TPM based authentication without a trusted third party

Question

Consider a scenario - Device manufacture provides in advance the TPM’s endorsement key certificate(containing EK public key) for device to be deployed.

1. In general, what are the TPM operations that needs an endorsement key(EK) handle ?
2. What is the root key for attestation identity key (AIK). Is it EK or SRK(storage root key) ?
3. EK & Device authentication - Is there any TPM operation like signing/crypto that could be done with an EK such that I could use the EK public part to authenticate the device?
4. If we could never traceback/authenticate with EK, why is trousers API providing a handle to EK ? I feel trousers could have internally decided when to use EK and spared the application programmer from that implementation detail.

Answer 1

TPM operations which need the EK:

• Take the ownership
• Clear the TPM
• Change the SRK
• Change the Owner(obviously)
• Allow SRK read using SRK auth (tpm_restrictsrk -a) Basically, these are all administration operations.

The root key for the AIK is the EK. The goal of the EK is to prove everything we send comes from a valid TPM. So yes, you can use your EK to sign, but there will be a privacy issue: everytime you use your EK, you will be traceable. That's why the AIK was created, to prove you are a valid TPM without getting traceable by anyone(Well at least by the CA, and that's why we use DAA).

Your forth question is interesting because you aren't the first one to ask it. Therefore the TPM 2.0 specifications separate all these operations. There is the endorsement hierarchy (administrator who manage the privacy domain), the storage hierarchy(user who manage the security domain), and the platform hierarchy(platform which can deny the use of the other hierarchies).

Obviously, the Endorsement Hierarchy may generate Endorsement Keys which you can use to sign your datas.

For more informations you can check this pdf