tpm.dev.tutorials/TPM-Commands/TPM2_MakeCredential.md
2021-05-19 16:15:27 -05:00

1.5 KiB

TPM2_MakeCredential()

TPM2_MakeCredential() takes an EKpub, the name of an object in a TPM identified by that EKpub, and a small secret, and it encrypts {name, secret} to the EKpub.

Nothing terribly interesting happens here. All the interesting semantics are on the TPM2_ActivateCredential() side.

Together with TPM2_ActivateCredential(), this function can be used to implement attestation protocols.

Inputs

  • TPMI_DH_OBJECT handle (e.g., an EKpub to encrypt to)
  • TPM2B_DIGEST credential (not necessarily a digest, but a small [digest-sized] secret)
  • TPM2B_NAME objectName (name of object resident on the same TPM as handle that TPM2_ActivateCredential() will check)

Outputs

  • TPM2B_ID_OBJECT credentialBlob (ciphertext of encryption of credential with a secret "seed" [see below])
  • TPM2B_ENCRYPTED_SECRET secret (ciphertext of encryption of a "seed" to handle)

References