Consider a scenario - Device manufacture provides in advance the TPM’s endorsement key certificate(containing EK public key) for device to be deployed.
- In general, what are the TPM operations that needs an endorsement key(EK) handle ?
- What is the root key for attestation identity key (AIK). Is it EK or SRK(storage root key) ?
- EK & Device authentication - Is there any TPM operation like signing/crypto that could be done with an EK such that I could use the EK public part to authenticate the device?
- If we could never traceback/authenticate with EK, why is trousers API providing a handle to EK ? I feel trousers could have internally decided when to use EK and spared the application programmer from that implementation detail.