Re: [tpm2] SLB 9670 TPM 2.0 device, How many keys I can store inside TPM as persistent

[Tadeusz Struk <tadeusz.struk at intel.com>]

[-- Attachment #1: Type: text/plain, Size: 1675 bytes --]

On 04/05/2018 10:49 PM, Tomasz Przybysz wrote:
> #define    TPM_PT_HR_PERSISTENT_MIN    (PT_FIXED + 15 )     /* the minimum number of persistent objects that can be held in TPM NV memoryNOTE    This minimum shall be no less than the minimum value required by the platformspecific specification to which the TPM is built.  */
> 
> I don't uderstand. So what is max capacity of this device ?

The maximum capacity of the device is limited only by the amount of the NV memory in the chip, which for this chip is 7KB as far as I can see.

> *
> Up to 7 loaded persistent Objects***for my understandig it's max capacity. But why this parameter is called *TPM_PT_HR_PERSISTENT_MIN* ?
> vs
> "the minimum number of persistent objects that can be held in TPM NV memory"
> 
> So is it min or max ?

It's min. The spec defines some minimums in order to ensure proper operation.
See section 41. "Minimums" in https://trustedcomputinggroup.org/wp-content/uploads/TPM-Rev-2.0-Part-1-Architecture-01.16.pdf
The chip vendor can define other minimums, not less than the minimums specified by the spec.
Put in other words. This tells you what is the minimum number of persistent objects a TPM needs to support to be able to support all TPM command implemented by the given TPM chip.

> 
> What does 'loaded persistent' mean  ? As I know persistent key is always loaded.
> When I want to use persistent key I don't need load it.

Right, you don't need to load a persistent key, assuming it wasn't evicted by tpm2_evictcontrol tool.
For more info see section 37.3 "Owner and Platform Evict Objects" from the spec above.

Hope that helps.
-- 
Tadeusz