Re: SVSM Attestation and vTPM specification additions - v0.60

[James Bottomley <James.Bottomley@HansenPartnership.com>]

On Tue, 2023-01-10 at 17:00 -0600, Tom Lendacky wrote:
> A GUID still works, though, to describe that the TPMT_PUBLIC supplied
> is for the EK - unless you want to go with the known handles, e.g.
> 0x81010001 for the EK RSA handle or 0x81010002 for the EK EC handle,
> etc.

You should probably use the hierarchy handle for that case: 0x40000001
for the Owner (storage) seed and 0x40000006 for the endorsement seed. 
However, I'd just specify the endorsement seed in the spec and be done
with it.  Once you know the EK, you can use it to certify any SRK you
create from the owner seed.

>  You still  need to identify what key is represented by the
> TPMT_PUBLIC structure, right, or am I missing something about the
> TPMT_PUBLIC structure?

All you need to know is what hierarchy seed (which is why I propose
endorsement).  After that the TPMT_PUBLIC defines exactly the
properties of the derived key, including the algorithm (RSA or EC
curve, etc).

James