fmaury/tpm.dev.tutorials
1
0
Fork 0
mirror of https://github.com/tpm2dev/tpm.dev.tutorials.git synced 2024-09-19 20:32:11 +00:00
Code Issues Projects Releases Packages Wiki Activity
tpm.dev.tutorials/TPM-Commands/TPM2_ActivateCredential.md
Nicolas Williams 3b4191c0ae Expand on restricted keys; describe more TPM commands
2021-05-19 16:15:27 -05:00

1.6 KiB
Raw Blame History

TPM2_ActivateCredential()

TPM2_ActivateCredential() decrypts a ciphertext made by TPM2_MakeCredential() and checks that the caller has access to the object named by the caller of TPM2_MakeCredential(), and if so then TPM2_ActivateCredential() outputs the small secret provided by the caller of TPM2_MakeCredential(), otherwise TPM2_ActivateCredential() fails.

Together with TPM2_MakeCredential(), this function can be used to implement attestation protocols.

Inputs

  • TPMI_DH_OBJECT activateHandle (e.g., handle for an AK)
  • TPMI_DH_OBJECT keyHandle (e.g., handle for an EK corresponding to the EKpub encrypted to by TPM2_MakeCredential())
  • TPM2B_ID_OBJECT credentialBlob (output of TPM2_MakeCredential())
  • TPM2B_ENCRYPTED_SECRET secret (output of TPM2_MakeCredential())

Outputs (success case)

  • TPM2B_DIGEST certInfo (not necessarily a digest, but a small [digest-sized] secret that was input to TPM2_MakeCredential())

References