1

I am currently trying to figure out just how key hierarchies in a TPM 2.0 work. I read that there are four possible hierarchies (storage, endorsement, platform, null). I also read, that these hierarchies form key trees with a parent key encrypting child keys. But I am unsure whether I grasped this concept correctly.

Does this mean, that I can have one tree hierarchy of keys with a storage root key (SRK) on top and another separate tree hierarchy of keys with an endorsement key (EK) on top?

1 Answer 1

1

TPM 2.0 newbie here and I'm also learning about TPM these days.

"Yes" to your questions:

  • You can have one tree hierarchy of keys with a storage root key (SR) on top and another separate tree hierarchy of keys with an endorsement key (EK) on top.
  • Particularly, the "one tree hierarchy of keys with a storage root key (SRK)" is the owner hierarchy, also known as storage hierarchy. (See below.)
  • Particularly, the "another separate tree hierarchy of keys with an endorsement key" is the endorsement hierarchy.

I found the documentation of TPM-JS explains things relatively more clearly. You can look at two sections: Keys and Ownership. After reading these sections, my understanding is:

  1. Every hierarchy has its (only) primary seed which is used to generate the (only) primary key which is the parent of all the child objects (i.e., keys or data). Therefore, there are four primary keys totally because there are four hierarchies in TPM.
  2. The owner hierarchy is also called the storage hierarchy (see section Keys: "Owner hierarchy, also known as storage hierarchy."), and SRK is the primary key on this hierarchy (see section Ownership: "The Storage Rook Key (SRK), is a primary, restricted encryption key on the owner hierarchy").
  3. EK is the primary key of the endorsement hierarchy. This doesn't seem to be stated explicitly but one can infer that after reading through the document.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .