_again_or_error_goto(r, "Cleanup", error_cleanup);
+
+            context->state = _FAPI_STATE_INIT;
+            LOG_TRACE("success");
+            r = TSS2_RC_SUCCESS;
+            break;
+
+        statecase(context->state, ENTITY_CHANGE_AUTH_WAIT_FOR_NV_READ)
+            /* Get object from file */
+            r = ifapi_keystore_load_finish(&context->keystore, &context->io,
+                    &command->object);
+            return_try_again(r);
+            return_if_error_reset_state(r, "read_finish failed");
+
+            r = ifapi_initialize_object(context->esys, &command->object);
+            goto_if_error_reset_state(r, "Initialize NV object", error_cleanup);
+
+            context->state = ENTITY_CHANGE_AUTH_WAIT_FOR_NV_AUTH;
+            fallthrough;
+
+        statecase(context->state, ENTITY_CHANGE_AUTH_WAIT_FOR_NV_AUTH)
+            /* Authorize the object with with the policies
+               auth value and command code */
+            r = ifapi_authorize_object(context, object, &auth_session);
+            return_try_again(r);
+            goto_if_error(r, "Authorize NV object.", error_cleanup);
+
+            r = Esys_NV_ChangeAuth_Async(context->esys,
+                    context->nv_cmd.nv_object.handle,
+                    auth_session,
+                    ESYS_TR_NONE,
+                    ESYS_TR_NONE,
+                    &command->newAuthValue);
+            goto_if_error(r, "Error: NV_ChangeAuth", error_cleanup);
+
+            context->state = ENTITY_CHANGE_AUTH_WAIT_FOR_NV_CHANGE_AUTH;
+            fallthrough;
+
+        statecase(context->state, ENTITY_CHANGE_AUTH_WAIT_FOR_NV_CHANGE_AUTH)
+            r = Esys_NV_ChangeAuth_Finish(context->esys);
+            return_try_again(r);
+
+            goto_if_error(r, "Error: Entity ChangeAuth", error_cleanup);
+
+            if (strlen(command->authValue) > 0)
+                object->misc.nv.with_auth = TPM2_YES;
+            else
+                object->misc.nv.with_auth = TPM2_NO;
+
+            context->state =  ENTITY_CHANGE_AUTH_WRITE_PREPARE;
+            return TSS2_FAPI_RC_TRY_AGAIN;
+
+            statecase(context->state, ENTITY_CHANGE_AUTH_HIERARCHY_READ)
+                r = ifapi_keystore_load_finish(&context->keystore, &context->io, object);
+            return_try_again(r);
+            return_if_error_reset_state(r, "read_finish failed");
+
+            r = ifapi_initialize_object(context->esys, &command->object);
+            goto_if_error_reset_state(r, "Initialize NV object", error_cleanup);
+
+            command->object.handle
+                = command->hierarchy_handle;
+
+            context->state = ENTITY_CHANGE_AUTH_HIERARCHY_AUTHORIZE;
+            fallthrough;
+
+        statecase(context->state, ENTITY_CHANGE_AUTH_HIERARCHY_AUTHORIZE)
+            r = ifapi_authorize_object(context, &command->object, &auth_session);
+            return_try_again(r);
+            goto_if_error(r, "Authorize hierarchy.", error_cleanup);
+
+            context->state = ENTITY_CHANGE_AUTH_HIERARCHY_CHANGE_AUTH;
+            fallthrough;
+
+        statecase(context->state, ENTITY_CHANGE_AUTH_HIERARCHY_CHANGE_AUTH)
+            r = ifapi_change_auth_hierarchy(context,
+                    command->hierarchy_handle,
+                    &command->object,
+                    &command->newAuthValue);
+            return_try_again(r);
+            goto_if_error(r, "Change auth hierarchy.", error_cleanup);
+
+            context->state = ENTITY_CHANGE_AUTH_WRITE_PREPARE;
+            return TSS2_FAPI_RC_TRY_AGAIN;
+
+        statecasedefault(context->state);
+    }
+
+error_cleanup:
+    /* In error cases object might not be flushed. */
+    if (context->loadKey.parent_handle != ESYS_TR_NONE)
+        Esys_FlushContext(context->esys, context->loadKey.parent_handle);
+    if (command->handle != ESYS_TR_NONE)
+        Esys_FlushContext(context->esys, command->handle);
+    ifapi_session_clean(context);
+    ifapi_cleanup_ifapi_object(object);
+    ifapi_cleanup_ifapi_object(context->loadKey.key_object);
+    ifapi_cleanup_ifapi_object(&context->loadKey.auth_object);
+    ifapi_cleanup_ifapi_object(&context->createPrimary.pkey_object);
+    ifapi_cleanup_ifapi_object(command->key_object);
+    SAFE_FREE(command->entityPath);
+    SAFE_FREE(command->authValue);
+    LOG_TRACE("finsihed");
+    return r;
+}

diff --git a/src/tss2-fapi/api/Fapi_CreateKey.c b/src/tss2-fapi/api/Fapi_CreateKey.c
new file mode 100644
index 0000000..0e90bdb
--- /dev/null
+++ b/src/tss2-fapi/api/Fapi_CreateKey.c

@@ -0,0 +1,228 @@
+/* SPDX-License-Identifier: BSD-2-Clause */
+/*******************************************************************************
+ * Copyright 2018-2019, Fraunhofer SIT sponsored by Infineon Technologies AG
+ * All rights reserved.
+ ******************************************************************************/
+
+#ifdef HAVE_CONFIG_H
+#include <config.h>
+#endif
+
+#include <stdlib.h>
+#include <errno.h>
+#include <unistd.h>
+#include <errno.h>
+#include <string.h>
+
+#include "tss2_fapi.h"
+#include "fapi_int.h"
+#include "fapi_util.h"
+#include "fapi_policy.h"
+#include "tss2_esys.h"
+#define LOGMODULE fapi
+#include "util/log.h"
+#include "util/aux_util.h"
+
+/** One-Call function for Fapi_CreateKey
+ *
+ * Creates a key inside the TPM based on the Key type, using the supplied
+ * policy and authValue. The key is then stored either in the FAPI metadata
+ * store or the TPM.
+ *
+ * @param [in, out] context The FAPI_CONTEXT
+ * @param [in] path The path where the new key is stored
+ * @param [in] type The type of the new key. May be NULL
+ * @param [in] policyPath The path to the policy that is associated with the new
+ *        key. May be NULL
+ * @param [in] authValue The authorization value for the new key. May be NULL
+ *
+ * @retval TSS2_RC_SUCCESS: if the function call was a success.
+ * @retval TSS2_FAPI_RC_BAD_REFERENCE: if context or path is NULL.
+ * @retval TSS2_FAPI_RC_BAD_CONTEXT: if context corruption is detected.
+ * @retval TSS2_FAPI_RC_BAD_PATH: if policyPath is non-NULL and does not map to
+ *         a FAPI policy.
+ * @retval TSS2_FAPI_RC_KEY_NOT_FOUND: if the parent key does not map to a FAPI
+ *         key.
+ * @retval TSS2_FAPI_RC_PATH_ALREADY_EXISTS: if a file already exists at path.
+ * @retval TSS2_FAPI_RC_BAD_VALUE: if the keyType is non-NULL and invalid.
+ * @retval TSS2_FAPI_RC_BAD_SEQUENCE: if the context has an asynchronous
+ *         operation already pending.
+ * @retval TSS2_FAPI_RC_IO_ERROR: if the data cannot be saved.
+ * @retval TSS2_FAPI_RC_MEMORY: if the FAPI cannot allocate enough memory for
+ *         internal operations or return parameters.
+ */
+TSS2_RC
+Fapi_CreateKey(
+    FAPI_CONTEXT *context,
+    char   const *path,
+    char   const *type,
+    char   const *policyPath,
+    char   const *authValue)
+{
+    LOG_TRACE("called for context:%p", context);
+
+    TSS2_RC r, r2;
+
+    /* Check for NULL parameters */
+    check_not_null(context);
+    check_not_null(path);
+
+    /* Check whether TCTI and ESYS are initialized */
+    return_if_null(context->esys, "Command can't be executed in none TPM mode.",
+                   TSS2_FAPI_RC_NO_TPM);
+
+    /* If the async state automata of FAPI shall be tested, then we must not set
+       the timeouts of ESYS to blocking mode.
+       During testing, the mssim tcti will ensure multiple re-invocations.
+       Usually however the synchronous invocations of FAPI shall instruct ESYS
+       to block until a result is available. */
+#ifndef TEST_FAPI_ASYNC
+    r = Esys_SetTimeout(context->esys, TSS2_TCTI_TIMEOUT_BLOCK);
+    return_if_error_reset_state(r, "Set Timeout to blocking");
+#endif /* TEST_FAPI_ASYNC */
+
+    r = Fapi_CreateKey_Async(context, path, type, policyPath, authValue);
+    return_if_error_reset_state(r, "Key_Create");
+
+    do {
+        /* We wait for file I/O to be ready if the FAPI state automata
+           are in a file I/O state. */
+        r = ifapi_io_poll(&context->io);
+        return_if_error(r, "Something went wrong with IO polling");
+
+        /* Repeatedly call the finish function, until FAPI has transitioned
+           through all execution stages / states of this invocation. */
+        r = Fapi_CreateKey_Finish(context);
+    } while ((r & ~TSS2_RC_LAYER_MASK) == TSS2_BASE_RC_TRY_AGAIN);
+
+    /* Reset the ESYS timeout to non-blocking, immediate response. */
+    r2 = Esys_SetTimeout(context->esys, 0);
+    return_if_error(r2, "Set Timeout to non-blocking");
+
+    return_if_error_reset_state(r, "Key_Create");
+
+    return TSS2_RC_SUCCESS;
+}
+
+/** Asynchronous function for Fapi_CreateKey
+ *
+ * Creates a key inside the TPM based on the Key type, using the supplied
+ * policy and authValue. The key is then stored either in the FAPI metadata
+ * store or the TPM.
+ *
+ * Call Fapi_CreateKey_Finish to finish the execution of this command.
+ *
+ * @param [in, out] context The FAPI_CONTEXT
+ * @param [in] path The path where the new key is stored
+ * @param [in] type The type of the new key. May be NULL
+ * @param [in] policyPath The path to the policy that is associated with the new
+ *        key. May be NULL
+ * @param [in] authValue The authorization value for the new key. May be NULL
+ *
+ * @retval TSS2_RC_SUCCESS: if the function call was a success.
+ * @retval TSS2_FAPI_RC_BAD_REFERENCE: if context or path is NULL.
+ * @retval TSS2_FAPI_RC_BAD_CONTEXT: if context corruption is detected.
+ * @retval TSS2_FAPI_RC_BAD_PATH: if policyPath is non-NULL and does not map to
+ *         a FAPI policy.
+ * @retval TSS2_FAPI_RC_KEY_NOT_FOUND: if the parent key does not map to a FAPI
+ *         key.
+ * @retval TSS2_FAPI_RC_PATH_ALREADY_EXISTS: if a file already exists at path.
+ * @retval TSS2_FAPI_RC_BAD_VALUE: if the keyType is non-NULL and invalid.
+ * @retval TSS2_FAPI_RC_BAD_SEQUENCE: if the context has an asynchronous
+ *         operation already pending.
+ * @retval TSS2_FAPI_RC_IO_ERROR: if the data cannot be saved.
+ * @retval TSS2_FAPI_RC_MEMORY: if the FAPI cannot allocate enough memory for
+ *         internal operations or return parameters.
+ */
+TSS2_RC
+Fapi_CreateKey_Async(
+    FAPI_CONTEXT *context,
+    char   const *path,
+    char   const *type,
+    char   const *policyPath,
+    char   const *authValue)
+{
+    LOG_TRACE("called for context:%p", context);
+    LOG_TRACE("path: %s", path);
+    LOG_TRACE("type: %s", type);
+    LOG_TRACE("policyPath: %s", policyPath);
+    LOG_TRACE("authValue: %s", authValue);
+
+    TSS2_RC r;
+
+    /* Check for NULL parameters */
+    check_not_null(context);
+    check_not_null(path);
+
+    r = ifapi_session_init(context);
+    return_if_error(r, "Initialize CreateKey");
+
+    r = ifapi_key_create_prepare_auth(context, path, policyPath, authValue);
+    return_if_error(r, "Key create.");
+
+    r = ifapi_set_key_flags(type ? type : "",
+                            (policyPath && strcmp(policyPath, "") != 0) ? true : false,
+                            &context->cmd.Key_Create.public_templ);
+    return_if_error(r, "Set key flags for key");
+
+    context->state = KEY_CREATE;
+    LOG_TRACE("finsihed");
+    return TSS2_RC_SUCCESS;
+}
+
+/** Asynchronous finish function for Fapi_CreateKey
+ *
+ * This function should be called after a previous Fapi_CreateKey_Async.
+ *
+ * @param [in, out] context The FAPI_CONTEXT
+ *
+ * @retval TSS2_RC_SUCCESS: if the function call was a success.
+ * @retval TSS2_FAPI_RC_BAD_REFERENCE: if context is NULL.
+ * @retval TSS2_FAPI_RC_BAD_CONTEXT: if context corruption is detected.
+ * @retval TSS2_FAPI_RC_BAD_SEQUENCE: if the context has an asynchronous
+ *         operation already pending.
+ * @retval TSS2_FAPI_RC_IO_ERROR: if the data cannot be saved.
+ * @retval TSS2_FAPI_RC_MEMORY: if the FAPI cannot allocate enough memory for
+ *         internal operations or return parameters.
+ * @retval TSS2_FAPI_RC_TRY_AGAIN: if the asynchronous operation is not yet
+ *         complete. Call this function again later.
+ */
+TSS2_RC
+Fapi_CreateKey_Finish(
+    FAPI_CONTEXT *context)
+{
+    LOG_TRACE("called for context:%p", context);
+
+    TSS2_RC r;
+
+    /* Check for NULL parameters */
+    check_not_null(context);
+
+    /* Helpful alias pointers */
+    IFAPI_Key_Create * command = &context->cmd.Key_Create;
+
+    switch (context->state) {
+        statecase(context->state, KEY_CREATE);
+            LOG_TRACE("KEY_CREATE");
+            r = ifapi_key_create(context, &command->public_templ);
+            return_try_again(r);
+            goto_if_error(r, "Key create", error_cleanup);
+
+            ifapi_cleanup_ifapi_object(&context->createPrimary.pkey_object);
+            ifapi_cleanup_ifapi_object(context->loadKey.key_object);
+            ifapi_cleanup_ifapi_object(&context->loadKey.auth_object);
+            context->state = _FAPI_STATE_INIT;
+            LOG_TRACE("finsihed");
+            return TSS2_RC_SUCCESS;
+
+        statecasedefault(context->state);
+    }
+
+error_cleanup:
+    context->cmd.Key_Create.state = KEY_CREATE_INIT;
+    ifapi_cleanup_ifapi_object(&context->createPrimary.pkey_object);
+    ifapi_cleanup_ifapi_object(context->loadKey.key_object);
+    ifapi_cleanup_ifapi_object(&context->loadKey.auth_object);
+    LOG_TRACE("finished");
+    return r;
+}

diff --git a/src/tss2-fapi/api/Fapi_CreateNv.c b/src/tss2-fapi/api/Fapi_CreateNv.c
new file mode 100644
index 0000000..d8b31c1
--- /dev/null
+++ b/src/tss2-fapi/api/Fapi_CreateNv.c

@@ -0,0 +1,413 @@
+/* SPDX-License-Identifier: BSD-2-Clause */
+/*******************************************************************************
+ * Copyright 2018-2019, Fraunhofer SIT sponsored by Infineon Technologies AG
+ * All rights reserved.
+ ******************************************************************************/
+
+#ifdef HAVE_CONFIG_H
+#include <config.h>
+#endif
+
+#include <string.h>
+#include <stdio.h>
+#include <unistd.h>
+#include <stdlib.h>
+#include <errno.h>
+
+#include "tss2_fapi.h"
+#include "fapi_int.h"
+#include "fapi_util.h"
+#include "fapi_policy.h"
+#include "tss2_esys.h"
+#define LOGMODULE fapi
+#include "util/log.h"
+#include "util/aux_util.h"
+
+/** One-Call function for Fapi_CreateNv
+ *
+ * This command creates an NV index in the TPM using a given path and type.
+ *
+ * @param [in, out] context The FAPI_CONTEXT
+ * @param [in] path The path to the new NV index
+ * @param [in] type The intended type of the new NV index. May be NULL
+ * @param [in] size The size of the new NV index in bytes. May be 0 if the size
+ *             is inferred from the type
+ * @param [in] policyPath The path to the policy that is associated with the new
+ *             NV index. May be NULL
+ * @param [in] authValue The authorization value that is associated with the new
+ *             NV index. May be NULL
+ *
+ * @retval TSS2_RC_SUCCESS: if the function call was a success.
+ * @retval TSS2_FAPI_RC_BAD_REFERENCE: if context or path is NULL.
+ * @retval TSS2_FAPI_RC_BAD_CONTEXT: if context corruption is detected.
+ * @retval TSS2_FAPI_RC_PATH_ALREADY_EXISTS: if an NV index already exists at
+ *         path.
+ * @retval TSS2_FAPI_RC_BAD_VALUE: if type is non-NULL but invalid or does not
+ *         match the size.
+ * @retval TSS2_FAPI_RC_BAD_PATH: if policyPath is non-NULL and does not map to
+ *         a FAPI policy or if path dos not refer to a valid NV index path.
+ * @retval TSS2_FAPI_RC_STORAGE_ERROR: if the FAPI storage cannot be updated.
+ * @retval TSS2_FAPI_RC_BAD_SEQUENCE: if the context has an asynchronous
+ *         operation already pending.
+ * @retval TSS2_FAPI_RC_IO_ERROR: if the data cannot be saved.
+ * @retval TSS2_FAPI_RC_MEMORY: if the FAPI cannot allocate enough memory for
+ *         internal operations or return parameters.
+ */
+TSS2_RC
+Fapi_CreateNv(
+    FAPI_CONTEXT *context,
+    char   const *path,
+    char   const *type,
+    size_t size,
+    char   const *policyPath,
+    char   const *authValue)
+{
+    LOG_TRACE("called for context:%p", context);
+
+    TSS2_RC r, r2;
+
+    /* Check for NULL parameters */
+    check_not_null(context);
+    check_not_null(path);
+
+    /* Check whether TCTI and ESYS are initialized */
+    return_if_null(context->esys, "Command can't be executed in none TPM mode.",
+                   TSS2_FAPI_RC_NO_TPM);
+
+    /* If the async state automata of FAPI shall be tested, then we must not set
+       the timeouts of ESYS to blocking mode.
+       During testing, the mssim tcti will ensure multiple re-invocations.
+       Usually however the synchronous invocations of FAPI shall instruct ESYS
+       to block until a result is available. */
+#ifndef TEST_FAPI_ASYNC
+    r = Esys_SetTimeout(context->esys, TSS2_TCTI_TIMEOUT_BLOCK);
+    return_if_error_reset_state(r, "Set Timeout to blocking");
+#endif /* TEST_FAPI_ASYNC */
+
+    r = Fapi_CreateNv_Async(context, path, type, size,
+                            policyPath, authValue);
+    return_if_error_reset_state(r, "NV_CreateWithTemplate");
+
+    do {
+        /* We wait for file I/O to be ready if the FAPI state automata
+           are in a file I/O state. */
+        r = ifapi_io_poll(&context->io);
+        return_if_error(r, "Something went wrong with IO polling");
+
+        /* Repeatedly call the finish function, until FAPI has transitioned
+           through all execution stages / states of this invocation. */
+        r = Fapi_CreateNv_Finish(context);
+    } while ((r & ~TSS2_RC_LAYER_MASK) == TSS2_BASE_RC_TRY_AGAIN);
+
+    /* Reset the ESYS timeout to non-blocking, immediate response. */
+    r2 = Esys_SetTimeout(context->esys, 0);
+    return_if_error(r2, "Set Timeout to non-blocking");
+
+    return_if_error_reset_state(r, "NV_CreateWithTemplate");
+
+    return TSS2_RC_SUCCESS;
+}
+
+/** Asynchronous function for Fapi_CreateNv
+ *
+ * This command creates an NV index in the TPM using a given path and type.
+ *
+ * Call Fapi_CreateNv_Finish to finish the execution of this command.
+ *
+ * @param [in, out] context The FAPI_CONTEXT
+ * @param [in] path The path to the new NV index
+ * @param [in] type The intended type of the new NV index. May be NULL
+ * @param [in] size The size of the new NV index in bytes. May be 0 if the size
+ *             is inferred from the type
+ * @param [in] policyPath The path to the policy that is associated with the new
+ *             NV index. May be NULL
+ * @param [in] authValue The authorization value that is associated with the new
+ *             NV index. May be NULL
+ *
+ * @retval TSS2_RC_SUCCESS: if the function call was a success.
+ * @retval TSS2_FAPI_RC_BAD_REFERENCE: if context or path is NULL.
+ * @retval TSS2_FAPI_RC_BAD_CONTEXT: if context corruption is detected.
+ * @retval TSS2_FAPI_RC_PATH_ALREADY_EXISTS: if an NV index already exists at
+ *         path.
+ * @retval TSS2_FAPI_RC_BAD_VALUE: if type is non-NULL but invalid or does not
+ *         match the size.
+ * @retval TSS2_FAPI_RC_BAD_PATH: if policyPath is non-NULL and does not map to
+ *         a FAPI policy or if path dos not refer to a valid NV index path.
+ * @retval TSS2_FAPI_RC_STORAGE_ERROR: if the FAPI storage cannot be updated.
+ * @retval TSS2_FAPI_RC_BAD_SEQUENCE: if the context has an asynchronous
+ *         operation already pending.
+ * @retval TSS2_FAPI_RC_IO_ERROR: if the data cannot be saved.
+ * @retval TSS2_FAPI_RC_MEMORY: if the FAPI cannot allocate enough memory for
+ *         internal operations or return parameters.
+ */
+TSS2_RC
+Fapi_CreateNv_Async(
+    FAPI_CONTEXT *context,
+    char   const *path,
+    char   const *type,
+    size_t size,
+    char   const *policyPath,
+    char   const *authValue)
+{
+    LOG_TRACE("called for context:%p", context);
+    LOG_TRACE("path: %s", path);
+    LOG_TRACE("type: %s", type);
+    LOG_TRACE("size: %zi", size);
+    LOG_TRACE("policyPath: %s", policyPath);
+    LOG_TRACE("authValue: %s", authValue);
+
+    TSS2_RC r;
+
+    /* Check for NULL parameters */
+    check_not_null(context);
+    check_not_null(path);
+
+    /* Helpful alias pointers */
+    IFAPI_NV_Cmds * nvCmd = &(context->nv_cmd);
+    TPM2B_AUTH *auth = &nvCmd->auth;
+    IFAPI_NV * miscNv = &(nvCmd->nv_object.misc.nv);
+
+    r = ifapi_session_init(context);
+    return_if_error(r, "Initialize NV_CreateNv");
+
+    /* First check whether an existing object would be overwritten */
+    r = ifapi_keystore_check_overwrite(&context->keystore, &context->io,
+                                       path);
+    return_if_error2(r, "Check overwrite %s", path);
+
+    memset(&context->nv_cmd, 0, sizeof(IFAPI_NV_Cmds));
+    if (authValue) {
+        if (strlen(authValue) > sizeof(TPMU_HA)) {
+            return_error(TSS2_FAPI_RC_BAD_VALUE, "AuthValue too long");
+        }
+
+        auth->size = strlen(authValue);
+        memcpy(&auth->buffer[0], authValue, auth->size);
+    } else {
+        auth->size = 0;
+    }
+    strdup_check(nvCmd->nvPath, path, r, error_cleanup);
+    nvCmd->numBytes = size;
+    nvCmd->nv_object.objectType = IFAPI_NV_OBJ;
+    strdup_check(miscNv->policyInstance, policyPath, r, error_cleanup);
+
+    r = ifapi_set_nv_flags(type ? type : "", &nvCmd->public_templ,
+                           policyPath);
+    goto_if_error(r, "Set key flags for NV object", error_cleanup);
+
+    context->state = NV_CREATE_READ_PROFILE;
+    LOG_TRACE("finsihed");
+    return TSS2_RC_SUCCESS;
+error_cleanup:
+    SAFE_FREE(nvCmd->nvPath);
+    SAFE_FREE(miscNv->policyInstance);
+    return r;
+}
+
+/** Asynchronous finish function for Fapi_CreateNv
+ *
+ * This function should be called after a previous Fapi_CreateNv_Async.
+ *
+ * @param [in, out] context The FAPI_CONTEXT
+ *
+ * @retval TSS2_RC_SUCCESS: if the function call was a success.
+ * @retval TSS2_FAPI_RC_BAD_REFERENCE: if context is NULL.
+ * @retval TSS2_FAPI_RC_BAD_CONTEXT: if context corruption is detected.
+ * @retval TSS2_FAPI_RC_BAD_SEQUENCE: if the context has an asynchronous
+ *         operation already pending.
+ * @retval TSS2_FAPI_RC_IO_ERROR: if the data cannot be saved.
+ * @retval TSS2_FAPI_RC_MEMORY: if the FAPI cannot allocate enough memory for
+ *         internal operations or return parameters.
+ * @retval TSS2_FAPI_RC_TRY_AGAIN: if the asynchronous operation is not yet
+ *         complete. Call this function again later.
+ */
+TSS2_RC
+Fapi_CreateNv_Finish(
+    FAPI_CONTEXT *context)
+{
+    LOG_TRACE("called for context:%p", context);
+
+    TSS2_RC r;
+    ESYS_TR nvHandle;
+
+    /* Check for NULL parameters */
+    check_not_null(context);
+
+    /* Helpful alias pointers */
+    IFAPI_NV_Cmds * nvCmd = &(context->nv_cmd);
+    TPM2B_AUTH *auth = &nvCmd->auth;
+    IFAPI_OBJECT *hierarchy = &nvCmd->auth_object;
+    IFAPI_NV * miscNv = &(nvCmd->nv_object.misc.nv);
+    TPM2B_NV_PUBLIC *publicInfo = &miscNv->public;
+    TPM2B_DIGEST * authPolicy = &(miscNv->public.nvPublic.authPolicy);
+    TPMS_POLICY_HARNESS * policyHarness = &(context->policy.harness);
+    TPMS_POLICY_HARNESS ** nvCmdPolicyHarness = &nvCmd->nv_object.policy_harness;
+    ESYS_TR auth_session;
+
+    switch (context->state) {
+        statecase(context->state, NV_CREATE_READ_PROFILE)
+            r = ifapi_merge_profile_into_nv_template(context,
+                    &nvCmd->public_templ);
+            goto_if_error_reset_state(r, "Merge profile", error_cleanup);
+
+            /* Store information from template in context */
+            miscNv->description = NULL;
+            publicInfo->nvPublic = nvCmd->public_templ.public;
+            if (nvCmd->public_templ.hierarchy == TPM2_RH_OWNER) {
+                miscNv->hierarchy = ESYS_TR_RH_OWNER;
+            } else {
+                goto_error(r, TSS2_FAPI_RC_BAD_VALUE, "Wrong hierarchy", error_cleanup);
+            }
+            r = ifapi_keystore_load_async(&context->keystore, &context->io, "HS");
+            return_if_error_reset_state(r, "Could not open storage hierarchy  HS");
+            fallthrough;
+
+        statecase(context->state, NV_CREATE_READ_HIERARCHY)
+            r = ifapi_keystore_load_finish(&context->keystore, &context->io,
+                                           &nvCmd->auth_object);
+            return_try_again(r);
+            goto_if_error_reset_state(r, "read_finish failed", error_cleanup);
+
+            r = ifapi_initialize_object(context->esys, &nvCmd->auth_object);
+            goto_if_error_reset_state(r, "Initialize NV object", error_cleanup);
+
+            nvCmd->auth_object.handle
+                =  miscNv->hierarchy;
+            if (miscNv->policyInstance &&
+                    strcmp(miscNv->policyInstance, "") != 0)
+                nvCmd->skip_policy_computation = false;
+            else
+                nvCmd->skip_policy_computation = true;
+            fallthrough;
+
+        statecase(context->state, NV_CREATE_CALCULATE_POLICY)
+            if (!nvCmd->skip_policy_computation) {
+                r = ifapi_calculate_tree(context,
+                                         miscNv->policyInstance,
+                                         policyHarness,
+                                         miscNv->public.nvPublic.nameAlg,
+                                         &context->policy.digest_idx,
+                                         &context->policy.hash_size);
+                return_try_again(r);
+
+                goto_if_error2(r, "Calculate policy tree %s", error_cleanup,
+                               context->cmd.Key_Create.policyPath);
+
+                /* Store the calculated policy in the NV object */
+                *nvCmdPolicyHarness = calloc(1,
+                        sizeof(TPMS_POLICY_HARNESS));
+                goto_if_null(*nvCmdPolicyHarness,
+                        "Out of memory,", TSS2_FAPI_RC_MEMORY, error_cleanup);
+                **(nvCmdPolicyHarness) = *policyHarness;
+
+                authPolicy->size =
+                    context->policy.hash_size;
+                memcpy(&authPolicy->buffer[0],
+                       &policyHarness->policyDigests.digests[context->policy.digest_idx].digest,
+                       context->policy.hash_size);
+                LOGBLOB_TRACE(
+                    &authPolicy->buffer[0],
+                    context->policy.hash_size, "Create Key Policy");
+            }
+            fallthrough;
+
+        statecase(context->state, NV_CREATE_GET_INDEX)
+            r = ifapi_get_nv_start_index(nvCmd->nvPath,
+                                         &publicInfo->nvPublic.nvIndex);
+            goto_if_error_reset_state(r, "FAPI get handle index.", error_cleanup);
+
+            r = ifapi_get_free_handle_async(context, &publicInfo->nvPublic.nvIndex);
+            goto_if_error_reset_state(r, "FAPI get handle index.", error_cleanup);
+            nvCmd->maxNvIndex = publicInfo->nvPublic.nvIndex + 100;
+            context->state = NV_CREATE_FIND_INDEX;
+            fallthrough;
+
+        statecase(context->state, NV_CREATE_FIND_INDEX)
+            r = ifapi_get_free_handle_finish(context, &publicInfo->nvPublic.nvIndex,
+                                             nvCmd->maxNvIndex);
+            return_try_again(r);
+
+            goto_if_error_reset_state(r, "FAPI get handle index.", error_cleanup);
+
+            context->primary_state = PRIMARY_INIT;
+            r = ifapi_get_sessions_async(context,
+                                         IFAPI_SESSION_GENEK | IFAPI_SESSION1,
+                                         0, 0);
+            goto_if_error_reset_state(r, "Create sessions", error_cleanup);
+            fallthrough;
+
+        statecase(context->state, NV_CREATE_WAIT_FOR_SESSION)
+            r = ifapi_get_sessions_finish(context, &context->profiles.default_profile);
+            return_try_again(r);
+
+            goto_if_error_reset_state(r, " FAPI create session", error_cleanup);
+
+            context->state = NV_CREATE_AUTHORIZE_HIERARCHY;
+            fallthrough;
+
+        statecase(context->state, NV_CREATE_AUTHORIZE_HIERARCHY)
+            r = ifapi_authorize_object(context, &nvCmd->auth_object, &auth_session);
+            FAPI_SYNC(r, "Authorize hierarchy.", error_cleanup);
+
+            r = Esys_NV_DefineSpace_Async(context->esys,
+                                          hierarchy->handle,
+                                          auth_session,
+                                          ESYS_TR_NONE,
+                                          ESYS_TR_NONE,
+                                          auth,
+                                          publicInfo);
+            goto_if_error_reset_state(r, " Fapi_CreateNv_Async", error_cleanup);
+            fallthrough;
+
+        statecase(context->state, NV_CREATE_AUTH_SENT)
+            r = Esys_NV_DefineSpace_Finish(context->esys, &nvHandle);
+            return_try_again(r);
+
+            goto_if_error_reset_state(r, "FAPI CreateWithTemplate_Finish", error_cleanup);
+
+            nvCmd->nv_object.handle = nvHandle;
+            if (nvCmd->auth.size > 0)
+                miscNv->with_auth = TPM2_YES;
+            else
+                miscNv->with_auth = TPM2_NO;
+
+            /* Perform esys serialization if necessary */
+            r = ifapi_esys_serialize_object(context->esys, &nvCmd->nv_object);
+            goto_if_error(r, "Prepare serialization", error_cleanup);
+
+            /* Start writing the NV object to the key store */
+            r = ifapi_keystore_store_async(&context->keystore, &context->io,
+                                           nvCmd->nvPath,
+                                           &nvCmd->nv_object);
+            goto_if_error_reset_state(r, "Could not open: %sh", error_cleanup,
+                                      nvCmd->nvPath);
+            context->state = NV_CREATE_WRITE;
+            fallthrough;
+
+        statecase(context->state, NV_CREATE_WRITE)
+            /* Finish writing the NV object to the key store */
+            r = ifapi_keystore_store_finish(&context->keystore, &context->io);
+            return_try_again(r);
+            return_if_error_reset_state(r, "write_finish failed");
+
+            break;
+
+        statecasedefault(context->state);
+    }
+
+    context->state =  _FAPI_STATE_INIT;
+    LOG_DEBUG("success");
+    r = TSS2_RC_SUCCESS;
+
+error_cleanup:
+    ifapi_cleanup_ifapi_object(&nvCmd->nv_object);
+    ifapi_cleanup_ifapi_object(&nvCmd->auth_object);
+    ifapi_cleanup_ifapi_object(&context->createPrimary.pkey_object);
+    ifapi_cleanup_ifapi_object(context->loadKey.key_object);
+    ifapi_cleanup_ifapi_object(&context->loadKey.auth_object);
+    SAFE_FREE(miscNv->policyInstance);
+    SAFE_FREE(nvCmd->nvPath);
+    ifapi_session_clean(context);
+    LOG_TRACE("finsihed");
+    return r;
+}

diff --git a/src/tss2-fapi/api/Fapi_CreateSeal.c b/src/tss2-fapi/api/Fapi_CreateSeal.c
new file mode 100644
index 0000000..c3f99f9
--- /dev/null
+++ b/src/tss2-fapi/api/Fapi_CreateSeal.c

@@ -0,0 +1,242 @@
+/* SPDX-License-Identifier: BSD-2-Clause */
+/*******************************************************************************
+ * Copyright 2018-2019, Fraunhofer SIT sponsored by Infineon Technologies AG
+ * All rights reserved.
+ ******************************************************************************/
+
+#ifdef HAVE_CONFIG_H
+#include <config.h>
+#endif
+
+#include <stdlib.h>
+#include <errno.h>
+#include <unistd.h>
+#include <errno.h>
+#include <string.h>
+
+#include "tss2_fapi.h"
+#include "fapi_int.h"
+#include "fapi_util.h"
+#include "fapi_policy.h"
+#include "tss2_esys.h"
+#define LOGMODULE fapi
+#include "util/log.h"
+#include "util/aux_util.h"
+
+/** One-Call function for Fapi_CreateSeal
+ *
+ * Creates a sealed object and stores it in the FAPI metadata store. If no data
+ * is provided, the TPM generates random data to fill the sealed object.
+ *
+ * @param [in, out] context The FAPI_CONTEXT
+ * @param [in] path The path to the new sealed object
+ * @param [in] type The type of the new sealed object. May be NULL
+ * @param [in] size The size of the new sealed object. Must not be 0
+ * @param [in] policyPath The path to the policy that is associated with the new
+ *             sealed object. May be NULL
+ * @param [in] authValue The authorization value for the new sealed object. May
+ *             be NULL
+ * @param [in] data The data that is to be sealed within the new object. May be
+ *             NULL
+ *
+ * @retval TSS2_RC_SUCCESS: if the function call was a success.
+ * @retval TSS2_FAPI_RC_BAD_REFERENCE: if context, or path is NULL.
+ * @retval TSS2_FAPI_RC_BAD_CONTEXT: if context corruption is detected.
+ * @retval TSS2_FAPI_RC_KEY_NOT_FOUND: if the parent key does not map to a
+ *         FAPI key.
+ * @retval TSS2_FAPI_RC_BAD_PATH: if policyPath is non-NULL and does not map to
+ *         a FAPI key.
+ * @retval TSS2_FAPI_RC_PATH_ALREADY_EXISTS: if a sealed object already exists
+ *         at path.
+ * @retval TSS2_FAPI_RC_BAD_VALUE: if the keyType is invalid.
+ * @retval TSS2_FAPI_RC_STORAGE_ERROR: if the FAPI storage cannot be updated.
+ * @retval TSS2_FAPI_RC_BAD_SEQUENCE: if the context has an asynchronous
+ *         operation already pending.
+ * @retval TSS2_FAPI_RC_IO_ERROR: if the data cannot be saved.
+ * @retval TSS2_FAPI_RC_MEMORY: if the FAPI cannot allocate enough memory for
+ *         internal operations or return parameters.
+ */
+TSS2_RC
+Fapi_CreateSeal(
+    FAPI_CONTEXT *context,
+    char    const *path,
+    char    const *type,
+    size_t         size,
+    char    const *policyPath,
+    char    const *authValue,
+    uint8_t const *data)
+{
+    LOG_TRACE("called for context:%p", context);
+
+    TSS2_RC r, r2;
+
+    /* Check for NULL parameters */
+    check_not_null(context);
+    check_not_null(path);
+
+    /* Check whether TCTI and ESYS are initialized */
+    return_if_null(context->esys, "Command can't be executed in none TPM mode.",
+                   TSS2_FAPI_RC_NO_TPM);
+
+    /* If the async state automata of FAPI shall be tested, then we must not set
+       the timeouts of ESYS to blocking mode.
+       During testing, the mssim tcti will ensure multiple re-invocations.
+       Usually however the synchronous invocations of FAPI shall instruct ESYS
+       to block until a result is available. */
+#ifndef TEST_FAPI_ASYNC
+    r = Esys_SetTimeout(context->esys, TSS2_TCTI_TIMEOUT_BLOCK);
+    return_if_error_reset_state(r, "Set Timeout to blocking");
+#endif /* TEST_FAPI_ASYNC */
+
+    r = Fapi_CreateSeal_Async(context, path, type, size, policyPath,
+                              authValue, data);
+    return_if_error_reset_state(r, "CreateSeal");
+
+    do {
+        /* We wait for file I/O to be ready if the FAPI state automata
+           are in a file I/O state. */
+        r = ifapi_io_poll(&context->io);
+        return_if_error(r, "Something went wrong with IO polling");
+
+        /* Repeatedly call the finish function, until FAPI has transitioned
+           through all execution stages / states of this invocation. */
+        r = Fapi_CreateSeal_Finish(context);
+    } while ((r & ~TSS2_RC_LAYER_MASK) == TSS2_BASE_RC_TRY_AGAIN);
+
+    /* Reset the ESYS timeout to non-blocking, immediate response. */
+    r2 = Esys_SetTimeout(context->esys, 0);
+    return_if_error(r2, "Set Timeout to non-blocking");
+
+    return_if_error_reset_state(r, "CreateSeal");
+
+    LOG_TRACE("finsihed");
+    return TSS2_RC_SUCCESS;
+}
+
+/** Asynchronous function for Fapi_CreateSeal
+ *
+ * Creates a sealed object and stores it in the FAPI metadata store. If no data
+ * is provided, the TPM generates random data to fill the sealed object.
+ *
+ * Call Fapi_CreateSeal_Finish to finish the execution of this command.
+ *
+ * @param [in, out] context The FAPI_CONTEXT
+ * @param [in] path The path to the new sealed object
+ * @param [in] type The type of the new sealed object. May be NULL
+ * @param [in] size The size of the new sealed object. Must not be 0
+ * @param [in] policyPath The path to the policy that is associated with the new
+ *             sealed object. May be NULL
+ * @param [in] authValue The authorization value for the new sealed object. May
+ *             be NULL
+ * @param [in] data The data that is to be sealed within the new object. May be
+ *             NULL
+ *
+ * @retval TSS2_RC_SUCCESS: if the function call was a success.
+ * @retval TSS2_FAPI_RC_BAD_REFERENCE: if context, or path is NULL.
+ * @retval TSS2_FAPI_RC_BAD_CONTEXT: if context corruption is detected.
+ * @retval TSS2_FAPI_RC_KEY_NOT_FOUND: if the parent key does not map to a
+ *         FAPI key.
+ * @retval TSS2_FAPI_RC_BAD_PATH: if policyPath is non-NULL and does not map to
+ *         a FAPI key.
+ * @retval TSS2_FAPI_RC_PATH_ALREADY_EXISTS: if a sealed object already exists
+ *         at path.
+ * @retval TSS2_FAPI_RC_BAD_VALUE: if the keyType is invalid.
+ * @retval TSS2_FAPI_RC_STORAGE_ERROR: if the FAPI storage cannot be updated.
+ * @retval TSS2_FAPI_RC_BAD_SEQUENCE: if the context has an asynchronous
+ *         operation already pending.
+ * @retval TSS2_FAPI_RC_IO_ERROR: if the data cannot be saved.
+ * @retval TSS2_FAPI_RC_MEMORY: if the FAPI cannot allocate enough memory for
+ *         internal operations or return parameters.
+ */
+TSS2_RC
+Fapi_CreateSeal_Async(
+    FAPI_CONTEXT *context,
+    char    const *path,
+    char    const *type,
+    size_t         size,
+    char    const *policyPath,
+    char    const *authValue,
+    uint8_t const *data)
+{
+    LOG_TRACE("called for context:%p", context);
+    LOG_TRACE("path: %s", path);
+    LOG_TRACE("type: %s", type);
+    LOG_TRACE("size: %zi", size);
+    LOG_TRACE("policyPath: %s", policyPath);
+    LOG_TRACE("authValue: %s", authValue);
+
+    TSS2_RC r;
+
+    /* Check for NULL parameters */
+    check_not_null(context);
+    check_not_null(path);
+
+    r = ifapi_session_init(context);
+    return_if_error(r, "Initialize CreateSeal");
+
+    memset(&context->cmd.Key_Create.public_templ, 0, sizeof(IFAPI_KEY_TEMPLATE));
+
+    r = ifapi_key_create_prepare_sensitive(context, path, policyPath, size,
+                                           authValue, data);
+    return_if_error(r, "Key create.");
+
+    r = ifapi_set_key_flags(type ? type : "",
+                            (policyPath && strcmp(policyPath, "") != 0) ? true : false,
+                            &context->cmd.Key_Create.public_templ);
+    return_if_error(r, "Set key flags for key");
+
+    context->cmd.Key_Create.public_templ.public.publicArea.objectAttributes  &=
+        ~TPMA_OBJECT_SENSITIVEDATAORIGIN;
+
+    context->state = CREATE_SEAL;
+
+    LOG_TRACE("finsihed");
+    return TSS2_RC_SUCCESS;
+}
+
+/** Asynchronous finish function for Fapi_CreateSeal
+ *
+ * This function should be called after a previous Fapi_CreateSeal.
+ *
+ * @param [in, out] context The FAPI_CONTEXT
+ *
+ * @retval TSS2_RC_SUCCESS: if the function call was a success.
+ * @retval TSS2_FAPI_RC_BAD_REFERENCE: if context is NULL.
+ * @retval TSS2_FAPI_RC_BAD_CONTEXT: if context corruption is detected.
+ * @retval TSS2_FAPI_RC_BAD_SEQUENCE: if the context has an asynchronous
+ *         operation already pending.
+ * @retval TSS2_FAPI_RC_IO_ERROR: if the data cannot be saved.
+ * @retval TSS2_FAPI_RC_MEMORY: if the FAPI cannot allocate enough memory for
+ *         internal operations or return parameters.
+ * @retval TSS2_FAPI_RC_TRY_AGAIN: if the asynchronous operation is not yet
+ *         complete. Call this function again later.
+ */
+TSS2_RC
+Fapi_CreateSeal_Finish(
+    FAPI_CONTEXT *context)
+{
+    LOG_TRACE("called for context:%p", context);
+
+    TSS2_RC r;
+
+    /* Check for NULL parameters */
+    check_not_null(context);
+
+    switch (context->state) {
+        statecase(context->state, CREATE_SEAL);
+            r = ifapi_key_create(context, &context->cmd.Key_Create.public_templ);
+            return_try_again(r);
+            goto_if_error(r, "Key create", error_cleanup);
+            break;
+
+        statecasedefault(context->state);
+    }
+
+error_cleanup:
+    ifapi_cleanup_ifapi_object(&context->createPrimary.pkey_object);
+    ifapi_cleanup_ifapi_object(context->loadKey.key_object);
+    ifapi_cleanup_ifapi_object(&context->loadKey.auth_object);
+    context->state = _FAPI_STATE_INIT;
+    LOG_TRACE("finsihed");
+    return r;
+}

diff --git a/src/tss2-fapi/api/Fapi_Decrypt.c b/src/tss2-fapi/api/Fapi_Decrypt.c
new file mode 100644
index 0000000..c427733
--- /dev/null
+++ b/src/tss2-fapi/api/Fapi_Decrypt.c

@@ -0,0 +1,530 @@
+/* SPDX-License-Identifier: BSD-2-Clause */
+/*******************************************************************************
+ * Copyright 2018-2019, Fraunhofer SIT sponsored by Infineon Technologies AG
+ * All rights reserved.
+ ******************************************************************************/
+
+#ifdef HAVE_CONFIG_H
+#include <config.h>
+#endif
+
+#include <stdlib.h>
+#include <errno.h>
+#include <unistd.h>
+#include <errno.h>
+#include <string.h>
+
+#include "tss2_fapi.h"
+#include "fapi_int.h"
+#include "fapi_util.h"
+#include "tss2_esys.h"
+#include "fapi_crypto.h"
+#include "fapi_policy.h"
+#include "ifapi_policyutil_execute.h"
+#include "ifapi_json_deserialize.h"
+#define LOGMODULE fapi
+#include "util/log.h"
+#include "util/aux_util.h"
+
+/** One-Call function for Fapi_Decrypt
+ *
+ * Decrypts data that was previously encrypted with Fapi_Encrypt.
+ *
+ * @param [in, out] context The FAPI_CONTEXT
+ * @param [in] cipherText The ciphertext to decrypt
+ * @param [out] plainText the decrypted ciphertext. May be NULL
+ *              (callee-allocated)
+ * @param [out] plainTextSize The size of the ciphertext in bytes. May be NULL
+ *
+ * @retval TSS2_RC_SUCCESS: if the function call was a success.
+ * @retval TSS2_FAPI_RC_BAD_REFERENCE: if context or cipherText is NULL.
+ * @retval TSS2_FAPI_RC_BAD_CONTEXT: if context corruption is detected.
+ * @retval TSS2_FAPI_RC_KEY_NOT_FOUND: if can’t find the key necessary to decrypt
+ *         the file.
+ * @retval TSS2_FAPI_RC_BAD_KEY: if the decryption key is unsuitable for the
+ *         requested operation.
+ * @retval TSS2_FAPI_RC_BAD_VALUE: if the decryption fails
+ * @retval TSS2_FAPI_RC_BAD_SEQUENCE: if the context has an asynchronous
+ *         operation already pending.
+ * @retval TSS2_FAPI_RC_IO_ERROR: if the data cannot be saved.
+ * @retval TSS2_FAPI_RC_MEMORY: if the FAPI cannot allocate enough memory for
+ *         internal operations or return parameters.
+ */
+TSS2_RC
+Fapi_Decrypt(
+    FAPI_CONTEXT *context,
+    char   const *cipherText,
+    uint8_t     **plainText,
+    size_t       *plainTextSize)
+{
+    LOG_TRACE("called for context:%p", context);
+
+    TSS2_RC r, r2;
+
+    /* Check for NULL parameters */
+    check_not_null(context);
+    check_not_null(cipherText);
+
+    /* Check whether TCTI and ESYS are initialized */
+    return_if_null(context->esys, "Command can't be executed in none TPM mode.",
+                   TSS2_FAPI_RC_NO_TPM);
+
+    /* If the async state automata of FAPI shall be tested, then we must not set
+       the timeouts of ESYS to blocking mode.
+       During testing, the mssim tcti will ensure multiple re-invocations.
+       Usually however the synchronous invocations of FAPI shall instruct ESYS
+       to block until a result is available. */
+#ifndef TEST_FAPI_ASYNC
+    r = Esys_SetTimeout(context->esys, TSS2_TCTI_TIMEOUT_BLOCK);
+    return_if_error_reset_state(r, "Set Timeout to blocking");
+#endif /* TEST_FAPI_ASYNC */
+
+    r = Fapi_Decrypt_Async(context, cipherText);
+    return_if_error_reset_state(r, "Data_Encrypt");
+
+    do {
+        /* We wait for file I/O to be ready if the FAPI state automata
+           are in a file I/O state. */
+        r = ifapi_io_poll(&context->io);
+        return_if_error(r, "Something went wrong with IO polling");
+
+        /* Repeatedly call the finish function, until FAPI has transitioned
+           through all execution stages / states of this invocation. */
+        r = Fapi_Decrypt_Finish(context, plainText, plainTextSize);
+    } while ((r & ~TSS2_RC_LAYER_MASK) == TSS2_BASE_RC_TRY_AGAIN);
+
+    /* Reset the ESYS timeout to non-blocking, immediate response. */
+    r2 = Esys_SetTimeout(context->esys, 0);
+    return_if_error(r2, "Set Timeout to non-blocking");
+
+    return_if_error_reset_state(r, "Data_Decrypt");
+
+    LOG_TRACE("finsihed");
+    return TSS2_RC_SUCCESS;
+}
+
+/** Asynchronous function for Fapi_Decrypt
+ *
+ * Decrypts data that was previously encrypted with Fapi_Encrypt.
+ *
+ * Call Fapi_Decrypt_Finish to finish the execution of this command.
+ *
+ * @param [in, out] context The FAPI_CONTEXT
+ * @param [in] cipherText The ciphertext to decrypt
+ *
+ * @retval TSS2_RC_SUCCESS: if the function call was a success.
+ * @retval TSS2_FAPI_RC_BAD_REFERENCE: if context or cipherText is NULL.
+ * @retval TSS2_FAPI_RC_BAD_CONTEXT: if context corruption is detected.
+ * @retval TSS2_FAPI_RC_KEY_NOT_FOUND: if can’t find the key necessary to decrypt
+ *         the file.
+ * @retval TSS2_FAPI_RC_BAD_KEY: if the decryption key is unsuitable for the
+ *         requested operation.
+ * @retval TSS2_FAPI_RC_BAD_VALUE: if the decryption fails
+ * @retval TSS2_FAPI_RC_BAD_SEQUENCE: if the context has an asynchronous
+ *         operation already pending.
+ * @retval TSS2_FAPI_RC_IO_ERROR: if the data cannot be saved.
+ * @retval TSS2_FAPI_RC_MEMORY: if the FAPI cannot allocate enough memory for
+ *         internal operations or return parameters.
+ */
+TSS2_RC
+Fapi_Decrypt_Async(
+    FAPI_CONTEXT *context,
+    char   const *cipherText)
+{
+    LOG_TRACE("called for context:%p", context);
+    LOG_TRACE("cipherText: %s", cipherText);
+
+    TSS2_RC r;
+    json_object *jso = NULL;
+
+    /* Check for NULL parameters */
+    check_not_null(context);
+    check_not_null(cipherText);
+
+    /* Helpful alias pointers */
+    IFAPI_Data_EncryptDecrypt * command = &(context->cmd.Data_EncryptDecrypt);
+    IFAPI_ENCRYPTED_DATA *encData = &command->enc_data;
+
+    r = ifapi_session_init(context);
+    return_if_error(r, "Initialize Decrypt");
+
+    encData->cipher.buffer = NULL;
+    command->out_data = NULL;
+    jso = json_tokener_parse(cipherText);
+    return_if_null(jso, "Json error.", TSS2_FAPI_RC_BAD_VALUE);
+    command->object_handle = ESYS_TR_NONE;
+
+    r = ifapi_json_IFAPI_ENCRYPTED_DATA_deserialize(jso,
+            encData);
+    goto_if_error(r, "Invalid cipher object.", error_cleanup);
+
+    command->in_data =
+        &encData->cipher.buffer[0];
+    command->numBytes =
+        encData->cipher.size;
+
+    /* No sub path in keystore will be used (first param == NULL */
+    r = ifapi_get_entities(&context->keystore, NULL,
+                           &command->pathlist,
+                           &command->numPaths);
+    goto_if_error(r, "get entities.", error_cleanup);
+
+    /* Start with the last path */
+    command->path_idx =
+        command->numPaths;
+
+    r = ifapi_get_sessions_async(context,
+                                 IFAPI_SESSION_GENEK | IFAPI_SESSION1,
+                                 TPMA_SESSION_DECRYPT, 0);
+    goto_if_error_reset_state(r, "Create sessions", error_cleanup);
+
+    json_object_put(jso);
+    context->state = DATA_DECRYPT_WAIT_FOR_SESSION;
+    LOG_TRACE("finsihed");
+    return r;
+
+error_cleanup:
+    if (jso)
+        json_object_put(jso);
+    SAFE_FREE(encData->cipher.buffer);
+
+    return r;
+}
+
+/** Asynchronous finish function for Fapi_Decrypt
+ *
+ * This function should be called after a previous Fapi_Decrypt.
+ *
+ * @param [in, out] context The FAPI_CONTEXT
+ * @param [out] plainText the decrypted ciphertext. May be NULL
+ *              (callee-allocated)
+ * @param [out] plainTextSize The size of the ciphertext in bytes. May be NULL
+ *
+ * @retval TSS2_RC_SUCCESS: if the function call was a success.
+ * @retval TSS2_FAPI_RC_BAD_REFERENCE: if context, plainText or plainTextSize
+ *         is NULL.
+ * @retval TSS2_FAPI_RC_BAD_CONTEXT: if context corruption is detected.
+ * @retval TSS2_FAPI_RC_BAD_SEQUENCE: if the context has an asynchronous
+ *         operation already pending.
+ * @retval TSS2_FAPI_RC_IO_ERROR: if the data cannot be saved.
+ * @retval TSS2_FAPI_RC_MEMORY: if the FAPI cannot allocate enough memory for
+ *         internal operations or return parameters.
+ * @retval TSS2_FAPI_RC_TRY_AGAIN: if the asynchronous operation is not yet
+ *         complete. Call this function again later.
+ */
+TSS2_RC
+Fapi_Decrypt_Finish(
+    FAPI_CONTEXT *context,
+    uint8_t     **plainText,
+    size_t       *plainTextSize)
+{
+    LOG_TRACE("called for context:%p", context);
+
+    TSS2_RC r;
+    char *path;
+    UINT32 pathIdx;
+    TPM2B_PUBLIC_KEY_RSA *tpmPlainText = NULL;
+    TPM2B_SENSITIVE_DATA *sym_key = NULL;
+
+    /* Check for NULL parameters */
+    check_not_null(context);
+
+    /* Helpful alias pointers */
+    IFAPI_OBJECT *encKeyObject = NULL;
+    IFAPI_Data_EncryptDecrypt * command = &(context->cmd.Data_EncryptDecrypt);
+    IFAPI_ENCRYPTED_DATA *encData = &command->enc_data;
+
+    switch(context->state) {
+        statecase(context->state, DATA_DECRYPT_WAIT_FOR_SESSION);
+            r = ifapi_get_sessions_finish(context, &context->profiles.default_profile);
+            return_try_again(r);
+
+            goto_if_error_reset_state(r, " FAPI create session", error_cleanup);
+            context->state = DATA_DECRYPT_SEARCH_KEY;
+            fallthrough;
+
+        statecase(context->state, DATA_DECRYPT_SEARCH_KEY);
+            r = ifapi_keystore_search_obj(&context->keystore, &context->io,
+                                          &command->enc_data.key_name,
+                                          &path);
+            return_try_again(r);
+            goto_if_error(r, "Search Key", error_cleanup);
+
+            r = ifapi_load_keys_async(context, path);
+            goto_if_error(r, "Load keys.", error_cleanup);
+            LOG_TRACE("Key found.");
+
+            SAFE_FREE(path);
+            context->state = DATA_DECRYPT_WAIT_FOR_KEY;
+            fallthrough;
+
+        statecase(context->state, DATA_DECRYPT_WAIT_FOR_KEY);
+            r = ifapi_load_keys_finish(context, IFAPI_FLUSH_PARENT,
+                                       &command->key_handle,
+                                       &command->key_object);
+            return_try_again(r);
+
+            goto_if_error_reset_state(r, " Load key.", error_cleanup);
+
+            encKeyObject = command->key_object;
+
+            /* Symmetric decryption */
+            if (command->enc_data.type == IFAPI_SYM_BULK_ENCRYPTION
+                    &&
+                    encKeyObject->misc.key.public.publicArea.type == TPM2_ALG_SYMCIPHER) {
+                r = Esys_TRSess_SetAttributes(context->esys, context->session1,
+                                              TPMA_SESSION_CONTINUESESSION,
+                                              0xff);
+
+                goto_if_error_reset_state(r, "Set session attributes.", error_cleanup);
+
+                r = ifapi_sym_encrypt_decrypt_async(context,
+                                                    command->in_data,
+                                                    command->in_dataSize,
+                                                    TPM2_YES); /**< decrypt (not encrypt) */
+                goto_if_error(r, "Symmetric decryption error.", error_cleanup);
+                context-> state = DATA_DECRYPT_WAIT_FOR_SYM_ENCRYPTION;
+                return TSS2_FAPI_RC_TRY_AGAIN;
+            }
+
+            if (command->enc_data.type == IFAPI_ASYM_BULK_ENCRYPTION
+                    &&
+                    encKeyObject->misc.key.public.publicArea.type == TPM2_ALG_RSA) {
+                context-> state = DATA_DECRYPT_AUTHORIZE_KEY;
+                return TSS2_FAPI_RC_TRY_AGAIN;
+            } else {
+                goto_error(r, TSS2_FAPI_RC_GENERAL_FAILURE, "Invalid mode", error_cleanup);
+                break;
+            }
+
+        statecase(context->state, DATA_DECRYPT_AUTHORIZE_KEY);
+            r = ifapi_authorize_object(context, command->key_object, &command->auth_session);
+            return_try_again(r);
+            goto_if_error(r, "Authorize signature key.", error_cleanup);
+
+            TPM2B_PRIVATE private;
+
+            private.size = encData->sym_private.size;
+            memcpy(&private.buffer[0], encData->sym_private.buffer, private.size);
+
+            r = Esys_Load_Async(context->esys, command->key_handle,
+                                command->auth_session,
+                                ESYS_TR_NONE, ESYS_TR_NONE,
+                                &private, &encData->sym_public);
+            goto_if_error(r, "Load async", error_cleanup);
+            context->state = DATA_DECRYPT_WAIT_FOR_SEAL_KEY;
+            fallthrough;
+
+        statecase(context->state, DATA_DECRYPT_WAIT_FOR_SEAL_KEY);
+            r = Esys_Load_Finish(context->esys,
+                                 &command->object_handle);
+            return_try_again(r);
+            goto_if_error(r, "Load_Finish", error_cleanup);
+            context->state = DATA_DECRYPT_FLUSH_KEY;
+            fallthrough;
+
+        statecase(context->state, DATA_DECRYPT_FLUSH_KEY);
+            r = Esys_FlushContext_Async(context->esys,
+                                        command->key_handle);
+            goto_if_error(r, "Error: FlushContext", error_cleanup);
+
+            context->state = DATA_DECRYPT_WAIT_FOR_FLUSH;
+            fallthrough;
+
+        statecase(context->state, DATA_DECRYPT_WAIT_FOR_FLUSH);
+            r = Esys_FlushContext_Finish(context->esys);
+            return_try_again(r);
+
+            goto_if_error(r, "Error: FlushContext", error_cleanup);
+            command->key_handle = ESYS_TR_NONE;
+
+            if (!encData->sym_policy_harness.policy) {
+                /* Object can be unsealed without authorization */
+                context->state = DATA_DECRYPT_UNSEAL_OBJECT;
+                return TSS2_FAPI_RC_TRY_AGAIN;
+            }
+            r = ifapi_policyutil_execute_prepare(context,
+                                                 encData->sym_public.publicArea.nameAlg,
+                                                 &encData->sym_policy_harness);
+            return_if_error(r, "Prepare policy execution.");
+
+            context->policy.util_current_policy = context->policy.util_current_policy->prev;
+            command->auth_session = ESYS_TR_NONE;
+
+            fallthrough;
+
+        statecase(context->state, DATA_DECRYPT_EXEC_POLICY);
+            r = ifapi_policyutil_execute(context, &command->auth_session);
+            return_try_again(r);
+            goto_if_error(r, "Execute policy", error_cleanup);
+
+            /* Clear continue session flag, so policy session will be flushed after
+               authorization */
+            r = Esys_TRSess_SetAttributes(context->esys, command->auth_session, 0,
+                                          TPMA_SESSION_CONTINUESESSION);
+            goto_if_error(r, "Esys_TRSess_SetAttributes", error_cleanup);
+
+            fallthrough;
+
+        statecase(context->state, DATA_DECRYPT_UNSEAL_OBJECT);
+            r = Esys_Unseal_Async(context->esys,
+                                  command->object_handle,
+                                  command->auth_session,
+                                  ESYS_TR_NONE, ESYS_TR_NONE);
+            goto_if_error(r, "Error esys Unseal ", error_cleanup);
+            context->state = DATA_DECRYPT_WAIT_FOR_UNSEAL;
+            fallthrough;
+
+        statecase(context->state, DATA_DECRYPT_WAIT_FOR_UNSEAL);
+            r = Esys_Unseal_Finish(context->esys, &sym_key);
+            return_try_again(r);
+            goto_if_error(r, "Unseal_Finish", error_cleanup);
+
+            r = ifapi_crypto_aes_decrypt(&sym_key->buffer[0], encData->sym_key_size,
+                                         &encData->sym_iv.buffer[0],
+                                         encData->cipher.buffer,
+                                         encData->cipher.size);
+            SAFE_FREE(sym_key);
+            goto_if_error(r, "Error esys Unseal ", error_cleanup);
+            if (plainText)
+                *plainText =  encData->cipher.buffer;
+            if (plainTextSize)
+                *plainTextSize =  encData->cipher.size;
+
+            r = Esys_FlushContext_Async(context->esys,
+                                        command->object_handle);
+            goto_if_error(r, "Error: FlushContext", error_cleanup);
+
+            context->state = DATA_DECRYPT_FLUSH_SYM_OBJECT;
+            fallthrough;
+
+        statecase(context->state, DATA_DECRYPT_FLUSH_SYM_OBJECT);
+            r = Esys_FlushContext_Finish(context->esys);
+            return_try_again(r);
+            goto_if_error(r, "Flush object", error_cleanup);
+
+            context->state = DATA_DECRYPT_CLEANUP;
+            return TSS2_FAPI_RC_TRY_AGAIN;
+
+        statecase(context->state, DATA_DECRYPT_NULL_AUTH_SENT);
+            /* This is used later on to differentiate two cases. see below */
+            fallthrough;
+
+        statecase(context->state, DATA_DECRYPT_WAIT_FOR_RSA_DECRYPTION);
+            r =  Esys_RSA_Decrypt_Finish(context->esys, &tpmPlainText);
+
+            return_try_again(r);
+
+            /* Retry with authorization callback after trial with null auth */
+            encKeyObject = command->key_object;
+            if (((r & ~TPM2_RC_N_MASK) == TPM2_RC_BAD_AUTH)
+                    && (encKeyObject->misc.key.public.publicArea.objectAttributes &
+                        TPMA_OBJECT_NODA)
+                    &&  context->state == DATA_DECRYPT_NULL_AUTH_SENT) {
+                context->state = DATA_DECRYPT_WAIT_FOR_RSA_DECRYPTION;
+
+                r = ifapi_set_auth(context, encKeyObject, "Decrypt Key");
+                goto_if_error_reset_state(r, " Fapi_Decrypt", error_cleanup);
+
+                TPM2B_PUBLIC_KEY_RSA *auxData = (TPM2B_PUBLIC_KEY_RSA *)&context->aux_data;
+                TPM2B_DATA null_data = {.size = 0, .buffer = {} };
+                const IFAPI_PROFILE *profile;
+
+                pathIdx = command->path_idx;
+                path = command->pathlist[pathIdx];
+
+                r = ifapi_profiles_get(&context->profiles, path, &profile);
+                goto_if_error(r, "Retrieving profiles data", error_cleanup);
+
+                r = Esys_RSA_Decrypt_Async(context->esys,
+                                           command->key_handle,
+                                           context->session1, ESYS_TR_NONE, ESYS_TR_NONE,
+                                           auxData,
+                                           &profile->rsa_decrypt_scheme,
+                                           &null_data);
+                goto_if_error(r, "Error esys rsa decrypt", error_cleanup);
+
+                return TSS2_FAPI_RC_TRY_AGAIN;
+            }
+
+            goto_if_error_reset_state(r, "RSA decryption.", error_cleanup);
+
+            if (plainTextSize)
+                *plainTextSize = tpmPlainText->size;
+            if (plainText) {
+                *plainText = malloc(tpmPlainText->size);
+                goto_if_null(*plainText, "Out of memory", TSS2_FAPI_RC_MEMORY, error_cleanup);
+
+                memcpy(*plainText, &tpmPlainText->buffer[0], tpmPlainText->size);
+                free(tpmPlainText);
+            }
+            context-> state = DATA_DECRYPT_FLUSH_KEY;
+            return TSS2_FAPI_RC_TRY_AGAIN;
+
+        statecase(context->state, DATA_DECRYPT_WAIT_FOR_SYM_ENCRYPTION);
+            r = ifapi_sym_encrypt_decrypt_finish(context, plainText, plainTextSize,
+                                                 TPM2_YES);
+            return_try_again(r);
+
+            goto_if_error_reset_state(r, "Symmetric encryption.", error_cleanup);
+
+            fallthrough;
+
+        statecase(context->state, DATA_DECRYPT_CLEANUP)
+            r = ifapi_cleanup_session(context);
+            try_again_or_error_goto(r, "Cleanup", error_cleanup);
+
+            break;
+
+        statecasedefault(context->state);
+    }
+
+    context->state =  _FAPI_STATE_INIT;
+
+    /* Cleanup of local objects */
+    SAFE_FREE(tpmPlainText);
+
+    /* Cleanup of command related objects */
+    ifapi_cleanup_ifapi_object(command->key_object);
+    for (size_t i = 0; i < command->numPaths; i++) {
+        SAFE_FREE(command->pathlist[i]);
+    }
+    SAFE_FREE(command->pathlist);
+
+    /* Cleanup of encryption data related objects */
+    ifapi_cleanup_policy_harness(&encData->sym_policy_harness);
+    SAFE_FREE(encData->sym_private.buffer);
+
+    /* Cleanup of context related objects */
+    ifapi_cleanup_ifapi_object(&context->createPrimary.pkey_object);
+    ifapi_cleanup_ifapi_object(context->loadKey.key_object);
+
+    LOG_TRACE("finsihed");
+    return TSS2_RC_SUCCESS;
+
+error_cleanup:
+    /* Cleanup of local objects */
+    SAFE_FREE(tpmPlainText);
+
+    /* Cleanup of command related objects */
+    ifapi_cleanup_ifapi_object(command->key_object);
+    ifapi_cleanup_policy_harness(&encData->sym_policy_harness);
+    for (size_t i = 0; i < command->numPaths; i++) {
+        SAFE_FREE(command->pathlist[i]);
+    }
+    SAFE_FREE(command->pathlist);
+
+    /* Cleanup of encryption data related objects */
+    SAFE_FREE(encData->cipher.buffer);
+    SAFE_FREE(encData->sym_private.buffer);
+
+    /* Cleanup of context related objects */
+    if (command->key_handle != ESYS_TR_NONE)
+        Esys_FlushContext(context->esys, command->key_handle);
+    ifapi_session_clean(context);
+    ifapi_cleanup_ifapi_object(&context->createPrimary.pkey_object);
+    ifapi_cleanup_ifapi_object(&context->loadKey.auth_object);
+    ifapi_cleanup_ifapi_object(context->loadKey.key_object);
+
+    return r;
+}

diff --git a/src/tss2-fapi/api/Fapi_Delete.c b/src/tss2-fapi/api/Fapi_Delete.c
new file mode 100644
index 0000000..019f285
--- /dev/null
+++ b/src/tss2-fapi/api/Fapi_Delete.c

@@ -0,0 +1,439 @@
+/* SPDX-License-Identifier: BSD-2-Clause */
+/*******************************************************************************
+ * Copyright 2018-2019, Fraunhofer SIT sponsored by Infineon Technologies AG
+ * All rights reserved.
+ ******************************************************************************/
+
+#ifdef HAVE_CONFIG_H
+#include <config.h>
+#endif
+
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <errno.h>
+
+#include "tss2_fapi.h"
+#include "fapi_int.h"
+#include "fapi_util.h"
+#include "tss2_esys.h"
+#include "ifapi_json_serialize.h"
+#include "ifapi_json_deserialize.h"
+#define LOGMODULE fapi
+#include "util/log.h"
+#include "util/aux_util.h"
+
+
+/** One-Call function for Fapi_Delete
+ *
+ * Deletes a given key, policy or NV index from the system.
+ *
+ * @param[in, out] context The ESAPI_CONTEXT
+ * @param[in] path The path to the entity that is to be deleted
+ *
+ * @retval TSS2_RC_SUCCESS: if the function call was a success.
+ * @retval TSS2_FAPI_RC_BAD_REFERENCE: if context or path is NULL.
+ * @retval TSS2_FAPI_RC_BAD_CONTEXT: if context corruption is detected.
+ * @retval TSS2_FAPI_RC_BAD_PATH: if path does not map to a FAPI entity.
+ * @retval TSS2_FAPI_RC_NOT_DELETABLE: if the entity is not deletable or the
+ *         path is read-only.
+ * @retval TSS2_FAPI_RC_STORAGE_ERROR: if the FAPI storage cannot be updated.
+ * @retval TSS2_FAPI_RC_BAD_SEQUENCE: if the context has an asynchronous
+ *         operation already pending.
+ * @retval TSS2_FAPI_RC_IO_ERROR: if the data cannot be saved.
+ * @retval TSS2_FAPI_RC_MEMORY: if the FAPI cannot allocate enough memory for
+ *         internal operations or return parameters.
+ */
+TSS2_RC
+Fapi_Delete(
+    FAPI_CONTEXT   *context,
+    char     const *path)
+{
+    LOG_TRACE("called for context:%p", context);
+
+    TSS2_RC r;
+
+    /* Check for NULL parameters */
+    check_not_null(context);
+    check_not_null(path);
+
+    r = Fapi_Delete_Async(context, path);
+    return_if_error_reset_state(r, "Entity_Delete");
+
+    do {
+        /* We wait for file I/O to be ready if the FAPI state automata
+           are in a file I/O state. */
+        r = ifapi_io_poll(&context->io);
+        return_if_error(r, "Something went wrong with IO polling");
+
+        /* Repeatedly call the finish function, until FAPI has transitioned
+           through all execution stages / states of this invocation. */
+        r = Fapi_Delete_Finish(context);
+    } while ((r & ~TSS2_RC_LAYER_MASK) == TSS2_BASE_RC_TRY_AGAIN);
+
+    return_if_error_reset_state(r, "Entity_Delete");
+
+    return TSS2_RC_SUCCESS;
+}
+
+/** Asynchronous function for Fapi_Delete
+ *
+ * Deletes a given key, policy or NV index from the system.
+
+ * Call Fapi_Delete_Finish to finish the execution of this command.
+ *
+ * @param[in, out] context The ESAPI_CONTEXT
+ * @param[in] path The path to the entity that is to be deleted
+ *
+ * @retval TSS2_RC_SUCCESS: if the function call was a success.
+ * @retval TSS2_FAPI_RC_BAD_REFERENCE: if context or path is NULL.
+ * @retval TSS2_FAPI_RC_BAD_CONTEXT: if context corruption is detected.
+ * @retval TSS2_FAPI_RC_BAD_PATH: if path does not map to a FAPI entity.
+ * @retval TSS2_FAPI_RC_NOT_DELETABLE: if the entity is not deletable or the
+ *         path is read-only.
+ * @retval TSS2_FAPI_RC_STORAGE_ERROR: if the FAPI storage cannot be updated.
+ * @retval TSS2_FAPI_RC_BAD_SEQUENCE: if the context has an asynchronous
+ *         operation already pending.
+ * @retval TSS2_FAPI_RC_IO_ERROR: if the data cannot be saved.
+ * @retval TSS2_FAPI_RC_MEMORY: if the FAPI cannot allocate enough memory for
+ *         internal operations or return parameters.
+ */
+TSS2_RC
+Fapi_Delete_Async(
+    FAPI_CONTEXT   *context,
+    char     const *path)
+{
+    LOG_TRACE("called for context:%p", context);
+    LOG_TRACE("path: %s", path);
+
+    TSS2_RC r;
+
+    /* Check for NULL parameters */
+    check_not_null(context);
+    check_not_null(path);
+
+    /* Helpful alias pointers */
+    IFAPI_Entity_Delete * command = &(context->cmd.Entity_Delete);
+    IFAPI_OBJECT *object = &command->object;
+    IFAPI_OBJECT *authObject = &command->auth_object;
+
+    strdup_check(command->path, path, r, error_cleanup);
+
+    r = ifapi_keystore_list_all(&context->keystore, path, &command->pathlist,
+                               &command->numPaths);
+    return_if_error(r, "get entities.");
+
+    command->path_idx = command->numPaths;
+
+    if (command->numPaths == 0) {
+        goto_error(r, TSS2_FAPI_RC_BAD_PATH, "No objects found.", error_cleanup);
+    }
+
+    object->objectType = IFAPI_OBJ_NONE;
+    authObject->objectType = IFAPI_OBJ_NONE;
+
+    if (ifapi_path_type_p(path, IFAPI_EXT_PATH) ||
+        (ifapi_path_type_p(path, IFAPI_POLICY_PATH))) {
+        /* No session will be needed these files can be deleted without
+           interaction with the TPM */
+        r = ifapi_non_tpm_mode_init(context);
+        return_if_error(r, "Initialize Entity_Delete");
+
+        context->state =  ENTITY_DELETE_GET_FILE;
+    } else {
+        /* Check whether TCTI and ESYS are initialized */
+        return_if_null(context->esys, "Command can't be executed in none TPM mode.",
+                       TSS2_FAPI_RC_NO_TPM);
+
+        /* If the async state automata of FAPI shall be tested, then we must not set
+           the timeouts of ESYS to blocking mode.
+           During testing, the mssim tcti will ensure multiple re-invocations.
+           Usually however the synchronous invocations of FAPI shall instruct ESYS
+           to block until a result is available. */
+#ifndef TEST_FAPI_ASYNC
+        r = Esys_SetTimeout(context->esys, TSS2_TCTI_TIMEOUT_BLOCK);
+        return_if_error_reset_state(r, "Set Timeout to blocking");
+#endif /* TEST_FAPI_ASYNC */
+
+        /* A TPM session will be created to enable object authorization */
+        r = ifapi_session_init(context);
+        return_if_error(r, "Initialize Entity_Delete");
+
+        r = ifapi_get_sessions_async(context,
+                                 IFAPI_SESSION_GENEK | IFAPI_SESSION1,
+                                 0, 0);
+        goto_if_error_reset_state(r, "Create sessions", error_cleanup);
+
+        context->state = ENTITY_DELETE_WAIT_FOR_SESSION;
+    }
+
+    LOG_TRACE("finsihed");
+    return TSS2_RC_SUCCESS;
+
+error_cleanup:
+    SAFE_FREE(command->path);
+    if (Esys_FlushContext(context->esys, context->session1) != TSS2_RC_SUCCESS) {
+        LOG_ERROR("Cleanup session failed.");
+    }
+    return r;
+}
+
+
+/** Asynchronous finish function for Fapi_Delete
+ *
+ * This function should be called after a previous Fapi_Delete_Async.
+ *
+ * @param [in, out] context The FAPI_CONTEXT
+ *
+ * @retval TSS2_RC_SUCCESS: if the function call was a success.
+ * @retval TSS2_FAPI_RC_BAD_REFERENCE: if context is NULL.
+ * @retval TSS2_FAPI_RC_BAD_CONTEXT: if context corruption is detected.
+ * @retval TSS2_FAPI_RC_BAD_SEQUENCE: if the context has an asynchronous
+ *         operation already pending.
+ * @retval TSS2_FAPI_RC_IO_ERROR: if the data cannot be saved.
+ * @retval TSS2_FAPI_RC_MEMORY: if the FAPI cannot allocate enough memory for
+ *         internal operations or return parameters.
+ * @retval TSS2_FAPI_RC_TRY_AGAIN: if the asynchronous operation is not yet
+ *         complete. Call this function again later.
+ */
+TSS2_RC
+Fapi_Delete_Finish(
+    FAPI_CONTEXT   *context)
+{
+    LOG_TRACE("called for context:%p", context);
+
+    TSS2_RC r;
+    ESYS_TR authIndex;
+    ESYS_TR auth_session;
+    char *path;
+
+    /* Check for NULL parameters */
+    check_not_null(context);
+
+    /* Helpful alias pointers */
+    IFAPI_Entity_Delete * command = &(context->cmd.Entity_Delete);
+    IFAPI_OBJECT *object = &command->object;
+    IFAPI_OBJECT *authObject = &command->auth_object;
+
+    switch (context->state) {
+        statecase(context->state, ENTITY_DELETE_WAIT_FOR_SESSION);
+            r = ifapi_get_sessions_finish(context, &context->profiles.default_profile);
+            return_try_again(r);
+            goto_if_error(r, "Create FAPI session.", error_cleanup);
+            context->state = ENTITY_DELETE_GET_FILE;
+            fallthrough;
+
+        statecase(context->state, ENTITY_DELETE_GET_FILE);
+            /* Use last path in the path list */
+            command->path_idx -= 1;
+            path =  command->pathlist[command->path_idx];
+            LOG_TRACE("Delete object: %s %zu", path, command->path_idx);
+
+            if (ifapi_path_type_p(path, IFAPI_EXT_PATH)) {
+                /* External keyfile can be deleted directly */
+                context->state = ENTITY_DELETE_FILE;
+                return TSS2_FAPI_RC_TRY_AGAIN;
+            }
+
+            if (ifapi_path_type_p(path, IFAPI_POLICY_PATH)) {
+                /* Policy file can be deleted directly */
+                context->state = ENTITY_DELETE_POLICY;
+                return TSS2_FAPI_RC_TRY_AGAIN;
+            }
+
+            r = ifapi_keystore_load_async(&context->keystore, &context->io, path);
+            return_if_error2(r, "Could not open: %s", path);
+
+            context->state = ENTITY_DELETE_READ;
+            fallthrough;
+
+        statecase(context->state, ENTITY_DELETE_READ);
+            r = ifapi_keystore_load_finish(&context->keystore, &context->io, object);
+            return_try_again(r);
+            return_if_error_reset_state(r, "read_finish failed");
+
+            r = ifapi_initialize_object(context->esys, object);
+            goto_if_error_reset_state(r, "Initialize NV object", error_cleanup);
+
+            if (object->objectType == IFAPI_KEY_OBJ) {
+                command->is_key = true;
+                context->state =  ENTITY_DELETE_KEY;
+                return TSS2_FAPI_RC_TRY_AGAIN;
+
+            } else  if (object->objectType == IFAPI_NV_OBJ) {
+                command->is_key = false;
+
+                if (object->misc.nv.hierarchy == ESYS_TR_RH_OWNER) {
+                    authIndex = ESYS_TR_RH_OWNER;
+                    ifapi_init_hierarchy_object(authObject, authIndex);
+                } else {
+                    *authObject = *object;
+                    authIndex = object->handle;
+                }
+                command->auth_index = authIndex;
+                context->state = ENTITY_DELETE_AUTHORIZE_NV;
+            } else {
+                context->state = ENTITY_DELETE_FILE;
+                return TSS2_FAPI_RC_TRY_AGAIN;
+            }
+            fallthrough;
+
+        statecase(context->state, ENTITY_DELETE_AUTHORIZE_NV);
+            r = ifapi_authorize_object(context, authObject, &auth_session);
+            return_try_again(r);
+            goto_if_error(r, "Authorize NV object.", error_cleanup);
+
+            r = Esys_NV_UndefineSpace_Async(context->esys,
+                                            command->auth_index,
+                                            object->handle,
+                                            auth_session,
+                                            ESYS_TR_NONE,
+                                            ESYS_TR_NONE);
+            goto_if_error_reset_state(r, " Fapi_NV_UndefineSpace_Async", error_cleanup);
+
+            context->state = ENTITY_DELETE_NULL_AUTH_SENT_FOR_NV;
+            return TSS2_FAPI_RC_TRY_AGAIN;
+
+        statecase(context->state, ENTITY_DELETE_KEY);
+            if (object->misc.key.persistent_handle) {
+                r = Esys_EvictControl_Async(context->esys, ESYS_TR_RH_OWNER,
+                                            object->handle,
+                                            context->session1,
+                                            ESYS_TR_NONE, ESYS_TR_NONE,
+                                            object->misc.key.persistent_handle);
+                goto_if_error(r, "Evict Control", error_cleanup);
+                context->state = ENTITY_DELETE_NULL_AUTH_SENT_FOR_KEY;
+            } else {
+                context->state = ENTITY_DELETE_FILE;
+                return TSS2_FAPI_RC_TRY_AGAIN;
+            }
+            fallthrough;
+
+        statecase(context->state, ENTITY_DELETE_AUTH_SENT_FOR_KEY);
+            fallthrough;
+        statecase(context->state, ENTITY_DELETE_NULL_AUTH_SENT_FOR_KEY);
+            r = Esys_EvictControl_Finish(context->esys,
+                                         &command->new_object_handle);
+            return_try_again(r);
+            if ((r & ~TPM2_RC_N_MASK) == TPM2_RC_BAD_AUTH) {
+                if (context->state == ENTITY_DELETE_NULL_AUTH_SENT_FOR_KEY) {
+                    ifapi_init_hierarchy_object(authObject,
+                                                TPM2_RH_OWNER);
+                    r = ifapi_set_auth(context, authObject,
+                                       "Owner Authorization");
+                    goto_if_error_reset_state(r, "Set owner authorization", error_cleanup);
+
+                    context->state = ENTITY_DELETE_AUTH_SENT_FOR_KEY;
+                    return TSS2_FAPI_RC_TRY_AGAIN;
+                }
+            }
+            goto_if_error_reset_state(r, "FAPI Entity_Delete", error_cleanup);
+
+            context->state = ENTITY_DELETE_FILE;
+            return TSS2_FAPI_RC_TRY_AGAIN;
+            break;
+
+        statecase(context->state, ENTITY_DELETE_AUTH_SENT_FOR_NV);
+            fallthrough;
+        statecase(context->state, ENTITY_DELETE_NULL_AUTH_SENT_FOR_NV);
+            r = Esys_NV_UndefineSpace_Finish(context->esys);
+            return_try_again(r);
+
+            if ((r & ~TPM2_RC_N_MASK) == TPM2_RC_BAD_AUTH) {
+                if (context->state == ENTITY_DELETE_NULL_AUTH_SENT_FOR_NV) {
+                    r = ifapi_set_auth(context, authObject, "Entity Delete object");
+                    goto_if_error_reset_state(r, " Fapi_NV_UndefineSpace", error_cleanup);
+
+                    r = Esys_NV_UndefineSpace_Async(context->esys,
+                                                    command->auth_index,
+                                                    object->handle,
+                                                    context->session1,
+                                                    context->session2,
+                                                    ESYS_TR_NONE);
+                    goto_if_error_reset_state(r, "FAPI Entity_Delete", error_cleanup);
+
+                    context->state = ENTITY_DELETE_AUTH_SENT_FOR_NV;
+                    return TSS2_FAPI_RC_TRY_AGAIN;
+                }
+            }
+            goto_if_error_reset_state(r, "FAPI NV_UndefineSpace", error_cleanup);
+
+            LOG_TRACE("NV Object undefined.");
+            context->state = ENTITY_DELETE_FILE;
+            return TSS2_FAPI_RC_TRY_AGAIN;
+            break;
+
+        statecase(context->state, ENTITY_DELETE_POLICY);
+            path = command->pathlist[command->path_idx];
+            LOG_TRACE("Delete: %s", path);
+
+            r = ifapi_policy_delete(&context->pstore, path);
+            goto_if_error_reset_state(r, "Could not delete: %s", error_cleanup, path);
+
+            if (command->path_idx > 0)
+                context->state = ENTITY_DELETE_GET_FILE;
+            else
+                context->state = ENTITY_DELETE_REMOVE_DIRS;
+            return TSS2_FAPI_RC_TRY_AGAIN;
+
+        statecase(context->state, ENTITY_DELETE_FILE);
+            path = command->pathlist[command->path_idx];
+            LOG_TRACE("Delete: %s", path);
+            ifapi_cleanup_ifapi_object(object);
+            ifapi_cleanup_ifapi_object(authObject);
+
+            r = ifapi_keystore_delete(&context->keystore, path);
+            goto_if_error_reset_state(r, "Could not delete: %s", error_cleanup, path);
+
+            if (command->path_idx > 0) {
+                context->state = ENTITY_DELETE_GET_FILE;
+                return TSS2_FAPI_RC_TRY_AGAIN;
+            }
+            context->state = ENTITY_DELETE_REMOVE_DIRS;
+            fallthrough;
+
+        statecase(context->state, ENTITY_DELETE_REMOVE_DIRS);
+            r = ifapi_keystore_remove_directories(&context->keystore, command->path);
+            goto_if_error(r, "Error while removing directories", error_cleanup);
+
+            context->state =  _FAPI_STATE_INIT;
+
+            LOG_DEBUG("success");
+            r = TSS2_RC_SUCCESS;
+            break;
+
+        statecasedefault(context->state);
+    }
+
+    /* Reset the ESYS timeout to non-blocking, immediate response. */
+    if (context->esys) {
+        r = Esys_SetTimeout(context->esys, 0);
+        goto_if_error(r, "Set Timeout to non-blocking", error_cleanup);
+    }
+
+    SAFE_FREE(command->path);
+    ifapi_cleanup_ifapi_object(authObject);
+    ifapi_cleanup_ifapi_object(object);
+    for (size_t i = 0; i < command->numPaths; i++) {
+        SAFE_FREE(command->pathlist[i]);
+    }
+    SAFE_FREE(command->pathlist);
+    ifapi_session_clean(context);
+    ifapi_cleanup_ifapi_object(&context->loadKey.auth_object);
+    ifapi_cleanup_ifapi_object(context->loadKey.key_object);
+    ifapi_cleanup_ifapi_object(&context->createPrimary.pkey_object);
+    LOG_TRACE("finsihed");
+    return r;
+
+error_cleanup:
+    Esys_SetTimeout(context->esys, 0);
+    ifapi_cleanup_ifapi_object(object);
+    SAFE_FREE(command->path);
+    for (size_t i = 0; i < command->numPaths; i++) {
+        SAFE_FREE(command->pathlist[i]);
+    }
+    SAFE_FREE(command->pathlist);
+    ifapi_session_clean(context);
+    ifapi_cleanup_ifapi_object(&context->createPrimary.pkey_object);
+    return r;
+}

diff --git a/src/tss2-fapi/api/Fapi_Encrypt.c b/src/tss2-fapi/api/Fapi_Encrypt.c
new file mode 100644
index 0000000..65c2c62
--- /dev/null
+++ b/src/tss2-fapi/api/Fapi_Encrypt.c

@@ -0,0 +1,527 @@
+/* SPDX-License-Identifier: BSD-2-Clause */
+/*******************************************************************************
+ * Copyright 2018-2019, Fraunhofer SIT sponsored by Infineon Technologies AG
+ * All rights reserved.
+ ******************************************************************************/
+
+#ifdef HAVE_CONFIG_H
+#include <config.h>
+#endif
+
+#include <stdlib.h>
+#include <errno.h>
+#include <unistd.h>
+#include <errno.h>
+#include <string.h>
+
+#include "tss2_fapi.h"
+#include "fapi_int.h"
+#include "fapi_util.h"
+#include "tss2_esys.h"
+#include "ifapi_json_serialize.h"
+#include "fapi_policy.h"
+#define LOGMODULE fapi
+#include "util/log.h"
+#include "util/aux_util.h"
+#include "fapi_crypto.h"
+
+#define IV_SIZE 16
+
+/** One-Call function for Fapi_Encrypt
+ *
+ * Encrypts the provided data with a given target key.
+ * If keypath is an asymmetric key and a plainText with
+ * size >= TPM2_MAX_SYM_SIZE is provided, Fapi_Encrypt() will bulk-encrypt the
+ * plainText with an intermediate symmetric key and then “seal” this
+ * intermediate symmetric key with keyPath as a KEYEDHASH TPM object. This
+ * keyPath may refer to the local TPM or to a public key of a remote TPM where
+ * the KEYEDHASH can be imported. The decrypt operation performs a TPM2_Unseal.
+ * ciphertext output contains a reference to the decryption key, the sealed
+ * symmetric key (if any), the policy instance, and the encrypted plainText.
+ *
+ * If plainText has a size <= TPM2_MAX_SYM_SIZE the plainText is sealed
+ * directly for keyPath.
+ *
+ * If encrypting for the local TPM (if keyPath is not from the external
+ * hierarchy), a storage key (symmetric or asymmetric) is required as keyPath
+ * (aka parent key) and the data intermediate symmetric key is created using
+ * TPM2_Create() as a KEYEDHASH object.
+ *
+ * If encrypting for a remote TPM, an asymmetric storage key is required as
+ * keyPath (aka parent key), and the data/intermediate symmetric key is
+ * encrypted such that it can be used in a TPM2_Import operation.
+ *
+ * @param [in,out] context The FAPI_CONTEXT
+ * @param [in] keyPath THe path to the encryption key
+ * @param [in] policyPath The path to the policy the sealed data will be
+ *        associated with. May be NULL
+ * @param [in] plainText The plaintext data to encrypt
+ * @param [in] plainTextSize The size of the plainText in bytes
+ * @param [out] cipherText The JSON-encoded ciphertext
+ *
+ * @retval TSS2_RC_SUCCESS: if the function call was a success.
+ * @retval TSS2_FAPI_RC_BAD_REFERENCE: if context, keyPath, plainText, or
+ *         cipherText is NULL.
+ * @retval TSS2_FAPI_RC_BAD_CONTEXT: if context corruption is detected.
+ * @retval TSS2_FAPI_RC_KEY_NOT_FOUND: if keyPath does not map to a FAPI key.
+ * @retval TSS2_FAPI_RC_BAD_KEY: if the key at keyPath is unsuitable for
+ *         encryption.
+ * @retval TSS2_RC_BAD_VALUE: if plainTextSize is 0.
+ * @retval TSS2_FAPI_RC_BAD_SEQUENCE: if the context has an asynchronous
+ *         operation already pending.
+ * @retval TSS2_FAPI_RC_IO_ERROR: if the data cannot be saved.
+ * @retval TSS2_FAPI_RC_MEMORY: if the FAPI cannot allocate enough memory for
+ *         internal operations or return parameters.
+ */
+TSS2_RC
+Fapi_Encrypt(
+    FAPI_CONTEXT  *context,
+    char    const *keyPath,
+    char    const *policyPath,
+    uint8_t const *plainText,
+    size_t         plainTextSize,
+    char         **cipherText)
+{
+    LOG_TRACE("called for context:%p", context);
+
+    TSS2_RC r, r2;
+
+    /* Check for NULL parameters */
+    check_not_null(context);
+    check_not_null(keyPath);
+    check_not_null(plainText);
+    check_not_null(cipherText);
+
+    /* Check whether TCTI and ESYS are initialized */
+    return_if_null(context->esys, "Command can't be executed in none TPM mode.",
+                   TSS2_FAPI_RC_NO_TPM);
+
+    /* If the async state automata of FAPI shall be tested, then we must not set
+       the timeouts of ESYS to blocking mode.
+       During testing, the mssim tcti will ensure multiple re-invocations.
+       Usually however the synchronous invocations of FAPI shall instruct ESYS
+       to block until a result is available. */
+#ifndef TEST_FAPI_ASYNC
+    r = Esys_SetTimeout(context->esys, TSS2_TCTI_TIMEOUT_BLOCK);
+    return_if_error_reset_state(r, "Set Timeout to blocking");
+#endif /* TEST_FAPI_ASYNC */
+
+    r = Fapi_Encrypt_Async(context, keyPath, policyPath, plainText, plainTextSize);
+    return_if_error_reset_state(r, "Data_Encrypt");
+
+    do {
+        /* We wait for file I/O to be ready if the FAPI state automata
+           are in a file I/O state. */
+        r = ifapi_io_poll(&context->io);
+        return_if_error(r, "Something went wrong with IO polling");
+
+        /* Repeatedly call the finish function, until FAPI has transitioned
+           through all execution stages / states of this invocation. */
+        r = Fapi_Encrypt_Finish(context, cipherText);
+    } while ((r & ~TSS2_RC_LAYER_MASK) == TSS2_BASE_RC_TRY_AGAIN);
+
+    /* Reset the ESYS timeout to non-blocking, immediate response. */
+    r2 = Esys_SetTimeout(context->esys, 0);
+    return_if_error(r2, "Set Timeout to non-blocking");
+
+    return_if_error_reset_state(r, "Data_Encrypt");
+
+    LOG_TRACE("finsihed");
+    return TSS2_RC_SUCCESS;
+}
+
+/** Asynchronous function for Fapi_Encrypt
+ *
+ * Encrypts the provided data with a given target key.
+ * If keypath is an asymmetric key and a plainText with
+ * size >= TPM2_MAX_SYM_SIZE is provided, Fapi_Encrypt() will bulk-encrypt the
+ * plainText with an intermediate symmetric key and then “seal” this
+ * intermediate symmetric key with keyPath as a KEYEDHASH TPM object. This
+ * keyPath may refer to the local TPM or to a public key of a remote TPM where
+ * the KEYEDHASH can be imported. The decrypt operation performs a TPM2_Unseal.
+ * ciphertext output contains a reference to the decryption key, the sealed
+ * symmetric key (if any), the policy instance, and the encrypted plainText.
+ *
+ * If plainText has a size <= TPM2_MAX_SYM_SIZE the plainText is sealed
+ * directly for keyPath.
+ *
+ * If encrypting for the local TPM (if keyPath is not from the external
+ * hierarchy), a storage key (symmetric or asymmetric) is required as keyPath
+ * (aka parent key) and the data intermediate symmetric key is created using
+ * TPM2_Create() as a KEYEDHASH object.
+ *
+ * If encrypting for a remote TPM, an asymmetric storage key is required as
+ * keyPath (aka parent key), and the data/intermediate symmetric key is
+ * encrypted such that it can be used in a TPM2_Import operation.
+ *
+ * Call Fapi_Encrypt_Finish to finish the execution of this command.
+ *
+ * @param [in,out] context The FAPI_CONTEXT
+ * @param [in] keyPath The path to the encryption key
+ * @param [in] policyPath The path to the policy the sealed data will be
+ *        associated with. May be NULL
+ * @param [in] plainText The plainText data to encrypt
+ * @param [in] plainTextSize The size of the plainText in bytes
+ *
+ * @retval TSS2_RC_SUCCESS: if the function call was a success.
+ * @retval TSS2_FAPI_RC_BAD_REFERENCE: if context, keyPath or plainText is
+ *         NULL.
+ * @retval TSS2_FAPI_RC_BAD_CONTEXT: if context corruption is detected.
+ * @retval TSS2_FAPI_RC_KEY_NOT_FOUND: if keyPath does not map to a FAPI key.
+ * @retval TSS2_FAPI_RC_BAD_KEY: if the key at keyPath is unsuitable for
+ *         encryption.
+ * @retval TSS2_RC_BAD_VALUE: if plainTextSize is 0.
+ * @retval TSS2_FAPI_RC_BAD_SEQUENCE: if the context has an asynchronous
+ *         operation already pending.
+ * @retval TSS2_FAPI_RC_IO_ERROR: if the data cannot be saved.
+ * @retval TSS2_FAPI_RC_MEMORY: if the FAPI cannot allocate enough memory for
+ *         internal operations or return parameters.
+ */
+TSS2_RC
+Fapi_Encrypt_Async(
+    FAPI_CONTEXT  *context,
+    char    const *keyPath,
+    char    const *policyPath,
+    uint8_t const *plainText,
+    size_t         plainTextSize)
+{
+    LOG_TRACE("called for context:%p", context);
+    LOG_TRACE("keyPath: %s", keyPath);
+    LOG_TRACE("policyPath: %s", policyPath);
+    if (plainText) {
+        LOGBLOB_TRACE(plainText, plainTextSize, "plainText");
+    } else {
+        LOG_TRACE("plainText: (null) plainTextSize: %zi", plainTextSize);
+    }
+
+    TSS2_RC r;
+
+    /* Check for NULL parameters */
+    check_not_null(context);
+    check_not_null(keyPath);
+    check_not_null(plainText);
+
+    /* Helpful alias pointers */
+    IFAPI_Data_EncryptDecrypt * command = &(context->cmd.Data_EncryptDecrypt);
+
+    r = ifapi_session_init(context);
+    return_if_error(r, "Initialize Encrypt");
+
+    uint8_t * inData = malloc(plainTextSize);
+    goto_if_null(inData, "Out of memory", r, error_cleanup);
+    memcpy(inData, plainText, plainTextSize);
+    command->in_data = inData;
+
+    strdup_check(command->keyPath, keyPath, r, error_cleanup);
+    strdup_check(command->policyPath, policyPath, r, error_cleanup);
+
+    command->in_dataSize = plainTextSize;
+    command->key_handle = ESYS_TR_NONE;
+
+    context->state = DATA_ENCRYPT_WAIT_FOR_PROFILE;
+    LOG_TRACE("finsihed");
+    return TSS2_RC_SUCCESS;
+error_cleanup:
+    SAFE_FREE(inData);
+    SAFE_FREE(command->keyPath);
+    SAFE_FREE(command->policyPath);
+    return r;
+}
+
+/** Asynchronous finish function for Fapi_Encrypt
+ *
+ * This function should be called after a previous Fapi_Encrypt_Async.
+ *
+ * @param [in, out] context The FAPI_CONTEXT
+ * @param [out] cipherText The JSON-encoded ciphertext
+ *
+ * @retval TSS2_RC_SUCCESS: if the function call was a success.
+ * @retval TSS2_FAPI_RC_BAD_REFERENCE: if context or ciphertext is NULL.
+ * @retval TSS2_FAPI_RC_BAD_CONTEXT: if context corruption is detected.
+ * @retval TSS2_FAPI_RC_BAD_SEQUENCE: if the context has an asynchronous
+ *         operation already pending.
+ * @retval TSS2_FAPI_RC_IO_ERROR: if the data cannot be saved.
+ * @retval TSS2_FAPI_RC_MEMORY: if the FAPI cannot allocate enough memory for
+ *         internal operations or return parameters.
+ * @retval TSS2_FAPI_RC_TRY_AGAIN: if the asynchronous operation is not yet
+ *         complete. Call this function again later.
+ */
+TSS2_RC
+Fapi_Encrypt_Finish(
+    FAPI_CONTEXT  *context,
+    char         **cipherText)
+{
+    LOG_TRACE("called for context:%p", context);
+
+    TSS2_RC r;
+    uint8_t *cipher;
+    size_t cipherSize;
+    json_object *jso = NULL;
+    const char *jso_string = NULL;
+    uint8_t *data;
+    size_t key_length;
+    ESYS_TR auth_session;
+
+    /* Check for NULL parameters */
+    check_not_null(context);
+    check_not_null(cipherText);
+
+    /* Helpful alias pointers */
+    IFAPI_Data_EncryptDecrypt * command = &context->cmd.Data_EncryptDecrypt;
+    IFAPI_ENCRYPTED_DATA *encData = &command->enc_data;
+    TPM2B_SENSITIVE_DATA * sensitiveData = &command->sym_sensitive.sensitive.data;
+    TPMS_POLICY_HARNESS *policyHarness = NULL;
+    const IFAPI_PROFILE *profile;
+    IFAPI_OBJECT *encKeyObject;
+    TPM2B_PUBLIC_KEY_RSA *tpmCipherText = NULL;
+
+    switch (context->state) {
+        statecase(context->state, DATA_ENCRYPT_WAIT_FOR_PROFILE);
+            command->outPublic = NULL;
+            command->outPrivate = NULL;
+
+            r = ifapi_get_sessions_async(context,
+                                         IFAPI_SESSION_GENEK | IFAPI_SESSION1,
+                                         TPMA_SESSION_ENCRYPT | TPMA_SESSION_DECRYPT, 0);
+            goto_if_error_reset_state(r, "Create sessions", error_cleanup);
+
+            context->state = DATA_ENCRYPT_WAIT_FOR_SESSION;
+            fallthrough;
+
+        statecase(context->state, DATA_ENCRYPT_WAIT_FOR_SESSION);
+            r = ifapi_profiles_get(&context->profiles, command->keyPath,
+                                   &profile);
+            goto_if_error_reset_state(r, " FAPI create session", error_cleanup);
+
+            r = ifapi_get_sessions_finish(context, profile);
+            return_try_again(r);
+
+            goto_if_error_reset_state(r, " FAPI create session", error_cleanup);
+
+            r = ifapi_load_keys_async(context, command->keyPath);
+            goto_if_error(r, "Load keys.", error_cleanup);
+
+            context->state = DATA_ENCRYPT_WAIT_FOR_KEY;
+            fallthrough;
+
+        statecase(context->state, DATA_ENCRYPT_WAIT_FOR_KEY);
+            r = ifapi_load_keys_finish(context, IFAPI_FLUSH_PARENT,
+                                       &command->key_handle,
+                                       &command->key_object);
+            return_try_again(r);
+
+            goto_if_error_reset_state(r, " Load key.", error_cleanup);
+
+            encKeyObject = command->key_object;
+
+            if (encKeyObject->misc.key.public.publicArea.type == TPM2_ALG_SYMCIPHER) {
+                r = ifapi_sym_encrypt_decrypt_async(context,
+                                                    command->in_data,
+                                                    command->in_dataSize,
+                                                    TPM2_NO); /**< encrypt (not decrypt) */
+                goto_if_error(r, "Symmetric encryption error.", error_cleanup);
+                context-> state = DATA_ENCRYPT_WAIT_FOR_SYM_ENCRYPTION;
+                return TSS2_FAPI_RC_TRY_AGAIN;
+            } else if (encKeyObject->misc.key.public.publicArea.type == TPM2_ALG_RSA) {
+
+                TPM2B_PUBLIC_KEY_RSA *rsa_message = (TPM2B_PUBLIC_KEY_RSA *)&context->aux_data;
+                rsa_message->size =  command->in_dataSize;
+
+                r =  ifapi_load_sym_key_template(&command->sym_template);
+                goto_if_error_reset_state(r, "Load template.", error_cleanup);
+
+                context-> state = DATA_ENCRYPT_GEN_SYM_KEY;
+            }
+            fallthrough;
+
+        statecase(context->state, DATA_ENCRYPT_GEN_SYM_KEY);
+            /* Generate random key which will be sealed by currently loaded key */
+            memset(&command->sym_sensitive, 0,
+                   sizeof(TPM2B_SENSITIVE_CREATE));
+            memset(&command->sym_outsideInfo, 0,
+                   sizeof(TPM2B_DATA));
+            memset(&command->sym_creationPCR, 0,
+                   sizeof(TPML_PCR_SELECTION));
+            sensitiveData->size = 16;
+            encData->sym_key_size =
+                sensitiveData->size;
+            /* Generate random data for key and IV_SIZE bytes for iv */
+            r = ifapi_get_random(context, encData->sym_key_size + IV_SIZE,
+                                 &command->sym_key);
+            return_try_again(r);
+            goto_if_error(r, "Get random", error_cleanup);
+
+            r = ifapi_get_name(&context->loadKey.auth_object.misc.key.public.publicArea,
+                               &encData->key_name);
+            goto_if_error(r, "Compute key name.", error_cleanup);
+
+
+            memcpy(&sensitiveData->buffer[0],
+                   command->sym_key,
+                   sensitiveData->size);
+            encData->sym_iv.size = IV_SIZE;
+            memcpy(&encData->sym_iv.buffer[0],
+                   &command->sym_key[encData->sym_key_size], IV_SIZE);
+
+            SAFE_FREE(command->sym_key);
+            if (!command->policyPath ||
+                    strcmp(command->policyPath, "") == 0) {
+                context->state = DATA_ENCRYPT_AUTHORIZE;
+                return TSS2_FAPI_RC_TRY_AGAIN;
+            } else {
+                context-> state = DATA_ENCRYPT_CALCULATE_POLICY;
+            }
+            fallthrough;
+
+        statecase(context->state, DATA_ENCRYPT_CALCULATE_POLICY);
+            r =  ifapi_calculate_policy_for_key(context,
+                                                command->policyPath,
+                                                &command->sym_template,
+                                                &policyHarness);
+            return_try_again(r);
+            goto_if_error(r, "Calculate policy for sealed key", error_cleanup);
+
+            if (policyHarness) {
+                command->enc_data.sym_policy_harness = *policyHarness;
+                SAFE_FREE(policyHarness);
+            }
+
+            context-> state = DATA_ENCRYPT_AUTHORIZE;
+            fallthrough;
+
+        statecase(context->state, DATA_ENCRYPT_AUTHORIZE);
+        r = ifapi_authorize_object(context, command->key_object, &auth_session);
+            return_try_again(r);
+            goto_if_error(r, "Authorize key.", error_cleanup);
+
+            r = Esys_Create_Async(context->esys,
+                                  command->key_handle,
+                                  auth_session,
+                                  ESYS_TR_NONE, ESYS_TR_NONE,
+                                  &command->sym_sensitive,
+                                  &command->sym_template.public,
+                                  &command->sym_outsideInfo,
+                                  &command->sym_creationPCR);
+
+            goto_if_error(r, "Create_Async", error_cleanup);
+            fallthrough;
+
+        statecase(context->state, DATA_ENCRYPT_WAIT_FOR_SEAL);
+            r = Esys_Create_Finish(context->esys,
+                                   &command->outPrivate,
+                                   &command->outPublic,
+                                   NULL, NULL, NULL);
+            return_try_again(r);
+            goto_if_error(r, "Create_Finish", error_cleanup);
+
+            command->enc_data.sym_public
+                = *command->outPublic;
+            command->enc_data.sym_private.size
+                = command->outPrivate->size;
+            command->enc_data.sym_private.buffer =
+                &command->outPrivate->buffer[0];
+
+            key_length = sensitiveData->size;
+            data = malloc(command->in_dataSize);
+            goto_if_null2(data, "Out of memory.", r, TSS2_FAPI_RC_MEMORY, error_cleanup);
+
+            memcpy(data, command->in_data,
+                   command->in_dataSize);
+            r = ifapi_crypto_aes_encrypt(
+                    &sensitiveData->buffer[0],
+                    key_length,
+                    &encData->sym_iv.buffer[0],
+                    data, command->in_dataSize);
+            goto_if_error(r, "AES encryption", error_cleanup);
+
+            encData->type = IFAPI_ASYM_BULK_ENCRYPTION;
+            encData->cipher.size =  command->in_dataSize;
+            encData->cipher.buffer = data;
+            context-> state = DATA_ENCRYPT_FLUSH_KEY;
+            return TSS2_FAPI_RC_TRY_AGAIN;
+
+        statecase(context->state, DATA_ENCRYPT_WAIT_FOR_RSA_ENCRYPTION);
+            r =  Esys_RSA_Encrypt_Finish(context->esys, &tpmCipherText);
+
+            return_try_again(r);
+
+            goto_if_error_reset_state(r, "RSA encryption.", error_cleanup);
+
+            encData->type = IFAPI_ASYM_ENCRYPTION;
+            encData->cipher.size = tpmCipherText->size;
+            encData->cipher.buffer = malloc(encData->cipher.size);
+            goto_if_null2(encData->cipher.buffer, "Out of memory", r, TSS2_FAPI_RC_MEMORY,
+                          error_cleanup);
+
+            memcpy(&encData->cipher.buffer[0], &tpmCipherText->buffer[0],
+                   encData->cipher.size);
+
+            r = ifapi_get_name(&context->loadKey.auth_object.misc.key.public.publicArea,
+                               &encData->key_name);
+            goto_if_error(r, "Compute key name.", error_cleanup);
+
+            context-> state = DATA_ENCRYPT_FLUSH_KEY;
+            return TSS2_FAPI_RC_TRY_AGAIN;
+
+        statecase(context->state, DATA_ENCRYPT_WAIT_FOR_SYM_ENCRYPTION);
+            r = ifapi_sym_encrypt_decrypt_finish(context, &cipher, &cipherSize,  TPM2_NO);
+
+            return_try_again(r);
+            goto_if_error_reset_state(r, "Symmetric encryption.", error_cleanup);
+            fallthrough;
+
+        statecase(context->state, DATA_ENCRYPT_FLUSH_KEY);
+
+            r = Esys_FlushContext_Async(context->esys,
+                                        command->key_handle);
+            goto_if_error(r, "Error: FlushContext", error_cleanup);
+            fallthrough;
+
+        statecase(context->state, DATA_ENCRYPT_WAIT_FOR_FLUSH);
+            r = Esys_FlushContext_Finish(context->esys);
+            return_try_again(r);
+
+            goto_if_error(r, "Error: FlushContext", error_cleanup);
+            command->key_handle = ESYS_TR_NONE;
+            fallthrough;
+
+        statecase(context->state, DATA_ENCRYPT_CLEAN)
+            r = ifapi_cleanup_session(context);
+            try_again_or_error_goto(r, "Cleanup", error_cleanup);
+
+            break;
+
+        statecasedefault(context->state);
+    }
+
+    r = ifapi_json_IFAPI_ENCRYPTED_DATA_serialize(
+            &command->enc_data, &jso);
+    goto_if_error(r, "Error serialize FAPI cipher", error_cleanup);
+
+    jso_string = json_object_to_json_string_ext(jso, JSON_C_TO_STRING_PRETTY);
+    goto_if_null2(jso_string, "Converting json to string", r, TSS2_FAPI_RC_MEMORY,
+                  error_cleanup);
+
+    strdup_check(*cipherText, jso_string, r, error_cleanup);
+    context->state = _FAPI_STATE_INIT;
+
+error_cleanup:
+    if (command->key_handle != ESYS_TR_NONE)
+        Esys_FlushContext(context->esys,  command->key_handle);
+    ifapi_cleanup_ifapi_object(&context->loadKey.auth_object);
+    ifapi_cleanup_ifapi_object(context->loadKey.key_object);
+    ifapi_cleanup_ifapi_object(&context->createPrimary.pkey_object);
+    ifapi_cleanup_ifapi_object(command->key_object);
+    ifapi_cleanup_policy_harness(&command->enc_data.sym_policy_harness);
+    json_object_put(jso);
+    SAFE_FREE(command->keyPath);
+    SAFE_FREE(command->in_data);
+    SAFE_FREE(command->policyPath);
+    SAFE_FREE(command->out_data);
+    SAFE_FREE(command->outPrivate);
+    SAFE_FREE(command->outPublic);
+    SAFE_FREE(encData->cipher.buffer);
+    ifapi_session_clean(context);
+    LOG_TRACE("finsihed");
+    return r;
+}

diff --git a/src/tss2-fapi/api/Fapi_ExportKey.c b/src/tss2-fapi/api/Fapi_ExportKey.c
new file mode 100644
index 0000000..ab7ee18
--- /dev/null
+++ b/src/tss2-fapi/api/Fapi_ExportKey.c

@@ -0,0 +1,405 @@
+/* SPDX-License-Identifier: BSD-2-Clause */
+/*******************************************************************************
+ * Copyright 2018-2019, Fraunhofer SIT sponsored by Infineon Technologies AG
+ * All rights reserved.
+ ******************************************************************************/
+
+#ifdef HAVE_CONFIG_H
+#include <config.h>
+#endif
+
+#include <stdlib.h>
+#include <errno.h>
+#include <unistd.h>
+#include <errno.h>
+#include <string.h>
+
+#include "tss2_fapi.h"
+#include "fapi_int.h"
+#include "fapi_util.h"
+#include "tss2_esys.h"
+#include "fapi_crypto.h"
+#include "fapi_policy.h"
+#include "ifapi_json_serialize.h"
+#include "ifapi_json_deserialize.h"
+#include "tpm_json_deserialize.h"
+#define LOGMODULE fapi
+#include "util/log.h"
+#include "util/aux_util.h"
+
+/** One-Call function for Fapi_ExportKey
+ *
+ * Given a key it will (if the key is a storage key) duplicate the key and
+ * package up the duplicated key and all keys below it into a file ready to move to
+ * a new TPM.
+ *
+ * @param [in, out] context The FAPI_CONTEXT
+ * @param [in] pathOfKeyToDuplicate The path to the root of the subtree to
+ *             export.
+ * @param [in] pathToPublicKeyOfNewParent The path to the public key of the new
+ *             parent. May be NULL
+ * @param [out] exportedData The exported subtree
+ *
+ * @retval TSS2_RC_SUCCESS: if the function call was a success.
+ * @retval TSS2_FAPI_RC_BAD_REFERENCE: if context, pathOfKeyToDuplicate
+ *         or exportedData is NULL.
+ * @retval TSS2_FAPI_RC_BAD_CONTEXT: if context corruption is detected.
+ * @retval TSS2_FAPI_RC_KEY_NOT_FOUND: if pathOfKeyToDuplicate or
+ *         pathToPublicKeyOfNewParent does not map to a . FAPI object.
+ * @retval TSS2_FAPI_RC_BAD_KEY: if the key at pathToPublicKeyOfNewParent is not
+ *         suitable for the requeste operation.
+ * @retval TSS2_FAPI_RC_KEY_NOT_DUPLICABLE: if the key is not a duplicable key.
+ * @retval TSS2_FAPI_RC_BAD_SEQUENCE: if the context has an asynchronous
+ *         operation already pending.
+ * @retval TSS2_FAPI_RC_IO_ERROR: if the data cannot be saved.
+ * @retval TSS2_FAPI_RC_MEMORY: if the FAPI cannot allocate enough memory for
+ *         internal operations or return parameters.
+ */
+TSS2_RC
+Fapi_ExportKey(
+    FAPI_CONTEXT *context,
+    char   const *pathOfKeyToDuplicate,
+    char   const *pathToPublicKeyOfNewParent,
+    char        **exportedData)
+{
+    LOG_TRACE("called for context:%p", context);
+
+    TSS2_RC r, r2;
+
+    /* Check for NULL parameters */
+    check_not_null(context);
+    check_not_null(pathOfKeyToDuplicate);
+    check_not_null(exportedData);
+
+    /* Check whether TCTI and ESYS are initialized */
+    return_if_null(context->esys, "Command can't be executed in none TPM mode.",
+                   TSS2_FAPI_RC_NO_TPM);
+
+    /* If the async state automata of FAPI shall be tested, then we must not set
+       the timeouts of ESYS to blocking mode.
+       During testing, the mssim tcti will ensure multiple re-invocations.
+       Usually however the synchronous invocations of FAPI shall instruct ESYS
+       to block until a result is available. */
+#ifndef TEST_FAPI_ASYNC
+    r = Esys_SetTimeout(context->esys, TSS2_TCTI_TIMEOUT_BLOCK);
+    return_if_error_reset_state(r, "Set Timeout to blocking");
+#endif /* TEST_FAPI_ASYNC */
+
+    r = Fapi_ExportKey_Async(context, pathOfKeyToDuplicate,
+                             pathToPublicKeyOfNewParent);
+    return_if_error_reset_state(r, "ExportKey");
+
+    do {
+        /* We wait for file I/O to be ready if the FAPI state automata
+           are in a file I/O state. */
+        r = ifapi_io_poll(&context->io);
+        return_if_error(r, "Something went wrong with IO polling");
+
+        /* Repeatedly call the finish function, until FAPI has transitioned
+           through all execution stages / states of this invocation. */
+        r = Fapi_ExportKey_Finish(context, exportedData);
+    } while ((r & ~TSS2_RC_LAYER_MASK) == TSS2_BASE_RC_TRY_AGAIN);
+
+    /* Reset the ESYS timeout to non-blocking, immediate response. */
+    r2 = Esys_SetTimeout(context->esys, 0);
+    return_if_error(r2, "Set Timeout to non-blocking");
+
+    return_if_error_reset_state(r, "ExportKey");
+
+    LOG_TRACE("finsihed");
+    return TSS2_RC_SUCCESS;
+}
+
+/** Asynchronous function for Fapi_ExportKey
+ *
+ * Given a key it will (if the key is a storage key) duplicate the key and
+ * package up the duplicated key and all keys below it into a file ready to move to
+ * a new TPM.
+ *
+ * Call Fapi_ExportKey_Finish to finish the execution of this command.
+ *
+ * @param [in, out] context The FAPI_CONTEXT
+ * @param [in] pathOfKeyToDuplicate The path to the root of the subtree to
+ *             export.
+ * @param [in] pathToPublicKeyOfNewParent The path to the public key of the new
+ *             parent
+ *
+ * @retval TSS2_RC_SUCCESS: if the function call was a success.
+ * @retval TSS2_FAPI_RC_BAD_REFERENCE: if context or pathOfKeyToDuplicate
+ *         is NULL.
+ * @retval TSS2_FAPI_RC_BAD_CONTEXT: if context corruption is detected.
+ * @retval TSS2_FAPI_RC_KEY_NOT_FOUND: if pathOfKeyToDuplicate or
+ *         pathToPublicKeyOfNewParent does not map to a . FAPI object.
+ * @retval TSS2_FAPI_RC_BAD_KEY: if the key at pathToPublicKeyOfNewParent is not
+ *         suitable for the requeste operation.
+ * @retval TSS2_FAPI_RC_KEY_NOT_DUPLICABLE: if the key is not a duplicable key.
+ * @retval TSS2_FAPI_RC_BAD_SEQUENCE: if the context has an asynchronous
+ *         operation already pending.
+ * @retval TSS2_FAPI_RC_IO_ERROR: if the data cannot be saved.
+ * @retval TSS2_FAPI_RC_MEMORY: if the FAPI cannot allocate enough memory for
+ *         internal operations or return parameters.
+ */
+TSS2_RC
+Fapi_ExportKey_Async(
+    FAPI_CONTEXT *context,
+    char   const *pathOfKeyToDuplicate,
+    char   const *pathToPublicKeyOfNewParent)
+{
+    LOG_TRACE("called for context:%p", context);
+    LOG_TRACE("pathOfKeyToDuplicate: %s", pathOfKeyToDuplicate);
+    LOG_TRACE("pathToPublicKeyOfNewParent: %s", pathToPublicKeyOfNewParent);
+
+    TSS2_RC r;
+
+    /* Check for NULL parameters */
+    check_not_null(context);
+    check_not_null(pathOfKeyToDuplicate);
+
+    /* Helpful alias pointers */
+    IFAPI_ExportKey * command = &context->cmd.ExportKey;
+
+    r = ifapi_session_init(context);
+    return_if_error(r, "Initialize NV_CreateNv");
+
+    command->pathOfKeyToDuplicate = NULL;
+    command->pathToPublicKeyOfNewParent = NULL;
+
+    strdup_check(command->pathOfKeyToDuplicate, pathOfKeyToDuplicate,
+                 r, error_cleanup);
+    strdup_check(command->pathToPublicKeyOfNewParent,
+                 pathToPublicKeyOfNewParent, r, error_cleanup);
+
+    if (!pathToPublicKeyOfNewParent) {
+        /* Only public key of KeyToDuplocate will be exported */
+        r = ifapi_keystore_load_async(&context->keystore, &context->io,
+                                      pathOfKeyToDuplicate);
+        return_if_error2(r, "Could not open: %s", pathOfKeyToDuplicate);
+
+        context->state = EXPORT_KEY_READ_PUB_KEY;
+    } else {
+        /* The public key of the new parent is needed for duplication */
+        r = ifapi_keystore_load_async(&context->keystore, &context->io,
+                                      pathToPublicKeyOfNewParent);
+        return_if_error2(r, "Could not open: %s", pathToPublicKeyOfNewParent);
+
+        context->state = EXPORT_KEY_READ_PUB_KEY_PARENT;
+    }
+    LOG_TRACE("finsihed");
+    return r;
+
+ error_cleanup:
+    SAFE_FREE(command->pathOfKeyToDuplicate);
+    SAFE_FREE(command->pathToPublicKeyOfNewParent);
+    return r;
+}
+
+/** Asynchronous finish function for Fapi_ExportKey
+ *
+ * This function should be called after a previous Fapi_ExportKey_Async.
+ *
+ * @param [in, out] context The FAPI_CONTEXT
+ * @param [out] exportedData The exported subtree
+ *
+ * @retval TSS2_RC_SUCCESS: if the function call was a success.
+ * @retval TSS2_FAPI_RC_BAD_REFERENCE: if context or exportedData is NULL.
+ * @retval TSS2_FAPI_RC_BAD_CONTEXT: if context corruption is detected.
+ * @retval TSS2_FAPI_RC_BAD_SEQUENCE: if the context has an asynchronous
+ *         operation already pending.
+ * @retval TSS2_FAPI_RC_IO_ERROR: if the data cannot be saved.
+ * @retval TSS2_FAPI_RC_MEMORY: if the FAPI cannot allocate enough memory for
+ *         internal operations or return parameters.
+ * @retval TSS2_FAPI_RC_TRY_AGAIN: if the asynchronous operation is not yet
+ *         complete. Call this function again later.
+ */
+TSS2_RC
+Fapi_ExportKey_Finish(
+    FAPI_CONTEXT *context,
+    char        **exportedData)
+{
+    LOG_TRACE("called for context:%p", context);
+
+    TSS2_RC r;
+    json_object *jsoOut = NULL;
+    int sizePem;
+    TPM2B_ENCRYPTED_SECRET *encryptedSeed = NULL;
+    TPM2B_PRIVATE *duplicate = NULL;
+    IFAPI_OBJECT commandObject = {0};
+    IFAPI_OBJECT parentKeyObject = {0};
+    ESYS_TR auth_session;
+
+    /* Check for NULL parameters */
+    check_not_null(context);
+    check_not_null(exportedData);
+
+    /* Helpful alias pointers */
+    IFAPI_ExportKey * command = &context->cmd.ExportKey;
+    IFAPI_OBJECT *pubKey = &command->pub_key;
+    IFAPI_OBJECT *exportTree = &command->export_tree;
+    IFAPI_DUPLICATE * keyTree = &exportTree->misc.key_tree;
+    pubKey->misc.ext_pub_key.certificate = NULL;
+
+    switch (context->state) {
+        statecase(context->state, EXPORT_KEY_READ_PUB_KEY);
+            r = ifapi_keystore_load_finish(&context->keystore, &context->io,
+                                           &commandObject);
+            return_try_again(r);
+            return_if_error_reset_state(r, "read_finish failed");
+
+            if (commandObject.objectType != IFAPI_KEY_OBJ) {
+                /* No key object was loaded */
+                ifapi_cleanup_ifapi_object(&commandObject);
+                goto_error(r, TSS2_FAPI_RC_BAD_PATH, "%s is not a key object.",
+                           cleanup, command->pathOfKeyToDuplicate);
+            }
+
+            pubKey->objectType = IFAPI_EXT_PUB_KEY_OBJ;
+            pubKey->misc.ext_pub_key.public = commandObject.misc.key.public;
+
+            r = ifapi_pub_pem_key_from_tpm(&pubKey->misc.ext_pub_key.public,
+                                           &pubKey->misc.ext_pub_key.pem_ext_public,
+                                           &sizePem);
+            goto_if_error(r, "Convert public TPM key to pem.", cleanup);
+
+            r = ifapi_json_IFAPI_OBJECT_serialize(pubKey, &jsoOut);
+            goto_if_error(r, "Error serialize FAPI KEY object", cleanup);
+
+            *exportedData = strdup(json_object_to_json_string_ext(jsoOut,
+                                                                  JSON_C_TO_STRING_PRETTY));
+            goto_if_null2(*exportedData, "Converting json to string", r,
+                          TSS2_FAPI_RC_MEMORY, cleanup);
+
+            break;
+
+        statecase(context->state, EXPORT_KEY_READ_PUB_KEY_PARENT);
+            r = ifapi_keystore_load_finish(&context->keystore, &context->io,
+                    &parentKeyObject);
+            if (r != TSS2_RC_SUCCESS) {
+                ifapi_cleanup_ifapi_object(&parentKeyObject);
+            }
+            return_try_again(r);
+            return_if_error_reset_state(r, "read_finish failed");
+
+            if (parentKeyObject.objectType != IFAPI_EXT_PUB_KEY_OBJ) {
+                goto_error(r, TSS2_FAPI_RC_BAD_VALUE, "No public key in %s",
+                           cleanup, command->pathToPublicKeyOfNewParent);
+            }
+            command->public_parent = parentKeyObject.misc.ext_pub_key.public;
+            ifapi_cleanup_ifapi_object(&parentKeyObject);
+            r = ifapi_get_sessions_async(context,
+                                         IFAPI_SESSION_GENEK | IFAPI_SESSION1,
+                                         TPMA_SESSION_DECRYPT, 0);
+            goto_if_error_reset_state(r, "Create sessions", cleanup);
+
+            context->state = EXPORT_KEY_WAIT_FOR_KEY;
+            fallthrough;
+
+        statecase(context->state, EXPORT_KEY_WAIT_FOR_KEY);
+            r = ifapi_load_key(context, command->pathOfKeyToDuplicate,
+                               &command->key_object);
+            return_try_again(r);
+            goto_if_error(r, "Fapi load key.", cleanup);
+
+            context->duplicate_key = command->key_object;
+            r = Esys_LoadExternal_Async(context->esys,
+                                        ESYS_TR_NONE, ESYS_TR_NONE, ESYS_TR_NONE,
+                                        NULL,   &command->public_parent,
+                                        TPM2_RH_OWNER);
+            goto_if_error(r, "LoadExternal_Async", cleanup);
+
+            context->state = EXPORT_KEY_WAIT_FOR_EXT_KEY;
+            fallthrough;
+
+        statecase(context->state, EXPORT_KEY_WAIT_FOR_EXT_KEY);
+            r = Esys_LoadExternal_Finish(context->esys,
+                                         &command->handle_ext_key);
+            try_again_or_error_goto(r, "Load external key.", cleanup);
+
+            context->state = EXPORT_KEY_WAIT_FOR_AUTHORIZATON;
+            fallthrough;
+
+        statecase(context->state, EXPORT_KEY_WAIT_FOR_AUTHORIZATON);
+
+            r = ifapi_authorize_object(context, command->key_object, &auth_session);
+            return_try_again(r);
+            goto_if_error(r, "Authorize key.", cleanup);
+
+            TPM2B_DATA encryptionKey;
+            TPMT_SYM_DEF_OBJECT symmetric;
+
+            symmetric.algorithm = TPM2_ALG_NULL;
+            encryptionKey.size = 0;
+
+            r = Esys_Duplicate_Async(context->esys,
+                                     command->key_object->handle,
+                                     command->handle_ext_key,
+                                     auth_session,
+                                     ESYS_TR_NONE, ESYS_TR_NONE,
+                                     &encryptionKey, &symmetric);
+            goto_if_error(r, "Duplicate", cleanup);
+
+            context->state = EXPORT_KEY_WAIT_FOR_DUPLICATE;
+            fallthrough;
+
+        statecase(context->state,  EXPORT_KEY_WAIT_FOR_DUPLICATE);
+            exportTree->objectType = IFAPI_DUPLICATE_OBJ;
+            r = Esys_Duplicate_Finish(context->esys, NULL, &duplicate, &encryptedSeed);
+            try_again_or_error_goto(r, "Duplicate", cleanup);
+
+            keyTree->encrypted_seed = *encryptedSeed;
+            SAFE_FREE(encryptedSeed);
+            keyTree->duplicate = *duplicate;
+            SAFE_FREE(duplicate);
+            keyTree->public =
+                command->key_object->misc.key.public;
+            keyTree->public_parent = command->public_parent;
+            r = ifapi_get_json(context, exportTree, exportedData);
+            goto_if_error2(r, "get JSON for exported data.", cleanup);
+
+            context->state = EXPORT_KEY_WAIT_FOR_FLUSH1;
+            fallthrough;
+
+        statecase(context->state, EXPORT_KEY_WAIT_FOR_FLUSH1);
+            r = ifapi_flush_object(context, command->key_object->handle);
+            return_try_again(r);
+            goto_if_error(r, "Flush key", cleanup);
+
+            context->state = EXPORT_KEY_WAIT_FOR_FLUSH2;
+            fallthrough;
+
+        statecase(context->state, EXPORT_KEY_WAIT_FOR_FLUSH2);
+            r = ifapi_flush_object(context, command->handle_ext_key);
+            return_try_again(r);
+            goto_if_error(r, "Flush key", cleanup);
+            fallthrough;
+
+        statecase(context->state, EXPORT_KEY_CLEANUP)
+            r = ifapi_cleanup_session(context);
+            try_again_or_error_goto(r, "Cleanup", cleanup);
+
+            break;
+
+        statecasedefault(context->state);
+    }
+
+cleanup:
+    if (command->key_object) {
+        ifapi_cleanup_ifapi_object(command->key_object);
+    }
+    if (jsoOut != NULL) {
+        json_object_put(jsoOut);
+    }
+    context->duplicate_key = NULL;
+    context->state = _FAPI_STATE_INIT;
+    ifapi_cleanup_ifapi_object(&parentKeyObject);
+    ifapi_cleanup_ifapi_object(&commandObject);
+    ifapi_session_clean(context);
+    ifapi_cleanup_ifapi_object(&context->loadKey.auth_object);
+    ifapi_cleanup_ifapi_object(context->loadKey.key_object);
+    ifapi_cleanup_ifapi_object(&context->createPrimary.pkey_object);
+    SAFE_FREE(pubKey->misc.ext_pub_key.pem_ext_public);
+    SAFE_FREE(pubKey->misc.ext_pub_key.certificate);
+    SAFE_FREE(command->pathOfKeyToDuplicate);
+    SAFE_FREE(command->pathToPublicKeyOfNewParent);
+    LOG_TRACE("finsihed");
+    return r;
+}

diff --git a/src/tss2-fapi/api/Fapi_ExportPolicy.c b/src/tss2-fapi/api/Fapi_ExportPolicy.c
new file mode 100644
index 0000000..f5bc945
--- /dev/null
+++ b/src/tss2-fapi/api/Fapi_ExportPolicy.c

