Is there a way to associate the state of an arbitrary file to a tpm2 PCR value? I want to seal a secret pass-phrase onto the TPM, and I want the TPM to be able to unseal it only if the file is not tampered with. I read through a related article in the link which talks about protecting the boot process using the TPM. Furthermore, I understand that different platform configuration registers are allocated to a state of components like BIOS, BIOS configuration, MBR, etc. However, I want to create a pcr policy that will control the access of sealed pass-phrase on TPM2 based on the checksum of a file. But I don't know how to create it. Please help me understand if this is possible.

  • What OS you are targeting?
    – saurabh
    Jul 23, 2021 at 6:25
  • I am using ubuntu 20.04
    – Vinmean
    Jul 23, 2021 at 6:31

1 Answer 1


Since you are using Ubuntu 20.04 you can directly use tpm2-tools to seal an object against TPM2.0

Download latest tpm2-tools from Ubuntu repo or from tpm2-tools

  1. First, create the primary key using tpm2_createprimary

    • tpm2_createprimary -C e -g <hash_algo> -G <Key_ALGO>-c primary.ctx
    • Save primary.ctx
  2. Now list the PCR using tpm2_pcrread

    • tpm2_pcrread
  3. After listing the PCR, select the appropriate PCR for sealing the data.

    • There are some reserved PCR's.
    • Link
    • Over here, you can either use the reserved PCR (e.g. PCR0) or extend another PCR.
    • Example for extending the PCR
      • tpm2_pcrextend 3:sha1=4e1243bd22c66e76c2ba9eddc1f91394e57f9f83
      • Extend the PCR 3 with sha1 value of 4e1243bd22c66e76c2ba9eddc1f91394e57f9f83
  4. Get the PCR-read data in file

    • tpm2_pcrread -o <output_pcr_file>
    • Example format for PCR value : "<BANK>:<PCR>[,<PCR>] or <BANK>:all"
    • Where BANK is sha1 or sha2 as per supported algorithm
    • Save output PCR file
    • Example using current PCR0:
      • tpm2_pcrread -o pcr.data sha256:0
      • This will seal the data corresponding to your system state in case of trusted boot.
  5. Start tpm2 authsession [Check Notes below]

  6. Create a PCR policy

    • tpm2_policypcr -S <session_file> -l <PCR BANK> -f <output_pcr_file> -L <policy_file>
    • Save policy file
    • Flush context: tpm2_flushcontext <session_file>
  7. Create object using the policy data, which we will further seal

    • tpm2_create -Q -u key.pub -r key.priv -C primary.ctx -L policy.dat -i <<< [Input_DATA]
    • Save key.pub and key.priv
    • Over here, input data could be the pass-phrase or key
  8. Load the Public and private portion

    • tpm2_load -C primary.ctx -u key.pub -r key.priv -n unseal.key.name -c unseal.key.ctx
    • save the unseal.key.ctx
  9. Satisfy Policy:

    • tpm2_startauthsession --policy-session -S <session_file>
    • tpm2_policypcr -S <session_file> -l <PCR_BANK> -f <pcr_output_file> -L <policy_file>
  10. Now using the unseal.key.ctx you can unseal the data

    • tpm2_unseal -psession:<session_file> -c unseal.key.ctx

NOTE: It is possible in Ubuntu 20.04 there is already Kernel resource manager for TPM2 enabled. Using tpm2_startauthsession will ease out the things

I've used the latest tpm2-tools version.

  • My understanding is that I should first create a hash of the file (that I wish not to be tampered with) and extend it to the corresponding PCR bank. Then follow your procedure to seal a secret using the PCR policy that uses the specific PCR bank value. Is that right?
    – Vinmean
    Jul 26, 2021 at 5:36
  • @Vinmean Yes, you are correct. I've updated the answer as well.
    – saurabh
    Jul 26, 2021 at 6:08
  • Sealing a passphrase will not protect the password from unauthorized access. If your goal is to ensure the integrity of the passphrase or ensure that the passphrase is protected in case of a stolen disk, then this procedure is fine. Otherwise, I recommend encrypting the passphrase with the key stored in TPM and seal the key.
    – saurabh
    Jul 26, 2021 at 6:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .