3

Our device comes with a device certificate which was signed with our private registration authority (CA). The private key (type ECC) was generated on the device itself - to be more specific directly on the on-board TPM. The public key is included inside the device certificate.

Now we have a use-case where we want to encrypt some sensitive files to be used on the device and wondered how we could do this with existing mechanisms. Could the public ECC key inside the device certificate (or something derived from it) be used to encrypt data that only the device would be able to decrypt using its private TPM-based ECC key (or something derived from it)?

What options do we have to encrypt something for the device while using device-specific information? We would not like that the encrypted file would work on every device which would be the case if we used a shared secret and symmetric encryption directly.

2 Answers 2

0

The normal way to handle this sort of thing, is to generate an ephemeral symmetric key, encrypt your file with the symmetric key, then encrypt the symmetric key with the public ECC key. Transmit the encrypted symmetric key + the encrypted file. The device decrypts the symmetric key using the TPM-based ECC key and then decrypts the file.

Notes:

  • Make sure to use good cryptographic randomness to generate the symmetric key
  • Make sure to use an authenticated encryption scheme (like AES-GCM)
  • You may find the private key in the TPM is a signing key, and doesn't want to be used for decryption. If that is a problem, you can probably generate another TPM key for encryption/decryption, and generate a certificate for its public key (which will be signed with the original, signing, key).
0

That ECC public key must be either platform key (PK) or Endorsement key (EK) used for TPM updates or verification. Do not use any of these keys directly for encrypting and decrypting the data. Instead, you can use different methods to protect your data:

  1. Encrypt the files or data with Keys under SRK (Storage root key) hierarchy.
    • Generate SRK (Storage root key) which will be controlled by your application.
    • Generate a key under SRK hierarchy and use that key to encrypt your files or any type of data.
    • SRK will wrap the generated key and will decrypt based on inputs.
    • SRK resides in TPM.

First option ensures only TPM associated with keys will be able to decrypt the data.

  1. Encrypt + Bind the data to system state: (Works in case of secure boot)
    • Generate SRK (Storage root key) which will be controlled by your application.
    • Generate a key under SRK hierarchy. For e.g., test-key
    • TPM has PCR's which can store specific data types for e.g., hashes.
    • If the secure boot is enabled PCR 0-7 could be used to make sure the system state is not altered.
      • Hashes are calculated and stored during boot process in TPM.
    • With the test-key encrypt the data and seal (Bind) it with any one or multiple PCR from 0-7. a. For e.g., we will user PCR 7 (Stores hash for secure boot policy)
    • Now the data is sealed. For unsealing the TPM unseal operation will ensure that PCR7 contains the same hash which was used during sealing.
    • If the hash matches data will be decrypted.
    • In case of any changes in the secure boot policy the data will not be decrypted.

Second option ensures that

  • TPM with associated keys + system with particular state (No change in system software like BIOS, Kernel etc.) will only be able to decrypt the data.
  1. Encrypt + Bind + Attestation (Provides third party verification such as your CA)
    • Follow all the procedure as per steps mentioned in “2” point.
    • Now Generate the AK (Attestation key) under SRK.
    • Generate AK credentials i.e., AK certificates signed by third party (e.g., CA)
    • Use AK to sign the PCR.
    • Use AK to attest that the PCR is valid and signed by trusted third party
    • This provides that data is encrypted with TPM i.e., hardware.

The third option provides authenticity and third party verification that data is protected by valid TPM and system.

6
  • I want to encrypt the data for the device. Imagine the data I want to encrypt resides on my PC. I want to encrypt it in such a way that only the device (with the TPM) can decrypt it. So the encryption happens on the PC using some information from the TPM of the device. I think that the suggested solutions do not provide a solution for this? Apr 25, 2023 at 16:59
  • The first and second option does the same. The keys SRK and EK resides in TPM. And the data is encrypted by these keys only. So, only the TPM with associated keys will be able to decrypt the data. The third option provides third party verification for the same that data is protected by particular TPM.
    – saurabh
    Apr 25, 2023 at 17:48
  • I want to encrypt the files on the PC. How do I get the encnryption key generated under the SRK in the TPM to my PC? Apr 26, 2023 at 9:15
  • What OS are you targeting? If you are using Linux follow below link for sealing (Encrypt) the file/data/secret with TPM SRK. For windows you will need more knowledge on TPM. security.stackexchange.com/questions/252608/…
    – saurabh
    Apr 26, 2023 at 9:42
  • It doesn't really depend on the operating system. Imagine that the file I want to encrypt resides on my PC (windows or linux). On my PC I want to encrypt that file so that only the target device (using it's TPM) would be able to decrypt it. I cannot just use the device's SRK as it's not known to me. If I create an encryption key on the device using its SRK, I need to somehow bring the symmetric encryption key to my PC in order to use it. That's why I thought about an asymmetric public key from the TPM I could use on my PC to encrypt the data with. Apr 26, 2023 at 13:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .