[tpm2] Re: How to store AES key inside the TPM and then use it?
Steven Clark <davolfman at gmail.com>
| Newsgroups | dev.linux.lists.tpm2 |
|---|---|
| Message-ID | <CAOCvsSmRQVp35+-0aE-k+Qy85iYyt9+mwn_hw=_VjdwgBPcakg@mail.gmail.com> |
For small data it's also possible to store it sealed as a "keyedhash" and put it in one of the NVM "persistent object" locations as if it's key. On Wed, Feb 2, 2022, 1:06 PM Kenneth Goldman <kgoldman(a)us.ibm.com> wrote: > There are two ways. Note that, since you're encrypting outside the TPM, > the 'key' is just a byte stream to the TPM. > > > > 1. If you have storage available, create the key as sealed data using > 'create'. Retrieve the key with 'unseal', with application specific > authorization for the unseal operation. > 2. If you have no external storage available, create the key as an NV > index using NVdefinespace. Retrieve the key using NV read, again with > application specific authorization for the read. > > > > *From:* Gabriele Saturni <gabriele.saturni(a)wsense.it> > *Sent:* Wednesday, February 2, 2022 12:31 PM > *To:* tpm2(a)lists.01.org > *Subject:* [EXTERNAL] [tpm2] How to store AES key inside the TPM and then > use it? > > > > Hi to everybody, I'm pretty new to the TPM and looking for a way to store > a premade AES key inside the TPM and retrieve it for encrypting the data of > my application. Is there any way to do it since a lot of TPM does not > support AES ? ZjQcmQRYFpfptBannerStart > > Hi to everybody, > > I'm pretty new to the TPM and looking for a way to store a premade AES key > inside the TPM and retrieve it for encrypting the data of my application. > Is there any way to do it since a lot of TPM does not support AES ? > > > > Thank you for your time > _______________________________________________ > tpm2 mailing list -- tpm2(a)lists.01.org > To unsubscribe send an email to tpm2-leave(a)lists.01.org > %(web_page_url)slistinfo%(cgiext)s/%(_internal_name)s
attachment.htm
(text/html, 3.5 KB)
<div dir="auto">For small data it's also possible to store it sealed as a "keyedhash" and put it in one of the NVM "persistent object" locations as if it's key.</div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, Feb 2, 2022, 1:06 PM Kenneth Goldman <<a href="mailto:[email protected]">[email protected]</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> <div lang="EN-US" link="#0563C1" vlink="#954F72" style="word-wrap:break-word"> <div class="m_-5176738345470668794WordSection1"> <p class="MsoNormal">There are two ways. Note that, since you're encrypting outside the TPM, the 'key' is just a byte stream to the TPM.<u></u><u></u></p> <p class="MsoNormal"><u></u> <u></u></p> <ol style="margin-top:0in" start="1" type="1"> <li class="m_-5176738345470668794MsoListParagraph" style="margin-left:0in">If you have storage available, create the key as sealed data using 'create'. Retrieve the key with 'unseal', with application specific authorization for the unseal operation.<u></u><u></u></li><li class="m_-5176738345470668794MsoListParagraph" style="margin-left:0in">If you have no external storage available, create the key as an NV index using NVdefinespace. Retrieve the key using NV read, again with application specific authorization for the read.<u></u><u></u></li></ol> <p class="MsoNormal"><u></u> <u></u></p> <div> <div style="border:none;border-top:solid #e1e1e1 1.0pt;padding:3.0pt 0in 0in 0in"> <p class="MsoNormal" style="margin-left:.5in"><b>From:</b> Gabriele Saturni <<a href="mailto:[email protected]" target="_blank" rel="noreferrer">[email protected]</a>> <br> <b>Sent:</b> Wednesday, February 2, 2022 12:31 PM<br> <b>To:</b> <a href="mailto:[email protected]" target="_blank" rel="noreferrer">[email protected]</a><br> <b>Subject:</b> [EXTERNAL] [tpm2] How to store AES key inside the TPM and then use it?<u></u><u></u></p> </div> </div> <p class="MsoNormal" style="margin-left:.5in"><u></u> <u></u></p> <p class="MsoNormal" style="margin-left:.5in"><span class="m_-5176738345470668794pfptpreheader1"><span style="font-size:1.0pt;color:white">Hi to everybody, I'm pretty new to the TPM and looking for a way to store a premade AES key inside the TPM and retrieve it for encrypting the data of my application. Is there any way to do it since a lot of TPM does not support AES ? </span></span><span style="font-size:1.0pt;color:white">ZjQcmQRYFpfptBannerStart</span> <u></u><u></u></p> <div> <div> <p class="MsoNormal" style="margin-left:.5in">Hi to everybody,<u></u><u></u></p> </div> <div> <p class="MsoNormal" style="margin-left:.5in">I'm pretty new to the TPM and looking for a way to store a premade AES key inside the TPM and retrieve it for encrypting the data of my application. Is there any way to do it since a lot of TPM does not support AES ?<u></u><u></u></p> </div> <div> <p class="MsoNormal" style="margin-left:.5in"><u></u> <u></u></p> </div> <div> <p class="MsoNormal" style="margin-left:.5in">Thank you for your time<u></u><u></u></p> </div> </div> </div> </div> _______________________________________________<br> tpm2 mailing list -- <a href="mailto:[email protected]" target="_blank" rel="noreferrer">[email protected]</a><br> To unsubscribe send an email to <a href="mailto:[email protected]" target="_blank" rel="noreferrer">[email protected]</a><br> %(web_page_url)slistinfo%(cgiext)s/%(_internal_name)s</blockquote></div>