> For the complete documentation index, see [llms.txt](https://davidjosearaujo.gitbook.io/notes-mcs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://davidjosearaujo.gitbook.io/notes-mcs/secure-execution-environments/tpm-trusted-platform-module/key-management.md). # Key management Can generate keys internally, and export them. * Public keys can be exported unprotected. * Private keys can be exported protected. Wrapped. Can import keys, previously exported by itself, produced by others. ## TPM as a key cache Many times keys must be used within the TPM-confined environment, but the TPM resources should not limit their number. Solution: * Off-load keys to external repositories (wrapped) * Import keys of interest * Use cached keys * Clear cached keys from TPM ## Key trees (aka key hierarchies) Sequence of keys. * Starting from a top-most, primary key * Hierarchies can have several key trees Primary keys are generated from hierarchy seeds and a public template: * Algorithm, key size, policy, usage. * Arbitrary data (kind of label). The key derivation is idempotent. * Same seed, same template -> same key. ### Storage keys
Keys that encrypt keys. * A storage key is a parent of a child's key. * It can be used to wrap the child key. * For exporting it. They cannot be used for arbitrary decryption. * It could compromise wrapped child keys. ### Changing seeds Different seed -> different key tree, the previous one is naturally flushed. This should not happen to the endorsement seed. * Because endorsement keys are pre-certified by the TPM manufacturer. * Getting the certification again is complex. * Can only be changed by the platform builder (OEM). * This is not an issue for the platform owner. * New keys can always be created with different templates. ### Endorsement primary keys Need to be certified by the TPM manufacturer. * The TPM manufacturer uses it to generate candidate primary keys. * Using well-defined templates. * The public keys are exported and certified. * The manufacturer keeps the certificates. * The keys are removed from the TPM. * The TPM keeps the seed that allows the recreation of keys with the same templates used by the manufacturer. ## Key duplication Copy of a key into a different hierarchy. It continues to exist in its original place. Primary keys cannot be duplicated * Because they cannot be wrapped. * They are generated from a seed. * And a template. Duplication of parent keys can duplicate their children. * Duplication group. ## Key attributes ### Type * Symmetric * Asymmetric ### Usage * Signing * Encryption * Decryption ### User restrictions * Restrict signing * Attestation * Restrict decryption * Storage ### Duplication restrictions * Fixed TPM * Cannot be duplicated * Fixed parent * Can only be duplicated under a duplicated parent