Repository: google/go-tpm
Pull request #304 (2022-09-03 15:11:10)

rename tpmdirect to tpm2 and rename existing tpm2 as legacy/tpm2
This PR moves the existing `tpm2` package out to `legacy/tpm2` and renames the `direct` package as `tpm2`.

The KDFa and KDFe helpers from the legacy API (which are needed by the new API) are moved into the new API, with the legacy API calling into the new API for htem.

A small adapter layer is added at `tpm2/adapter.go` to provide the API that `go-tpm-tools/simulator` requires. In the future, we can remove it after `go-tpm-tools/simulator` has been updated to use the new API.

We may flatten the new `tpm2` library's sub-libraries `structures` and `commands` together into `tpm2` in a future change, perhaps as part of resolving #302.


Patch:
diff --git a/examples/tpm-clear/clear.go b/examples/tpm-clear/clear.go
index 2c0a50f..45a6655 100644
--- a/examples/tpm-clear/clear.go
+++ b/examples/tpm-clear/clear.go
@@ -1,4 +1,4 @@
-// +build !windows
+//go:build !windows
 
 // Copyright (c) 2014, Google LLC All rights reserved.
 //
diff --git a/examples/tpm-genaik/genaik.go b/examples/tpm-genaik/genaik.go
index 066283d..dd4ed7d 100644
--- a/examples/tpm-genaik/genaik.go
+++ b/examples/tpm-genaik/genaik.go
@@ -1,4 +1,4 @@
-// +build !windows
+//go:build !windows
 
 // Copyright (c) 2014, Google LLC All rights reserved.
 //
diff --git a/examples/tpm-keys/tpm-keys.go b/examples/tpm-keys/tpm-keys.go
index d2b2e64..b69feec 100644
--- a/examples/tpm-keys/tpm-keys.go
+++ b/examples/tpm-keys/tpm-keys.go
@@ -1,4 +1,4 @@
-// +build !windows
+//go:build !windows
 
 // Copyright (c) 2016, Kevin Walsh.  All rights reserved.
 //
diff --git a/examples/tpm-sign/common.go b/examples/tpm-sign/common.go
index 41e5738..2a51ce3 100644
--- a/examples/tpm-sign/common.go
+++ b/examples/tpm-sign/common.go
@@ -1,4 +1,4 @@
-// +build !windows
+//go:build !windows
 
 package main
 
diff --git a/examples/tpm-sign/extend_pcr.go b/examples/tpm-sign/extend_pcr.go
index b6a3689..63a68b3 100644
--- a/examples/tpm-sign/extend_pcr.go
+++ b/examples/tpm-sign/extend_pcr.go
@@ -1,4 +1,4 @@
-// +build !windows
+//go:build !windows
 
 // Copyright (c) 2018, Ian Haken. All rights reserved.
 //
diff --git a/examples/tpm-sign/generate.go b/examples/tpm-sign/generate.go
index 3f5125d..3061e6c 100644
--- a/examples/tpm-sign/generate.go
+++ b/examples/tpm-sign/generate.go
@@ -1,4 +1,4 @@
-// +build !windows
+//go:build !windows
 
 // Copyright (c) 2018, Ian Haken. All rights reserved.
 //
diff --git a/examples/tpm-sign/sign.go b/examples/tpm-sign/sign.go
index bef7a21..fd86962 100644
--- a/examples/tpm-sign/sign.go
+++ b/examples/tpm-sign/sign.go
@@ -1,4 +1,4 @@
-// +build !windows
+//go:build !windows
 
 // Copyright (c) 2018, Ian Haken. All rights reserved.
 //
diff --git a/examples/tpm-sign/tpm-sign.go b/examples/tpm-sign/tpm-sign.go
index dbb2be1..a7a43c3 100644
--- a/examples/tpm-sign/tpm-sign.go
+++ b/examples/tpm-sign/tpm-sign.go
@@ -1,4 +1,4 @@
-// +build !windows
+//go:build !windows
 
 // Copyright (c) 2018, Ian Haken. All rights reserved.
 //
diff --git a/examples/tpm-sign/verify.go b/examples/tpm-sign/verify.go
index 58ed145..68b23f1 100644
--- a/examples/tpm-sign/verify.go
+++ b/examples/tpm-sign/verify.go
@@ -1,4 +1,4 @@
-// +build !windows
+//go:build !windows
 
 // Copyright (c) 2018, Ian Haken. All rights reserved.
 //
diff --git a/examples/tpm-takeownership/own.go b/examples/tpm-takeownership/own.go
index e4de2db..b551d34 100644
--- a/examples/tpm-takeownership/own.go
+++ b/examples/tpm-takeownership/own.go
@@ -1,4 +1,4 @@
-// +build !windows
+//go:build !windows
 
 // Copyright (c) 2014, Google LLC All rights reserved.
 //
diff --git a/examples/tpm2-ekcert/main.go b/examples/tpm2-ekcert/main.go
index 1fca03d..41e7e74 100644
--- a/examples/tpm2-ekcert/main.go
+++ b/examples/tpm2-ekcert/main.go
@@ -1,4 +1,4 @@
-// +build !windows
+//go:build !windows
 
 // Binary tpm2-ekcert reads an x509 certificate from a specific NVRAM index.
 package main
@@ -13,7 +13,7 @@ import (
 	"os"
 	"reflect"
 
-	"github.com/google/go-tpm/tpm2"
+	"github.com/google/go-tpm/legacy/tpm2"
 	"github.com/google/go-tpm/tpmutil"
 )
 
diff --git a/examples/tpm2-nvread/main.go b/examples/tpm2-nvread/main.go
index de5ea2c..70a1962 100644
--- a/examples/tpm2-nvread/main.go
+++ b/examples/tpm2-nvread/main.go
@@ -1,4 +1,4 @@
-// +build !windows
+//go:build !windows
 
 // Binary tpm2-nvread reads data from NVRAM at a specified index. The data is
 // printed out hex-encoded.
@@ -9,7 +9,7 @@ import (
 	"fmt"
 	"os"
 
-	"github.com/google/go-tpm/tpm2"
+	"github.com/google/go-tpm/legacy/tpm2"
 	"github.com/google/go-tpm/tpmutil"
 )
 
diff --git a/examples/tpm2-seal-unseal/main.go b/examples/tpm2-seal-unseal/main.go
index 0cbdad6..ae6b629 100644
--- a/examples/tpm2-seal-unseal/main.go
+++ b/examples/tpm2-seal-unseal/main.go
@@ -1,4 +1,4 @@
-// +build !windows
+//go:build !windows
 
 // Copyright (c) 2018, Google LLC All rights reserved.
 //
@@ -23,7 +23,7 @@ import (
 	"io"
 	"os"
 
-	"github.com/google/go-tpm/tpm2"
+	"github.com/google/go-tpm/legacy/tpm2"
 	"github.com/google/go-tpm/tpmutil"
 )
 
diff --git a/go.mod b/go.mod
index 38c39de..26bcf5e 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/google/go-tpm
 
-go 1.17
+go 1.18
 
 require (
 	github.com/google/go-cmp v0.5.0
diff --git a/tpm2/README.md b/legacy/tpm2/README.md
similarity index 100%
rename from tpm2/README.md
rename to legacy/tpm2/README.md
diff --git a/tpm2/constants.go b/legacy/tpm2/constants.go
similarity index 100%
rename from tpm2/constants.go
rename to legacy/tpm2/constants.go
diff --git a/tpm2/credactivation/credential_activation.go b/legacy/tpm2/credactivation/credential_activation.go
similarity index 94%
rename from tpm2/credactivation/credential_activation.go
rename to legacy/tpm2/credactivation/credential_activation.go
index 7045b35..019d656 100644
--- a/tpm2/credactivation/credential_activation.go
+++ b/legacy/tpm2/credactivation/credential_activation.go
@@ -27,7 +27,8 @@ import (
 	"fmt"
 	"io"
 
-	"github.com/google/go-tpm/tpm2"
+	"github.com/google/go-tpm/legacy/tpm2"
+	"github.com/google/go-tpm/tpm2/helpers"
 	"github.com/google/go-tpm/tpmutil"
 )
 
@@ -91,7 +92,7 @@ func generateRSA(aik *tpm2.HashValue, pub *rsa.PublicKey, symBlockSize int, secr
 	if err != nil {
 		return nil, nil, fmt.Errorf("generating symmetric key: %v", err)
 	}
-	symmetricKey := tpm2.KDFaHash(h, seed, labelStorage, aikNameEncoded, nil, len(seed)*8)
+	symmetricKey := helpers.KDFaHash(h, seed, labelStorage, aikNameEncoded, nil, len(seed)*8)
 	c, err := aes.NewCipher(symmetricKey)
 	if err != nil {
 		return nil, nil, fmt.Errorf("symmetric cipher setup: %v", err)
@@ -108,7 +109,7 @@ func generateRSA(aik *tpm2.HashValue, pub *rsa.PublicKey, symBlockSize int, secr
 	// Generate the integrity HMAC, which is used to protect the integrity of the
 	// encrypted structure.
 	// See section 24.5 of the TPM specification revision 2 part 1.
-	macKey := tpm2.KDFaHash(h, seed, labelIntegrity, nil, nil, crypothash.Size()*8)
+	macKey := helpers.KDFaHash(h, seed, labelIntegrity, nil, nil, crypothash.Size()*8)
 
 	mac := hmac.New(crypothash.New, macKey)
 	mac.Write(encIdentity)
diff --git a/tpm2/encoding_test.go b/legacy/tpm2/encoding_test.go
similarity index 100%
rename from tpm2/encoding_test.go
rename to legacy/tpm2/encoding_test.go
diff --git a/tpm2/error.go b/legacy/tpm2/error.go
similarity index 100%
rename from tpm2/error.go
rename to legacy/tpm2/error.go
diff --git a/tpm2/error_test.go b/legacy/tpm2/error_test.go
similarity index 100%
rename from tpm2/error_test.go
rename to legacy/tpm2/error_test.go
diff --git a/legacy/tpm2/kdf.go b/legacy/tpm2/kdf.go
new file mode 100644
index 0000000..46564e2
--- /dev/null
+++ b/legacy/tpm2/kdf.go
@@ -0,0 +1,50 @@
+// Copyright (c) 2018, Google LLC All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package tpm2
+
+import (
+	"github.com/google/go-tpm/tpm2/helpers"
+)
+
+// KDFa implements TPM 2.0's default key derivation function, as defined in
+// section 11.4.9.2 of the TPM revision 2 specification part 1.
+// See: https://trustedcomputinggroup.org/resource/tpm-library-specification/
+// The key & label parameters must not be zero length.
+// The label parameter is a non-null-terminated string.
+// The contextU & contextV parameters are optional.
+// Deprecated: Use KDFaHash.
+func KDFa(hashAlg Algorithm, key []byte, label string, contextU, contextV []byte, bits int) ([]byte, error) {
+	h, err := hashAlg.Hash()
+	if err != nil {
+		return nil, err
+	}
+	return helpers.KDFaHash(h, key, label, contextU, contextV, bits), nil
+}
+
+// KDFe implements TPM 2.0's ECDH key derivation function, as defined in
+// section 11.4.9.3 of the TPM revision 2 specification part 1.
+// See: https://trustedcomputinggroup.org/resource/tpm-library-specification/
+// The z parameter is the x coordinate of one party's private ECC key multiplied
+// by the other party's public ECC point.
+// The use parameter is a non-null-terminated string.
+// The partyUInfo and partyVInfo are the x coordinates of the initiator's and
+// Deprecated: Use KDFeHash.
+func KDFe(hashAlg Algorithm, z []byte, use string, partyUInfo, partyVInfo []byte, bits int) ([]byte, error) {
+	h, err := hashAlg.Hash()
+	if err != nil {
+		return nil, err
+	}
+	return helpers.KDFeHash(h, z, use, partyUInfo, partyVInfo, bits), nil
+}
diff --git a/tpm2/open_other.go b/legacy/tpm2/open_other.go
similarity index 98%
rename from tpm2/open_other.go
rename to legacy/tpm2/open_other.go
index 5a83b6c..7d6d9a3 100644
--- a/tpm2/open_other.go
+++ b/legacy/tpm2/open_other.go
@@ -1,4 +1,4 @@
-// +build !windows
+//go:build !windows
 
 // Copyright (c) 2019, Google LLC All rights reserved.
 //
diff --git a/tpm2/open_windows.go b/legacy/tpm2/open_windows.go
similarity index 98%
rename from tpm2/open_windows.go
rename to legacy/tpm2/open_windows.go
index c243fa7..ad37a60 100644
--- a/tpm2/open_windows.go
+++ b/legacy/tpm2/open_windows.go
@@ -1,3 +1,5 @@
+//go:build windows
+
 // Copyright (c) 2018, Google LLC All rights reserved.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
diff --git a/tpm2/tpm2.go b/legacy/tpm2/tpm2.go
similarity index 100%
rename from tpm2/tpm2.go
rename to legacy/tpm2/tpm2.go
diff --git a/tpm/open_other.go b/tpm/open_other.go
index 0925da9..a357a17 100644
--- a/tpm/open_other.go
+++ b/tpm/open_other.go
@@ -1,4 +1,4 @@
-// +build !windows
+//go:build !windows
 
 // Copyright (c) 2019, Google LLC All rights reserved.
 //
diff --git a/tpm2/adapter.go b/tpm2/adapter.go
new file mode 100644
index 0000000..f1d1cdf
--- /dev/null
+++ b/tpm2/adapter.go
@@ -0,0 +1,22 @@
+// Package tpm2 implements an adapter layer expected by github.com/google/go-tpm-tools/simulator
+// TODO: after release, we can update simulator to use the new API
+package tpm2
+
+import (
+	"io"
+
+	"github.com/google/go-tpm/legacy/tpm2"
+)
+
+// StartupClear tells the TPM to perform a Reset and not a Restart.
+var StartupClear = tpm2.StartupClear
+
+// Startup initializes the TPM.
+func Startup(rw io.ReadWriter, typ tpm2.StartupType) error {
+	return tpm2.Startup(rw, typ)
+}
+
+// Shutdown prepares the TPM for a power loss.
+func Shutdown(rw io.ReadWriter, typ tpm2.StartupType) error {
+	return tpm2.Shutdown(rw, typ)
+}
diff --git a/direct/tpm2/audit.go b/tpm2/commands/audit.go
similarity index 95%
rename from direct/tpm2/audit.go
rename to tpm2/commands/audit.go
index e893357..93d5141 100644
--- a/direct/tpm2/audit.go
+++ b/tpm2/commands/audit.go
@@ -5,8 +5,8 @@ import (
 	"fmt"
 	"reflect"
 
-	"github.com/google/go-tpm/direct/structures/tpm"
-	"github.com/google/go-tpm/direct/structures/tpmi"
+	"github.com/google/go-tpm/tpm2/structures/tpm"
+	"github.com/google/go-tpm/tpm2/structures/tpmi"
 )
 
 // CommandAudit represents an audit session for attesting the execution of a
diff --git a/direct/tpm2/names.go b/tpm2/commands/names.go
similarity index 86%
rename from direct/tpm2/names.go
rename to tpm2/commands/names.go
index 1f56423..1cf8582 100644
--- a/direct/tpm2/names.go
+++ b/tpm2/commands/names.go
@@ -3,10 +3,10 @@ package tpm2
 import (
 	"encoding/binary"
 
-	"github.com/google/go-tpm/direct/structures/tpm"
-	"github.com/google/go-tpm/direct/structures/tpm2b"
-	"github.com/google/go-tpm/direct/structures/tpms"
-	"github.com/google/go-tpm/direct/structures/tpmt"
+	"github.com/google/go-tpm/tpm2/structures/tpm"
+	"github.com/google/go-tpm/tpm2/structures/tpm2b"
+	"github.com/google/go-tpm/tpm2/structures/tpms"
+	"github.com/google/go-tpm/tpm2/structures/tpmt"
 )
 
 // HandleName returns the TPM Name of a PCR, session, or permanent value
diff --git a/direct/tpm2/policy.go b/tpm2/commands/policy.go
similarity index 92%
rename from direct/tpm2/policy.go
rename to tpm2/commands/policy.go
index 9b0fe4d..28c7454 100644
--- a/direct/tpm2/policy.go
+++ b/tpm2/commands/policy.go
@@ -3,8 +3,8 @@ package tpm2
 import (
 	"crypto"
 
-	"github.com/google/go-tpm/direct/structures/tpmi"
-	"github.com/google/go-tpm/direct/structures/tpmt"
+	"github.com/google/go-tpm/tpm2/structures/tpmi"
+	"github.com/google/go-tpm/tpm2/structures/tpmt"
 )
 
 // PolicyCalculator represents a TPM 2.0 policy that needs to be calculated
diff --git a/direct/tpm2/reflect.go b/tpm2/commands/reflect.go
similarity index 99%
rename from direct/tpm2/reflect.go
rename to tpm2/commands/reflect.go
index ff57dbd..c005fdc 100644
--- a/direct/tpm2/reflect.go
+++ b/tpm2/commands/reflect.go
@@ -10,17 +10,17 @@ import (
 	"strconv"
 	"strings"
 
-	"github.com/google/go-tpm/direct/structures/tpm"
-	"github.com/google/go-tpm/direct/structures/tpm2b"
-	"github.com/google/go-tpm/direct/structures/tpma"
-	"github.com/google/go-tpm/direct/structures/tpms"
-	"github.com/google/go-tpm/direct/transport"
+	"github.com/google/go-tpm/tpm2/structures/tpm"
+	"github.com/google/go-tpm/tpm2/structures/tpm2b"
+	"github.com/google/go-tpm/tpm2/structures/tpma"
+	"github.com/google/go-tpm/tpm2/structures/tpms"
+	"github.com/google/go-tpm/tpm2/transport"
 )
 
 const (
 	// Chosen based on MAX_DIGEST_BUFFER, the length of the longest
 	// reasonable list returned by the reference implementation.
-	// The maxListLength must be greater than MAX_CONTEXT_SIZE = 1344, 
+	// The maxListLength must be greater than MAX_CONTEXT_SIZE = 1344,
 	// in order to allow for the unmarshalling of Context.
 	maxListLength uint32 = 4096
 )
@@ -81,7 +81,7 @@ func execute(t transport.TPM, cmd Command, rsp Response, extraSess ...Session) e
 		return err
 	}
 
-	// Parse the command directly into the response structure.
+	// Parse the command tpm2ly into the response structure.
 	rspBuf := bytes.NewBuffer(response)
 	err = rspHeader(rspBuf)
 	if err != nil {
diff --git a/direct/tpm2/sessions.go b/tpm2/commands/sessions.go
similarity index 95%
rename from direct/tpm2/sessions.go
rename to tpm2/commands/sessions.go
index f4ab3ce..c4a4f00 100644
--- a/direct/tpm2/sessions.go
+++ b/tpm2/commands/sessions.go
@@ -11,16 +11,15 @@ import (
 	"encoding/binary"
 	"fmt"
 
-	"github.com/google/go-tpm/direct/helpers"
-	"github.com/google/go-tpm/direct/structures/tpm"
-	"github.com/google/go-tpm/direct/structures/tpm2b"
-	"github.com/google/go-tpm/direct/structures/tpma"
-	"github.com/google/go-tpm/direct/structures/tpmi"
-	"github.com/google/go-tpm/direct/structures/tpms"
-	"github.com/google/go-tpm/direct/structures/tpmt"
-	"github.com/google/go-tpm/direct/structures/tpmu"
-	"github.com/google/go-tpm/direct/transport"
-	legacy "github.com/google/go-tpm/tpm2"
+	"github.com/google/go-tpm/tpm2/helpers"
+	"github.com/google/go-tpm/tpm2/structures/tpm"
+	"github.com/google/go-tpm/tpm2/structures/tpm2b"
+	"github.com/google/go-tpm/tpm2/structures/tpma"
+	"github.com/google/go-tpm/tpm2/structures/tpmi"
+	"github.com/google/go-tpm/tpm2/structures/tpms"
+	"github.com/google/go-tpm/tpm2/structures/tpmt"
+	"github.com/google/go-tpm/tpm2/structures/tpmu"
+	"github.com/google/go-tpm/tpm2/transport"
 )
 
 // Session represents a session in the TPM.
@@ -258,13 +257,13 @@ func Salted(handle tpmi.DHObject, pub tpmt.Public) AuthOption {
 	}
 }
 
-// parameterEncryptionDirection specifies whether the session-encrypted
+// parameterEncryptiontpm2ion specifies whether the session-encrypted
 // parameters are encrypted on the way into the TPM, out of the TPM, or both.
-type parameterEncryptionDirection int
+type parameterEncryptiontpm2ion int
 
 const (
 	// EncryptIn specifies a decrypt session.
-	EncryptIn parameterEncryptionDirection = 1 + iota
+	EncryptIn parameterEncryptiontpm2ion = 1 + iota
 	// EncryptOut specifies an encrypt session.
 	EncryptOut
 	// EncryptInOut specifies a decrypt+encrypt session.
@@ -275,7 +274,7 @@ const (
 // the TPM.
 // Note that only commands whose first command/response parameter is a 2B can
 // support session encryption.
-func AESEncryption(keySize tpm.KeyBits, dir parameterEncryptionDirection) AuthOption {
+func AESEncryption(keySize tpm.KeyBits, dir parameterEncryptiontpm2ion) AuthOption {
 	return func(o *sessionOptions) {
 		o.attrs.Decrypt = (dir == EncryptIn || dir == EncryptInOut)
 		o.attrs.Encrypt = (dir == EncryptOut || dir == EncryptInOut)
@@ -441,7 +440,7 @@ func getEncryptedSaltECC(nameAlg tpmi.AlgHash, parms *tpms.ECCParms, pub *tpms.E
 	if err != nil {
 		return nil, nil, err
 	}
-	salt := legacy.KDFeHash(ha, z, "SECRET", ephPubX.Bytes(), pub.X.Buffer, ha.Size()*8)
+	salt := helpers.KDFeHash(ha, z, "SECRET", ephPubX.Bytes(), pub.X.Buffer, ha.Size()*8)
 
 	var encSalt bytes.Buffer
 	binary.Write(&encSalt, binary.BigEndian, uint16(len(ephPubX.Bytes())))
@@ -516,7 +515,7 @@ func (s *hmacSession) Init(t transport.TPM) error {
 		var authSalt []byte
 		authSalt = append(authSalt, s.bindAuth...)
 		authSalt = append(authSalt, salt...)
-		s.sessionKey = legacy.KDFaHash(ha, authSalt, "ATH", s.nonceTPM.Buffer, s.nonceCaller.Buffer, ha.Size()*8)
+		s.sessionKey = helpers.KDFaHash(ha, authSalt, "ATH", s.nonceTPM.Buffer, s.nonceCaller.Buffer, ha.Size()*8)
 	}
 	return nil
 }
@@ -708,7 +707,7 @@ func (s *hmacSession) Encrypt(parameter []byte) error {
 	if err != nil {
 		return err
 	}
-	keyIV := legacy.KDFaHash(ha, sessionValue, "CFB", s.nonceCaller.Buffer, s.nonceTPM.Buffer, keyIVBytes*8)
+	keyIV := helpers.KDFaHash(ha, sessionValue, "CFB", s.nonceCaller.Buffer, s.nonceTPM.Buffer, keyIVBytes*8)
 	key, err := aes.NewCipher(keyIV[:keyBytes])
 	if err != nil {
 		return err
@@ -735,7 +734,7 @@ func (s *hmacSession) Decrypt(parameter []byte) error {
 	if err != nil {
 		return err
 	}
-	keyIV := legacy.KDFaHash(ha, sessionValue, "CFB", s.nonceTPM.Buffer, s.nonceCaller.Buffer, keyIVBytes*8)
+	keyIV := helpers.KDFaHash(ha, sessionValue, "CFB", s.nonceTPM.Buffer, s.nonceCaller.Buffer, keyIVBytes*8)
 	key, err := aes.NewCipher(keyIV[:keyBytes])
 	if err != nil {
 		return err
@@ -877,7 +876,7 @@ func (s *policySession) Init(t transport.TPM) error {
 		if err != nil {
 			return err
 		}
-		s.sessionKey = legacy.KDFaHash(ha, authSalt, "ATH", s.nonceTPM.Buffer, s.nonceCaller.Buffer, ha.Size()*8)
+		s.sessionKey = helpers.KDFaHash(ha, authSalt, "ATH", s.nonceTPM.Buffer, s.nonceCaller.Buffer, ha.Size()*8)
 	}
 
 	// Call the callback to execute the policy, if needed
@@ -1020,7 +1019,7 @@ func (s *policySession) Encrypt(parameter []byte) error {
 	if err != nil {
 		return err
 	}
-	keyIV := legacy.KDFaHash(ha, sessionValue, "CFB", s.nonceCaller.Buffer, s.nonceTPM.Buffer, keyIVBytes*8)
+	keyIV := helpers.KDFaHash(ha, sessionValue, "CFB", s.nonceCaller.Buffer, s.nonceTPM.Buffer, keyIVBytes*8)
 	key, err := aes.NewCipher(keyIV[:keyBytes])
 	if err != nil {
 		return err
@@ -1047,7 +1046,7 @@ func (s *policySession) Decrypt(parameter []byte) error {
 	if err != nil {
 		return err
 	}
-	keyIV := legacy.KDFaHash(ha, sessionValue, "CFB", s.nonceTPM.Buffer, s.nonceCaller.Buffer, keyIVBytes*8)
+	keyIV := helpers.KDFaHash(ha, sessionValue, "CFB", s.nonceTPM.Buffer, s.nonceCaller.Buffer, keyIVBytes*8)
 	key, err := aes.NewCipher(keyIV[:keyBytes])
 	if err != nil {
 		return err
diff --git a/direct/tpm2/tpm2.go b/tpm2/commands/tpm2.go
similarity index 96%
rename from direct/tpm2/tpm2.go
rename to tpm2/commands/tpm2.go
index 0c709e1..516a844 100644
--- a/direct/tpm2/tpm2.go
+++ b/tpm2/commands/tpm2.go
@@ -1,16 +1,16 @@
-// package tpm2 contains TPM 2.0 commands
+// Package tpm2 contains TPM 2.0 commands
 package tpm2
 
 import (
 	"bytes"
 
-	"github.com/google/go-tpm/direct/structures/tpm"
-	"github.com/google/go-tpm/direct/structures/tpm2b"
-	"github.com/google/go-tpm/direct/structures/tpmi"
-	"github.com/google/go-tpm/direct/structures/tpml"
-	"github.com/google/go-tpm/direct/structures/tpms"
-	"github.com/google/go-tpm/direct/structures/tpmt"
-	"github.com/google/go-tpm/direct/transport"
+	"github.com/google/go-tpm/tpm2/structures/tpm"
+	"github.com/google/go-tpm/tpm2/structures/tpm2b"
+	"github.com/google/go-tpm/tpm2/structures/tpmi"
+	"github.com/google/go-tpm/tpm2/structures/tpml"
+	"github.com/google/go-tpm/tpm2/structures/tpms"
+	"github.com/google/go-tpm/tpm2/structures/tpmt"
+	"github.com/google/go-tpm/tpm2/transport"
 )
 
 // handle represents a TPM handle as comprehended in Part 3: Commands.
@@ -441,16 +441,16 @@ func (cmd *GetRandom) Execute(t transport.TPM, s ...Session) (*GetRandomResponse
 	return &rsp, nil
 }
 
-// GetRandomReponse is the reponse from TPM2_GetRandom.
+// GetRandomResponse is the response from TPM2_GetRandom.
 type GetRandomResponse struct {
 	// the random octets
 	RandomBytes tpm2b.Digest
 }
 
-// Reponse implements the Response interface.
+// Response implements the Response interface.
 func (*GetRandomResponse) Response() tpm.CC { return tpm.CCGetRandom }
 
-// Quote is the input to TPM2_HashSequenceStart.
+// HashSequenceStart is the input to TPM2_HashSequenceStart.
 // See definition in Part 3, Commands, section 17.3
 type HashSequenceStart struct {
 	// authorization value for subsequent use of the sequence
@@ -949,8 +949,8 @@ func policyUpdate(policy *PolicyCalculator, cc tpm.CC, arg2, arg3 []byte) error
 }
 
 // Update implements the PolicyCommand interface.
-func (p *PolicySigned) Update(policy *PolicyCalculator) error {
-	return policyUpdate(policy, tpm.CCPolicySigned, p.AuthObject.KnownName().Buffer, p.PolicyRef.Buffer)
+func (cmd *PolicySigned) Update(policy *PolicyCalculator) error {
+	return policyUpdate(policy, tpm.CCPolicySigned, cmd.AuthObject.KnownName().Buffer, cmd.PolicyRef.Buffer)
 }
 
 // PolicySignedResponse is the response from TPM2_PolicySigned.
@@ -995,8 +995,8 @@ func (cmd *PolicySecret) Execute(t transport.TPM, s ...Session) (*PolicySecretRe
 }
 
 // Update implements the PolicyCommand interface.
-func (p *PolicySecret) Update(policy *PolicyCalculator) {
-	policyUpdate(policy, tpm.CCPolicySecret, p.AuthHandle.KnownName().Buffer, p.PolicyRef.Buffer)
+func (cmd *PolicySecret) Update(policy *PolicyCalculator) {
+	policyUpdate(policy, tpm.CCPolicySecret, cmd.AuthHandle.KnownName().Buffer, cmd.PolicyRef.Buffer)
 }
 
 // PolicySecretResponse is the response from TPM2_PolicySecret.
@@ -1029,10 +1029,10 @@ func (cmd *PolicyOr) Execute(t transport.TPM, s ...Session) error {
 }
 
 // Update implements the PolicyCommand interface.
-func (p *PolicyOr) Update(policy *PolicyCalculator) error {
+func (cmd *PolicyOr) Update(policy *PolicyCalculator) error {
 	policy.Reset()
 	var digests bytes.Buffer
-	for _, digest := range p.PHashList.Digests {
+	for _, digest := range cmd.PHashList.Digests {
 		digests.Write(digest.Buffer)
 	}
 	return policy.Update(tpm.CCPolicyOR, digests.Bytes())
@@ -1066,8 +1066,8 @@ func (cmd *PolicyPCR) Execute(t transport.TPM, s ...Session) error {
 }
 
 // Update implements the PolicyCommand interface.
-func (p *PolicyPCR) Update(policy *PolicyCalculator) error {
-	return policy.Update(tpm.CCPolicyPCR, p.Pcrs, p.PcrDigest.Buffer)
+func (cmd *PolicyPCR) Update(policy *PolicyCalculator) error {
+	return policy.Update(tpm.CCPolicyPCR, cmd.Pcrs, cmd.PcrDigest.Buffer)
 }
 
 // PolicyPCRResponse is the response from TPM2_PolicyPCR.
@@ -1095,8 +1095,8 @@ func (cmd *PolicyCommandCode) Execute(t transport.TPM, s ...Session) error {
 }
 
 // Update implements the PolicyCommand interface.
-func (p *PolicyCommandCode) Update(policy *PolicyCalculator) error {
-	return policy.Update(tpm.CCPolicyCommandCode, p.Code)
+func (cmd *PolicyCommandCode) Update(policy *PolicyCalculator) error {
+	return policy.Update(tpm.CCPolicyCommandCode, cmd.Code)
 }
 
 // PolicyCommandCodeResponse is the response from TPM2_PolicyCommandCode.
@@ -1124,8 +1124,8 @@ func (cmd *PolicyCPHash) Execute(t transport.TPM, s ...Session) error {
 }
 
 // Update implements the PolicyCommand interface.
-func (p *PolicyCPHash) Update(policy *PolicyCalculator) error {
-	return policy.Update(tpm.CCPolicyCpHash, p.CPHashA.Buffer)
+func (cmd *PolicyCPHash) Update(policy *PolicyCalculator) error {
+	return policy.Update(tpm.CCPolicyCpHash, cmd.CPHashA.Buffer)
 }
 
 // PolicyCPHashResponse is the response from TPM2_PolicyCpHash.
@@ -1159,8 +1159,8 @@ func (cmd *PolicyAuthorize) Execute(t transport.TPM, s ...Session) error {
 }
 
 // Update implements the PolicyCommand interface.
-func (p *PolicyAuthorize) Update(policy *PolicyCalculator) error {
-	return policyUpdate(policy, tpm.CCPolicyAuthorize, p.KeySign.Buffer, p.PolicyRef.Buffer)
+func (cmd *PolicyAuthorize) Update(policy *PolicyCalculator) error {
+	return policyUpdate(policy, tpm.CCPolicyAuthorize, cmd.KeySign.Buffer, cmd.PolicyRef.Buffer)
 }
 
 // PolicyAuthorizeResponse is the response from TPM2_PolicyAuthorize.
@@ -1220,8 +1220,8 @@ func (cmd *PolicyNVWritten) Execute(t transport.TPM, s ...Session) (*PolicyNVWri
 }
 
