I've got an Infineon SLB9670 TPM module connected to a BeagleBone Board. I would like to carry out RSA signature verification on the board by using the TPM as a key store (storing the public key). W.r.t the same I have the following questions:

  1. Is it possible to store an externally generated public key on the TPM?
  2. If the above is possible, then is there an authentication mechanism in place that will allow only me to write to the public key store in the TPM?

I'm just starting out with TPMs, so please let me know if I've made some glaring assumptions.


This doesn't sound like something you'd do with regular TPM key objects.

However, TPMs do have a small amount of general-purpose NVRAM, which you can access by allocating an "NV index" (e.g. using tpm2 nvdefine) and storing any data you want (such as a public key or a whole certificate). For example, usually you'll find a predefined index 0x1c00002 containing the TPM's "endorsement certificate" from the manufacturer.

NV indices can have various read/write conditions – specifying ownerwrite will require the "owner hierarchy" password in order to change its contents, and enabling writedefine allows the NV index to be locked and made unwritable. Normally owner auth is already required in order to delete (aka undefine) the NV index, but policydelete with a blank policy should make it completely undeletable.

Note: I don't have any spare TPMs so I've never actually tried making permanent NV indices or otherwise bricking a TPM. However, if I understand the spec correctly, clearing the TPM will still delete all "owner"-created NV indices, even those that you somehow (accidentally) made impossible to delete.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.