[tpm2] Re: How to store AES key inside the TPM and then use it?
Gabriele Saturni <gabriele.saturni at wsense.it>
| Newsgroups | dev.linux.lists.tpm2 |
|---|---|
| Message-ID | <CAFruog2Hc+FqU8mx-5DeLNKzFVA-h5Uww=b=bfjx4U=LbwOY9Q@mail.gmail.com> |
Ok guys thanks a lot for the help! Googling i found these commands can you confirm that this is the correct procedure ? 1) echo "That is my secret" > secret.txt 2) tpm2_createprimary -c primary.ctx -Q //create primary context 3) tpm2_pcrread -Q -o pcr.bin sha256:x,y,z //read the hash of pcr register x,y,z and save in a file 4) tpm2_createpolicy -Q --policy-pcr -l sha256:x,y,z -f pcr.bin -L pcr.policy //use the file created in the prev step for create a policy 5) tpm2_create -C primary.ctx -L pcr.policy -i secret.txt -u seal.pub -r seal.priv -c seal.ctx -Q //seal the secret in the TPM using the policy 6) tpm2_load -Q -C primary.ctx -u seal.pub -r seal.priv -n seal.name -c seal.ctx //load the sensitive portion in the TPM. Then for unseal: tpm2_unseal -c seal.ctx -p pcr:sha256:x,y,z Moreover, I have just one question: after step 6 Can I safely delete the files primary.ctx -u seal.pub -r seal.priv since they are loaded inside the TPM ? Thanks again for your help. Il giorno gio 3 feb 2022 alle ore 18:31 Kenneth Goldman <kgoldman(a)us.ibm.com> ha scritto: > I do not advise this. There are very few (perhaps 7) persistent object > slots, and many are used by OS-level functions. It is a waste of a scarce > resource. > > > > General TPM principle - use TPM NV only when absolutely necessary. > > > > *From:* Steven Clark <davolfman(a)gmail.com> > *Sent:* Wednesday, February 2, 2022 10:28 PM > *To:* Kenneth Goldman <kgoldman(a)us.ibm.com> > *Cc:* Gabriele Saturni <gabriele.saturni(a)wsense.it>; tpm2 < > tpm2(a)lists.01.org> > *Subject:* [EXTERNAL] [tpm2] Re: How to store AES key inside the TPM and > then use it? > > > > For small data it's also possible to store it sealed as a "keyedhash" and > put it in one of the NVM "persistent object" locations as if it's key. > > > > On Wed, Feb 2, 2022, 1:06 PM Kenneth Goldman <kgoldman(a)us.ibm.com> wrote: > > There are two ways. Note that, since you're encrypting outside the TPM, > the 'key' is just a byte stream to the TPM. > > > > 1. If you have storage available, create the key as sealed data > using 'create'. Retrieve the key with 'unseal', with application specific > authorization for the unseal operation. > > 2. If you have no external storage available, create the key as an > NV index using NVdefinespace. Retrieve the key using NV read, again with > application specific authorization for the read. > > > >
attachment.htm
(text/html, 5.1 KB)
<div dir="ltr"><div dir="ltr">Ok guys thanks a lot for the help! Googling i found these commands can you confirm that this is the correct procedure ?<br><br><code>1) echo "That is my secret" > secret.txt<br></code><pre>2) tpm2_createprimary -c primary.ctx -Q //create primary context<br><br>3) tpm2_pcrread -Q -o pcr.bin sha256:x,y,z //read the hash of pcr register x,y,z and save in a file 4) tpm2_createpolicy -Q --policy-pcr -l sha256:x,y,z -f pcr.bin -L pcr.policy //use the file created in the prev step for create a policy 5) tpm2_create -C primary.ctx -L pcr.policy -i <code>secret.txt </code>-u seal.pub -r seal.priv -c seal.ctx -Q //seal the secret in the TPM using the policy<br><br><code>6) tpm2_load -Q -C primary.ctx -u seal.pub -r seal.priv -n <a href="http://seal.name" target="_blank">seal.name</a> -c seal.ctx //load the sensitive portion in the TPM.<br></code></pre><pre><code><br></code></pre><pre><code><span style="font-family:arial,sans-serif">Then for unseal</span>:<br><br>tpm2_unseal -c seal.ctx -p pcr:sha256:x,y,z<br><br></code></pre><pre><code><font face="arial,sans-serif">Moreover, I have just one question: after step 6 Can I safely delete the files </font><code>primary.ctx -u seal.pub -r seal.priv <font face="arial,sans-serif">since they are loaded inside the TPM ?<br><br></font></code></code></pre><pre><code><code><font face="arial,sans-serif">Thanks again for your help.<br></font></code></code></pre></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">Il giorno gio 3 feb 2022 alle ore 18:31 Kenneth Goldman <<a href="mailto:[email protected]">[email protected]</a>> ha scritto:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"> <div style="overflow-wrap: break-word;" lang="EN-US"> <div class="gmail-m_4279244335341495629WordSection1"> <p class="MsoNormal">I do not advise this. There are very few (perhaps 7) persistent object slots, and many are used by OS-level functions. It is a waste of a scarce resource.<u></u><u></u></p> <p class="MsoNormal"><u></u> <u></u></p> <p class="MsoNormal">General TPM principle - use TPM NV only when absolutely necessary.<u></u><u></u></p> <p class="MsoNormal"><u></u> <u></u></p> <div style="border-color:rgb(225,225,225) currentcolor currentcolor;border-style:solid none none;border-width:1pt medium medium;padding:3pt 0in 0in"> <p class="MsoNormal" style="margin-left:0.5in"><b>From:</b> Steven Clark <<a href="mailto:[email protected]" target="_blank">[email protected]</a>> <br> <b>Sent:</b> Wednesday, February 2, 2022 10:28 PM<br> <b>To:</b> Kenneth Goldman <<a href="mailto:[email protected]" target="_blank">[email protected]</a>><br> <b>Cc:</b> Gabriele Saturni <<a href="mailto:[email protected]" target="_blank">[email protected]</a>>; tpm2 <<a href="mailto:[email protected]" target="_blank">[email protected]</a>><br> <b>Subject:</b> [EXTERNAL] [tpm2] Re: How to store AES key inside the TPM and then use it?<u></u><u></u></p> </div> <p class="MsoNormal" style="margin-left:0.5in"><u></u> <u></u></p> <div> <p class="MsoNormal" style="margin-left:0.5in">For small data it's also possible to store it sealed as a "keyedhash" and put it in one of the NVM "persistent object" locations as if it's key.<u></u><u></u></p> </div> <p class="MsoNormal" style="margin-left:0.5in"><u></u> <u></u></p> <div> <div> <p class="MsoNormal" style="margin-left:0.5in">On Wed, Feb 2, 2022, 1:06 PM Kenneth Goldman <<a href="mailto:[email protected]" target="_blank">[email protected]</a>> wrote:<u></u><u></u></p> </div> <blockquote style="border-color:currentcolor currentcolor currentcolor rgb(204,204,204);border-style:none none none solid;border-width:medium medium medium 1pt;padding:0in 0in 0in 6pt;margin-left:4.8pt;margin-right:0in"> <div> <div> <p class="MsoNormal" style="margin-left:0.5in"> There are two ways. Note that, since you're encrypting outside the TPM, the 'key' is just a byte stream to the TPM.<u></u><u></u></p> <p class="MsoNormal" style="margin-left:0.5in"> <u></u><u></u></p> <p class="gmail-m_4279244335341495629m-5176738345470668794msolistparagraph" style="margin-left:1in"> <u></u><span>1.<span style="font:7pt "Times New Roman""> </span></span><u></u>If you have storage available, create the key as sealed data using 'create'. Retrieve the key with 'unseal', with application specific authorization for the unseal operation.<u></u><u></u></p> <p class="gmail-m_4279244335341495629m-5176738345470668794msolistparagraph" style="margin-left:1in"> <u></u><span>2.<span style="font:7pt "Times New Roman""> </span></span><u></u>If you have no external storage available, create the key as an NV index using NVdefinespace. Retrieve the key using NV read, again with application specific authorization for the read.<u></u><u></u></p> <p class="MsoNormal" style="margin-left:0.5in"> <u></u><u></u></p> </div> </div> </blockquote> </div> </div> </div> </blockquote></div></div>