Here is what I understood from the AIK(Attestation Identity Key) generation the AIK is generated after the boot, when all the PCRs have been initialized. The algorithm will take some PCRs (not necessarily all the PCRs), will encrypt it with the private part of the EK. Am I right/wrong? Another way of formulating would be “How is the AIK generated?”

So, the AIK identifies one and only one TPM? And that’s why we need to use DAA(Direct Anonymous Attestation), to prove we use a non-compromised TPM, while keeping privacy?

I’m sorry if I got it all wrong, but I didn’t find much information about this AIK.

Edit: So I understood the link, I have the confirmation that AIK and EK are linked, but what exactly is the link?

1 Answer 1


First, there is the Endorsement Key (EK), an asymmetric Key. Each TPM owns a unique and identifiable EK. As it is unique and identifiable, we can clearly see privacy issues.

So the TCG created the AIK. An AIK is another key pair generated by the TPM, which will be signed by the EK. One can create multiple AIK. For an AIK to be used, one need to send the signed AIK to a privacy CA (Certificate Authority). Last issue, is can I trust the CA? If not, one can use Direct Anonymous Attestation (DAA), which will prove the keys used come from a valid TPM through a Zero-Knowledge-Proof.

  • "So we created..." You're in the TCG then? Commented Jun 14, 2017 at 20:47
  • What does the ZKP prove exactly? Commented Jun 14, 2017 at 20:49
  • I'm not in the TCG, bad formulation. For the ZKP, I don't know exactly how it works, but the goal is to prove the AIK was really created from a EK, and so from a "valid" TPM.
    – Damien
    Commented Jun 15, 2017 at 6:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .