[tpm2] Re: How to store AES key inside the TPM and then use it?

Kenneth Goldman <kgoldman at us.ibm.com>
Newsgroups dev.linux.lists.tpm2
Message-ID <BN8PR15MB2753693B74C66587A00B44AFF2289@BN8PR15MB2753.namprd15.prod.outlook.com> 
I do not advise this.  There are very few (perhaps 7) persistent object slots, and many are used by OS-level functions.  It is a waste of a scarce resource.

General TPM principle - use TPM NV only when absolutely necessary.

From: Steven Clark <davolfman(a)gmail.com>
Sent: Wednesday, February 2, 2022 10:28 PM
To: Kenneth Goldman <kgoldman(a)us.ibm.com>
Cc: Gabriele Saturni <gabriele.saturni(a)wsense.it>; tpm2 <tpm2(a)lists.01.org>
Subject: [EXTERNAL] [tpm2] Re: How to store AES key inside the TPM and then use it?

For small data it's also possible to store it sealed as a "keyedhash" and put it in one of the NVM "persistent object" locations as if it's key.

On Wed, Feb 2, 2022, 1:06 PM Kenneth Goldman <kgoldman(a)us.ibm.com<mailto:kgoldman(a)us.ibm.com>> wrote:
There are two ways.  Note that, since you're encrypting outside the TPM, the 'key' is just a byte stream to the TPM.


1.       If you have storage available, create the key as sealed data using 'create'.  Retrieve the key with 'unseal', with application specific authorization for the unseal operation.

2.       If you have no external storage available, create the key as an NV index using NVdefinespace. Retrieve the key using NV read, again with application specific authorization for the read.
attachment.htm (text/html, 5 KB) 
<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
	{font-family:"Cambria Math";
	panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
	{font-family:Calibri;
	panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
	{margin:0in;
	font-size:11.0pt;
	font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
	{mso-style-priority:99;
	color:blue;
	text-decoration:underline;}
p.m-5176738345470668794msolistparagraph, li.m-5176738345470668794msolistparagraph, div.m-5176738345470668794msolistparagraph
	{mso-style-name:m_-5176738345470668794msolistparagraph;
	mso-margin-top-alt:auto;
	margin-right:0in;
	mso-margin-bottom-alt:auto;
	margin-left:0in;
	font-size:11.0pt;
	font-family:"Calibri",sans-serif;}
span.EmailStyle20
	{mso-style-type:personal-reply;
	font-family:"Calibri",sans-serif;
	color:windowtext;}
.MsoChpDefault
	{mso-style-type:export-only;
	font-family:"Calibri",sans-serif;}
@page WordSection1
	{size:8.5in 11.0in;
	margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
	{page:WordSection1;}
/* List Definitions */
@list l0
	{mso-list-id:753211794;
	mso-list-template-ids:1487596642;}
ol
	{margin-bottom:0in;}
ul
	{margin-bottom:0in;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">I do not advise this.&nbsp; There are very few (perhaps 7) persistent object slots, and many are used by OS-level functions.&nbsp; It is a waste of a scarce resource.<o:p></o:p></p>
<p class="MsoNormal"><o:p>&nbsp;</o:p></p>
<p class="MsoNormal">General TPM principle - use TPM NV only when absolutely necessary.<o:p></o:p></p>
<p class="MsoNormal"><o:p>&nbsp;</o:p></p>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal" style="margin-left:.5in"><b>From:</b> Steven Clark &lt;[email protected]&gt;
<br>
<b>Sent:</b> Wednesday, February 2, 2022 10:28 PM<br>
<b>To:</b> Kenneth Goldman &lt;[email protected]&gt;<br>
<b>Cc:</b> Gabriele Saturni &lt;[email protected]&gt;; tpm2 &lt;[email protected]&gt;<br>
<b>Subject:</b> [EXTERNAL] [tpm2] Re: How to store AES key inside the TPM and then use it?<o:p></o:p></p>
</div>
<p class="MsoNormal" style="margin-left:.5in"><o:p>&nbsp;</o:p></p>
<div>
<p class="MsoNormal" style="margin-left:.5in">For small data it's also possible to store it sealed as a &quot;keyedhash&quot; and put it in one of the NVM &quot;persistent object&quot; locations as if it's key.<o:p></o:p></p>
</div>
<p class="MsoNormal" style="margin-left:.5in"><o:p>&nbsp;</o:p></p>
<div>
<div>
<p class="MsoNormal" style="margin-left:.5in">On Wed, Feb 2, 2022, 1:06 PM Kenneth Goldman &lt;<a href="mailto:[email protected]">[email protected]</a>&gt; wrote:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in">
There are two ways.&nbsp; Note that, since you're encrypting outside the TPM, the 'key' is just a byte stream to the TPM.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in">
&nbsp;<o:p></o:p></p>
<p class="m-5176738345470668794msolistparagraph" style="margin-left:1.0in;text-indent:-.25in;mso-list:l0 level1 lfo1">
<![if !supportLists]><span style="mso-list:Ignore">1.<span style="font:7.0pt &quot;Times New Roman&quot;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
</span></span><![endif]>If you have storage available, create the key as sealed data using 'create'.&nbsp; Retrieve the key with 'unseal', with application specific authorization for the unseal operation.<o:p></o:p></p>
<p class="m-5176738345470668794msolistparagraph" style="margin-left:1.0in;text-indent:-.25in;mso-list:l0 level1 lfo1">
<![if !supportLists]><span style="mso-list:Ignore">2.<span style="font:7.0pt &quot;Times New Roman&quot;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
</span></span><![endif]>If you have no external storage available, create the key as an NV index using NVdefinespace. Retrieve the key using NV read, again with application specific authorization for the read.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in">
&nbsp;<o:p></o:p></p>
</div>
</div>
</blockquote>
</div>
</div>
</body>
</html>
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.