[tpm2] Re: Want to use c++ to get TPM Serial Number - how do it?
Roberts, William C <william.c.roberts at intel.com>
| Newsgroups | dev.linux.lists.tpm2 |
|---|---|
| Message-ID | <SN6PR11MB3437698905C8A0D3F6967623B8E39@SN6PR11MB3437.namprd11.prod.outlook.com> |
Getting the EK is not as easy as one would expect, it depends on how the TPM
manufacturer provisions it. Some require that you generate the EK and then
get a hash and look it up online, some store it in NV indices. IIRC, Infineon
TPM's store them in NV incidces. The tpm2_getekcertificate tool looks in the following NV indices:
#define RSA_EK_CERT_NV_INDEX 0x01C00002
#define ECC_EK_CERT_NV_INDEX 0x01C0000A
Since the EK is a primary key, you usually need to create it with a template defined in the link below.
This will then create a key that matches the manufacturer generated EK Certificate.
IIRC the NV indices and templates needed are covered in:
- https://trustedcomputinggroup.org/wp-content/uploads/TCG_IWG_Credential_Profile_EK_V2.1_R13.pdf
So this would involve a NV read using the C API would look like calling the function
Esys_NV_Read().
________________________________
From: Andy Purcell <andy_purcell(a)keysight.com>
Sent: Tuesday, July 20, 2021 12:18 PM
To: tpm2(a)lists.01.org <tpm2(a)lists.01.org>
Subject: [tpm2] Want to use c++ to get TPM Serial Number - how do it?
I have a need to use C++ to obtain the unique TPM information – like a Serial Number.
My system is running Windows 10/64. This is on an HP Desktop PC with TPM 2.0 chip.
I can use PowerShell
Get-TpmEndorsementKeyInfo -hashalgorithm sha256
To get this output:
…
ManufacturerCertificates : {[Subject]
TPMVersion=id:073E, TPMModel=SLB 9670 TPM2.0, TPMManufacturer=id:49465800
[Issuer]
CN=Infineon OPTIGA(TM) RSA Manufacturing CA 034, OU=OPTIGA(TM) TPM2.0, O=Infineon Technologies AG, C=DE
…
[Serial Number]
4880DE8E
[Thumbprint]
B8395DA6A1D661C8CCD35D47E3DA6E9532EFFEC4
But how can I get this same Serial Number information using C++?
ap
attachment.htm
(text/html, 5.9 KB)
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Getting the EK is not as easy as one would expect, it depends on how the TPM</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
manufacturer provisions it. Some require that you generate the EK and then</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
get a hash and look it up online, some store it in NV indices. IIRC, Infineon</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
TPM's store them in NV incidces. The tpm2_getekcertificate tool looks in the following NV indices:</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
#define RSA_EK_CERT_NV_INDEX 0x01C00002<br>
<span>#define ECC_EK_CERT_NV_INDEX 0x01C0000A</span><br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span><br>
</span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span>Since the EK is a primary key, you usually need to create it with a template defined in the link below.</span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span>This will then create a key that matches the manufacturer generated EK Certificate.</span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span><br>
</span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
IIRC the NV indices and templates needed are covered in:<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span> - <a href="https://trustedcomputinggroup.org/wp-content/uploads/TCG_IWG_Credential_Profile_EK_V2.1_R13.pdf" id="LPlnk284359">https://trustedcomputinggroup.org/wp-content/uploads/TCG_IWG_Credential_Profile_EK_V2.1_R13.pdf</a></span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
So this would involve a NV read using the C API would look like calling the function</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Esys_NV_Read().</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> Andy Purcell <[email protected]><br>
<b>Sent:</b> Tuesday, July 20, 2021 12:18 PM<br>
<b>To:</b> [email protected] <[email protected]><br>
<b>Subject:</b> [tpm2] Want to use c++ to get TPM Serial Number - how do it? </font>
<div> </div>
</div>
<style>
<!--
.x_EmailQuote
{margin-left:1pt;
padding-left:4pt;
border-left:#800000 2px solid}
-->
</style>
<div><font face="Calibri" size="2"><span style="font-size:11pt">
<div>I have a need to use C++ to obtain the unique TPM information like a Serial Number.
</div>
<div>My system is running Windows 10/64. This is on an HP Desktop PC with TPM 2.0 chip.
</div>
<div> </div>
<div>I can use PowerShell </div>
<div style="text-indent:36pt">Get-TpmEndorsementKeyInfo -hashalgorithm sha256</div>
<div> </div>
<div>To get this output: </div>
<div>
</div>
<div style="text-indent:36pt">ManufacturerCertificates : {[Subject]</div>
<div> TPMVersion=id:073E, TPMModel=SLB 9670 TPM2.0, TPMManufacturer=id:49465800</div>
<div> [Issuer]</div>
<div> CN=Infineon OPTIGA(TM) RSA Manufacturing CA 034, OU=OPTIGA(TM) TPM2.0, O=Infineon Technologies AG, C=DE</div>
<div style="text-indent:36pt; padding-left:36pt">
</div>
<div> [Serial Number]</div>
<div> 4880DE8E</div>
<div> [Thumbprint]</div>
<div> B8395DA6A1D661C8CCD35D47E3DA6E9532EFFEC4</div>
<div> </div>
<div>But how can I get this same Serial Number information using C++?</div>
<div> </div>
<div>ap</div>
<div> </div>
</span></font></div>
</body>
</html>