1

I 'm finding a lot of information and i can't search the command. I need to execute a command, that create a key pair according to the PCR values, so in case of these pcr have not changed, always generate the same key pair, but if one of then change, the key will be diferent.

Please, anyone can help me?

Improve this question

1 Answer 1

Reset to default
1

You can't.

I'm assuming you want your TPM to generate a key deterministicly depending on PCR values. The TPM will always use TRNG entropy for key generation (except for the primary keys) (see TPM2 Spec Part 1 - 11.4.9 Key Generation).

What you could do in theory is generating the key outside the TPM and loading it afterwards. I really doubt that this is a good idea, though.

Also: I think basing a secret key on PCR values is not a good idea, either.

Edit: what you might want to actually do is sealing the key. Basically, that is having a security policy associated with that key which prevents using it when your PCRs do not have a known good value.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .