Timeline for TPM Endorsement Key usage in secure and trusted boot
Current License: CC BY-SA 4.0
4 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Mar 22, 2022 at 20:55 | comment | added | sau_t | AIK is also generated inside the TPM or outside, but encrypted by EK. External Service provider like Private PKI (outside TPM) or any other process (Internal) can verify the AIK and EK via trusted CA and verify that AIK is bound to EK. So, PCR register values (Quote) is signed by AIK (Inside TPM) which can be verified by external service provider (outside TPM) or internally as per the process. TPM itself does not verify anything; it is a part of other processes, such as secure boot. I've updated the answer w.r.t local attestation where you do not need AIK. | |
| Mar 22, 2022 at 20:52 | history | edited | sau_t | CC BY-SA 4.0 |
Added note for trusted and secure boot.
|
| Mar 22, 2022 at 19:30 | comment | added | Engineer999 | Thanks for your reply. You state "These AIK keys can be used to generate signatures. One of the use cases is signing the contents of PCR register." Do you mean the signing of the contents from the device side with the TPM and then verified outside the device? or vice-versa, contents signed outside the device and then verified on the device by the TPM? | |
| Mar 22, 2022 at 13:36 | history | answered | sau_t | CC BY-SA 4.0 |