 // Update implements the PolicyCommand interface.
-func (p *PolicyNVWritten) Update(policy *PolicyCalculator) error {
-	return policy.Update(tpm.CCPolicyNvWritten, p.WrittenSet)
+func (cmd *PolicyNVWritten) Update(policy *PolicyCalculator) error {
+	return policy.Update(tpm.CCPolicyNvWritten, cmd.WrittenSet)
 }
 
 // PolicyNVWrittenResponse is the response from TPM2_PolicyNvWritten.
@@ -1252,9 +1252,9 @@ func (cmd *PolicyAuthorizeNV) Execute(t transport.TPM, s ...Session) error {
 }
 
 // Update implements the PolicyCommand interface.
-func (p *PolicyAuthorizeNV) Update(policy *PolicyCalculator) error {
+func (cmd *PolicyAuthorizeNV) Update(policy *PolicyCalculator) error {
 	policy.Reset()
-	return policy.Update(tpm.CCPolicyAuthorizeNV, p.NVIndex.KnownName().Buffer)
+	return policy.Update(tpm.CCPolicyAuthorizeNV, cmd.NVIndex.KnownName().Buffer)
 }
 
 // PolicyAuthorizeNVResponse is the response from TPM2_PolicyAuthorizeNV.
diff --git a/direct/helpers/crypto.go b/tpm2/helpers/crypto.go
similarity index 85%
rename from direct/helpers/crypto.go
rename to tpm2/helpers/crypto.go
index 49bab75..85bc13f 100644
--- a/direct/helpers/crypto.go
+++ b/tpm2/helpers/crypto.go
@@ -1,3 +1,4 @@
+// Package helpers provides helper functionality for interacting with the TPM 2.0 API.
 package helpers
 
 import (
@@ -5,8 +6,8 @@ import (
 	"crypto/rsa"
 	"math/big"
 
-	"github.com/google/go-tpm/direct/structures/tpm2b"
-	"github.com/google/go-tpm/direct/structures/tpms"
+	"github.com/google/go-tpm/tpm2/structures/tpm2b"
+	"github.com/google/go-tpm/tpm2/structures/tpms"
 )
 
 // RSAPub converts a TPM RSA public key into one recognized by the rsa package.
diff --git a/tpm2/kdf.go b/tpm2/helpers/kdf.go
similarity index 53%
rename from tpm2/kdf.go
rename to tpm2/helpers/kdf.go
index f2fe507..0258aa4 100644
--- a/tpm2/kdf.go
+++ b/tpm2/helpers/kdf.go
@@ -1,18 +1,4 @@
-// Copyright (c) 2018, Google LLC All rights reserved.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package tpm2
+package helpers
 
 import (
 	"crypto"
@@ -40,21 +26,6 @@ func KDFaHash(h crypto.Hash, key []byte, label string, contextU, contextV []byte
 	return out
 }
 
-// KDFa implements TPM 2.0's default key derivation function, as defined in
-// section 11.4.9.2 of the TPM revision 2 specification part 1.
-// See: https://trustedcomputinggroup.org/resource/tpm-library-specification/
-// The key & label parameters must not be zero length.
-// The label parameter is a non-null-terminated string.
-// The contextU & contextV parameters are optional.
-// Deprecated: Use KDFaHash.
-func KDFa(hashAlg Algorithm, key []byte, label string, contextU, contextV []byte, bits int) ([]byte, error) {
-	h, err := hashAlg.Hash()
-	if err != nil {
-		return nil, err
-	}
-	return KDFaHash(h, key, label, contextU, contextV, bits), nil
-}
-
 // KDFeHash implements TPM 2.0's ECDH key derivation function, as defined in
 // section 11.4.9.3 of the TPM revision 2 specification part 1.
 // See: https://trustedcomputinggroup.org/resource/tpm-library-specification/
@@ -76,22 +47,6 @@ func KDFeHash(h crypto.Hash, z []byte, use string, partyUInfo, partyVInfo []byte
 	return out
 }
 
-// KDFe implements TPM 2.0's ECDH key derivation function, as defined in
-// section 11.4.9.3 of the TPM revision 2 specification part 1.
-// See: https://trustedcomputinggroup.org/resource/tpm-library-specification/
-// The z parameter is the x coordinate of one party's private ECC key multiplied
-// by the other party's public ECC point.
-// The use parameter is a non-null-terminated string.
-// The partyUInfo and partyVInfo are the x coordinates of the initiator's and
-// Deprecated: Use KDFeHash.
-func KDFe(hashAlg Algorithm, z []byte, use string, partyUInfo, partyVInfo []byte, bits int) ([]byte, error) {
-	h, err := hashAlg.Hash()
-	if err != nil {
-		return nil, err
-	}
-	return KDFeHash(h, z, use, partyUInfo, partyVInfo, bits), nil
-}
-
 func kdf(h hash.Hash, bits int, update func()) []byte {
 	bytes := (bits + 7) / 8
 	out := []byte{}
diff --git a/direct/helpers/names.go b/tpm2/helpers/names.go
similarity index 83%
rename from direct/helpers/names.go
rename to tpm2/helpers/names.go
index e179ab6..f020a30 100644
--- a/direct/helpers/names.go
+++ b/tpm2/helpers/names.go
@@ -3,7 +3,7 @@ package helpers
 import (
 	"encoding/binary"
 
-	"github.com/google/go-tpm/direct/structures/tpm"
+	"github.com/google/go-tpm/tpm2/structures/tpm"
 )
 
 // PrimaryHandleName returns the TPM Name of a primary handle.
diff --git a/direct/helpers/wrappers.go b/tpm2/helpers/wrappers.go
similarity index 87%
rename from direct/helpers/wrappers.go
rename to tpm2/helpers/wrappers.go
index 404d350..a897661 100644
--- a/direct/helpers/wrappers.go
+++ b/tpm2/helpers/wrappers.go
@@ -1,6 +1,6 @@
 package helpers
 
-import "github.com/google/go-tpm/direct/structures/tpm"
+import "github.com/google/go-tpm/tpm2/structures/tpm"
 
 // This file provides wrapper functions for concrete types used by tpm2, for
 // setting union member pointers.
diff --git a/direct/structures/internal/bitfield.go b/tpm2/structures/internal/bitfield.go
similarity index 99%
rename from direct/structures/internal/bitfield.go
rename to tpm2/structures/internal/bitfield.go
index 41fd4ec..fe4c7c1 100644
--- a/direct/structures/internal/bitfield.go
+++ b/tpm2/structures/internal/bitfield.go
@@ -80,4 +80,3 @@ func (r *bitfield32) SetReservedBit(pos int, val bool) {
 		*r &= ^(1 << pos)
 	}
 }
-
diff --git a/direct/structures/internal/constants.go b/tpm2/structures/internal/constants.go
similarity index 100%
rename from direct/structures/internal/constants.go
rename to tpm2/structures/internal/constants.go
diff --git a/direct/structures/internal/errors.go b/tpm2/structures/internal/errors.go
similarity index 100%
rename from direct/structures/internal/errors.go
rename to tpm2/structures/internal/errors.go
diff --git a/direct/structures/internal/structures.go b/tpm2/structures/internal/structures.go
similarity index 99%
rename from direct/structures/internal/structures.go
rename to tpm2/structures/internal/structures.go
index 78af6ed..16a018d 100644
--- a/direct/structures/internal/structures.go
+++ b/tpm2/structures/internal/structures.go
@@ -1,4 +1,4 @@
-// package internal defines all the TPM 2.0 structures together to avoid import cycles
+// Package internal defines all the TPM 2.0 structures together to avoid import cycles
 package internal
 
 import (
@@ -577,7 +577,7 @@ type TPMTTKCreation struct {
 	Digest TPM2BDigest
 }
 
-// TPMTTVerified represents a TPMT_TK_Verified.
+// TPMTTKVerified represents a TPMT_TK_Verified.
 // See definition in Part 2: Structures, section 10.7.4.
 type TPMTTKVerified struct {
 	// ticket structure tag
diff --git a/direct/structures/tpm/constants.go b/tpm2/structures/tpm/constants.go
similarity index 99%
rename from direct/structures/tpm/constants.go
rename to tpm2/structures/tpm/constants.go
index 3659584..9377431 100644
--- a/direct/structures/tpm/constants.go
+++ b/tpm2/structures/tpm/constants.go
@@ -1,7 +1,7 @@
 package tpm
 
 import (
-	"github.com/google/go-tpm/direct/structures/internal"
+	"github.com/google/go-tpm/tpm2/structures/internal"
 )
 
 // AlgID values come from Part 2: Structures, section 6.3.
diff --git a/direct/structures/tpm/tpm.go b/tpm2/structures/tpm/tpm.go
similarity index 96%
rename from direct/structures/tpm/tpm.go
rename to tpm2/structures/tpm/tpm.go
index a85f86e..a3ceb35 100644
--- a/direct/structures/tpm/tpm.go
+++ b/tpm2/structures/tpm/tpm.go
@@ -1,8 +1,8 @@
-// package tpm contains the TPM 2.0 structures prefixed with "TPM_"
+// Package tpm contains the TPM 2.0 structures prefixed with "TPM_"
 package tpm
 
 import (
-	"github.com/google/go-tpm/direct/structures/internal"
+	"github.com/google/go-tpm/tpm2/structures/internal"
 )
 
 // CmdHeader is the header structure in front of any TPM command.
diff --git a/direct/structures/tpm2b/tpm2b.go b/tpm2/structures/tpm2b/tpm2b.go
similarity index 94%
rename from direct/structures/tpm2b/tpm2b.go
rename to tpm2/structures/tpm2b/tpm2b.go
index 5c88863..0120356 100644
--- a/direct/structures/tpm2b/tpm2b.go
+++ b/tpm2/structures/tpm2b/tpm2b.go
@@ -1,8 +1,8 @@
-// package tpm2b contains the TPM 2.0 structures prefixed with "TPM2B_"
+// Package tpm2b contains the TPM 2.0 structures prefixed with "TPM2B_"
 package tpm2b
 
 import (
-	"github.com/google/go-tpm/direct/structures/internal"
+	"github.com/google/go-tpm/tpm2/structures/internal"
 )
 
 // Digest represents a TPM2B_DIGEST.
@@ -29,11 +29,11 @@ type Timeout = internal.TPM2BTimeout
 // See definition in Part 2: Structures, section 10.4.5.
 type Auth = internal.TPM2BAuth
 
-// TPM2BMaxBuffer represents a TPM2B_MAX_BUFFER.
+// MaxBuffer represents a TPM2B_MAX_BUFFER.
 // See definition in Part 2: Structures, section 10.4.8.
 type MaxBuffer = internal.TPM2BMaxBuffer
 
-// TPM2BMaxNVBuffer represents a TPM2B_MAX_NV_BUFFER.
+// MaxNVBuffer represents a TPM2B_MAX_NV_BUFFER.
 // See definition in Part 2: Structures, section 10.4.9.
 type MaxNVBuffer = internal.TPM2BMaxNVBuffer
 
diff --git a/direct/structures/tpma/tpma.go b/tpm2/structures/tpma/tpma.go
similarity index 74%
rename from direct/structures/tpma/tpma.go
rename to tpm2/structures/tpma/tpma.go
index 8feae65..707da1d 100644
--- a/direct/structures/tpma/tpma.go
+++ b/tpm2/structures/tpma/tpma.go
@@ -1,12 +1,17 @@
-// package tpma contains the TPM 2.0 structures prefixed by "TPMA_"
+// Package tpma contains the TPM 2.0 structures prefixed by "TPMA_"
 package tpma
 
 import (
-	"github.com/google/go-tpm/direct/structures/internal"
+	"github.com/google/go-tpm/tpm2/structures/internal"
 )
 
+// Bitfield represents a TPM bitfield (i.e., TPMA_*) type.
 type Bitfield = internal.Bitfield
+
+// BitSetter represents a TPM bitfield (i.e., TPMA_*) type that can be written.
 type BitSetter = internal.BitSetter
+
+// BitGetter represents a TPM bitfield (i.e., TPMA_*) type that can be read.
 type BitGetter = internal.BitGetter
 
 // Algorithm represents a TPMA_ALGORITHM.
diff --git a/direct/structures/tpmi/tpmi.go b/tpm2/structures/tpmi/tpmi.go
similarity index 97%
rename from direct/structures/tpmi/tpmi.go
rename to tpm2/structures/tpmi/tpmi.go
index b0f5c5f..ac7683f 100644
--- a/direct/structures/tpmi/tpmi.go
+++ b/tpm2/structures/tpmi/tpmi.go
@@ -1,8 +1,8 @@
-// package tpmi contains the TPM 2.0 structures prefixed by "TPMI_"
+// Package tpmi contains the TPM 2.0 structures prefixed by "TPMI_"
 package tpmi
 
 import (
-	"github.com/google/go-tpm/direct/structures/internal"
+	"github.com/google/go-tpm/tpm2/structures/internal"
 )
 
 // YesNo represents a TPMI_YES_NO.
diff --git a/direct/structures/tpml/tpml.go b/tpm2/structures/tpml/tpml.go
similarity index 93%
rename from direct/structures/tpml/tpml.go
rename to tpm2/structures/tpml/tpml.go
index 3f7ed23..fcb6066 100644
--- a/direct/structures/tpml/tpml.go
+++ b/tpm2/structures/tpml/tpml.go
@@ -1,8 +1,8 @@
-// package tpml contains TPM 2.0 structures prefixed with "TPML_"
+// Package tpml contains TPM 2.0 structures prefixed with "TPML_"
 package tpml
 
 import (
-	"github.com/google/go-tpm/direct/structures/internal"
+	"github.com/google/go-tpm/tpm2/structures/internal"
 )
 
 // CC represents a TPML_CC.
diff --git a/direct/structures/tpms/tpms.go b/tpm2/structures/tpms/tpms.go
similarity index 98%
rename from direct/structures/tpms/tpms.go
rename to tpm2/structures/tpms/tpms.go
index d5d36de..94c24aa 100644
--- a/direct/structures/tpms/tpms.go
+++ b/tpm2/structures/tpms/tpms.go
@@ -1,7 +1,7 @@
-// package tpms contains the TPM 2.0 structures prefixed by "TPMS_"
+// Package tpms contains the TPM 2.0 structures prefixed by "TPMS_"
 package tpms
 
-import "github.com/google/go-tpm/direct/structures/internal"
+import "github.com/google/go-tpm/tpm2/structures/internal"
 
 // Empty represents a TPMS_EMPTY.
 // See definition in Part 2: Structures, section 10.1.
diff --git a/direct/structures/tpmt/tpmt.go b/tpm2/structures/tpmt/tpmt.go
similarity index 91%
rename from direct/structures/tpmt/tpmt.go
rename to tpm2/structures/tpmt/tpmt.go
index 2c36e2b..6d5e442 100644
--- a/direct/structures/tpmt/tpmt.go
+++ b/tpm2/structures/tpmt/tpmt.go
@@ -1,7 +1,7 @@
-// package tpmt contains TPM 2.0 structures prefixed with "TPMT_"
+// Package tpmt contains TPM 2.0 structures prefixed with "TPMT_"
 package tpmt
 
-import "github.com/google/go-tpm/direct/structures/internal"
+import "github.com/google/go-tpm/tpm2/structures/internal"
 
 // HA represents a TPMT_HA.
 // See definition in Part 2: Structures, section 10.3.2.
@@ -11,7 +11,7 @@ type HA = internal.TPMTHA
 // See definition in Part 2: Structures, section 10.7.3.
 type TKCreation = internal.TPMTTKCreation
 
-// TVerified represents a TPMT_TK_Verified.
+// TKVerified represents a TPMT_TK_Verified.
 // See definition in Part 2: Structures, section 10.7.4.
 type TKVerified = internal.TPMTTKVerified
 
@@ -19,7 +19,7 @@ type TKVerified = internal.TPMTTKVerified
 // See definition in Part 2: Structures, section 10.7.5.
 type TKAuth = internal.TPMTTKAuth
 
-// TPMTTKHashCheck represents a TPMT_TK_HASHCHECK.
+// TKHashCheck represents a TPMT_TK_HASHCHECK.
 // See definition in Part 2: Structures, section 10.7.6.
 type TKHashCheck = internal.TPMTTKHashCheck
 
diff --git a/direct/structures/tpmu/tpmu.go b/tpm2/structures/tpmu/tpmu.go
similarity index 94%
rename from direct/structures/tpmu/tpmu.go
rename to tpm2/structures/tpmu/tpmu.go
index 26fe1ab..b5276ee 100644
--- a/direct/structures/tpmu/tpmu.go
+++ b/tpm2/structures/tpmu/tpmu.go
@@ -1,7 +1,7 @@
-// package tpmu contains TPM 2.0 structures prefixed with "TPMU_"
+// Package tpmu contains TPM 2.0 structures prefixed with "TPMU_"
 package tpmu
 
-import "github.com/google/go-tpm/direct/structures/internal"
+import "github.com/google/go-tpm/tpm2/structures/internal"
 
 // Capabilities represents a TPMU_CAPABILITIES.
 // See definition in Part 2: Structures, section 10.10.1.
diff --git a/direct/templates/templates.go b/tpm2/templates/templates.go
similarity index 92%
rename from direct/templates/templates.go
rename to tpm2/templates/templates.go
index a697fdf..193b344 100644
--- a/direct/templates/templates.go
+++ b/tpm2/templates/templates.go
@@ -1,13 +1,14 @@
+// Package templates provides standard templates for TPM 2.0 primary keys.
 package templates
 
 import (
-	"github.com/google/go-tpm/direct/helpers"
-	"github.com/google/go-tpm/direct/structures/tpm"
-	"github.com/google/go-tpm/direct/structures/tpm2b"
-	"github.com/google/go-tpm/direct/structures/tpma"
-	"github.com/google/go-tpm/direct/structures/tpms"
-	"github.com/google/go-tpm/direct/structures/tpmt"
-	"github.com/google/go-tpm/direct/structures/tpmu"
+	"github.com/google/go-tpm/tpm2/helpers"
+	"github.com/google/go-tpm/tpm2/structures/tpm"
+	"github.com/google/go-tpm/tpm2/structures/tpm2b"
+	"github.com/google/go-tpm/tpm2/structures/tpma"
+	"github.com/google/go-tpm/tpm2/structures/tpms"
+	"github.com/google/go-tpm/tpm2/structures/tpmt"
+	"github.com/google/go-tpm/tpm2/structures/tpmu"
 )
 
 var (
diff --git a/direct/transport/open_other.go b/tpm2/transport/open_other.go
similarity index 94%
rename from direct/transport/open_other.go
rename to tpm2/transport/open_other.go
index 05e3d35..83fb0ee 100644
--- a/direct/transport/open_other.go
+++ b/tpm2/transport/open_other.go
@@ -3,7 +3,7 @@
 package transport
 
 import (
-	legacy "github.com/google/go-tpm/tpm2"
+	legacy "github.com/google/go-tpm/legacy/tpm2"
 )
 
 // Wrap the legacy OpenTPM function so callers don't have to import both the
diff --git a/direct/transport/open_windows.go b/tpm2/transport/open_windows.go
similarity index 94%
rename from direct/transport/open_windows.go
rename to tpm2/transport/open_windows.go
index 19b9a80..001ee8e 100644
--- a/direct/transport/open_windows.go
+++ b/tpm2/transport/open_windows.go
@@ -3,9 +3,7 @@
 package transport
 
 import (
-	"io"
-
-	legacy "github.com/google/go-tpm/tpm2"
+	legacy "github.com/google/go-tpm/legacy/tpm2"
 )
 
 // Wrap the legacy OpenTPM function so callers don't have to import both the
diff --git a/direct/transport/simulator/simulator.go b/tpm2/transport/simulator/simulator.go
similarity index 86%
rename from direct/transport/simulator/simulator.go
rename to tpm2/transport/simulator/simulator.go
index 95762db..6887f66 100644
--- a/direct/transport/simulator/simulator.go
+++ b/tpm2/transport/simulator/simulator.go
@@ -1,11 +1,11 @@
-// package simulator provides access to a local simulator for TPM testing.
+// Package simulator provides access to a local simulator for TPM testing.
 package simulator
 
 import (
 	"io"
 
 	"github.com/google/go-tpm-tools/simulator"
-	"github.com/google/go-tpm/direct/transport"
+	"github.com/google/go-tpm/tpm2/transport"
 	"github.com/google/go-tpm/tpmutil"
 )
 
diff --git a/direct/transport/tpm.go b/tpm2/transport/tpm.go
similarity index 96%
rename from direct/transport/tpm.go
rename to tpm2/transport/tpm.go
index 8ce689e..95a63f4 100644
--- a/direct/transport/tpm.go
+++ b/tpm2/transport/tpm.go
@@ -1,4 +1,4 @@
-// package transport implements types for physically talking to TPMs.
+// Package transport implements types for physically talking to TPMs.
 package transport
 
 import (
@@ -18,7 +18,6 @@ type TPMCloser interface {
 	io.Closer
 }
 
-
 // wrappedRW represents a struct that wraps an io.ReadWriter
 // to a transport.TPM to be compatible with tpmdirect.
 type wrappedRW struct {
@@ -31,7 +30,7 @@ type wrappedRWC struct {
 	transport io.ReadWriteCloser
 }
 
-// wrappedTPM represents a struct that wraps a transport.TPM's underlying 
+// wrappedTPM represents a struct that wraps a transport.TPM's underlying
 // transport to use with legacy code that expects an io.ReadWriter.
 type wrappedTPM struct {
 	response []byte
diff --git a/tpmutil/poll_other.go b/tpmutil/poll_other.go
index 6840f6f..52d9b69 100644
--- a/tpmutil/poll_other.go
+++ b/tpmutil/poll_other.go
@@ -1,4 +1,4 @@
-// +build !linux,!darwin
+//go:build !linux && !darwin
 
 package tpmutil
 
diff --git a/tpmutil/poll_unix.go b/tpmutil/poll_unix.go
index 7fe56fd..89d85d3 100644
--- a/tpmutil/poll_unix.go
+++ b/tpmutil/poll_unix.go
@@ -1,4 +1,4 @@
-// +build linux darwin
+//go:build linux || darwin
 
 package tpmutil
 
diff --git a/tpmutil/run_other.go b/tpmutil/run_other.go
index 53d11b2..2a142d3 100644
--- a/tpmutil/run_other.go
+++ b/tpmutil/run_other.go
@@ -1,4 +1,4 @@
-// +build !windows
+//go:build !windows
 
