TPM - ECC based encryption / decryption using the public key

Question

Our device comes with a device certificate which was signed with our private registration authority (CA). The private key (type ECC) was generated on the device itself - to be more specific directly on the on-board TPM. The public key is included inside the device certificate.

Now we have a use-case where we want to encrypt some sensitive files to be used on the device and wondered how we could do this with existing mechanisms. Could the public ECC key inside the device certificate (or something derived from it) be used to encrypt data that only the device would be able to decrypt using its private TPM-based ECC key (or something derived from it)?

What options do we have to encrypt something for the device while using device-specific information? We would not like that the encrypted file would work on every device which would be the case if we used a shared secret and symmetric encryption directly.

Answer 1

The normal way to handle this sort of thing, is to generate an ephemeral symmetric key, encrypt your file with the symmetric key, then encrypt the symmetric key with the public ECC key. Transmit the encrypted symmetric key + the encrypted file. The device decrypts the symmetric key using the TPM-based ECC key and then decrypts the file.

Notes:

• Make sure to use good cryptographic randomness to generate the symmetric key
• Make sure to use an authenticated encryption scheme (like AES-GCM)
• You may find the private key in the TPM is a signing key, and doesn't want to be used for decryption. If that is a problem, you can probably generate another TPM key for encryption/decryption, and generate a certificate for its public key (which will be signed with the original, signing, key).

Answer 2

That ECC public key must be either platform key (PK) or Endorsement key (EK) used for TPM updates or verification. Do not use any of these keys directly for encrypting and decrypting the data. Instead, you can use different methods to protect your data:

1. Encrypt the files or data with Keys under SRK (Storage root key) hierarchy.
   • Generate SRK (Storage root key) which will be controlled by your application.
   • Generate a key under SRK hierarchy and use that key to encrypt your files or any type of data.
   • SRK will wrap the generated key and will decrypt based on inputs.
   • SRK resides in TPM.

First option ensures only TPM associated with keys will be able to decrypt the data.

2. Encrypt + Bind the data to system state: (Works in case of secure boot)
   • Generate SRK (Storage root key) which will be controlled by your application.
   • Generate a key under SRK hierarchy. For e.g., test-key
   • TPM has PCR's which can store specific data types for e.g., hashes.
   • If the secure boot is enabled PCR 0-7 could be used to make sure the system state is not altered.
     • Hashes are calculated and stored during boot process in TPM.
   • With the test-key encrypt the data and seal (Bind) it with any one or multiple PCR from 0-7. a. For e.g., we will user PCR 7 (Stores hash for secure boot policy)
   • Now the data is sealed. For unsealing the TPM unseal operation will ensure that PCR7 contains the same hash which was used during sealing.
   • If the hash matches data will be decrypted.
   • In case of any changes in the secure boot policy the data will not be decrypted.

Second option ensures that

• TPM with associated keys + system with particular state (No change in system software like BIOS, Kernel etc.) will only be able to decrypt the data.

3. Encrypt + Bind + Attestation (Provides third party verification such as your CA)
   • Follow all the procedure as per steps mentioned in “2” point.
   • Now Generate the AK (Attestation key) under SRK.
   • Generate AK credentials i.e., AK certificates signed by third party (e.g., CA)
   • Use AK to sign the PCR.
   • Use AK to attest that the PCR is valid and signed by trusted third party
   • This provides that data is encrypted with TPM i.e., hardware.

The third option provides authenticity and third party verification that data is protected by valid TPM and system.