On 19-01-04 21:50:13, Roberts, William C wrote:
> You can't change an existing objects policy AFAIK. So if you have objects 
> sealed to PCR state and PCR state changes, you're out of luck. Imran, that 
> statement is correct right?

This is not how i read "Non-Brittle PCRs (New in 2.0)" paragraph in "A Practical 
Guide to TPM2" book, page 34.

> You need to use policyauthorize when you build a new policy for an object, 
> which Pretty much means, any policy signed by X is ok. Thus when PCR state 
> changes, you Just sign a new PCR policy.

I really hope it is "policy signed by X _and_ these new PCR values" else it 
makes no sense to use PCR values as policy, isn't it?

> See this test for an example of usage:
> https://github.com/tpm2-software/tpm2-tools/blob/master/test/integration/tests/tcti/abrmd/policyauthorize.sh

Thanks for the reference.  I guess i'll be back with more questions after i 
digest the above example.


cheers,
Petko


> > -----Original Message-----
> > From: tpm2 [mailto:tpm2-bounces(a)lists.01.org] On Behalf Of Petko Manolov
> > Sent: Friday, January 4, 2019 10:21 AM
> > To: tpm2(a)lists.01.org
> > Subject: [tpm2] facilitating BIOS update with seamless PCR policy change
> > 
> > 	Hello guys,
> > 
> > I'm trying to devise a way to change the PCR policy used to seal certain key into
> > TPM2 in case of BIOS change.  So far i've run into this article (along with the
> > references it suggests):
> > 
> > 	https://github.com/tpm2-software/tpm2-tss/issues/487
> > 
> > However, i did not find a definitive answer there.  Could someone please
> > elaborate or point me in the right direction i can read more about how to
> > authorize the new PCR policy?
> > 
> > 
> > thanks a bunch,
> > Petko
> > _______________________________________________
> > tpm2 mailing list
> > tpm2(a)lists.01.org
> > https://lists.01.org/mailman/listinfo/tpm2
>