I am currently looking at TPM (Trusted Platform Module) and wondering how does TPM offer platform authentication. Suppose a legal host is deployed on the cloud. How do I use TPM to assure that the host I am connecting to is that very host, rather than some other host that has the same configuration?
In principle, since that very host is equipped with TPM, whose Endorsement Key is unique, I can verify it via the public key of EK (Endorsement Key). For example, I can have TPM to encrypt a message with its private key of EK. And I decrypt it with the public key of EK. However, I looked up the documents, and didn't find any API to explicitly encrypt arbitrary message with private key of EK.
So, usually, how can TPM be used to perform such host authentication?