[tpm2] Re: tpm2_createprimary to a transient handle...
Sievert, James <james.sievert at bsci.com>
| Newsgroups | dev.linux.lists.tpm2 |
|---|---|
| Message-ID | < <DS7PR03MB55763E0E8D44B2345120E4269A059@DS7PR03MB5576.namprd03.prod.outlook.com>> |
* However, the EK is not a signing key. It cannot sign anything.
Section 2.1.2.2 of TCG Credential Profile EK 2.0 (trustedcomputinggroup.org)<https://trustedcomputinggroup.org/wp-content/uploads/TCG_IWG_EKCredentialProfile_v2p4_r3.pdf> contradicts your statement:
"For such platforms, privacy is not a central concern and unique identification is of critical importance. These platforms MAY use a certified EK for signing operations."
From: Kenneth Goldman <kgoldman(a)us.ibm.com>
Sent: Friday, March 4, 2022 8:31 AM
To: Sievert, James <james.sievert(a)bsci.com>; tpm2(a)lists.01.org
Subject: {External} RE: tpm2_createprimary to a transient handle...
In general (not the command line tools), the create primary result stays loaded.
However, the EK is not a signing key. It cannot sign anything.
From: Sievert, James <james.sievert(a)bsci.com<mailto:james.sievert(a)bsci.com>>
Sent: Friday, March 4, 2022 8:23 AM
To: tpm2(a)lists.01.org<mailto:tpm2(a)lists.01.org>
Subject: [EXTERNAL] [tpm2] Re: tpm2_createprimary to a transient handle...
More specifically, I'm looking at how to implement Section 2.1.2.2 of TCG Credential Profile EK 2.0 (trustedcomputinggroup.org). I need to sign the CSR with the EK using openssl cms and the tpm2tss engine. With that, I need the transient ZjQcmQRYFpfptBannerStart
This Message Is From an External Sender
This message came from outside your organization.
ZjQcmQRYFpfptBannerEnd
More specifically, I'm looking at how to implement Section 2.1.2.2 of TCG Credential Profile EK 2.0 (trustedcomputinggroup.org)<https://trustedcomputinggroup.org/wp-content/uploads/TCG_IWG_EKCredentialProfile_v2p4_r3.pdf>. I need to sign the CSR with the EK using openssl cms and the tpm2tss engine. With that, I need the transient handle of the EK that corresponds to the public key held in the cert. located in TPM NV slot 0x01c0000a.
From: Sievert, James <james.sievert(a)bsci.com<mailto:james.sievert(a)bsci.com>>
Sent: Thursday, March 3, 2022 11:18 PM
To: tpm2(a)lists.01.org<mailto:tpm2(a)lists.01.org>
Subject: {External} [tpm2] tpm2_createprimary to a transient handle...
Hi,
Is there a way to get the result of tpm2_createprimary loaded into a transient handle?
Thanks.
attachment.htm
(text/html, 9.4 KB)
<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:dt="uuid:C2F41010-65B3-11d1-A29F-00AA00C14882" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"DejaVu Sans";}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.pfptpreheader1
{mso-style-name:pfptpreheader1;
display:none;}
span.pfpttitlemso1
{mso-style-name:pfpttitlemso1;
font-family:"Arial",sans-serif;
color:black;
font-weight:bold;}
span.pfptsubtitlemso1
{mso-style-name:pfptsubtitlemso1;
font-family:"Arial",sans-serif;}
span.EmailStyle24
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:1256093150;
mso-list-type:hybrid;
mso-list-template-ids:-1984284272 -237612856 67698691 67698693 67698689 67698691 67698693 67698689 67698691 67698693;}
@list l0:level1
{mso-level-start-at:2;
mso-level-number-format:bullet;
mso-level-text:\F0D8;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Wingdings;
mso-fareast-font-family:Calibri;
mso-bidi-font-family:"Times New Roman";}
@list l0:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:"Courier New";}
@list l0:level3
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Wingdings;}
@list l0:level4
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Symbol;}
@list l0:level5
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:"Courier New";}
@list l0:level6
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Wingdings;}
@list l0:level7
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Symbol;}
@list l0:level8
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:"Courier New";}
@list l0:level9
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Wingdings;}
ol
{margin-bottom:0in;}
ul
{margin-bottom:0in;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72" style="word-wrap:break-word">
<div class="WordSection1">
<ul style="margin-top:0in" type="disc">
<li class="MsoListParagraph" style="margin-left:0in;mso-list:l0 level1 lfo1"><span style="font-family:"DejaVu Sans"">However, the EK is not a signing key. It cannot sign anything.<o:p></o:p></span></li></ul>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Section 2.1.2.2 of <a href="https://trustedcomputinggroup.org/wp-content/uploads/TCG_IWG_EKCredentialProfile_v2p4_r3.pdf">
TCG Credential Profile EK 2.0 (trustedcomputinggroup.org)</a> contradicts your statement:<br>
<br>
“For such platforms, privacy is not a central concern and unique identification is of critical importance. These platforms MAY use a certified EK for signing operations.”<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b>From:</b> Kenneth Goldman <[email protected]> <br>
<b>Sent:</b> Friday, March 4, 2022 8:31 AM<br>
<b>To:</b> Sievert, James <[email protected]>; [email protected]<br>
<b>Subject:</b> {External} RE: tpm2_createprimary to a transient handle...<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="font-family:"DejaVu Sans"">In general (not the command line tools), the create primary result stays loaded.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"DejaVu Sans""><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:"DejaVu Sans"">However, the EK is not a signing key. It cannot sign anything.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"DejaVu Sans""><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal" style="margin-left:.5in"><b>From:</b> Sievert, James <<a href="mailto:[email protected]">[email protected]</a>>
<br>
<b>Sent:</b> Friday, March 4, 2022 8:23 AM<br>
<b>To:</b> <a href="mailto:[email protected]">[email protected]</a><br>
<b>Subject:</b> [EXTERNAL] [tpm2] Re: tpm2_createprimary to a transient handle...<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal" style="margin-left:.5in"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><span class="pfptpreheader1"><span style="font-size:1.0pt;color:white">More specifically, I’m looking at how to implement Section 2.1.2.2 of TCG Credential Profile EK 2.0 (trustedcomputinggroup.org). I need to sign
the CSR with the EK using openssl cms and the tpm2tss engine. With that, I need the transient
</span></span><span style="font-size:1.0pt;color:white">ZjQcmQRYFpfptBannerStart</span>
<o:p></o:p></p>
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" width="100%" style="width:100.0%;margin-left:.5in;border-radius:4px">
<tbody>
<tr>
<td style="padding:2.25pt 0in 12.0pt 0in">
<table class="MsoNormalTable" border="1" cellspacing="0" cellpadding="0" width="100%" style="width:100.0%;background:#D0D8DC;border:none;border-top:solid #90A4AE 3.0pt">
<tbody>
<tr>
<td valign="top" style="border:none;padding:0in 7.5pt 3.75pt 4.5pt">
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" align="left">
<tbody>
<tr>
<td style="padding:3.0pt 6.0pt 3.0pt 6.0pt">
<p class="MsoNormal"><span class="pfpttitlemso1"><span style="font-size:10.5pt">This Message Is From an External Sender
</span></span><o:p></o:p></p>
</td>
</tr>
<tr>
<td style="padding:3.0pt 6.0pt 3.0pt 6.0pt">
<p class="MsoNormal"><span class="pfptsubtitlemso1"><span style="font-size:9.0pt">This message came from outside your organization.
</span></span><o:p></o:p></p>
</td>
</tr>
</tbody>
</table>
</td>
</tr>
</tbody>
</table>
</td>
</tr>
</tbody>
</table>
<p class="MsoNormal" style="mso-margin-top-alt:0in;margin-right:0in;margin-bottom:12.0pt;margin-left:.5in">
<span style="font-size:1.0pt;color:white">ZjQcmQRYFpfptBannerEnd</span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in">More specifically, I’m looking at how to implement Section 2.1.2.2 of
<a href="https://trustedcomputinggroup.org/wp-content/uploads/TCG_IWG_EKCredentialProfile_v2p4_r3.pdf">
TCG Credential Profile EK 2.0 (trustedcomputinggroup.org)</a>. I need to sign the CSR with the EK using openssl cms and the tpm2tss engine. With that, I need the transient handle of the EK that corresponds to the public key held in the cert. located in TPM
NV slot 0x01c0000a.<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><o:p> </o:p></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal" style="margin-left:.5in"><b>From:</b> Sievert, James <<a href="mailto:[email protected]">[email protected]</a>>
<br>
<b>Sent:</b> Thursday, March 3, 2022 11:18 PM<br>
<b>To:</b> <a href="mailto:[email protected]">[email protected]</a><br>
<b>Subject:</b> {External} [tpm2] tpm2_createprimary to a transient handle...<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal" style="margin-left:.5in"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-left:.5in">Hi,<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-left:.5in">Is there a way to get the result of tpm2_createprimary loaded into a transient handle?<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-left:.5in">Thanks.<o:p></o:p></p>
</div>
</body>
</html>