[tpm2] Re: tpm2_createprimary to a transient handle...
Kenneth Goldman <kgoldman at us.ibm.com>
| Newsgroups | dev.linux.lists.tpm2 |
|---|---|
| Message-ID | < <BN8PR15MB27539E7909436EFF13D5AC96F2059@BN8PR15MB2753.namprd15.prod.outlook.com>> |
In general (not the command line tools), the create primary result stays loaded.
However, the EK is not a signing key. It cannot sign anything.
From: Sievert, James <james.sievert(a)bsci.com>
Sent: Friday, March 4, 2022 8:23 AM
To: tpm2(a)lists.01.org
Subject: [EXTERNAL] [tpm2] Re: tpm2_createprimary to a transient handle...
More specifically, I'm looking at how to implement Section 2.1.2.2 of TCG Credential Profile EK 2.0 (trustedcomputinggroup.org). I need to sign the CSR with the EK using openssl cms and the tpm2tss engine. With that, I need the transient ZjQcmQRYFpfptBannerStart
This Message Is From an External Sender
This message came from outside your organization.
ZjQcmQRYFpfptBannerEnd
More specifically, I'm looking at how to implement Section 2.1.2.2 of TCG Credential Profile EK 2.0 (trustedcomputinggroup.org)<https://trustedcomputinggroup.org/wp-content/uploads/TCG_IWG_EKCredentialProfile_v2p4_r3.pdf>. I need to sign the CSR with the EK using openssl cms and the tpm2tss engine. With that, I need the transient handle of the EK that corresponds to the public key held in the cert. located in TPM NV slot 0x01c0000a.
From: Sievert, James <james.sievert(a)bsci.com<mailto:james.sievert(a)bsci.com>>
Sent: Thursday, March 3, 2022 11:18 PM
To: tpm2(a)lists.01.org<mailto:tpm2(a)lists.01.org>
Subject: {External} [tpm2] tpm2_createprimary to a transient handle...
Hi,
Is there a way to get the result of tpm2_createprimary loaded into a transient handle?
Thanks.
attachment.htm
(text/html, 6 KB)
<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"DejaVu Sans";
panose-1:2 11 6 3 3 8 4 2 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
span.pfptpreheader1
{mso-style-name:pfptpreheader1;
display:none;}
span.pfpttitlemso1
{mso-style-name:pfpttitlemso1;
font-family:"Arial",sans-serif;
color:black;
font-weight:bold;}
span.pfptsubtitlemso1
{mso-style-name:pfptsubtitlemso1;
font-family:"Arial",sans-serif;}
span.EmailStyle36
{mso-style-type:personal-reply;
font-family:"DejaVu Sans",sans-serif;
color:windowtext;
font-weight:normal;
font-style:normal;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-family:"DejaVu Sans",sans-serif">In general (not the command line tools), the create primary result stays loaded.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"DejaVu Sans",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:"DejaVu Sans",sans-serif">However, the EK is not a signing key. It cannot sign anything.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"DejaVu Sans",sans-serif"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal" style="margin-left:.5in"><b>From:</b> Sievert, James <[email protected]>
<br>
<b>Sent:</b> Friday, March 4, 2022 8:23 AM<br>
<b>To:</b> [email protected]<br>
<b>Subject:</b> [EXTERNAL] [tpm2] Re: tpm2_createprimary to a transient handle...<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal" style="margin-left:.5in"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><span class="pfptpreheader1"><span style="font-size:1.0pt;color:white">More specifically, I’m looking at how to implement Section 2.1.2.2 of TCG Credential Profile EK 2.0 (trustedcomputinggroup.org). I need to sign
the CSR with the EK using openssl cms and the tpm2tss engine. With that, I need the transient
</span></span><span style="font-size:1.0pt;color:white">ZjQcmQRYFpfptBannerStart</span>
<o:p></o:p></p>
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" width="100%" style="width:100.0%;margin-left:.5in;border-radius:4px">
<tbody>
<tr>
<td style="padding:2.25pt 0in 12.0pt 0in">
<table class="MsoNormalTable" border="1" cellspacing="0" cellpadding="0" width="100%" style="width:100.0%;background:#D0D8DC;border:none;border-top:solid #90A4AE 3.0pt">
<tbody>
<tr>
<td valign="top" style="border:none;padding:0in 7.5pt 3.75pt 4.5pt">
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" align="left">
<tbody>
<tr>
<td style="padding:3.0pt 6.0pt 3.0pt 6.0pt">
<p class="MsoNormal"><span class="pfpttitlemso1"><span style="font-size:10.5pt">This Message Is From an External Sender
</span></span><o:p></o:p></p>
</td>
</tr>
<tr>
<td style="padding:3.0pt 6.0pt 3.0pt 6.0pt">
<p class="MsoNormal"><span class="pfptsubtitlemso1"><span style="font-size:9.0pt">This message came from outside your organization.
</span></span><o:p></o:p></p>
</td>
</tr>
</tbody>
</table>
</td>
</tr>
</tbody>
</table>
</td>
</tr>
</tbody>
</table>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:1.0pt;color:white">ZjQcmQRYFpfptBannerEnd<br>
<br>
</span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in">More specifically, I’m looking at how to implement Section 2.1.2.2 of
<a href="https://trustedcomputinggroup.org/wp-content/uploads/TCG_IWG_EKCredentialProfile_v2p4_r3.pdf">TCG Credential Profile EK 2.0 (trustedcomputinggroup.org)</a>. I need to sign the CSR with the EK using openssl cms and the tpm2tss engine. With that, I need the transient handle of the EK that corresponds to the public key held in the cert. located in TPM
NV slot 0x01c0000a.<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><o:p> </o:p></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal" style="margin-left:.5in"><b>From:</b> Sievert, James <<a href="mailto:[email protected]">[email protected]</a>>
<br>
<b>Sent:</b> Thursday, March 3, 2022 11:18 PM<br>
<b>To:</b> <a href="mailto:[email protected]">[email protected]</a><br>
<b>Subject:</b> {External} [tpm2] tpm2_createprimary to a transient handle...<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal" style="margin-left:.5in"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-left:.5in">Hi,<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-left:.5in">Is there a way to get the result of tpm2_createprimary loaded into a transient handle?<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-left:.5in">Thanks.<o:p></o:p></p>
</div>
</body>
</html>