Key management
Can generate keys internally, and export them.
Public keys can be exported unprotected.
Private keys can be exported protected. Wrapped.
Can import keys, previously exported by itself, produced by others.
TPM as a key cache
Many times keys must be used within the TPM-confined environment, but the TPM resources should not limit their number.
Solution:
Off-load keys to external repositories (wrapped)
Import keys of interest
Use cached keys
Clear cached keys from TPM
Key trees (aka key hierarchies)
Sequence of keys.
Starting from a top-most, primary key
Hierarchies can have several key trees
Primary keys are generated from hierarchy seeds and a public template:
Algorithm, key size, policy, usage.
Arbitrary data (kind of label).
The key derivation is idempotent.
Same seed, same template -> same key.
Storage keys
Keys that encrypt keys.
A storage key is a parent of a child's key.
It can be used to wrap the child key.
For exporting it.
They cannot be used for arbitrary decryption.
It could compromise wrapped child keys.
Changing seeds
Different seed -> different key tree, the previous one is naturally flushed.
This should not happen to the endorsement seed.
Because endorsement keys are pre-certified by the TPM manufacturer.
Getting the certification again is complex.
Can only be changed by the platform builder (OEM).
This is not an issue for the platform owner.
New keys can always be created with different templates.
Endorsement primary keys
Need to be certified by the TPM manufacturer.
The TPM manufacturer uses it to generate candidate primary keys.
Using well-defined templates.
The public keys are exported and certified.
The manufacturer keeps the certificates.
The keys are removed from the TPM.
The TPM keeps the seed that allows the recreation of keys with the same templates used by the manufacturer.
Key duplication
Copy of a key into a different hierarchy. It continues to exist in its original place.
Primary keys cannot be duplicated
Because they cannot be wrapped.
They are generated from a seed.
And a template.
Duplication of parent keys can duplicate their children.
Duplication group.
Key attributes
Type
Symmetric
Asymmetric
Usage
Signing
Encryption
Decryption
User restrictions
Restrict signing
Attestation
Restrict decryption
Storage
Duplication restrictions
Fixed TPM
Cannot be duplicated
Fixed parent
Can only be duplicated under a duplicated parent
Last updated
