[tpm2] Re: How to store AES key inside the TPM and then use it?
Kenneth Goldman <kgoldman at us.ibm.com>
| Newsgroups | dev.linux.lists.tpm2 |
|---|---|
| Message-ID | <BN8PR15MB275322A43302335478F86CFAF2289@BN8PR15MB2753.namprd15.prod.outlook.com> |
Definitely use external storage. TPM NV space is limited. Create the sealed data, which will be encrypted with the parent key. Load it when you need it, then unseal to get the plaintext key. From: Gabriele Saturni <gabriele.saturni(a)wsense.it> Sent: Thursday, February 3, 2022 3:07 AM To: Steven Clark <davolfman(a)gmail.com> Cc: Kenneth Goldman <kgoldman(a)us.ibm.com>; tpm2 <tpm2(a)lists.01.org> Subject: [EXTERNAL] [tpm2] Re: How to store AES key inside the TPM and then use it? Thanks for the answers, basing on your experiences, since I have storage available outside the TPM, which of the two proposed approaches is the best (in terms of both security and efficiency)? Il giorno gio 3 feb 2022 alle ore 04:27 Steven Clark <davolfman(a)gmail.com<mailto:davolfman(a)gmail.com>> ha scritto: For small data it's also possible to store it sealed as a "keyedhash" and put it in one of the NVM "persistent object" locations as if it's key. On Wed, Feb 2, 2022, 1:06 PM Kenneth Goldman <kgoldman(a)us.ibm.com<mailto:kgoldman(a)us.ibm.com>> wrote: There are two ways. Note that, since you're encrypting outside the TPM, the 'key' is just a byte stream to the TPM. 1. If you have storage available, create the key as sealed data using 'create'. Retrieve the key with 'unseal', with application specific authorization for the unseal operation. 2. If you have no external storage available, create the key as an NV index using NVdefinespace. Retrieve the key using NV read, again with application specific authorization for the read. From: Gabriele Saturni <gabriele.saturni(a)wsense.it<mailto:gabriele.saturni(a)wsense.it>> Sent: Wednesday, February 2, 2022 12:31 PM To: tpm2(a)lists.01.org<mailto:tpm2(a)lists.01.org> Subject: [EXTERNAL] [tpm2] How to store AES key inside the TPM and then use it? Hi to everybody, I'm pretty new to the TPM and looking for a way to store a premade AES key inside the TPM and retrieve it for encrypting the data of my application. Is there any way to do it since a lot of TPM does not support AES ? ZjQcmQRYFpfptBannerStart Hi to everybody, I'm pretty new to the TPM and looking for a way to store a premade AES key inside the TPM and retrieve it for encrypting the data of my application. Is there any way to do it since a lot of TPM does not support AES ? Thank you for your time _______________________________________________ tpm2 mailing list -- tpm2(a)lists.01.org<mailto:tpm2(a)lists.01.org> To unsubscribe send an email to tpm2-leave(a)lists.01.org<mailto:tpm2-leave(a)lists.01.org> %(web_page_url)slistinfo%(cgiext)s/%(_internal_name)s -- Gabriele Saturni, PhD R&D Developer, WSense Srl E-mail: gabriele.saturni(a)wsense.it<mailto:giovanni.pagnotta(a)wsense.it> WSense Srl web site: https://www.wsense.it/<https://www.wsense.it/> This message is confidential. Any unauthorised disclosure, use or dissemination, either whole or partial, is prohibited. If you are not the intended recipient of the message, please notify the sender immediately. Questo messaggio e riservato;Qualsiasi pubblicazione, utilizzo o diffusione, anche parziale di questo messaggio, deve essere preventivamente autorizzata. Nel caso in cui non foste destinatari del presente messaggio,vogliate cortesemente avvertire immediatamente il mittente. Ce message est confidentiel. Toute publication, utilisation ou diffusion, meme partielle, doit etre autorisee prealablement. Si vous n' etes pas destinataire de ce message, merci d'en avertir immediatement l'expediteur.
attachment.htm
(text/html, 9.5 KB)
<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:141626044;
mso-list-template-ids:-57235086;}
ol
{margin-bottom:0in;}
ul
{margin-bottom:0in;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">Definitely use external storage.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">TPM NV space is limited. Create the sealed data, which will be encrypted with the parent key. Load it when you need it, then unseal to get the plaintext key.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal" style="margin-left:.5in"><b>From:</b> Gabriele Saturni <[email protected]>
<br>
<b>Sent:</b> Thursday, February 3, 2022 3:07 AM<br>
<b>To:</b> Steven Clark <[email protected]><br>
<b>Cc:</b> Kenneth Goldman <[email protected]>; tpm2 <[email protected]><br>
<b>Subject:</b> [EXTERNAL] [tpm2] Re: How to store AES key inside the TPM and then use it?<o:p></o:p></p>
</div>
<p class="MsoNormal" style="margin-left:.5in"><o:p> </o:p></p>
<div>
<p class="MsoNormal" style="margin-left:.5in">Thanks for the answers, basing on your experiences, since I have storage available outside the TPM, which of the two proposed approaches is the best (in terms of both security and efficiency)?<o:p></o:p></p>
</div>
<p class="MsoNormal" style="margin-left:.5in"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal" style="margin-left:.5in">Il giorno gio 3 feb 2022 alle ore 04:27 Steven Clark <<a href="mailto:[email protected]" target="_blank">[email protected]</a>> ha scritto:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<p class="MsoNormal" style="margin-left:.5in">For small data it's also possible to store it sealed as a "keyedhash" and put it in one of the NVM "persistent object" locations as if it's key.<o:p></o:p></p>
</div>
<p class="MsoNormal" style="margin-left:.5in"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal" style="margin-left:.5in">On Wed, Feb 2, 2022, 1:06 PM Kenneth Goldman <<a href="mailto:[email protected]" target="_blank">[email protected]</a>> wrote:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in">
There are two ways. Note that, since you're encrypting outside the TPM, the 'key' is just a byte stream to the TPM.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in">
<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:1.0in;text-indent:-.25in;mso-list:l0 level1 lfo1">
<![if !supportLists]><span style="mso-list:Ignore">1.<span style="font:7.0pt "Times New Roman"">
</span></span><![endif]>If you have storage available, create the key as sealed data using 'create'. Retrieve the key with 'unseal', with application specific authorization for the unseal operation.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:1.0in;text-indent:-.25in;mso-list:l0 level1 lfo1">
<![if !supportLists]><span style="mso-list:Ignore">2.<span style="font:7.0pt "Times New Roman"">
</span></span><![endif]>If you have no external storage available, create the key as an NV index using NVdefinespace. Retrieve the key using NV read, again with application specific authorization for the read.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in">
<o:p></o:p></p>
<div>
<div style="border:none;border-top:solid windowtext 1.0pt;padding:3.0pt 0in 0in 0in;border-color:currentcolor currentcolor">
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:1.0in">
<b>From:</b> Gabriele Saturni <<a href="mailto:[email protected]" target="_blank">[email protected]</a>>
<br>
<b>Sent:</b> Wednesday, February 2, 2022 12:31 PM<br>
<b>To:</b> <a href="mailto:[email protected]" target="_blank">[email protected]</a><br>
<b>Subject:</b> [EXTERNAL] [tpm2] How to store AES key inside the TPM and then use it?<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:1.0in">
<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:1.0in">
<span style="font-size:1.0pt;color:white">Hi to everybody, I'm pretty new to the TPM and looking for a way to store a premade AES key inside the TPM and retrieve it for encrypting the data of my application. Is there any way to do it since a lot of TPM does
not support AES ? ZjQcmQRYFpfptBannerStart</span> <o:p></o:p></p>
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:1.0in">
Hi to everybody,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:1.0in">
I'm pretty new to the TPM and looking for a way to store a premade AES key inside the TPM and retrieve it for encrypting the data of my application. Is there any way to do it since a lot of TPM does not support AES ?<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:1.0in">
<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:1.0in">
Thank you for your time<o:p></o:p></p>
</div>
</div>
</div>
</div>
<p class="MsoNormal" style="margin-left:.5in">_______________________________________________<br>
tpm2 mailing list -- <a href="mailto:[email protected]" target="_blank">[email protected]</a><br>
To unsubscribe send an email to <a href="mailto:[email protected]" target="_blank">[email protected]</a><br>
%(web_page_url)slistinfo%(cgiext)s/%(_internal_name)s<o:p></o:p></p>
</blockquote>
</div>
</blockquote>
</div>
<p class="MsoNormal" style="margin-left:.5in"><br clear="all">
<br>
-- <o:p></o:p></p>
<div>
<div>
<div>
<p class="MsoNormal" style="margin-left:.5in">Gabriele Saturni, PhD<o:p></o:p></p>
</div>
<div>
<div>
<p class="MsoNormal" style="margin-left:.5in">R&D Developer, WSense Srl<br>
E-mail: <a href="mailto:[email protected]" target="_blank">[email protected]</a><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:.5in">WSense Srl web site: <a href="https://www.wsense.it/" target="_blank"><span style="color:#1155CC">https://www.wsense.it/</span></a><o:p></o:p></p>
</div>
</div>
<div>
<p class="MsoNormal" style="margin-left:.5in"><o:p> </o:p></p>
</div>
<div>
<div>
<p class="MsoNormal" style="margin-left:.5in">This message is confidential. Any unauthorised disclosure, use or dissemination, either whole or partial, is prohibited. If you are not the intended recipient of the message, please notify the sender immediately.<o:p></o:p></p>
</div>
<div>
<div>
<p class="MsoNormal" style="margin-left:.5in"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:.5in">Questo messaggio e riservato;Qualsiasi pubblicazione, utilizzo o diffusione, anche parziale di questo messaggio, deve essere preventivamente autorizzata. Nel caso in cui non foste destinatari del presente messaggio,vogliate cortesemente
avvertire immediatamente il mittente. <br>
<br>
Ce message est confidentiel. Toute publication, utilisation ou diffusion, meme partielle, doit etre autorisee prealablement. Si vous n' etes pas destinataire de ce message, merci d'en avertir immediatement l'expediteur.<o:p></o:p></p>
</div>
</div>
</div>
</div>
</div>
</div>
</body>
</html>