[tpm2] Re: How to store AES key inside the TPM and then use it?
Kenneth Goldman <kgoldman at us.ibm.com>
| Newsgroups | dev.linux.lists.tpm2 |
|---|---|
| Message-ID | <BN8PR15MB2753A095F28852A0A553661CF22A9@BN8PR15MB2753.namprd15.prod.outlook.com> |
Caution - context blobs may not be loadable after a reboot. It depends how it's created. Invalidating context blobs on reboot is sometimes desired. This is a high-level question. It depends on the application security design. Me - I'd keep the public and private parts. They're very small. From: Steven Clark <davolfman(a)gmail.com> Sent: Friday, February 4, 2022 9:14 PM To: Gabriele Saturni <gabriele.saturni(a)wsense.it> Cc: Kenneth Goldman <kgoldman(a)us.ibm.com>; tpm2 <tpm2(a)lists.01.org> Subject: [EXTERNAL] Re: [tpm2] Re: How to store AES key inside the TPM and then use it? I think none of them are stored in the TPM. But if you create a primary key with an identical procedure in the future you'll get the same key. Also it might be in the context file but I'm not sure. So creating primaries that are ECC keys is beneficial because generation is orders of magnitude faster than RSA. Also your secret is now in the context blob so you don't need the pub and priv regions anymore. On Fri, Feb 4, 2022, 1:29 AM Gabriele Saturni <gabriele.saturni(a)wsense.it<mailto:gabriele.saturni(a)wsense.it>> wrote: Ok guys thanks a lot for the help! Googling i found these commands can you confirm that this is the correct procedure ? 1) echo "That is my secret" > secret.txt 2) tpm2_createprimary -c primary.ctx -Q //create primary context 3) tpm2_pcrread -Q -o pcr.bin sha256:x,y,z //read the hash of pcr register x,y,z and save in a file 4) tpm2_createpolicy -Q --policy-pcr -l sha256:x,y,z -f pcr.bin -L pcr.policy //use the file created in the prev step for create a policy 5) tpm2_create -C primary.ctx -L pcr.policy -i secret.txt -u seal.pub -r seal.priv -c seal.ctx -Q //seal the secret in the TPM using the policy 6) tpm2_load -Q -C primary.ctx -u seal.pub -r seal.priv -n seal.name<http://seal.name> -c seal.ctx //load the sensitive portion in the TPM. Then for unseal: tpm2_unseal -c seal.ctx -p pcr:sha256:x,y,z Moreover, I have just one question: after step 6 Can I safely delete the files primary.ctx -u seal.pub -r seal.priv since they are loaded inside the TPM ? Thanks again for your help. Il giorno gio 3 feb 2022 alle ore 18:31 Kenneth Goldman <kgoldman(a)us.ibm.com<mailto:kgoldman(a)us.ibm.com>> ha scritto: I do not advise this. There are very few (perhaps 7) persistent object slots, and many are used by OS-level functions. It is a waste of a scarce resource. General TPM principle - use TPM NV only when absolutely necessary. From: Steven Clark <davolfman(a)gmail.com<mailto:davolfman(a)gmail.com>> Sent: Wednesday, February 2, 2022 10:28 PM To: Kenneth Goldman <kgoldman(a)us.ibm.com<mailto:kgoldman(a)us.ibm.com>> Cc: Gabriele Saturni <gabriele.saturni(a)wsense.it<mailto:gabriele.saturni(a)wsense.it>>; tpm2 <tpm2(a)lists.01.org<mailto:tpm2(a)lists.01.org>> Subject: [EXTERNAL] [tpm2] Re: How to store AES key inside the TPM and then use it? For small data it's also possible to store it sealed as a "keyedhash" and put it in one of the NVM "persistent object" locations as if it's key. On Wed, Feb 2, 2022, 1:06 PM Kenneth Goldman <kgoldman(a)us.ibm.com<mailto:kgoldman(a)us.ibm.com>> wrote: There are two ways. Note that, since you're encrypting outside the TPM, the 'key' is just a byte stream to the TPM. 1. If you have storage available, create the key as sealed data using 'create'. Retrieve the key with 'unseal', with application specific authorization for the unseal operation. 2. If you have no external storage available, create the key as an NV index using NVdefinespace. Retrieve the key using NV read, again with application specific authorization for the read.
attachment.htm
(text/html, 10.3 KB)
<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
code
{mso-style-priority:99;
font-family:"Courier New";}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0in;
font-size:10.0pt;
font-family:"Courier New";}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:Consolas;}
span.EmailStyle38
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">Caution - context blobs may not be loadable after a reboot. It depends how it's created. Invalidating context blobs on reboot is sometimes desired.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">This is a high-level question. It depends on the application security design.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Me - I'd keep the public and private parts. They're very small.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal" style="margin-left:.5in"><b>From:</b> Steven Clark <[email protected]>
<br>
<b>Sent:</b> Friday, February 4, 2022 9:14 PM<br>
<b>To:</b> Gabriele Saturni <[email protected]><br>
<b>Cc:</b> Kenneth Goldman <[email protected]>; tpm2 <[email protected]><br>
<b>Subject:</b> [EXTERNAL] Re: [tpm2] Re: How to store AES key inside the TPM and then use it?<o:p></o:p></p>
</div>
</div>
<div>
<div>
<p class="MsoNormal" style="margin-left:.5in">I think none of them are stored in the TPM. But if you create a primary key with an identical procedure in the future you'll get the same key. Also it might be in the context file but I'm not sure. So creating
primaries that are ECC keys is beneficial because generation is orders of magnitude faster than RSA.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:0in;margin-right:0in;margin-bottom:12.0pt;margin-left:.5in">
Also your secret is now in the context blob so you don't need the pub and priv regions anymore.<o:p></o:p></p>
<div>
<div>
<p class="MsoNormal" style="margin-left:.5in">On Fri, Feb 4, 2022, 1:29 AM Gabriele Saturni <<a href="mailto:[email protected]">[email protected]</a>> wrote:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<p class="MsoNormal" style="margin-left:.5in">Ok guys thanks a lot for the help! Googling i found these commands can you confirm that this is the correct procedure ?<br>
<br>
<code><span style="font-size:10.0pt">1) echo "That is my secret" > secret.txt</span></code><o:p></o:p></p>
<pre style="margin-left:.5in">2) tpm2_createprimary -c primary.ctx -Q //create primary context<br><br>3) tpm2_pcrread -Q -o pcr.bin sha256:x,y,z //read the hash of pcr register x,y,z and save in a file<o:p></o:p></pre>
<pre style="margin-left:.5in"><o:p> </o:p></pre>
<pre style="margin-left:.5in">4) tpm2_createpolicy -Q --policy-pcr -l sha256:x,y,z -f pcr.bin -L pcr.policy //use the file created in the prev step for create a policy<o:p></o:p></pre>
<pre style="margin-left:.5in"><o:p> </o:p></pre>
<pre style="margin-left:.5in">5) tpm2_create -C primary.ctx -L pcr.policy -i <code>secret.txt </code>-u seal.pub -r seal.priv -c seal.ctx -Q //seal the secret in the TPM using the policy<br><br><code>6) tpm2_load -Q -C primary.ctx -u seal.pub -r seal.priv -n <a href="http://seal.name" target="_blank">seal.name</a> -c seal.ctx //load the sensitive portion in the TPM.</code><o:p></o:p></pre>
<pre style="margin-left:.5in"><o:p> </o:p></pre>
<pre style="mso-margin-top-alt:0in;margin-right:0in;margin-bottom:12.0pt;margin-left:.5in"><code><span style="font-family:"Arial",sans-serif">Then for unseal</span>:</code><br><br><code>tpm2_unseal -c seal.ctx -p pcr:sha256:x,y,z</code><o:p></o:p></pre>
<pre style="mso-margin-top-alt:0in;margin-right:0in;margin-bottom:12.0pt;margin-left:.5in"><code><span style="font-family:"Arial",sans-serif">Moreover, I have just one question: after step 6 Can I safely delete the files </span>primary.ctx -u seal.pub -r seal.priv </code><code><span style="font-family:"Arial",sans-serif">since they are loaded inside the TPM ?</span></code><o:p></o:p></pre>
<pre style="margin-left:.5in"><code><span style="font-family:"Arial",sans-serif">Thanks again for your help.</span></code><o:p></o:p></pre>
</div>
<p class="MsoNormal" style="margin-left:.5in"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal" style="margin-left:.5in">Il giorno gio 3 feb 2022 alle ore 18:31 Kenneth Goldman <<a href="mailto:[email protected]" target="_blank">[email protected]</a>> ha scritto:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in">
I do not advise this. There are very few (perhaps 7) persistent object slots, and many are used by OS-level functions. It is a waste of a scarce resource.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in">
<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in">
General TPM principle - use TPM NV only when absolutely necessary.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in">
<o:p></o:p></p>
<div style="border:none;border-top:solid windowtext 1.0pt;padding:3.0pt 0in 0in 0in;border-color:currentcolor currentcolor">
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:1.0in">
<b>From:</b> Steven Clark <<a href="mailto:[email protected]" target="_blank">[email protected]</a>>
<br>
<b>Sent:</b> Wednesday, February 2, 2022 10:28 PM<br>
<b>To:</b> Kenneth Goldman <<a href="mailto:[email protected]" target="_blank">[email protected]</a>><br>
<b>Cc:</b> Gabriele Saturni <<a href="mailto:[email protected]" target="_blank">[email protected]</a>>; tpm2 <<a href="mailto:[email protected]" target="_blank">[email protected]</a>><br>
<b>Subject:</b> [EXTERNAL] [tpm2] Re: How to store AES key inside the TPM and then use it?<o:p></o:p></p>
</div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:1.0in">
<o:p></o:p></p>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:1.0in">
For small data it's also possible to store it sealed as a "keyedhash" and put it in one of the NVM "persistent object" locations as if it's key.<o:p></o:p></p>
</div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:1.0in">
<o:p></o:p></p>
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:1.0in">
On Wed, Feb 2, 2022, 1:06 PM Kenneth Goldman <<a href="mailto:[email protected]" target="_blank">[email protected]</a>> wrote:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid windowtext 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-top:5.0pt;margin-right:0in;margin-bottom:5.0pt;border-color:currentcolor currentcolor currentcolor rgb(204,204,204)">
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:1.0in">
There are two ways. Note that, since you're encrypting outside the TPM, the 'key' is just a byte stream to the TPM.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:1.0in">
<o:p></o:p></p>
<p style="margin-left:1.5in">1.<span style="font-size:7.0pt;font-family:"Times New Roman",serif">
</span>If you have storage available, create the key as sealed data using 'create'. Retrieve the key with 'unseal', with application specific authorization for the unseal operation.<o:p></o:p></p>
<p style="margin-left:1.5in">2.<span style="font-size:7.0pt;font-family:"Times New Roman",serif">
</span>If you have no external storage available, create the key as an NV index using NVdefinespace. Retrieve the key using NV read, again with application specific authorization for the read.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:1.0in">
<o:p></o:p></p>
</div>
</div>
</blockquote>
</div>
</div>
</div>
</blockquote>
</div>
</div>
</blockquote>
</div>
</div>
</div>
</div>
</body>
</html>