Re: [PATCH v7 12/21] tpm: Add NULL primary creation

["Jarkko Sakkinen" <jarkko@kernel.org>]

On Mon Apr 1, 2024 at 7:55 PM EEST, James Bottomley wrote:
> On Mon, 2024-04-01 at 10:19 -0400, James Bottomley wrote:
> > So I'm not really sure how to solve this.  At the moment the kernel
> > doesn't use permanent handles for keys, but it should and it should
> > follow what all of the industry is doing for interoperability (i.e.
> > zero size points), which means the NULL primary should also follow
> > it.
>
> Actually, it turns out this is already solved by the TCG.  The template
> we're using is the correct one (zero size points).  Apparently they
> regretted their earlier decision to zero fill and issued this guidance:
>
>    2.2.1.2.2 EK Template
>    
>    An EK Template is stored in an NV Index as a TPMT_PUBLIC structure
>    marshaled as described in the TPM 2.0 Library Specification [1]. The
>    default EK Templates are defined in annex B. The EK Template NV Index
>    MUST be Populated if non-default values are used. It SHOULD be Absent
>    if default values are used.
>    
>    The EK Template unique field buffer size(s) SHOULD be zero.
>    
> But since they can't revoke the previous guidance, we now have two
> templates defined: the L one which has the old n bytes of zeros and the
> new (and recommended) H one which has zero size unique field.
>
> https://trustedcomputinggroup.org/resource/http-trustedcomputinggroup-org-wp-content-uploads-tcg-ek-credential-profile-v-2-5-r2_published-pdf/
>
> So in other words, we're doing the later correct thing and there's no
> problem.  I'll update the ASN.1 draft
>
> https://www.hansenpartnership.com/draft-bottomley-tpm2-keys.html

First time I'm seeing this document or URL.

>
> to state that we MUST use the H template to remove any ambiguity
>
> James

BR, Jarkko