@@ -0,0 +1,258 @@
+/* SPDX-License-Identifier: BSD-2-Clause */
+/*******************************************************************************
+ * Copyright 2018-2019, Fraunhofer SIT sponsored by Infineon Technologies AG
+ * All rights reserved.
+ ******************************************************************************/
+
+#ifdef HAVE_CONFIG_H
+#include <config.h>
+#endif
+
+#include "tss2_fapi.h"
+#include "fapi_int.h"
+#include "fapi_util.h"
+#include "tss2_esys.h"
+#include "fapi_policy.h"
+#define LOGMODULE fapi
+#include "util/log.h"
+#include "util/aux_util.h"
+
+/** One-Call function for Fapi_ExportPolicy
+ *
+ * Exports a policy to a JSON encoded byte buffer.
+ *
+ * @param [in,out] context The FAPI_CONTEXT
+ * @param [in] path The path to the policy that is to be exported
+ * @param [out] jsonPolicy The byte buffer the JSON-encoded policy is exported
+ *              to
+ *
+ * @retval TSS2_RC_SUCCESS: if the function call was a success.
+ * @retval TSS2_FAPI_RC_BAD_REFERENCE: if context, path or jsonPolicy is NULL.
+ * @retval TSS2_FAPI_RC_BAD_CONTEXT: if context corruption is detected.
+ * @retval TSS2_FAPI_RC_BAD_PATH: if path does not map to a FAPI policy.
+ * @retval TSS2_FAPI_RC_BAD_SEQUENCE: if the context has an asynchronous
+ *         operation already pending.
+ * @retval TSS2_FAPI_RC_IO_ERROR: if the data cannot be saved.
+ * @retval TSS2_FAPI_RC_MEMORY: if the FAPI cannot allocate enough memory for
+ *         internal operations or return parameters.
+ */
+TSS2_RC
+Fapi_ExportPolicy(
+    FAPI_CONTEXT *context,
+    char   const *path,
+    char        **jsonPolicy)
+{
+    LOG_TRACE("called for context:%p", context);
+
+    TSS2_RC r, r2;
+
+    /* Check for NULL parameters */
+    check_not_null(context);
+    check_not_null(path);
+    check_not_null(jsonPolicy);
+
+    /* Check whether TCTI and ESYS are initialized */
+    return_if_null(context->esys, "Command can't be executed in none TPM mode.",
+                   TSS2_FAPI_RC_NO_TPM);
+
+    /* If the async state automata of FAPI shall be tested, then we must not set
+       the timeouts of ESYS to blocking mode.
+       During testing, the mssim tcti will ensure multiple re-invocations.
+       Usually however the synchronous invocations of FAPI shall instruct ESYS
+       to block until a result is available. */
+#ifndef TEST_FAPI_ASYNC
+    r = Esys_SetTimeout(context->esys, TSS2_TCTI_TIMEOUT_BLOCK);
+    return_if_error_reset_state(r, "Set Timeout to blocking");
+#endif /* TEST_FAPI_ASYNC */
+
+    r = Fapi_ExportPolicy_Async(context, path);
+    return_if_error_reset_state(r, "PolicyExport");
+
+    do {
+        /* We wait for file I/O to be ready if the FAPI state automata
+           are in a file I/O state. */
+        r = ifapi_io_poll(&context->io);
+        return_if_error(r, "Something went wrong with IO polling");
+
+        /* Repeatedly call the finish function, until FAPI has transitioned
+           through all execution stages / states of this invocation. */
+        r = Fapi_ExportPolicy_Finish(context, jsonPolicy);
+    } while ((r & ~TSS2_RC_LAYER_MASK) == TSS2_BASE_RC_TRY_AGAIN);
+
+    /* Reset the ESYS timeout to non-blocking, immediate response. */
+    r2 = Esys_SetTimeout(context->esys, 0);
+    return_if_error(r2, "Set Timeout to non-blocking");
+
+    return_if_error_reset_state(r, "PolicyExport");
+
+    return TSS2_RC_SUCCESS;
+
+}
+
+/** Asynchronous function for Fapi_ExportPolicy
+ *
+ * Exports a policy to a JSON encoded byte buffer.
+ *
+ * Call Fapi_ExportPolicy_Finish to finish the execution of this command.
+ *
+ * @param [in,out] context The FAPI_CONTEXT
+ * @param [in] path The path to the policy that is to be exported
+ *
+ * @retval TSS2_RC_SUCCESS: if the function call was a success.
+ * @retval TSS2_FAPI_RC_BAD_REFERENCE: if context or path is NULL.
+ * @retval TSS2_FAPI_RC_BAD_CONTEXT: if context corruption is detected.
+ * @retval TSS2_FAPI_RC_BAD_PATH: if path does not map to a FAPI policy.
+ * @retval TSS2_FAPI_RC_BAD_SEQUENCE: if the context has an asynchronous
+ *         operation already pending.
+ * @retval TSS2_FAPI_RC_IO_ERROR: if the data cannot be saved.
+ * @retval TSS2_FAPI_RC_MEMORY: if the FAPI cannot allocate enough memory for
+ *         internal operations or return parameters.
+ */
+TSS2_RC
+Fapi_ExportPolicy_Async(
+    FAPI_CONTEXT *context,
+    char   const *path)
+{
+    LOG_TRACE("called for context:%p", context);
+    LOG_TRACE("path: %s", path);
+
+    TSS2_RC r;
+
+    /* Check for NULL parameters */
+    check_not_null(context);
+    check_not_null(path);
+
+    /* Helpful alias pointers */
+    IFAPI_ExportPolicy * command = &context->cmd.ExportPolicy;
+
+    r = ifapi_session_init(context);
+    return_if_error(r, "Initialize PolicyExport");
+
+    if (ifapi_path_type_p(path, IFAPI_POLICY_PATH)) {
+        context->state = POLICY_EXPORT_READ_POLICY;
+    } else {
+        context->state = POLICY_EXPORT_READ_OBJECT;
+    }
+    strdup_check(command->path, path, r ,error_cleanup);
+    memset(&command->object, 0, sizeof(IFAPI_OBJECT));
+
+    LOG_TRACE("finsihed");
+    return TSS2_RC_SUCCESS;
+error_cleanup:
+    SAFE_FREE(command->path);
+    return r;
+}
+
+/** Asynchronous finish function for Fapi_ExportPolicy
+ *
+ * This function should be called after a previous Fapi_ExportPolicy_Async.
+ *
+ * @param [in, out] context The FAPI_CONTEXT
+ * @param [out] jsonPolicy The byte buffer the JSON-encoded policy is exported
+ *              to
+ *
+ * @retval TSS2_RC_SUCCESS: if the function call was a success.
+ * @retval TSS2_FAPI_RC_BAD_REFERENCE: if context or jsonPolicy is NULL.
+ * @retval TSS2_FAPI_RC_BAD_CONTEXT: if context corruption is detected.
+ * @retval TSS2_FAPI_RC_BAD_SEQUENCE: if the context has an asynchronous
+ *         operation already pending.
+ * @retval TSS2_FAPI_RC_IO_ERROR: if the data cannot be saved.
+ * @retval TSS2_FAPI_RC_MEMORY: if the FAPI cannot allocate enough memory for
+ *         internal operations or return parameters.
+ * @retval TSS2_FAPI_RC_TRY_AGAIN: if the asynchronous operation is not yet
+ *         complete. Call this function again later.
+ */
+TSS2_RC
+Fapi_ExportPolicy_Finish(
+    FAPI_CONTEXT *context,
+    char        **jsonPolicy)
+{
+    LOG_TRACE("called for context:%p", context);
+
+    TPMS_POLICY_HARNESS harness = {0};
+    json_object *jso = NULL;
+    TSS2_RC r;
+
+    /* Check for NULL parameters */
+    check_not_null(context);
+    check_not_null(jsonPolicy);
+
+    /* Helpful alias pointers */
+    IFAPI_ExportPolicy * command = &context->cmd.ExportPolicy;
+
+    switch (context->state) {
+        statecase(context->state, POLICY_EXPORT_READ_POLICY);
+            r = ifapi_policy_store_load_async(&context->pstore, &context->io,
+                                              command->path);
+            goto_if_error2(r, "Can't open: %s", error_cleanup,
+                    command->path);
+            fallthrough;
+
+        statecase(context->state, POLICY_EXPORT_READ_POLICY_FINISH);
+            r = ifapi_policy_store_load_finish(&context->pstore, &context->io, &harness);
+            return_try_again(r);
+            return_if_error_reset_state(r, "read_finish failed");
+
+            r = ifapi_json_TPMS_POLICY_HARNESS_serialize(&harness, &jso);
+            goto_if_error(r, "Serialize policy", error_cleanup);
+
+            strdup_check(*jsonPolicy,
+                    json_object_to_json_string_ext(jso, JSON_C_TO_STRING_PRETTY),
+                    r, error_cleanup);
+
+            break;
+        statecase(context->state, POLICY_EXPORT_READ_OBJECT);
+            memset(&command->object, 0, sizeof(IFAPI_OBJECT));
+            r = ifapi_keystore_load_async(&context->keystore, &context->io,
+                                          command->path);
+            return_if_error2(r, "Could not open: %s", command->path);
+            fallthrough;
+
+        statecase(context->state, POLICY_EXPORT_READ_OBJECT_FINISH);
+            r = ifapi_keystore_load_finish(&context->keystore, &context->io,
+                                           &command->object);
+            return_try_again(r);
+            return_if_error_reset_state(r, "read_finish failed");
+
+            goto_if_null2(command->object.policy_harness,
+                          "Object has no policy",
+                          r, TSS2_FAPI_RC_BAD_PATH, error_cleanup);
+
+            r = ifapi_json_TPMS_POLICY_HARNESS_serialize(context->
+                cmd.ExportPolicy.object.policy_harness, &jso);
+            goto_if_error(r, "Serialize policy", error_cleanup);
+
+            strdup_check(*jsonPolicy,
+                    json_object_to_json_string_ext(jso, JSON_C_TO_STRING_PRETTY),
+                    r, error_cleanup);
+            break;
+
+        statecasedefault(context->state);
+    }
+    goto_if_null2(*jsonPolicy, "Out of memory.", r, TSS2_FAPI_RC_MEMORY, error_cleanup);
+
+    context->state = _FAPI_STATE_INIT;
+    if (jso)
+        json_object_put(jso);
+    ifapi_cleanup_ifapi_object(&command->object);
+    ifapi_cleanup_policy_harness(&harness);
+    ifapi_cleanup_ifapi_object(&context->loadKey.auth_object);
+    ifapi_cleanup_ifapi_object(context->loadKey.key_object);
+    ifapi_cleanup_ifapi_object(&context->createPrimary.pkey_object);
+    SAFE_FREE(command->path);
+    LOG_TRACE("finsihed");
+    return TSS2_RC_SUCCESS;
+
+error_cleanup:
+    if (command->object.objectType)
+        ifapi_cleanup_ifapi_object(&command->object);
+    if (jso)
+        json_object_put(jso);
+    ifapi_cleanup_policy_harness(&harness);
+    ifapi_cleanup_ifapi_object(&context->loadKey.auth_object);
+    ifapi_cleanup_ifapi_object(context->loadKey.key_object);
+    ifapi_cleanup_ifapi_object(&context->createPrimary.pkey_object);
+    SAFE_FREE(command->path);
+    context->state = _FAPI_STATE_INIT;
+    return r;
+}

diff --git a/src/tss2-fapi/api/Fapi_Finalize.c b/src/tss2-fapi/api/Fapi_Finalize.c
new file mode 100644
index 0000000..e90aae8
--- /dev/null
+++ b/src/tss2-fapi/api/Fapi_Finalize.c

@@ -0,0 +1,85 @@
+/* SPDX-License-Identifier: BSD-2-Clause */
+/*******************************************************************************
+ * Copyright 2018-2019, Fraunhofer SIT sponsored by Infineon Technologies AG
+ * All rights reserved.
+ ******************************************************************************/
+
+#ifdef HAVE_CONFIG_H
+#include <config.h>
+#endif
+
+#ifndef NO_DL
+#include <dlfcn.h>
+#endif /* NO_DL */
+#include <stdlib.h>
+
+#include<unistd.h>
+
+#include "tss2_fapi.h"
+#include "tss2_tctildr.h"
+#include "fapi_int.h"
+#include "fapi_util.h"
+#include "tss2_esys.h"
+#define LOGMODULE fapi
+#include "util/log.h"
+#include "util/aux_util.h"
+
+/** One-Call function for Fapi_Finalize
+ *
+ * Fapi_Finalize() finalizes a context by closing IPC/RPC connections and freeing
+ * its consumed memory.
+ *
+ * @param [in] context The FAPI_CONTEXT
+ */
+void
+Fapi_Finalize(
+    FAPI_CONTEXT **context)
+{
+    LOG_TRACE("called for context:%p", context);
+
+    if (!context || !*context) {
+        LOG_WARNING("Attempting to free NULL context");
+        return;
+    }
+
+    LOG_DEBUG("called: context: %p, *context: %p", context,
+              (context != NULL) ? *context : NULL);
+
+    ifapi_profiles_finalize(&(*context)->profiles);
+
+    TSS2_TCTI_CONTEXT *tcti = NULL;
+
+    if ((*context)->esys) {
+        Esys_GetTcti((*context)->esys, &tcti);
+        Esys_Finalize(&((*context)->esys));
+        if (tcti) {
+            LOG_TRACE("Finalizing TCTI");
+            Tss2_TctiLdr_Finalize(&tcti);
+        }
+    }
+
+    SAFE_FREE((*context)->pstore.policydir);
+    SAFE_FREE((*context)->keystore.systemdir);
+    SAFE_FREE((*context)->keystore.userdir);
+    SAFE_FREE((*context)->keystore.defaultprofile);
+
+    SAFE_FREE((*context)->cmd.Provision.root_crt);
+    SAFE_FREE((*context)->cmd.Provision.intermed_crt);
+    SAFE_FREE((*context)->cmd.Provision.pem_cert);
+
+    SAFE_FREE((*context)->config.profile_dir);
+    SAFE_FREE((*context)->config.user_dir);
+    SAFE_FREE((*context)->config.keystore_dir);
+    SAFE_FREE((*context)->config.profile_name);
+    SAFE_FREE((*context)->config.tcti);
+    SAFE_FREE((*context)->config.log_dir);
+    ifapi_profiles_finalize(&(*context)->profiles);
+
+    SAFE_FREE((*context)->eventlog.log_dir);
+
+    ifapi_free_objects(*context);
+    free(*context);
+    *context = NULL;
+
+    LOG_DEBUG("finished");
+}

diff --git a/src/tss2-fapi/api/Fapi_Free.c b/src/tss2-fapi/api/Fapi_Free.c
new file mode 100644
index 0000000..37ce751
--- /dev/null
+++ b/src/tss2-fapi/api/Fapi_Free.c

@@ -0,0 +1,27 @@
+/* SPDX-License-Identifier: BSD-2-Clause */
+/*******************************************************************************
+ * Copyright 2018-2019, Fraunhofer SIT sponsored by Infineon Technologies AG
+ * All rights reserved.
+ ******************************************************************************/
+
+#ifdef HAVE_CONFIG_H
+#include <config.h>
+#endif
+
+#include <stdlib.h>
+
+/*
+ * Fapi_Free is a helper function that is a wrapper around free().
+ * This allows programs that are built using a different version
+ * of the C runtime to free memory that has been allocated by the
+ * esys library on Windows.
+ *
+ * @param [in] ptr A pointer to the object that is to be freed.
+ */
+void
+Fapi_Free(void *ptr)
+{
+    if (ptr != NULL) {
+        free(ptr);
+    }
+}

diff --git a/src/tss2-fapi/api/Fapi_GetAppData.c b/src/tss2-fapi/api/Fapi_GetAppData.c
new file mode 100644
index 0000000..dbaac27
--- /dev/null
+++ b/src/tss2-fapi/api/Fapi_GetAppData.c

@@ -0,0 +1,224 @@
+/* SPDX-License-Identifier: BSD-2-Clause */
+/*******************************************************************************
+ * Copyright 2018-2019, Fraunhofer SIT sponsored by Infineon Technologies AG
+ * All rights reserved.
+ ******************************************************************************/
+
+#ifdef HAVE_CONFIG_H
+#include <config.h>
+#endif
+
+#include <stdlib.h>
+#include <errno.h>
+#include <unistd.h>
+#include <errno.h>
+#include <string.h>
+
+#include "tss2_fapi.h"
+#include "fapi_int.h"
+#include "fapi_util.h"
+#include "tss2_esys.h"
+#define LOGMODULE fapi
+#include "util/log.h"
+#include "util/aux_util.h"
+
+/** One-Call function for Fapi_GetAppData
+ *
+ * Every object has a description field that can be retrieved in order to obtain
+ * additional information in its “path” entry.
+ *
+ * @param [in, out] context The FAPI_CONTEXT
+ * @param [in] path The path to the object for which the appData is returned
+ * @param [out] appData A copy of the appData. May be NULL (callee-allocated)
+ * @param [out] appDataSize The size of the returned AppData. May be NULL
+ *
+ * @retval TSS2_RC_SUCCESS: if the function call was a success.
+ * @retval TSS2_FAPI_RC_BAD_REFERENCE: if context or path is NULL.
+ * @retval TSS2_FAPI_RC_BAD_CONTEXT: if context corruption is detected.
+ * @retval TSS2_FAPI_RC_BAD_PATH: if path does not map to a FAPI entity.
+ * @retval TSS2_FAPI_RC_STORAGE_ERROR: if the updated data cannot be loaded.
+ * @retval TSS2_FAPI_RC_BAD_SEQUENCE: if the context has an asynchronous
+ *         operation already pending.
+ * @retval TSS2_FAPI_RC_IO_ERROR: if the data cannot be saved.
+ * @retval TSS2_FAPI_RC_MEMORY: if the FAPI cannot allocate enough memory for
+ *         internal operations or return parameters.
+ */
+TSS2_RC
+Fapi_GetAppData(
+    FAPI_CONTEXT *context,
+    char   const *path,
+    uint8_t    **appData,
+    size_t      *appDataSize)
+{
+    LOG_TRACE("called for context:%p", context);
+
+    TSS2_RC r, r2;
+
+    /* Check for NULL parameters */
+    check_not_null(context);
+    check_not_null(path);
+
+    /* Check whether TCTI and ESYS are initialized */
+    return_if_null(context->esys, "Command can't be executed in none TPM mode.",
+                   TSS2_FAPI_RC_NO_TPM);
+
+    /* If the async state automata of FAPI shall be tested, then we must not set
+       the timeouts of ESYS to blocking mode.
+       During testing, the mssim tcti will ensure multiple re-invocations.
+       Usually however the synchronous invocations of FAPI shall instruct ESYS
+       to block until a result is available. */
+#ifndef TEST_FAPI_ASYNC
+    r = Esys_SetTimeout(context->esys, TSS2_TCTI_TIMEOUT_BLOCK);
+    return_if_error_reset_state(r, "Set Timeout to blocking");
+#endif /* TEST_FAPI_ASYNC */
+
+    r = Fapi_GetAppData_Async(context, path);
+    return_if_error_reset_state(r, "Path_SetDescription");
+
+    do {
+        /* We wait for file I/O to be ready if the FAPI state automata
+           are in a file I/O state. */
+        r = ifapi_io_poll(&context->io);
+        return_if_error(r, "Something went wrong with IO polling");
+
+        /* Repeatedly call the finish function, until FAPI has transitioned
+           through all execution stages / states of this invocation. */
+        r = Fapi_GetAppData_Finish(context, appData, appDataSize);
+    } while ((r & ~TSS2_RC_LAYER_MASK) == TSS2_BASE_RC_TRY_AGAIN);
+
+    /* Reset the ESYS timeout to non-blocking, immediate response. */
+    r2 = Esys_SetTimeout(context->esys, 0);
+    return_if_error(r2, "Set Timeout to non-blocking");
+
+    return_if_error_reset_state(r, "Path_SetDescription");
+
+    LOG_TRACE("finsihed");
+    return TSS2_RC_SUCCESS;
+}
+
+/** Asynchronous function for Fapi_GetAppData
+ *
+ * Every object has a description field that can be retrieved in order to obtain
+ * additional information in its “path” entry.
+ *
+ * Call Fapi_GetAppData_Finish to finish the execution of this command.
+ *
+ * @param [in, out] context The FAPI_CONTEXT
+ * @param [in] path The path to the object for which the appData is returned
+ *
+ * @retval TSS2_RC_SUCCESS: if the function call was a success.
+ * @retval TSS2_FAPI_RC_BAD_REFERENCE: if context or path is NULL.
+ * @retval TSS2_FAPI_RC_BAD_CONTEXT: if context corruption is detected.
+ * @retval TSS2_FAPI_RC_BAD_PATH: if path does not map to a FAPI entity.
+ * @retval TSS2_FAPI_RC_STORAGE_ERROR: if the updated data cannot be loaded.
+ * @retval TSS2_FAPI_RC_BAD_SEQUENCE: if the context has an asynchronous
+ *         operation already pending.
+ * @retval TSS2_FAPI_RC_IO_ERROR: if the data cannot be saved.
+ * @retval TSS2_FAPI_RC_MEMORY: if the FAPI cannot allocate enough memory for
+ *         internal operations or return parameters.
+ */
+TSS2_RC
+Fapi_GetAppData_Async(
+    FAPI_CONTEXT *context,
+    char   const *path)
+{
+    LOG_TRACE("called for context:%p", context);
+    LOG_TRACE("path: %s", path);
+
+    TSS2_RC r;
+
+    /* Check for NULL parameters */
+    check_not_null(context);
+    check_not_null(path);
+
+    r = ifapi_session_init(context);
+    return_if_error(r, "Initialize GetAppData");
+
+    r = ifapi_keystore_load_async(&context->keystore, &context->io, path);
+    return_if_error2(r, "Could not open: %s", path);
+
+    context->state =  PATH_GET_DESCRIPTION_READ;
+    LOG_TRACE("finsihed");
+    return TSS2_RC_SUCCESS;
+}
+
+/** Asynchronous finish function for Fapi_GetAppData
+ *
+ * This function should be called after a previous Fapi_GetAppData_Async.
+ *
+ * @param [in, out] context The FAPI_CONTEXT
+ * @param [out] appData A copy of the appData. May be Null (callee-allocated)
+ * @param [out] appDataSize The size of the returned AppData. May be NULL
+ *
+ * @retval TSS2_RC_SUCCESS: if the function call was a success.
+ * @retval TSS2_FAPI_RC_BAD_REFERENCE: if context is NULL.
+ * @retval TSS2_FAPI_RC_BAD_CONTEXT: if context corruption is detected.
+ * @retval TSS2_FAPI_RC_BAD_SEQUENCE: if the context has an asynchronous
+ *         operation already pending.
+ * @retval TSS2_FAPI_RC_IO_ERROR: if the data cannot be saved.
+ * @retval TSS2_FAPI_RC_MEMORY: if the FAPI cannot allocate enough memory for
+ *         internal operations or return parameters.
+ * @retval TSS2_FAPI_RC_TRY_AGAIN: if the asynchronous operation is not yet
+ *         complete. Call this function again later.
+ */
+TSS2_RC
+Fapi_GetAppData_Finish(
+    FAPI_CONTEXT *context,
+    uint8_t     **appData,
+    size_t       *appDataSize)
+{
+    LOG_TRACE("called for context:%p", context);
+
+    TSS2_RC r;
+    IFAPI_OBJECT object;
+    UINT8_ARY *objAppData;
+
+    /* Check for NULL parameters */
+    check_not_null(context);
+
+    switch (context->state) {
+        statecase(context->state, PATH_GET_DESCRIPTION_READ);
+            r = ifapi_keystore_load_finish(&context->keystore, &context->io, &object);
+            return_try_again(r);
+            return_if_error_reset_state(r, "read_finish failed");
+
+            switch (object.objectType) {
+                case IFAPI_KEY_OBJ:
+                    objAppData = &object.misc.key.appData;
+                    break;
+                case IFAPI_NV_OBJ:
+                    objAppData = &object.misc.nv.appData;
+                    break;
+                default:
+                    goto_error(r, TSS2_FAPI_RC_BAD_PATH, "Object has no app data.", cleanup);
+            }
+
+            if (appData) {
+                if (objAppData->size) {
+                    *appData = malloc(objAppData->size);
+                    goto_if_null2(*appData, "Out of memory.", r, TSS2_FAPI_RC_MEMORY,
+                                  cleanup);
+                    memcpy(*appData, &objAppData->buffer[0],
+                           objAppData->size);
+                } else {
+                    *appData = NULL;
+                }
+            }
+            if (appDataSize)
+                *appDataSize = objAppData->size;
+
+            context->state = _FAPI_STATE_INIT;
+            r = TSS2_RC_SUCCESS;
+            break;
+
+        statecasedefault(context->state);
+    }
+
+cleanup:
+    ifapi_cleanup_ifapi_object(&object);
+    ifapi_cleanup_ifapi_object(&context->loadKey.auth_object);
+    ifapi_cleanup_ifapi_object(context->loadKey.key_object);
+    ifapi_cleanup_ifapi_object(&context->createPrimary.pkey_object);
+    LOG_TRACE("finsihed");
+    return r;
+}

