3:07 a.m.
Hello All,
Need information Regarding the FAPI for the following
• Does FAPI_createKey support symmetric key creation
• Is there any Template for the crypto profile used in FAPI
• How to specify the Unique value in the profile while creating the SRK
• Can multiple profiles be used in FAPI and provisioned individually
Regards
Phani
5:05 p.m.
Hi Phani,
• Does FAPI_createKey support symmetric key creation
No it does not. Reason is that most TPMs do not support it.
• Is there any Template for the crypto profile used in FAPI
I don't know what you mean by this?
By default, our implementation comes with two example profiles. RSA2kSHA256 and
ECCP256SHA256
to be chosen in fapi-config file.
• How to specify the Unique value in the profile while creating the SRK
This is currently not forseen. Is this really necessary ?
We're currently using the most-used template.
• Can multiple profiles be used in FAPI and provisioned individually
Yes, you can provision multiple profiles by changing the profile in the config and calling
provision again.
Just make sure that the persistent handles for the SRKs do not collide (inside the
profile).
Then you can always access all provisioned profiles.
Hope this helps,
Andreas
7:18 p.m.
-----Original Message-----
From: Fuchs, Andreas <andreas.fuchs(a)sit.fraunhofer.de>
Sent: Tuesday, July 21, 2020 3:05 AM
To: phani.srinivas(a)in.abb.com; tpm2(a)lists.01.org
Subject: [tpm2] Re: Information Needed on FAPI Usage
Hi Phani,
* Does FAPI_createKey support symmetric key creation
No it does not. Reason is that most TPMs do not support it.
* Is there any Template for the crypto profile used in FAPI
I don't know what you mean by this?
By default, our implementation comes with two example profiles. RSA2kSHA256
and ECCP256SHA256 to be chosen in fapi-config file.
* How to specify the Unique value in the profile while creating the SRK
This is currently not forseen. Is this really necessary ?
We're currently using the most-used template.
Andreas is this not true, am I misreading the code?
My response yesterday:
I don't think there is.... the SRK follows the EK but with a few
changes.
https://trustedcomputinggroup.org/wp-content/uploads/TCG-TPM-v2.0-
Provisioning-Guidance-Published-v1r1.pdf
https://trustedcomputinggroup.org/wp-
content/uploads/Credential_Profile_EK_V2.0_R14_published.pdf
So the unique values come from reading the NV index and it looks like
ifapi_init_primary_async() handles that case.
https://github.com/tpm2-software/tpm2-
tss/blob/72ecf7c1eec2c40f9daf93f9ac3eaedc5afb95e0/src/tss2-fapi/fapi_u
til.c
>
> * Can multiple profiles be used in FAPI and provisioned individually
> Yes, you can provision multiple profiles by changing the profile in the config and
> calling provision again.
> Just make sure that the persistent handles for the SRKs do not collide (inside the
> profile).
> Then you can always access all provisioned profiles.
>
> Hope this helps,
> Andreas
> _______________________________________________
> tpm2 mailing list -- tpm2(a)lists.01.org
> To unsubscribe send an email to tpm2-leave(a)lists.01.org
> %(web_page_url)slistinfo%(cgiext)s/%(_internal_name)s
7:34 p.m.
> * How to specify the Unique value in the profile while
creating the SRK
> This is currently not forseen. Is this really necessary ?
> We're currently using the most-used template.
Andreas is this not true, am I misreading the code?
My response yesterday:
> I don't think there is.... the SRK follows the EK but with a few changes.
> https://trustedcomputinggroup.org/wp-content/uploads/TCG-TPM-v2.0-
> Provisioning-Guidance-Published-v1r1.pdf
> https://trustedcomputinggroup.org/wp-
> content/uploads/Credential_Profile_EK_V2.0_R14_published.pdf
>
> So the unique values come from reading the NV index and it looks like
> ifapi_init_primary_async() handles that case.
> https://github.com/tpm2-software/tpm2-
> tss/blob/72ecf7c1eec2c40f9daf93f9ac3eaedc5afb95e0/src/tss2-fapi/fapi_u
> til.c
For the EK, we follow the Credential Profile (which includes the Unique value of
64/256 Zeros. We need to do so, because of the EK Cert.
For the SRK we deviate, because most SRKs have a Unique value of 0 length;
which is different from the Provisioning Guidance.
That choice was made based on SRKs "in the wild" for which none set the
Unique value (pkcs11 and both openssl-engines).
Also should not matter too much, because you can retrieve the exact SRK that
was used for the primary from the FAPI API or the SRK is even persistent.
224
days inactive
225
days old
3 comments
3 participants
participants (3)
-
Fuchs, Andreas -
phani.srinivas＠in.abb.com -
Roberts, William C