- Secure Boot - can use the TPM
- Measured Boot - must use the TPM
Can anyone intimately familiar with these processes explain if any TPM owner-authorized commands are required or used in these processes?
Background: I am using a TPM in an enterprise application. I need to own it and certify my own root-of-trust for reporting.
However, out of the box, my TPM chip is owned, I'm assuming for UEFI stuff, as above.
I don't necessarily want to disable secure boots, but I do need ownership of the chip.
I'm hoping if I take ownership I can do what I want to do, and the UEFI and secure boot code can still do what it needs to do, simple key operations, checking signature, etc. without actual ownership.
Anyone know? If I clear the TPM and take ownership, what will happen if the OEM/PC manufacturer already owned it for UEFI?