I have the following problem:
I have two platforms, one of them has a TPM. I need to transfer data between these two platforms, so I first determine an attestation, in order to confirm that the destiny platform is the original and not a corrupted platform.
I find a lot of information, but I don't know how to do that with TPM2. Can anyone help me?
First up to clarify:
If you only want to authenticate your destiny platform (i.e. verify its identity), you do not need a TPM. You can use a simple X.509 certificate as they are used e.g. with TLS.
Attestation is more than certification. It guarantees platform properties (which depend on your implementation). Attestation can enable identifying your destiny platform, although it does not necessarily have to.
I'll just make two assumptions:
How you would do it:
In this case you need to do things. First you need to implement measured boot on your destiny platform. That is, early boot code is measured (hashed) before it is executed. The measurements are stored in the TPM's PCRs.
Then, you need to implement attestation. You have multiple options here. The simplest one is sealing a private key to your PCRs and use the key's public portion on the other device to encrypt your message. Of course there is a bootstrapping problem since you need to securely transfer that public key once and associate it with your platform.
Of course, this scales poorly. In fact, often, the Endorsement Key (EK) and the EK certificate are used. Basically, the TPM ships a certificate signed by its manufacturer which assures that it is a genuine TPM. Using the Attestation Certificate Authority (ACA) (sometimes Privacy Certificate Authority (PCA)) scheme, you don't need the one-time-association. I recommend Google's interactive learning platform. It includes a section about attestation - I recommend reading from the beginning, though.
