[tpm2] Re: Re-provision TPM

Anthony Arrascue <AArrascue at neuroloop.de>
Newsgroups dev.linux.lists.tpm2
Message-ID <[email protected]> 
A way of re-provisioning (on a different OS image) that worked for me is the following:

tpm2_startup
#This clears the persistent storage
tpm2_clear
#To change profile from ECC to RSA
sed -i 's/"profile_name": "P_ECCP256SHA256"/"profile_name": "P_RSA2048SHA256"/g' /usr/local/etc/tpm2-tss/fapi-config.json
#Delete existing keystores
rm -rf ~/.local/share/tpm2-tss/user/keystore
rm -rf /usr/local/var/lib/tpm2-tss/system/keystore
#Before we provision we need to generate an EK
tpm2_createprimary -C e -g sha256 -G rsa -c endorsementprimary.ctx
tpm2_create -C endorsementprimary.ctx -g sha256 -G rsa -u rsak.pub -r rsak.priv
tpm2_load -C endorsementprimary.ctx -u rsak.pub -r rsak.priv -n rsak.name -c rsak.ctx
tpm2_evictcontrol -c rsak.ctx 0x81010001
tss2_provision

Without the tpm2_createprimary I would get an error when I use tss2_provision (something like “key cannot be signed”. I cannot remember the error message, but it contained the word EK).

Some questions that came to my mind:

  1.  Can all of this be done using only Fapi (no tpm2 commands)
  2.  Why is generating an EK required for provisioning? (which documentation describes this step)
  3.  Previous versions of the tpm2-tools had also a tpm2_takeownership. What happened with it and how to provision with owner’s authorization?

Thank you very much for your comments.
Best,
Anthony





From: Anthony Arrascue
Sent: Tuesday, 1 June 2021 19:18
To: 'tpm2(a)lists.01.org' <tpm2(a)lists.01.org>
Subject: Re-provision TPM

Hello,

I am learning about the TSS and TPM techonologies.
I have provisioned the TPM with the default settings, which means I am now using the ECC profile (P_ECCP256SHA256).
However, encryption was a requirement I needed to fulfill. I just didn't know that ECC encryption is currently not supported and now I realize RSA would be a better fit for me.
So here is my question:

  *   I see there is another profile in /usr/local/etc/tpm2-tss/fapi-profiles, namely P_RSA2048SHA256.json. Is there a way I can encrypt using the RSA profile instead of the ECC one? I tried to re-run tss2_provision, after setting it in fapi-config.json, but it seems this is not the way to proceed. I get the message that the TPM has been already provisioned. What is the correct way of "changing" profile? Is it even possible or do I need to reset the TPM?
Thank you for your help.
Anthony Arrascue
attachment.htm (text/html, 13.7 KB) 
<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
	{font-family:Wingdings;
	panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
	{font-family:"Cambria Math";
	panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
	{font-family:Calibri;
	panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
	{font-family:"Segoe UI";
	panose-1:2 11 5 2 4 2 4 2 2 3;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
	{margin:0cm;
	font-size:11.0pt;
	font-family:"Calibri",sans-serif;
	mso-fareast-language:EN-US;}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
	{mso-style-priority:34;
	margin-top:0cm;
	margin-right:0cm;
	margin-bottom:0cm;
	margin-left:36.0pt;
	font-size:11.0pt;
	font-family:"Calibri",sans-serif;
	mso-fareast-language:EN-US;}
span.EmailStyle19
	{mso-style-type:personal-reply;
	font-family:"Calibri",sans-serif;
	color:windowtext;}
.MsoChpDefault
	{mso-style-type:export-only;
	font-size:10.0pt;}
@page WordSection1
	{size:612.0pt 792.0pt;
	margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
	{page:WordSection1;}
/* List Definitions */
@list l0
	{mso-list-id:218826893;
	mso-list-template-ids:1372121884;}
@list l0:level1
	{mso-level-number-format:bullet;
	mso-level-text:;
	mso-level-tab-stop:36.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l0:level2
	{mso-level-number-format:bullet;
	mso-level-text:;
	mso-level-tab-stop:72.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l0:level3
	{mso-level-number-format:bullet;
	mso-level-text:;
	mso-level-tab-stop:108.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l0:level4
	{mso-level-number-format:bullet;
	mso-level-text:;
	mso-level-tab-stop:144.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l0:level5
	{mso-level-number-format:bullet;
	mso-level-text:;
	mso-level-tab-stop:180.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l0:level6
	{mso-level-number-format:bullet;
	mso-level-text:;
	mso-level-tab-stop:216.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l0:level7
	{mso-level-number-format:bullet;
	mso-level-text:;
	mso-level-tab-stop:252.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l0:level8
	{mso-level-number-format:bullet;
	mso-level-text:;
	mso-level-tab-stop:288.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l0:level9
	{mso-level-number-format:bullet;
	mso-level-text:;
	mso-level-tab-stop:324.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l1
	{mso-list-id:855466907;
	mso-list-template-ids:201384234;}
@list l1:level1
	{mso-level-number-format:bullet;
	mso-level-text:;
	mso-level-tab-stop:36.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l1:level2
	{mso-level-number-format:bullet;
	mso-level-text:o;
	mso-level-tab-stop:72.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:"Courier New";
	mso-bidi-font-family:"Times New Roman";}
@list l1:level3
	{mso-level-number-format:bullet;
	mso-level-text:;
	mso-level-tab-stop:108.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l1:level4
	{mso-level-number-format:bullet;
	mso-level-text:;
	mso-level-tab-stop:144.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l1:level5
	{mso-level-number-format:bullet;
	mso-level-text:;
	mso-level-tab-stop:180.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l1:level6
	{mso-level-number-format:bullet;
	mso-level-text:;
	mso-level-tab-stop:216.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l1:level7
	{mso-level-number-format:bullet;
	mso-level-text:;
	mso-level-tab-stop:252.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l1:level8
	{mso-level-number-format:bullet;
	mso-level-text:;
	mso-level-tab-stop:288.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l1:level9
	{mso-level-number-format:bullet;
	mso-level-text:;
	mso-level-tab-stop:324.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l2
	{mso-list-id:1464424616;
	mso-list-type:hybrid;
	mso-list-template-ids:969413492 536870929 536870937 536870939 536870927 536870937 536870939 536870927 536870937 536870939;}
@list l2:level1
	{mso-level-text:"%1\)";
	mso-level-tab-stop:none;
	mso-level-number-position:left;
	text-indent:-18.0pt;}
@list l2:level2
	{mso-level-number-format:alpha-lower;
	mso-level-tab-stop:none;
	mso-level-number-position:left;
	text-indent:-18.0pt;}
@list l2:level3
	{mso-level-number-format:roman-lower;
	mso-level-tab-stop:none;
	mso-level-number-position:right;
	text-indent:-9.0pt;}
@list l2:level4
	{mso-level-tab-stop:none;
	mso-level-number-position:left;
	text-indent:-18.0pt;}
@list l2:level5
	{mso-level-number-format:alpha-lower;
	mso-level-tab-stop:none;
	mso-level-number-position:left;
	text-indent:-18.0pt;}
@list l2:level6
	{mso-level-number-format:roman-lower;
	mso-level-tab-stop:none;
	mso-level-number-position:right;
	text-indent:-9.0pt;}
@list l2:level7
	{mso-level-tab-stop:none;
	mso-level-number-position:left;
	text-indent:-18.0pt;}
@list l2:level8
	{mso-level-number-format:alpha-lower;
	mso-level-tab-stop:none;
	mso-level-number-position:left;
	text-indent:-18.0pt;}
@list l2:level9
	{mso-level-number-format:roman-lower;
	mso-level-tab-stop:none;
	mso-level-number-position:right;
	text-indent:-9.0pt;}
ol
	{margin-bottom:0cm;}
ul
	{margin-bottom:0cm;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="en-DE" link="#0563C1" vlink="#954F72" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><span lang="EN-US">A way of re-provisioning (on a different OS image) that worked for me is the following:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p>&nbsp;</o:p></span></p>
<p class="MsoNormal"><b><span lang="EN-US">tpm2_startup<o:p></o:p></span></b></p>
<p class="MsoNormal"><span lang="EN-US">#This clears the persistent storage<o:p></o:p></span></p>
<p class="MsoNormal"><b><span lang="EN-US">tpm2_clear<o:p></o:p></span></b></p>
<p class="MsoNormal"><span lang="EN-US">#To change profile from ECC to RSA<o:p></o:p></span></p>
<p class="MsoNormal"><b><span lang="EN-US">sed -i 's/&quot;profile_name&quot;: &quot;P_ECCP256SHA256&quot;/&quot;profile_name&quot;: &quot;P_RSA2048SHA256&quot;/g' /usr/local/etc/tpm2-tss/fapi-config.json<o:p></o:p></span></b></p>
<p class="MsoNormal"><span lang="EN-US">#Delete existing keystores<o:p></o:p></span></p>
<p class="MsoNormal"><b><span lang="EN-US">rm -rf ~/.local/share/tpm2-tss/user/keystore<o:p></o:p></span></b></p>
<p class="MsoNormal"><b><span lang="EN-US">rm -rf /usr/local/var/lib/tpm2-tss/system/keystore<o:p></o:p></span></b></p>
<p class="MsoNormal"><span lang="EN-US">#Before we provision we need to generate an EK<o:p></o:p></span></p>
<p class="MsoNormal"><b><span lang="EN-US">tpm2_createprimary -C e -g sha256 -G rsa -c endorsementprimary.ctx
<o:p></o:p></span></b></p>
<p class="MsoNormal"><b><span lang="EN-US">tpm2_create -C endorsementprimary.ctx -g sha256 -G rsa -u rsak.pub -r rsak.priv<o:p></o:p></span></b></p>
<p class="MsoNormal"><b><span lang="EN-US">tpm2_load -C endorsementprimary.ctx -u rsak.pub -r rsak.priv -n rsak.name -c rsak.ctx<o:p></o:p></span></b></p>
<p class="MsoNormal"><b><span lang="EN-US">tpm2_evictcontrol -c rsak.ctx 0x81010001<o:p></o:p></span></b></p>
<p class="MsoNormal"><b><span lang="EN-US">tss2_provision<o:p></o:p></span></b></p>
<p class="MsoNormal"><span lang="EN-US"><o:p>&nbsp;</o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Without the tpm2_createprimary I would get an error when I use tss2_provision (something like “key cannot be signed”. I cannot remember the error message, but it contained the word EK).<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p>&nbsp;</o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Some questions that came to my mind: <o:p>
</o:p></span></p>
<ol style="margin-top:0cm" start="1" type="1">
<li class="MsoListParagraph" style="margin-left:0cm;mso-list:l2 level1 lfo4"><span lang="EN-US">Can all of this be done using only Fapi (no tpm2 commands)<o:p></o:p></span></li><li class="MsoListParagraph" style="margin-left:0cm;mso-list:l2 level1 lfo4"><span lang="EN-US">Why is generating an EK required for provisioning? (which documentation describes this step)<o:p></o:p></span></li><li class="MsoListParagraph" style="margin-left:0cm;mso-list:l2 level1 lfo4"><span lang="EN-US">Previous versions of the tpm2-tools had also a
<b>tpm2_takeownership</b>. What happened with it and how to provision with owner’s authorization?<o:p></o:p></span></li></ol>
<p class="MsoNormal"><span lang="EN-US"><o:p>&nbsp;</o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Thank you very much for your comments.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Best,<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Anthony<o:p></o:p></span></p>
<p class="MsoNormal"><b><span lang="EN-US"><o:p>&nbsp;</o:p></span></b></p>
<p class="MsoNormal"><span lang="EN-US"><o:p>&nbsp;</o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p>&nbsp;</o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p>&nbsp;</o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p>&nbsp;</o:p></span></p>
<div style="border:none;border-left:solid blue 1.5pt;padding:0cm 0cm 0cm 4.0pt">
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span lang="EN-US" style="mso-fareast-language:#2000">From:</span></b><span lang="EN-US" style="mso-fareast-language:#2000"> Anthony Arrascue
<br>
<b>Sent:</b> Tuesday, 1 June 2021 19:18<br>
<b>To:</b> '[email protected]' &lt;[email protected]&gt;<br>
<b>Subject:</b> Re-provision TPM<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p>&nbsp;</o:p></p>
<p class="MsoNormal"><span lang="DE">Hello,<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="DE"><o:p>&nbsp;</o:p></span></p>
<p class="MsoNormal" style="margin-bottom:12.0pt;background:white"><span lang="en-DE" style="font-size:10.5pt;font-family:&quot;Segoe UI&quot;,sans-serif;color:#24292E;mso-fareast-language:#2000">I am learning about the TSS and TPM techonologies.<br>
I have provisioned the TPM with the default settings, which means I am now using the ECC profile (P_ECCP256SHA256).<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:12.0pt;background:white"><span lang="en-DE" style="font-size:10.5pt;font-family:&quot;Segoe UI&quot;,sans-serif;color:#24292E;mso-fareast-language:#2000">However, encryption was a requirement I needed to fulfill. I just didn't
 know that ECC encryption is currently not supported and now I realize RSA would be a better fit for me.<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:12.0pt;background:white"><span lang="en-DE" style="font-size:10.5pt;font-family:&quot;Segoe UI&quot;,sans-serif;color:#24292E;mso-fareast-language:#2000">So here is my question:<o:p></o:p></span></p>
<ul type="disc">
<li class="MsoNormal" style="color:#24292E;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l1 level1 lfo3;background:white">
<span lang="en-DE" style="font-size:10.5pt;font-family:&quot;Segoe UI&quot;,sans-serif;mso-fareast-language:#2000">I see there is another profile in /usr/local/etc/tpm2-tss/fapi-profiles, namely P_RSA2048SHA256.json. Is there a way I can encrypt using the RSA profile
 instead of the ECC one? I tried to re-run tss2_provision, after setting it in fapi-config.json, but it seems this is not the way to proceed. I get the message that the TPM has been already provisioned. What is the correct way of &quot;changing&quot; profile? Is it even
 possible or do I need to reset the TPM?<o:p></o:p></span></li></ul>
<p class="MsoNormal" style="mso-margin-bottom-alt:auto;background:white"><span lang="en-DE" style="font-size:10.5pt;font-family:&quot;Segoe UI&quot;,sans-serif;color:#24292E;mso-fareast-language:#2000">Thank you for your help.</span><span lang="en-DE"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="DE" style="font-size:10.0pt;color:black;mso-fareast-language:DE">Anthony Arrascue<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-DE"><o:p>&nbsp;</o:p></span></p>
</div>
</div>
</body>
</html>
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.