diff --git a/src/tss2-fapi/api/Fapi_GetCertificate.c b/src/tss2-fapi/api/Fapi_GetCertificate.c
new file mode 100644
index 0000000..0db21ab
--- /dev/null
+++ b/src/tss2-fapi/api/Fapi_GetCertificate.c

@@ -0,0 +1,209 @@
+/* SPDX-License-Identifier: BSD-2-Clause */
+/*******************************************************************************
+ * Copyright 2018-2019, Fraunhofer SIT sponsored by Infineon Technologies AG
+ * All rights reserved.
+ ******************************************************************************/
+
+#ifdef HAVE_CONFIG_H
+#include <config.h>
+#endif
+
+#include <stdlib.h>
+#include <errno.h>
+#include <unistd.h>
+#include <errno.h>
+#include <string.h>
+
+
+#include "tss2_fapi.h"
+#include "fapi_int.h"
+#include "fapi_util.h"
+#include "tss2_esys.h"
+#define LOGMODULE fapi
+#include "util/log.h"
+#include "util/aux_util.h"
+#include "fapi_crypto.h"
+
+/** One-Call function for Fapi_GetCertificate
+ *
+ * Gets an x.509 certificate for the key at a given path.
+ *
+ * @param [in, out] context The FAPI_CONTEXT
+ * @param [in] path The path to the key whose certificate is created
+ * @param [out] x509certData The PEM-encoded certificate
+ *
+ * @retval TSS2_RC_SUCCESS: if the function call was a success.
+ * @retval TSS2_FAPI_RC_BAD_REFERENCE: if context, path or x509CertData is
+ *         NULL.
+ * @retval TSS2_FAPI_RC_BAD_CONTEXT: if context corruption is detected.
+ * @retval TSS2_FAPI_RC_PATH_NOT_FOUND: if path does not map to a FAPI entity.
+ * @retval TSS2_FAPI_RC_BAD_KEY: if the key is unsuitable for the requested
+ *         operation.
+ * @retval TSS2_FAPI_RC_NO_CERTIFICATE: if there is not a x.509 cert associated
+ *         with the path of the key.
+ * @retval TSS2_FAPI_RC_BAD_SEQUENCE: if the context has an asynchronous
+ *         operation already pending.
+ * @retval TSS2_FAPI_RC_IO_ERROR: if the data cannot be saved.
+ * @retval TSS2_FAPI_RC_MEMORY: if the FAPI cannot allocate enough memory for
+ *         internal operations or return parameters.
+ */
+TSS2_RC
+Fapi_GetCertificate(
+    FAPI_CONTEXT *context,
+    char const   *path,
+    char        **x509certData)
+{
+    LOG_TRACE("called for context:%p", context);
+
+    TSS2_RC r;
+
+    /* Check for NULL parameters */
+    check_not_null(context);
+    check_not_null(path);
+    check_not_null(x509certData);
+
+    r = Fapi_GetCertificate_Async(context, path);
+    return_if_error_reset_state(r, "Key_GetCertificate");
+
+    do {
+        /* We wait for file I/O to be ready if the FAPI state automata
+           are in a file I/O state. */
+        r = ifapi_io_poll(&context->io);
+        return_if_error(r, "Something went wrong with IO polling");
+
+        /* Repeatedly call the finish function, until FAPI has transitioned
+           through all execution stages / states of this invocation. */
+        r = Fapi_GetCertificate_Finish(context, x509certData);
+    } while ((r & ~TSS2_RC_LAYER_MASK) == TSS2_BASE_RC_TRY_AGAIN);
+
+    return_if_error_reset_state(r, "Key_GetCertificate");
+
+    LOG_TRACE("finsihed");
+    return TSS2_RC_SUCCESS;
+}
+
+/** Asynchronous function for Fapi_GetCertificate
+ *
+ * Gets an x.509 certificate for the key at a given path.
+ *
+ * Call Fapi_GetCertificate_Finish to finish the execution of this command.
+ *
+ * @param [in, out] context The FAPI_CONTEXT
+ * @param [in] path The path to the key whose certificate is created
+ *
+ * @retval TSS2_RC_SUCCESS: if the function call was a success.
+ * @retval TSS2_FAPI_RC_BAD_REFERENCE: if context or path is NULL.
+ * @retval TSS2_FAPI_RC_BAD_CONTEXT: if context corruption is detected.
+ * @retval TSS2_FAPI_RC_PATH_NOT_FOUND: if path does not map to a FAPI entity.
+ * @retval TSS2_FAPI_RC_BAD_KEY: if the key is unsuitable for the requested
+ *         operation.
+ * @retval TSS2_FAPI_RC_NO_CERTIFICATE: if there is not a x.509 cert associated
+ *         with the path of the key.
+ * @retval TSS2_FAPI_RC_BAD_SEQUENCE: if the context has an asynchronous
+ *         operation already pending.
+ * @retval TSS2_FAPI_RC_IO_ERROR: if the data cannot be saved.
+ * @retval TSS2_FAPI_RC_MEMORY: if the FAPI cannot allocate enough memory for
+ *         internal operations or return parameters.
+ */
+TSS2_RC
+Fapi_GetCertificate_Async(
+    FAPI_CONTEXT   *context,
+    char    const  *path)
+
+{
+    LOG_TRACE("called for context:%p", context);
+    LOG_TRACE("path: %s", path);
+
+    TSS2_RC r;
+
+    /* Check for NULL parameters */
+    check_not_null(context);
+    check_not_null(path);
+
+    /* Helpful alias pointers */
+    IFAPI_Key_SetCertificate * command = &context->cmd.Key_SetCertificate;
+
+    r = ifapi_non_tpm_mode_init(context);
+    return_if_error(r, "Initialize GetCertificate");
+
+    command->key_path = path;
+    r = ifapi_keystore_load_async(&context->keystore, &context->io, path);
+    return_if_error2(r, "Could not open: %s", path);
+
+    context->state =  KEY_GET_CERTIFICATE_READ;
+
+    LOG_TRACE("finsihed");
+    return TSS2_RC_SUCCESS;
+}
+
+/** Asynchronous finish function for Fapi_GetCertificate
+ *
+ * This function should be called after a previous Fapi_GetCertificate_Async.
+ *
+ * @param [in, out] context The FAPI_CONTEXT
+ * @param [out] x509certData The PEM-encoded certificate
+ *
+ * @retval TSS2_RC_SUCCESS: if the function call was a success.
+ * @retval TSS2_FAPI_RC_BAD_REFERENCE: if context or x509certData is NULL.
+ * @retval TSS2_FAPI_RC_BAD_CONTEXT: if context corruption is detected.
+ * @retval TSS2_FAPI_RC_BAD_SEQUENCE: if the context has an asynchronous
+ *         operation already pending.
+ * @retval TSS2_FAPI_RC_IO_ERROR: if the data cannot be saved.
+ * @retval TSS2_FAPI_RC_MEMORY: if the FAPI cannot allocate enough memory for
+ *         internal operations or return parameters.
+ * @retval TSS2_FAPI_RC_TRY_AGAIN: if the asynchronous operation is not yet
+ *         complete. Call this function again later.
+ */
+TSS2_RC
+Fapi_GetCertificate_Finish(
+    FAPI_CONTEXT  *context,
+    char         **x509certData)
+{
+    LOG_TRACE("called for context:%p", context);
+
+    TSS2_RC r;
+
+    /* Check for NULL parameters */
+    check_not_null(context);
+    check_not_null(x509certData);
+
+    /* Helpful alias pointers */
+    IFAPI_Key_SetCertificate * command = &context->cmd.Key_SetCertificate;
+    IFAPI_OBJECT *keyObject =  &command->key_object;
+
+    switch (context->state) {
+        statecase(context->state, KEY_GET_CERTIFICATE_READ)
+            r = ifapi_keystore_load_finish(&context->keystore, &context->io, keyObject);
+            return_try_again(r);
+            return_if_error_reset_state(r, "read_finish failed");
+
+            r = ifapi_initialize_object(context->esys, keyObject);
+            goto_if_error_reset_state(r, "Initialize NV object", error_cleanup);
+
+            if (keyObject->objectType == IFAPI_EXT_PUB_KEY_OBJ) {
+                strdup_check(*x509certData, keyObject->misc.ext_pub_key.certificate,
+                        r, error_cleanup);
+            }
+            else if (x509certData) {
+                strdup_check(*x509certData, keyObject->misc.key.certificate,
+                        r, error_cleanup);
+            }
+
+            context->state = _FAPI_STATE_INIT;
+            r = TSS2_RC_SUCCESS;
+            break;
+
+        statecasedefault(context->state);
+    }
+
+error_cleanup:
+    if (keyObject->objectType) {
+        ifapi_cleanup_ifapi_object(keyObject);
+    }
+    ifapi_cleanup_ifapi_object(&context->loadKey.auth_object);
+    ifapi_cleanup_ifapi_object(context->loadKey.key_object);
+    ifapi_cleanup_ifapi_object(&context->createPrimary.pkey_object);
+
+    LOG_TRACE("finsihed");
+    return r;
+}

diff --git a/src/tss2-fapi/api/Fapi_GetDescription.c b/src/tss2-fapi/api/Fapi_GetDescription.c
new file mode 100644
index 0000000..53c9461
--- /dev/null
+++ b/src/tss2-fapi/api/Fapi_GetDescription.c

@@ -0,0 +1,197 @@
+/* SPDX-License-Identifier: BSD-2-Clause */
+/*******************************************************************************
+ * Copyright 2018-2019, Fraunhofer SIT sponsored by Infineon Technologies AG
+ * All rights reserved.
+ ******************************************************************************/
+
+#ifdef HAVE_CONFIG_H
+#include <config.h>
+#endif
+
+#include <stdlib.h>
+#include <errno.h>
+#include <unistd.h>
+#include <errno.h>
+#include <string.h>
+
+#include "tss2_fapi.h"
+#include "fapi_int.h"
+#include "fapi_util.h"
+#include "tss2_esys.h"
+#define LOGMODULE fapi
+#include "util/log.h"
+#include "util/aux_util.h"
+
+/** One-Call function for Fapi_GetDescription
+ *
+ * Returns the description of a previously stored object.
+ *
+ * @param [in, out] context The FAPI_CONTEXT
+ * @param [in] path The path of the object for which the description is loaded
+ * @param [out] description The description of the object
+ *
+ * @retval TSS2_RC_SUCCESS: if the function call was a success.
+ * @retval TSS2_FAPI_RC_BAD_REFERENCE: if context, path or description is NULL.
+ * @retval TSS2_FAPI_RC_BAD_CONTEXT: if context corruption is detected.
+ * @retval TSS2_FAPI_RC_BAD_PATH: if path does not map to a FAPI entity.
+ * @retval TSS2_FAPI_RC_STORAGE_ERROR: if the updated data cannot be loaded.
+ * @retval TSS2_FAPI_RC_BAD_SEQUENCE: if the context has an asynchronous
+ *         operation already pending.
+ * @retval TSS2_FAPI_RC_IO_ERROR: if the data cannot be saved.
+ * @retval TSS2_FAPI_RC_MEMORY: if the FAPI cannot allocate enough memory for
+ *         internal operations or return parameters.
+ */
+TSS2_RC
+Fapi_GetDescription(
+    FAPI_CONTEXT *context,
+    char   const *path,
+    char        **description)
+{
+    LOG_TRACE("called for context:%p", context);
+
+    TSS2_RC r, r2;
+
+    /* Check for NULL parameters */
+    check_not_null(context);
+    check_not_null(path);
+    check_not_null(description);
+
+    /* Check whether TCTI and ESYS are initialized */
+    return_if_null(context->esys, "Command can't be executed in none TPM mode.",
+                   TSS2_FAPI_RC_NO_TPM);
+
+    /* If the async state automata of FAPI shall be tested, then we must not set
+       the timeouts of ESYS to blocking mode.
+       During testing, the mssim tcti will ensure multiple re-invocations.
+       Usually however the synchronous invocations of FAPI shall instruct ESYS
+       to block until a result is available. */
+#ifndef TEST_FAPI_ASYNC
+    r = Esys_SetTimeout(context->esys, TSS2_TCTI_TIMEOUT_BLOCK);
+    return_if_error_reset_state(r, "Set Timeout to blocking");
+#endif /* TEST_FAPI_ASYNC */
+
+    r = Fapi_GetDescription_Async(context, path);
+    return_if_error_reset_state(r, "Path_SetDescription");
+
+    do {
+        /* We wait for file I/O to be ready if the FAPI state automata
+           are in a file I/O state. */
+        r = ifapi_io_poll(&context->io);
+        return_if_error(r, "Something went wrong with IO polling");
+
+        /* Repeatedly call the finish function, until FAPI has transitioned
+           through all execution stages / states of this invocation. */
+        r = Fapi_GetDescription_Finish(context, description);
+    } while ((r & ~TSS2_RC_LAYER_MASK) == TSS2_BASE_RC_TRY_AGAIN);
+
+    /* Reset the ESYS timeout to non-blocking, immediate response. */
+    r2 = Esys_SetTimeout(context->esys, 0);
+    return_if_error(r2, "Set Timeout to non-blocking");
+
+    return_if_error_reset_state(r, "Path_SetDescription");
+
+    LOG_TRACE("finsihed");
+    return TSS2_RC_SUCCESS;
+}
+
+/** Asynchronous function for Fapi_GetDescription
+ *
+ * Returns the description of a previously stored object.
+ *
+ * Call Fapi_GetDescription_Finish to finish the execution of this command.
+ *
+ * @param [in, out] context The FAPI_CONTEXT
+ * @param [in] path The path of the object for which the description is loaded
+ *
+ * @retval TSS2_RC_SUCCESS: if the function call was a success.
+ * @retval TSS2_FAPI_RC_BAD_REFERENCE: if context or path is NULL.
+ * @retval TSS2_FAPI_RC_BAD_CONTEXT: if context corruption is detected.
+ * @retval TSS2_FAPI_RC_BAD_PATH: if path does not map to a FAPI entity.
+ * @retval TSS2_FAPI_RC_STORAGE_ERROR: if the updated data cannot be loaded.
+ * @retval TSS2_FAPI_RC_BAD_SEQUENCE: if the context has an asynchronous
+ *         operation already pending.
+ * @retval TSS2_FAPI_RC_IO_ERROR: if the data cannot be saved.
+ * @retval TSS2_FAPI_RC_MEMORY: if the FAPI cannot allocate enough memory for
+ *         internal operations or return parameters.
+ */
+TSS2_RC
+Fapi_GetDescription_Async(
+    FAPI_CONTEXT *context,
+    char   const *path)
+{
+    LOG_TRACE("called for context:%p", context);
+    LOG_TRACE("path: %s", path);
+
+    TSS2_RC r;
+
+    /* Check for NULL parameters */
+    check_not_null(context);
+    check_not_null(path);
+
+    r = ifapi_session_init(context);
+    return_if_error(r, "Initialize GetDescription");
+
+    r = ifapi_keystore_load_async(&context->keystore, &context->io, path);
+    return_if_error2(r, "Could not open: %s", path);
+
+    context->state =  PATH_GET_DESCRIPTION_READ;
+    LOG_TRACE("finsihed");
+    return TSS2_RC_SUCCESS;
+}
+
+/** Asynchronous finish function for Fapi_GetDescription
+ *
+ * This function should be called after a previous Fapi_GetDescription_Async.
+ *
+ * @param [in, out] context The FAPI_CONTEXT
+ * @param [out] description The description of the object
+ *
+ * @retval TSS2_RC_SUCCESS: if the function call was a success.
+ * @retval TSS2_FAPI_RC_BAD_REFERENCE: if context or description is NULL.
+ * @retval TSS2_FAPI_RC_BAD_CONTEXT: if context corruption is detected.
+ * @retval TSS2_FAPI_RC_BAD_SEQUENCE: if the context has an asynchronous
+ *         operation already pending.
+ * @retval TSS2_FAPI_RC_IO_ERROR: if the data cannot be saved.
+ * @retval TSS2_FAPI_RC_MEMORY: if the FAPI cannot allocate enough memory for
+ *         internal operations or return parameters.
+ * @retval TSS2_FAPI_RC_TRY_AGAIN: if the asynchronous operation is not yet
+ *         complete. Call this function again later.
+ */
+TSS2_RC
+Fapi_GetDescription_Finish(
+    FAPI_CONTEXT *context,
+    char        **description)
+{
+    LOG_TRACE("called for context:%p", context);
+
+    TSS2_RC r;
+    IFAPI_OBJECT object;
+
+    /* Check for NULL parameters */
+    check_not_null(context);
+    check_not_null(description);
+
+    switch (context->state) {
+        statecase(context->state, PATH_GET_DESCRIPTION_READ);
+            r = ifapi_keystore_load_finish(&context->keystore, &context->io, &object);
+            return_try_again(r);
+            return_if_error_reset_state(r, "read_finish failed");
+
+            r = ifapi_get_description(&object, description);
+            ifapi_cleanup_ifapi_object(&object);
+
+            return_if_error_reset_state(r, "Get description");
+
+            context->state = _FAPI_STATE_INIT;
+            r = TSS2_RC_SUCCESS;
+            break;
+
+        statecasedefault(context->state);
+    }
+    LOG_TRACE("finsihed");
+    ifapi_cleanup_ifapi_object(&object);
+    ifapi_cleanup_ifapi_object(&context->loadKey.auth_object);
+    ifapi_cleanup_ifapi_object(context->loadKey.key_object);
+    ifapi_cleanup_ifapi_object(&context->createPrimary.pkey_object);
+    return r;
+}