I am dealing with the TPM right now and do not get why there is a need for an extra signing key. Instead one could use one of the AIKs for signing as well?! Using different keys shall be good practice but I would like to get a more detailed view on that issue.

I figured out that one advantage is that the signing key can be migratable. So changing the plattform/tpm would not necessarily end in revoking the created certificates.

Are there further reasons for a separate signing key?

I am dealing with the TPM right now and do not get why there is a need for an extra signing key. Instead one could use one of the Attestation Identity Keys (AIKs) for signing as well?! Using different keys shall be good practice but I would like to get a more detailed view on that issue.

I figured out that one advantage is that the signing key can be migratable. So changing the plattform/tpm would not necessarily end in revoking the created certificates.

Are there further reasons for a separate signing key?

I am dealing with the TPM right now and do not get why there is a need for an extra signing key. Instead one could use one of the AIKs for signing as well?! Using different keys shall be good practice but I would like to get a more detailed view on that issue.

Thanks in advance!

onb

EDIT: Meanwhile I figured out that one advantage is that the signing key can be migratable. So changing the plattform/tpm would not necessarily end in revoking the created certificates.

I am dealing with the TPM right now and do not get why there is a need for an extra signing key. Instead one could use one of the AIKs for signing as well?! Using different keys shall be good practice but I would like to get a more detailed view on that issue.

I figured out that one advantage is that the signing key can be migratable. So changing the plattform/tpm would not necessarily end in revoking the created certificates.

Are there further reasons for a separate signing key?

I am dealing with the TPM right now and do not get why there is a need for an extra signing key. Instead one could use one of the AIKs for signing as well?! Using different keys shall be good practice but I would like to get a more detailed view on that issue.

Thanks in advance!

onb

I am dealing with the TPM right now and do not get why there is a need for an extra signing key. Instead one could use one of the AIKs for signing as well?! Using different keys shall be good practice but I would like to get a more detailed view on that issue.

Thanks in advance!

onb

EDIT: Meanwhile I figured out that one advantage is that the signing key can be migratable. So changing the plattform/tpm would not necessarily end in revoking the created certificates.