Re: [Tpm2] is it possible to create a child public that can be use to encrypt data externally ?

I am not quite sure I understand your question, but maybe some ideas.

You can create a variety of primary keys and normal keys. What you should make sure is that the decrypt bit in in attributes is set and the restricted bit is not set.

You can also create a keypair externally to the TPM and then import the private key into the TPM for protection using tpm2_import.

Finally, the TPM performs only asymmetric decryption. If your data is longer, then you should generate an AES key for data encryption and then encrypt this AES key with the TPM public key.
This scheme is called “hybrid encryption”.

I hope this has some hints for you, or just keep asking.

Cheers,
Andreas

From: Tpm2 <[email protected]> On Behalf Of benzwt benzwt
Sent: Donnerstag, 15. Juni 2023 17:25
To: [email protected]
Subject: [Tpm2] is it possible to create a child public that can be use to encrypt data externally ?

Caution: This e-mail originated outside Infineon Technologies. Do not click on links or open attachments unless you validate it is safe<https://intranet-content.infineon.com/explore/aboutinfineon/rules/informationsecurity/ug/SocialEngineering/Pages/SocialEngineeringElements_en.aspx>.


Hi Folks,

I am new to tpm2.
I would to create a child key from a primary key.
I need to encrypt my data with the child public key externally.
After that, this encrypted data will be sent to the TPM for decryption.
Provided that, the TPM with only perform the decryption if the encrypted data was encrypted by a public key cat be linked back to primary key; in other words, the TPM will not perform decryption if the public key does not come from itself.
It is possible to do that ? Are there any work around ?

BTW,  I tried to miss-use the endorsement key, makecrendential and active-crential to do the job I have mentioned above. But I failed, because the size of encrypted blob must be less than or equal to 64 bytes which is why too small for my data.

Best regards,
benzwt