1

What does nvLocked control in a TPM? I've read it makes makes NVRAM access permissions be enforced, but I'd like examples. It is also referred to as permanent, but the documentation is ambiguous. Locked "permanently" until the TPM owner is reset or locked permanently like a programmable fuse?

Improve this question

1 Answer 1

Reset to default
1

According to section 28.2 of Part 1 of the TPM 1.2 specs (found here), nvLocked is the state that the TPM manufacturer can place the TPM in after defining each NV index that will be permanently held in the TPM. A non-permanent index can be defined after nvLocked has been set to true, but it cannot be set as permanent with the D bit set.

This usually comes in to play when the TPM manufacturer stores the endorsement key (EK) cert in NV. They set the D bit of the index, making the EK cert index 0x1000f000, instead of 0x0000f000. This also permanently places the EK cert in the TPM's NV store. Once the TPM is nvLocked, no more NV index can be defined using the D bit. If a platform manufacturer wants to store a platform cert, they will have to do so at index 0x0000f002, instead of being able to permanently define the index at 0x1000f002. The practical effect is that the index can be released, and that same index can be redefined and a new cert can be written.

"Permanent" here means having the same life of the EK. The TPM 1.2 spec optionally allows for the EK to be revokable, but to my knowledge, no TPM manufacturer has ever chosen to implement that option.

Improve this answer
4
  • Is that anything like WRITEDEFINE?
    – Melab
    Commented Jun 20, 2017 at 23:58
  • WRITEDEFINE and nvLocked can both protect data written at an NV index, but in different ways. Once nvLocked is set to true, any index defined with the D bit, and data written at that index, is locked for the lifetime of the TPM. (Really, the life of the EK, which is the life of the TPM for every TPM I'm aware of.) WRITEDEFINE is an NV permission, set when an index is defined. Data written at that index is safe, until the index is cleared and redefined... which can be at any time if that index does not have the D bit set.
    – Lampshade
    Commented Jun 22, 2017 at 13:17
  • And in the case of WRITEDEFINE, what does it mean to "clear" it? Resetting the TPM such that the SRK and everything else is wiped?
    – Melab
    Commented Jul 1, 2017 at 15:06
  • You that "permanent" means the lifespan of the EK. So does that mean a TPM can be informed that the EK is revoked and unlock itself accordingly? Is the D bit settable with tpm_nvdefine?
    – Melab
    Commented Nov 15, 2023 at 3:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .