Re: [Tpm2] help regarding how to create NV under platform hierarchy

You're trying to define the NV index in the platform hierarchy which is usually locked out with a password. This is what the -Cp option is doing. Any particular reason for that? If you leave off -Cp option or do -Co it will use the owner hierarchy which is usually what normal users use to create NV indices but you still need the owner password if it is set.

You can query if the owner password is set by:
tpm2_getcap properties-variable
TPM2_PT_PERMANENT:
  ownerAuthSet:              0
  endorsementAuthSet:        0
  lockoutAuthSet:            0
  reserved1:                 0
  disableClear:              0
  inLockout:                 0
  tpmGeneratedEPS:           1
  reserved2:                 0

<snip>
Note the ownerAuthSet bit under TPM2_PT_PERMANENT. You can pass the password for the owner hiearchy if it's set by using the -P (capital P) option.
________________________________
From: Tpm2 <[email protected]> on behalf of SAI VAMSEE KRISHNA Lankisetti via Tpm2 <[email protected]>
Sent: Monday, July 10, 2023 1:48 AM
To: [email protected] <[email protected]>
Cc: Ravindra Sure <[email protected]>
Subject: [Tpm2] help regarding how to create NV under platform hierarchy

Hi Folks,
I am new to tpm2.


I am trying to create NV index under platform hierarchy using tpm2-tools but getting below error.

tpm2_nvdefine 0x01000000 -C p -s 32 -a "ppwrite|ppread|platformcreate" WARNING:esys:src/tss2-esys/api/Esys_NV_DefineSpace.c:337:Esys_NV_DefineSpace_Finish() Received TPM Error ERROR:esys:src/tss2-esys/api/Esys_NV_DefineSpace.c:122:Esys_NV_DefineSpace() Esys Finish ErrorCode (0x000009a2) ERROR: Failed to define NV area at index 0x1000000 ERROR: Esys_NV_DefineSpace(0x9A2) - tpm:session(1):authorization failure without DA implications ERROR: Failed to create NV index 0x1000000.


need help regarding above error and how to create nv index in platform hierarchy
if I create nv index in owner hierarchy tmp2_clear will remove the NV index which i don't want to happen so I am trying to create in platform hierarchy.

are there any ways to store a symmetric key in TPM for external use other than nv index?

Thanks,
Vamsee Krishna.