 // Copyright (c) 2018, Google LLC All rights reserved.
 //


Test patch:
diff --git a/tpm2/credactivation/credential_activation_test.go b/legacy/tpm2/credactivation/credential_activation_test.go
similarity index 98%
rename from tpm2/credactivation/credential_activation_test.go
rename to legacy/tpm2/credactivation/credential_activation_test.go
index 1fd21ae..a27deb4 100644
--- a/tpm2/credactivation/credential_activation_test.go
+++ b/legacy/tpm2/credactivation/credential_activation_test.go
@@ -22,7 +22,7 @@ import (
 	insecureRand "math/rand"
 	"testing"
 
-	"github.com/google/go-tpm/tpm2"
+	"github.com/google/go-tpm/legacy/tpm2"
 )
 
 func mustDecodeBase64(in string, t *testing.T) []byte {
diff --git a/tpm2/structures.go b/legacy/tpm2/structures.go
similarity index 100%
rename from tpm2/structures.go
rename to legacy/tpm2/structures.go
diff --git a/tpm2/test/benchmark_test.go b/legacy/tpm2/test/benchmark_test.go
similarity index 98%
rename from tpm2/test/benchmark_test.go
rename to legacy/tpm2/test/benchmark_test.go
index 0f57b89..ab1ea7d 100644
--- a/tpm2/test/benchmark_test.go
+++ b/legacy/tpm2/test/benchmark_test.go
@@ -18,7 +18,7 @@ import (
 	"crypto/sha256"
 	"testing"
 
-	. "github.com/google/go-tpm/tpm2"
+	. "github.com/google/go-tpm/legacy/tpm2"
 )
 
 func BenchmarkRSA2048Signing(b *testing.B) {
diff --git a/tpm2/test/kdf_test.go b/legacy/tpm2/test/kdf_test.go
similarity index 99%
rename from tpm2/test/kdf_test.go
rename to legacy/tpm2/test/kdf_test.go
index e2cbece..4451ed5 100644
--- a/tpm2/test/kdf_test.go
+++ b/legacy/tpm2/test/kdf_test.go
@@ -18,7 +18,7 @@ import (
 	"bytes"
 	"testing"
 
-	. "github.com/google/go-tpm/tpm2"
+	. "github.com/google/go-tpm/legacy/tpm2"
 )
 
 func TestKDFa(t *testing.T) {
diff --git a/tpm2/test/tpm2_other_test.go b/legacy/tpm2/test/tpm2_other_test.go
similarity index 94%
rename from tpm2/test/tpm2_other_test.go
rename to legacy/tpm2/test/tpm2_other_test.go
index bb4825a..801ea19 100644
--- a/tpm2/test/tpm2_other_test.go
+++ b/legacy/tpm2/test/tpm2_other_test.go
@@ -1,4 +1,4 @@
-// +build !windows
+//go:build !windows
 
 // Copyright (c) 2018, Google LLC All rights reserved.
 //
@@ -21,7 +21,7 @@ import (
 	"io"
 	"testing"
 
-	. "github.com/google/go-tpm/tpm2"
+	. "github.com/google/go-tpm/legacy/tpm2"
 )
 
 var tpmPath = flag.String("tpm-path", "", "Path to TPM character device. Most Linux systems expose it under /dev/tpm0. Empty value (default) will disable all integration tests.")
diff --git a/tpm2/test/tpm2_test.go b/legacy/tpm2/test/tpm2_test.go
similarity index 99%
rename from tpm2/test/tpm2_test.go
rename to legacy/tpm2/test/tpm2_test.go
index d961f11..abbb4b7 100644
--- a/tpm2/test/tpm2_test.go
+++ b/legacy/tpm2/test/tpm2_test.go
@@ -35,7 +35,7 @@ import (
 	"testing"
 
 	"github.com/google/go-tpm-tools/simulator"
-	. "github.com/google/go-tpm/tpm2"
+	. "github.com/google/go-tpm/legacy/tpm2"
 	"github.com/google/go-tpm/tpmutil"
 )
 
diff --git a/tpm2/test/tpm2_windows_test.go b/legacy/tpm2/test/tpm2_windows_test.go
similarity index 96%
rename from tpm2/test/tpm2_windows_test.go
rename to legacy/tpm2/test/tpm2_windows_test.go
index 08e1d17..32d747a 100644
--- a/tpm2/test/tpm2_windows_test.go
+++ b/legacy/tpm2/test/tpm2_windows_test.go
@@ -19,7 +19,7 @@ import (
 	"io"
 	"testing"
 
-	. "github.com/google/go-tpm/tpm2"
+	. "github.com/google/go-tpm/legacy/tpm2"
 )
 
 var runTPMTests = flag.Bool("use-tbs", false, "Run integration tests against Windows TPM Base Services (TBS). Defaults to false.")
diff --git a/tpm/tpm_other_test.go b/tpm/tpm_other_test.go
index bcbf983..3662766 100644
--- a/tpm/tpm_other_test.go
+++ b/tpm/tpm_other_test.go
@@ -1,4 +1,4 @@
-// +build !windows
+//go:build !windows
 
 // Copyright (c) 2014, Google LLC All rights reserved.
 //
diff --git a/direct/tpm2/audit_test.go b/tpm2/commands/audit_test.go
similarity index 89%
rename from direct/tpm2/audit_test.go
rename to tpm2/commands/audit_test.go
index 1035a58..b75ac58 100644
--- a/direct/tpm2/audit_test.go
+++ b/tpm2/commands/audit_test.go
@@ -4,13 +4,13 @@ import (
 	"bytes"
 	"testing"
 
-	"github.com/google/go-tpm/direct/structures/tpm"
-	"github.com/google/go-tpm/direct/structures/tpm2b"
-	"github.com/google/go-tpm/direct/structures/tpma"
-	"github.com/google/go-tpm/direct/structures/tpms"
-	"github.com/google/go-tpm/direct/structures/tpmt"
-	"github.com/google/go-tpm/direct/structures/tpmu"
-	"github.com/google/go-tpm/direct/transport/simulator"
+	"github.com/google/go-tpm/tpm2/structures/tpm"
+	"github.com/google/go-tpm/tpm2/structures/tpm2b"
+	"github.com/google/go-tpm/tpm2/structures/tpma"
+	"github.com/google/go-tpm/tpm2/structures/tpms"
+	"github.com/google/go-tpm/tpm2/structures/tpmt"
+	"github.com/google/go-tpm/tpm2/structures/tpmu"
+	"github.com/google/go-tpm/tpm2/transport/simulator"
 )
 
 func TestAuditSession(t *testing.T) {
diff --git a/direct/tpm2/certify_test.go b/tpm2/commands/certify_test.go
similarity index 91%
rename from direct/tpm2/certify_test.go
rename to tpm2/commands/certify_test.go
index c47c1a4..0dfc208 100644
--- a/direct/tpm2/certify_test.go
+++ b/tpm2/commands/certify_test.go
@@ -8,15 +8,15 @@ import (
 	"testing"
 
 	"github.com/google/go-cmp/cmp"
-	"github.com/google/go-tpm/direct/helpers"
-	"github.com/google/go-tpm/direct/structures/tpm"
-	"github.com/google/go-tpm/direct/structures/tpm2b"
-	"github.com/google/go-tpm/direct/structures/tpma"
-	"github.com/google/go-tpm/direct/structures/tpml"
-	"github.com/google/go-tpm/direct/structures/tpms"
-	"github.com/google/go-tpm/direct/structures/tpmt"
-	"github.com/google/go-tpm/direct/structures/tpmu"
-	"github.com/google/go-tpm/direct/transport/simulator"
+	"github.com/google/go-tpm/tpm2/helpers"
+	"github.com/google/go-tpm/tpm2/structures/tpm"
+	"github.com/google/go-tpm/tpm2/structures/tpm2b"
+	"github.com/google/go-tpm/tpm2/structures/tpma"
+	"github.com/google/go-tpm/tpm2/structures/tpml"
+	"github.com/google/go-tpm/tpm2/structures/tpms"
+	"github.com/google/go-tpm/tpm2/structures/tpmt"
+	"github.com/google/go-tpm/tpm2/structures/tpmu"
+	"github.com/google/go-tpm/tpm2/transport/simulator"
 )
 
 func TestCertify(t *testing.T) {
@@ -150,7 +150,7 @@ func TestCertify(t *testing.T) {
 	pub := rspSigner.OutPublic.PublicArea
 	rsaPub, err := helpers.RSAPub(pub.Parameters.RSADetail, pub.Unique.RSA)
 	if err != nil {
-		t.Fatalf("Failed to retrive Public Key: %v", err)
+		t.Fatalf("Failed to retrieve Public Key: %v", err)
 	}
 
 	if err := rsa.VerifyPKCS1v15(rsaPub, crypto.SHA256, attestHash[:], rspCert.Signature.Signature.RSASSA.Sig.Buffer); err != nil {
@@ -268,7 +268,7 @@ func TestCreateAndCertifyCreation(t *testing.T) {
 	pub := rspCP.OutPublic.PublicArea
 	rsaPub, err := helpers.RSAPub(pub.Parameters.RSADetail, pub.Unique.RSA)
 	if err != nil {
-		t.Fatalf("Failed to retrive Public Key: %v", err)
+		t.Fatalf("Failed to retrieve Public Key: %v", err)
 	}
 
 	if err := rsa.VerifyPKCS1v15(rsaPub, crypto.SHA256, attestHash[:], rspCC.Signature.Signature.RSASSA.Sig.Buffer); err != nil {
diff --git a/direct/tpm2/combined_context_test.go b/tpm2/commands/combined_context_test.go
similarity index 83%
rename from direct/tpm2/combined_context_test.go
rename to tpm2/commands/combined_context_test.go
index 89db30c..ad408c2 100644
--- a/direct/tpm2/combined_context_test.go
+++ b/tpm2/commands/combined_context_test.go
@@ -4,15 +4,15 @@ import (
 	"testing"
 
 	"github.com/google/go-cmp/cmp"
-	"github.com/google/go-tpm/direct/structures/tpm"
-	"github.com/google/go-tpm/direct/structures/tpm2b"
-	"github.com/google/go-tpm/direct/structures/tpma"
-	"github.com/google/go-tpm/direct/structures/tpml"
-	"github.com/google/go-tpm/direct/structures/tpms"
-	"github.com/google/go-tpm/direct/structures/tpmt"
-	"github.com/google/go-tpm/direct/structures/tpmu"
-	"github.com/google/go-tpm/direct/transport"
-	"github.com/google/go-tpm/direct/transport/simulator"
+	"github.com/google/go-tpm/tpm2/structures/tpm"
+	"github.com/google/go-tpm/tpm2/structures/tpm2b"
+	"github.com/google/go-tpm/tpm2/structures/tpma"
+	"github.com/google/go-tpm/tpm2/structures/tpml"
+	"github.com/google/go-tpm/tpm2/structures/tpms"
+	"github.com/google/go-tpm/tpm2/structures/tpmt"
+	"github.com/google/go-tpm/tpm2/structures/tpmu"
+	"github.com/google/go-tpm/tpm2/transport"
+	"github.com/google/go-tpm/tpm2/transport/simulator"
 )
 
 func ReadPublicName(t *testing.T, handle tpm.Handle, thetpm transport.TPM) tpm2b.Name {
diff --git a/direct/tpm2/commit_test.go b/tpm2/commands/commit_test.go
similarity index 85%
rename from direct/tpm2/commit_test.go
rename to tpm2/commands/commit_test.go
index 5f325a1..a505637 100644
--- a/direct/tpm2/commit_test.go
+++ b/tpm2/commands/commit_test.go
@@ -3,13 +3,13 @@ package tpm2
 import (
 	"testing"
 
-	"github.com/google/go-tpm/direct/structures/tpm"
-	"github.com/google/go-tpm/direct/structures/tpm2b"
-	"github.com/google/go-tpm/direct/structures/tpma"
-	"github.com/google/go-tpm/direct/structures/tpms"
-	"github.com/google/go-tpm/direct/structures/tpmt"
-	"github.com/google/go-tpm/direct/structures/tpmu"
-	"github.com/google/go-tpm/direct/transport/simulator"
+	"github.com/google/go-tpm/tpm2/structures/tpm"
+	"github.com/google/go-tpm/tpm2/structures/tpm2b"
+	"github.com/google/go-tpm/tpm2/structures/tpma"
+	"github.com/google/go-tpm/tpm2/structures/tpms"
+	"github.com/google/go-tpm/tpm2/structures/tpmt"
+	"github.com/google/go-tpm/tpm2/structures/tpmu"
+	"github.com/google/go-tpm/tpm2/transport/simulator"
 )
 
 func TestCommit(t *testing.T) {
diff --git a/direct/tpm2/create_loaded_test.go b/tpm2/commands/create_loaded_test.go
similarity index 88%
rename from direct/tpm2/create_loaded_test.go
rename to tpm2/commands/create_loaded_test.go
index 932e3b2..2862b56 100644
--- a/direct/tpm2/create_loaded_test.go
+++ b/tpm2/commands/create_loaded_test.go
@@ -3,15 +3,15 @@ package tpm2
 import (
 	"testing"
 
-	"github.com/google/go-tpm/direct/structures/tpm"
-	"github.com/google/go-tpm/direct/structures/tpm2b"
-	"github.com/google/go-tpm/direct/structures/tpma"
-	"github.com/google/go-tpm/direct/structures/tpms"
-	"github.com/google/go-tpm/direct/structures/tpmt"
-	"github.com/google/go-tpm/direct/structures/tpmu"
-	"github.com/google/go-tpm/direct/templates"
-	"github.com/google/go-tpm/direct/transport"
-	"github.com/google/go-tpm/direct/transport/simulator"
+	"github.com/google/go-tpm/tpm2/structures/tpm"
+	"github.com/google/go-tpm/tpm2/structures/tpm2b"
+	"github.com/google/go-tpm/tpm2/structures/tpma"
+	"github.com/google/go-tpm/tpm2/structures/tpms"
+	"github.com/google/go-tpm/tpm2/structures/tpmt"
+	"github.com/google/go-tpm/tpm2/structures/tpmu"
+	"github.com/google/go-tpm/tpm2/templates"
+	"github.com/google/go-tpm/tpm2/transport"
+	"github.com/google/go-tpm/tpm2/transport/simulator"
 )
 
 func getDeriver(t *testing.T, thetpm transport.TPM) NamedHandle {
diff --git a/direct/tpm2/ek_test.go b/tpm2/commands/ek_test.go
similarity index 93%
rename from direct/tpm2/ek_test.go
rename to tpm2/commands/ek_test.go
index d801984..3eb93ec 100644
--- a/direct/tpm2/ek_test.go
+++ b/tpm2/commands/ek_test.go
@@ -4,15 +4,15 @@ import (
 	"errors"
 	"testing"
 
-	"github.com/google/go-tpm/direct/structures/tpm"
-	"github.com/google/go-tpm/direct/structures/tpm2b"
-	"github.com/google/go-tpm/direct/structures/tpma"
-	"github.com/google/go-tpm/direct/structures/tpmi"
-	"github.com/google/go-tpm/direct/structures/tpms"
-	"github.com/google/go-tpm/direct/structures/tpmt"
-	"github.com/google/go-tpm/direct/templates"
-	"github.com/google/go-tpm/direct/transport"
-	"github.com/google/go-tpm/direct/transport/simulator"
+	"github.com/google/go-tpm/tpm2/structures/tpm"
+	"github.com/google/go-tpm/tpm2/structures/tpm2b"
+	"github.com/google/go-tpm/tpm2/structures/tpma"
+	"github.com/google/go-tpm/tpm2/structures/tpmi"
+	"github.com/google/go-tpm/tpm2/structures/tpms"
+	"github.com/google/go-tpm/tpm2/structures/tpmt"
+	"github.com/google/go-tpm/tpm2/templates"
+	"github.com/google/go-tpm/tpm2/transport"
+	"github.com/google/go-tpm/tpm2/transport/simulator"
 )
 
 // Test creating a sealed data blob on the standard-template EK using its policy.
diff --git a/direct/tpm2/get_random_test.go b/tpm2/commands/get_random_test.go
similarity index 86%
rename from direct/tpm2/get_random_test.go
rename to tpm2/commands/get_random_test.go
index 8951c34..8e8bb68 100644
--- a/direct/tpm2/get_random_test.go
+++ b/tpm2/commands/get_random_test.go
@@ -3,7 +3,7 @@ package tpm2
 import (
 	"testing"
 
-	"github.com/google/go-tpm/direct/transport/simulator"
+	"github.com/google/go-tpm/tpm2/transport/simulator"
 )
 
 func TestGetRandom(t *testing.T) {
diff --git a/direct/tpm2/hash_sequence_hash_test.go b/tpm2/commands/hash_sequence_hash_test.go
similarity index 96%
rename from direct/tpm2/hash_sequence_hash_test.go
rename to tpm2/commands/hash_sequence_hash_test.go
index 5cfce51..4519d66 100644
--- a/direct/tpm2/hash_sequence_hash_test.go
+++ b/tpm2/commands/hash_sequence_hash_test.go
@@ -7,10 +7,10 @@ import (
 	"math/rand"
 	"testing"
 
-	"github.com/google/go-tpm/direct/structures/tpm"
-	"github.com/google/go-tpm/direct/structures/tpm2b"
-	"github.com/google/go-tpm/direct/transport"
-	"github.com/google/go-tpm/direct/transport/simulator"
+	"github.com/google/go-tpm/tpm2/structures/tpm"
+	"github.com/google/go-tpm/tpm2/structures/tpm2b"
+	"github.com/google/go-tpm/tpm2/transport"
+	"github.com/google/go-tpm/tpm2/transport/simulator"
 )
 
 func TestHash(t *testing.T) {
diff --git a/direct/tpm2/load_external_test.go b/tpm2/commands/load_external_test.go
similarity index 86%
rename from direct/tpm2/load_external_test.go
rename to tpm2/commands/load_external_test.go
index ffff77a..84f8a29 100644
--- a/direct/tpm2/load_external_test.go
+++ b/tpm2/commands/load_external_test.go
@@ -4,13 +4,13 @@ import (
 	"encoding/hex"
 	"testing"
 
-	"github.com/google/go-tpm/direct/structures/tpm"
-	"github.com/google/go-tpm/direct/structures/tpm2b"
-	"github.com/google/go-tpm/direct/structures/tpma"
-	"github.com/google/go-tpm/direct/structures/tpms"
-	"github.com/google/go-tpm/direct/structures/tpmt"
-	"github.com/google/go-tpm/direct/structures/tpmu"
-	"github.com/google/go-tpm/direct/transport/simulator"
+	"github.com/google/go-tpm/tpm2/structures/tpm"
+	"github.com/google/go-tpm/tpm2/structures/tpm2b"
+	"github.com/google/go-tpm/tpm2/structures/tpma"
+	"github.com/google/go-tpm/tpm2/structures/tpms"
+	"github.com/google/go-tpm/tpm2/structures/tpmt"
+	"github.com/google/go-tpm/tpm2/structures/tpmu"
+	"github.com/google/go-tpm/tpm2/transport/simulator"
 )
 
 func decodeHex(t *testing.T, h string) []byte {
diff --git a/direct/tpm2/names_test.go b/tpm2/commands/names_test.go
similarity index 87%
rename from direct/tpm2/names_test.go
rename to tpm2/commands/names_test.go
index a31435d..a447f05 100644
--- a/direct/tpm2/names_test.go
+++ b/tpm2/commands/names_test.go
@@ -4,12 +4,12 @@ import (
 	"bytes"
 	"testing"
 
-	"github.com/google/go-tpm/direct/structures/tpm"
-	"github.com/google/go-tpm/direct/structures/tpm2b"
-	"github.com/google/go-tpm/direct/structures/tpma"
-	"github.com/google/go-tpm/direct/structures/tpms"
-	"github.com/google/go-tpm/direct/templates"
-	"github.com/google/go-tpm/direct/transport/simulator"
+	"github.com/google/go-tpm/tpm2/structures/tpm"
+	"github.com/google/go-tpm/tpm2/structures/tpm2b"
+	"github.com/google/go-tpm/tpm2/structures/tpma"
+	"github.com/google/go-tpm/tpm2/structures/tpms"
+	"github.com/google/go-tpm/tpm2/templates"
+	"github.com/google/go-tpm/tpm2/transport/simulator"
 )
 
 func TestHandleName(t *testing.T) {
diff --git a/direct/tpm2/nv_test.go b/tpm2/commands/nv_test.go
similarity index 88%
rename from direct/tpm2/nv_test.go
rename to tpm2/commands/nv_test.go
index 4f64fae..2ec54df 100644
--- a/direct/tpm2/nv_test.go
+++ b/tpm2/commands/nv_test.go
@@ -3,11 +3,11 @@ package tpm2
 import (
 	"testing"
 
-	"github.com/google/go-tpm/direct/structures/tpm"
-	"github.com/google/go-tpm/direct/structures/tpm2b"
-	"github.com/google/go-tpm/direct/structures/tpma"
-	"github.com/google/go-tpm/direct/structures/tpms"
-	"github.com/google/go-tpm/direct/transport/simulator"
+	"github.com/google/go-tpm/tpm2/structures/tpm"
+	"github.com/google/go-tpm/tpm2/structures/tpm2b"
+	"github.com/google/go-tpm/tpm2/structures/tpma"
+	"github.com/google/go-tpm/tpm2/structures/tpms"
+	"github.com/google/go-tpm/tpm2/transport/simulator"
 )
 
 func TestNVAuthWrite(t *testing.T) {
diff --git a/direct/tpm2/pcr_test.go b/tpm2/commands/pcr_test.go
similarity index 84%
rename from direct/tpm2/pcr_test.go
rename to tpm2/commands/pcr_test.go
index 4329a01..6053264 100644
--- a/direct/tpm2/pcr_test.go
+++ b/tpm2/commands/pcr_test.go
@@ -7,14 +7,14 @@ import (
 	"crypto/sha512"
 	"testing"
 
-	"github.com/google/go-tpm/direct/structures/tpm"
-	"github.com/google/go-tpm/direct/structures/tpml"
-	"github.com/google/go-tpm/direct/structures/tpms"
-	"github.com/google/go-tpm/direct/structures/tpmt"
-	"github.com/google/go-tpm/direct/transport/simulator"
+	"github.com/google/go-tpm/tpm2/structures/tpm"
+	"github.com/google/go-tpm/tpm2/structures/tpml"
+	"github.com/google/go-tpm/tpm2/structures/tpms"
+	"github.com/google/go-tpm/tpm2/structures/tpmt"
+	"github.com/google/go-tpm/tpm2/transport/simulator"
 )
 
-var extendsDirect = map[tpm.AlgID][]struct {
+var extendstpm2 = map[tpm.AlgID][]struct {
 	digest []byte
 }{
 	tpm.AlgSHA1: {
@@ -32,12 +32,12 @@ var extendsDirect = map[tpm.AlgID][]struct {
 }
 
 func allZero(s []byte) bool {
-    for _, v := range s {
-        if v != 0 {
-            return false
-        }
-    }
-    return true
+	for _, v := range s {
+		if v != 0 {
+			return false
+		}
+	}
+	return true
 }
 
 func TestPCRReset(t *testing.T) {
@@ -82,7 +82,7 @@ func TestPCRReset(t *testing.T) {
 			}
 
 			// Extending PCR 16
-			for _, d := range extendsDirect[c.hashalg] {
+			for _, d := range extendstpm2[c.hashalg] {
 				pcrExtend := PCRExtend{
 					PCRHandle: authHandle,
 					Digests: tpml.DigestValues{
diff --git a/direct/tpm2/policy_test.go b/tpm2/commands/policy_test.go
similarity index 97%
rename from direct/tpm2/policy_test.go
rename to tpm2/commands/policy_test.go
index e6eb2ac..e8457c9 100644
--- a/direct/tpm2/policy_test.go
+++ b/tpm2/commands/policy_test.go
@@ -5,15 +5,15 @@ import (
 	"crypto/sha1"
 	"testing"
 
-	"github.com/google/go-tpm/direct/structures/tpm"
-	"github.com/google/go-tpm/direct/structures/tpm2b"
-	"github.com/google/go-tpm/direct/structures/tpma"
-	"github.com/google/go-tpm/direct/structures/tpml"
-	"github.com/google/go-tpm/direct/structures/tpms"
-	"github.com/google/go-tpm/direct/structures/tpmt"
-	"github.com/google/go-tpm/direct/structures/tpmu"
-	"github.com/google/go-tpm/direct/transport"
-	"github.com/google/go-tpm/direct/transport/simulator"
+	"github.com/google/go-tpm/tpm2/structures/tpm"
+	"github.com/google/go-tpm/tpm2/structures/tpm2b"
+	"github.com/google/go-tpm/tpm2/structures/tpma"
+	"github.com/google/go-tpm/tpm2/structures/tpml"
+	"github.com/google/go-tpm/tpm2/structures/tpms"
+	"github.com/google/go-tpm/tpm2/structures/tpmt"
+	"github.com/google/go-tpm/tpm2/structures/tpmu"
+	"github.com/google/go-tpm/tpm2/transport"
+	"github.com/google/go-tpm/tpm2/transport/simulator"
 )
 
 func signingKey(t *testing.T, thetpm transport.TPM) (NamedHandle, func()) {
diff --git a/direct/tpm2/read_public_test.go b/tpm2/commands/read_public_test.go
similarity index 84%
rename from direct/tpm2/read_public_test.go
rename to tpm2/commands/read_public_test.go
index c42c241..03529d9 100644
--- a/direct/tpm2/read_public_test.go
+++ b/tpm2/commands/read_public_test.go
@@ -4,16 +4,16 @@ import (
 	"testing"
 
 	"github.com/google/go-cmp/cmp"
-	"github.com/google/go-tpm/direct/structures/tpm"
-	"github.com/google/go-tpm/direct/structures/tpm2b"
-	"github.com/google/go-tpm/direct/structures/tpma"
-	"github.com/google/go-tpm/direct/structures/tpms"
-	"github.com/google/go-tpm/direct/structures/tpmt"
-	"github.com/google/go-tpm/direct/structures/tpmu"
-	"github.com/google/go-tpm/direct/transport/simulator"
+	"github.com/google/go-tpm/tpm2/structures/tpm"
+	"github.com/google/go-tpm/tpm2/structures/tpm2b"
+	"github.com/google/go-tpm/tpm2/structures/tpma"
+	"github.com/google/go-tpm/tpm2/structures/tpms"
+	"github.com/google/go-tpm/tpm2/structures/tpmt"
+	"github.com/google/go-tpm/tpm2/structures/tpmu"
+	"github.com/google/go-tpm/tpm2/transport/simulator"
 )
 
-// TestReadPublicKey compares the CreatePrimary reponse parameter outPublic with the output of ReadPublic outPublic.
+// TestReadPublicKey compares the CreatePrimary response parameter outPublic with the output of ReadPublic outPublic.
 func TestReadPublicKey(t *testing.T) {
 	// Open simulated TPM for testing.
 	thetpm, err := simulator.OpenSimulator()
@@ -27,7 +27,7 @@ func TestReadPublicKey(t *testing.T) {
 
 	// Fill in the CreatePrimary struct.
 	// See definition in Part 3, Commands, section 24.1.
-	// See direct/templates/templates.go for more tpmt.Public examples.
+	// See tpm2/templates/templates.go for more tpmt.Public examples.
 	createPrimary := CreatePrimary{
 		PrimaryHandle: tpm.RHOwner,
 		InPublic: tpm2b.Public{
diff --git a/direct/tpm2/reflect_test.go b/tpm2/commands/reflect_test.go
similarity index 99%
rename from direct/tpm2/reflect_test.go
rename to tpm2/commands/reflect_test.go
index bf9a49b..314ea85 100644
--- a/direct/tpm2/reflect_test.go
+++ b/tpm2/commands/reflect_test.go
@@ -9,7 +9,7 @@ import (
 	"github.com/google/go-cmp/cmp"
 	"github.com/google/go-cmp/cmp/cmpopts"
 
-	"github.com/google/go-tpm/direct/structures/tpma"
+	"github.com/google/go-tpm/tpm2/structures/tpma"
 )
 
 func marshalUnmarshal(t *testing.T, v interface{}, want []byte) {
diff --git a/direct/tpm2/sealing_test.go b/tpm2/commands/sealing_test.go
similarity index 97%
rename from direct/tpm2/sealing_test.go
rename to tpm2/commands/sealing_test.go
index e6fe73d..10b0446 100644
--- a/direct/tpm2/sealing_test.go
+++ b/tpm2/commands/sealing_test.go
@@ -5,13 +5,13 @@ import (
 	"errors"
 	"testing"
 
-	"github.com/google/go-tpm/direct/structures/tpm"
-	"github.com/google/go-tpm/direct/structures/tpm2b"
-	"github.com/google/go-tpm/direct/structures/tpma"
-	"github.com/google/go-tpm/direct/structures/tpms"
-	"github.com/google/go-tpm/direct/structures/tpmt"
-	"github.com/google/go-tpm/direct/templates"
-	"github.com/google/go-tpm/direct/transport/simulator"
+	"github.com/google/go-tpm/tpm2/structures/tpm"
+	"github.com/google/go-tpm/tpm2/structures/tpm2b"
+	"github.com/google/go-tpm/tpm2/structures/tpma"
+	"github.com/google/go-tpm/tpm2/structures/tpms"
+	"github.com/google/go-tpm/tpm2/structures/tpmt"
+	"github.com/google/go-tpm/tpm2/templates"
+	"github.com/google/go-tpm/tpm2/transport/simulator"
 )
 
 // Test creating and unsealing a sealed data blob with a password and HMAC.
diff --git a/direct/tpm2/sign_test.go b/tpm2/commands/sign_test.go
similarity index 86%
rename from direct/tpm2/sign_test.go
rename to tpm2/commands/sign_test.go
index b93487a..54a2540 100644
--- a/direct/tpm2/sign_test.go
+++ b/tpm2/commands/sign_test.go
@@ -9,15 +9,15 @@ import (
 
 	"github.com/google/go-cmp/cmp"
 
-	"github.com/google/go-tpm/direct/helpers"
-	"github.com/google/go-tpm/direct/structures/tpm"
-	"github.com/google/go-tpm/direct/structures/tpm2b"
-	"github.com/google/go-tpm/direct/structures/tpma"
-	"github.com/google/go-tpm/direct/structures/tpml"
-	"github.com/google/go-tpm/direct/structures/tpms"
-	"github.com/google/go-tpm/direct/structures/tpmt"
-	"github.com/google/go-tpm/direct/structures/tpmu"
-	"github.com/google/go-tpm/direct/transport/simulator"
+	"github.com/google/go-tpm/tpm2/helpers"
+	"github.com/google/go-tpm/tpm2/structures/tpm"
+	"github.com/google/go-tpm/tpm2/structures/tpm2b"
+	"github.com/google/go-tpm/tpm2/structures/tpma"
+	"github.com/google/go-tpm/tpm2/structures/tpml"
+	"github.com/google/go-tpm/tpm2/structures/tpms"
+	"github.com/google/go-tpm/tpm2/structures/tpmt"
+	"github.com/google/go-tpm/tpm2/structures/tpmu"
+	"github.com/google/go-tpm/tpm2/transport/simulator"
 	"github.com/google/go-tpm/tpmutil"
 )
 
@@ -151,7 +151,7 @@ func TestSign(t *testing.T) {
 	pub := rspCP.OutPublic.PublicArea
 	rsaPub, err := helpers.RSAPub(pub.Parameters.RSADetail, pub.Unique.RSA)
 	if err != nil {
-		t.Fatalf("Failed to retrive Public Key: %v", err)
+		t.Fatalf("Failed to retrieve Public Key: %v", err)
 	}
 
 	if err := rsa.VerifyPKCS1v15(rsaPub, crypto.SHA256, digest[:], rspSign.Signature.Signature.RSASSA.Sig.Buffer); err != nil {
diff --git a/tpmutil/emulator_read_write_closer_test.go b/tpmutil/emulator_read_write_closer_test.go
index 542e0c5..0a1885c 100644
--- a/tpmutil/emulator_read_write_closer_test.go
+++ b/tpmutil/emulator_read_write_closer_test.go
@@ -1,4 +1,4 @@
-// +build !windows
+//go:build !windows
 
 // Copyright (c) 2019, Google LLC All rights reserved.
 //
diff --git a/tpmutil/poll_unix_test.go b/tpmutil/poll_unix_test.go
index 884f3af..4bef3a0 100644
--- a/tpmutil/poll_unix_test.go
+++ b/tpmutil/poll_unix_test.go
@@ -1,4 +1,4 @@
-// +build linux darwin
+//go:build linux || darwin
 
 package tpmutil