Here is what I understood from the AIK(Attestation Identity Key) generation the AIK is generated after the boot, when all the PCRs have been initialized. The algorithm will take some PCRs (not necessarily all the PCRs), will encrypt it with the private part of the EK. Am I right/wrong? Another way of formulating would be “How is the AIK generated?”
So, the AIK identifies one and only one TPM? And that’s why we need to use DAA(Direct Anonymous Attestation), to prove we use a non-compromised TPM, while keeping privacy?
I’m sorry if I got it all wrong, but I didn’t find much information about this AIK.
Edit: So I understood the link, I have the confirmation that AIK and EK are linked, but what exactly is the link?