Re: [Tpm2] help regarding how to create NV under platform hierarchy

Hi ,
   I am trying to use TPM to store symmetric keys and retrieve them from TPM whenever needed. First, I created a symmetric in TPM and tried to use it, but I came to know that private key which is the symmetric key doesn't come out of TPM. Then I thought NV index will be good to store the keys with some authentication. But NV Index defined in owner hierarchy is not persistent with TPM clear and reset. I have read in below link that NV index can't be cleared using tpm2_clear when defined in platform hierarchy . But unable to create it .
https://github.com/Infineon/optiga-tpm-cheatsheet#nv-storage

I have few questions

  1.  is there way to access randomly set platform hierarchy authentication through TPM software stack ?
  2.  does NV index defined through platform hierarchy is persistent unless we undefine it manually ?
  3.  I tried to use tpm2_clearcontrol to disable tpm2_clear but it also requires
platform authentication . can we disable clear from owner hierarchy ?
  4.  I came across other solution to store keys using seal and unseal from below links
https://github.com/tpm2-software/tpm2-tools/issues/3246

https://github.com/tpm2-software/tpm2-tools/issues/3180#issuecomment-1354996963

  *
can you let me know what sealing and unsealing the key means here?
  *
where will the sealed data reside in TPM ?
  *
can we get a sealed data object so that after TPM clear or reset it can be loaded into TPM again and used for unsealing ?


Thanks,
Vamsee Krishna.

________________________________
From: Roberts, William C <[email protected]>
Sent: 10 July 2023 20:17
To: [email protected] <[email protected]>; SAI VAMSEE KRISHNA Lankisetti <[email protected]>
Cc: Ravindra Sure <[email protected]>
Subject: [EXTERNAL] Re: [Tpm2] help regarding how to create NV under platform hierarchy

You're trying to define the NV index in the platform hierarchy which is usually locked out with a password. This is what the -Cp option is doing. Any particular reason for that? If you leave off -Cp option or do -Co it will use the owner hierarchy
ZjQcmQRYFpfptBannerStart
This Message Is From an External Sender
This message came from outside your organization.
<https://us-phishalarm-ewt.proofpoint.com/EWT/v1/PjiDSg!1e-trX6zRvm6lYv7uAElbjDV-N1WPgO-Z4rd5Cvb-R7oRVgpFx77CzoyPG6-k0ArvQdtiFKelJJQC_MYkaTD0hOPIiXdeeNnWjy7rvV08EgKHEOlpNl6WqVbTe9uPO-7HENoanchZZr0XCkxSNdK6wWs$>
Report Suspicious

ZjQcmQRYFpfptBannerEnd
You're trying to define the NV index in the platform hierarchy which is usually locked out with a password. This is what the -Cp option is doing. Any particular reason for that? If you leave off -Cp option or do -Co it will use the owner hierarchy which is usually what normal users use to create NV indices but you still need the owner password if it is set.

You can query if the owner password is set by:
tpm2_getcap properties-variable
TPM2_PT_PERMANENT:
  ownerAuthSet:              0
  endorsementAuthSet:        0
  lockoutAuthSet:            0
  reserved1:                 0
  disableClear:              0
  inLockout:                 0
  tpmGeneratedEPS:           1
  reserved2:                 0

<snip>
Note the ownerAuthSet bit under TPM2_PT_PERMANENT. You can pass the password for the owner hiearchy if it's set by using the -P (capital P) option.
________________________________
From: Tpm2 <[email protected]> on behalf of SAI VAMSEE KRISHNA Lankisetti via Tpm2 <[email protected]>
Sent: Monday, July 10, 2023 1:48 AM
To: [email protected] <[email protected]>
Cc: Ravindra Sure <[email protected]>
Subject: [Tpm2] help regarding how to create NV under platform hierarchy

Hi Folks,
I am new to tpm2.


I am trying to create NV index under platform hierarchy using tpm2-tools but getting below error.

tpm2_nvdefine 0x01000000 -C p -s 32 -a "ppwrite|ppread|platformcreate" WARNING:esys:src/tss2-esys/api/Esys_NV_DefineSpace.c:337:Esys_NV_DefineSpace_Finish() Received TPM Error ERROR:esys:src/tss2-esys/api/Esys_NV_DefineSpace.c:122:Esys_NV_DefineSpace() Esys Finish ErrorCode (0x000009a2) ERROR: Failed to define NV area at index 0x1000000 ERROR: Esys_NV_DefineSpace(0x9A2) - tpm:session(1):authorization failure without DA implications ERROR: Failed to create NV index 0x1000000.


need help regarding above error and how to create nv index in platform hierarchy
if I create nv index in owner hierarchy tmp2_clear will remove the NV index which i don't want to happen so I am trying to create in platform hierarchy.

are there any ways to store a symmetric key in TPM for external use other than nv index?

Thanks,
Vamsee Krishna.