I try to learn a bit about the TPM and have a few questions I could not solve by myself.
- There are some privacy concerns about using the EK for identifying a TPM. I do not get these privacy concerns. Can anyone provide me a small example how one could identify the certain TPM when using an EK for attestation purposes?
- Same story with the AIK. One should use an AIK which is derived from the EK. But there are seemingly also privacy concerns. That should be the reason why there is more than one AIK in a TPM. I don't get this either. A small explanation would be nice.
- My last question: Why do we need an extra signing key? We could use the/an AIK instead?