Skip to content

Latest commit

 

History

History
90 lines (59 loc) · 3.03 KB

tpm2_makecredential.1.md

File metadata and controls

90 lines (59 loc) · 3.03 KB

% tpm2_makecredential(1) tpm2-tools | General Commands Manual

NAME

tpm2_makecredential(1) - Generate the encrypted-user-chosen-data and the wrapped-secret-data-encryption-key for the privacy-sensitive credentialing process of a TPM object.

SYNOPSIS

tpm2_makecredential [OPTIONS]

DESCRIPTION

tpm2_makecredential(1) - The TPM supports a privacy preserving protocol for distributing credentials for keys on a TPM. The process guarantees that the credentialed-TPM-object(AIK) is loaded on the same TPM as a well-known public-key-object(EK) without knowledge of the specific public properties of the credentialed-TPM-object(AIK). The privacy is guaranteed due to the fact that only the name of the credentialed-TPM-object(AIK) is shared and not the credentialed-TPM-object's public key itself.

Make-credential is the first step in this process where in after receiving the public-key-object(EK) public key of the TPM and the name of the credentialed-TPM-object(AIK), an encrypted-user-chosen-data is generated and the secret-data-encryption-key is generated and wrapped using cryptographic processes specific to credential activation that guarantees that the credentialed-TPM-object(AIK) is loaded on the TPM with the well-known public-key-object(EK).

tpm2_makecredential can be used to generate the encrypted-user-chosen-data and the wrapped secret-data-encryption-key without a TPM by using the none TCTI option.

OPTIONS

  • -e, --encryption-key=FILE:

    DEPRECATED, use -u or --public instead.

  • -u, --public=FILE:

    A TPM public key which was used to wrap the seed. NOTE: This option is same as -e and is added to make it similar with other tools specifying the public key. The old option is retained for backwards compatibility.

  • -G, --key-algorithm=ALGORITHM:

    The key algorithm associated with TPM public key. Specify either RSA/ ECC. When this option is used, input public key is expected to be in PEM format and the default TCG EK template is used for the key properties.

  • -s, --secret=FILE or STDIN:

    The secret which will be protected by the key derived from the random seed. It can be specified as a file or passed from stdin.

  • -n, --name=FILE:

    The name of the key for which certificate is to be created.

  • -o, --credential-blob=FILE:

    The output file path, recording the encrypted-user-chosen-data and the wrapped secret-data-encryption-key.

common options

common tcti options

EXAMPLES

tpm2 createek -Q -c 0x81010009 -G rsa -u ek.pub

tpm2 createak -C 0x81010009 -c ak.ctx -G rsa -g sha256 -s rsassa -u ak.pub \
-n ak.name -p akpass> ak.out

file_size=`ls -l ak.name | awk {'print $5'}`
loaded_key_name=`cat ak.name | xxd -p -c $file_size`

tpm2 readpublic -c 0x81010009 -o ek.pem -f pem -Q

echo "12345678" | tpm2 makecredential -Q -u ek.pem -s - -n $loaded_key_name \
-o mkcred.out -G rsa

returns

footer