It's written that the TPM never allows these private keys to be exported outside the chip. This means that the only way to sign something with one of those keys is to use the computer to send a request to the TPM. Now when it comes to remote attestation for authentification,the trusted third party must know the private key of TPM to decrypt its data , isn't the secret key of TPM revealed outside the chip? thanks

  • Why would a trusted third party need to know the private key? – forest Jun 14 '18 at 10:35
  • @forest to decrypt the data sent by the Tpm no? – user180095 Jun 14 '18 at 10:43
  • 1
    That's not how remote attestation works. No data is sent from the TPM to a remote host that can only be decrypted with the TPM's private key. – forest Jun 14 '18 at 10:45
  • does it mean a remote host needs always just the public key to decrypt data? – user180095 Jun 14 '18 at 11:04
  • 1
    Remote attestation verifies that the remote server is in the state expected (presumably the expected state is uncompromised). The appraiser does not need to hold any secret data. – forest Jun 14 '18 at 11:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy