[tpm2] Re: Calculating name of created AK- server side

[tpm2] Re: Calculating name of created AK- server side

[kuba.michal.n]

[-- Attachment #1: Type: text/plain, Size: 34 bytes --]

Thank You for clear explanation :D

[tpm2] Re: Calculating name of created AK- server side

[painololo]

[-- Attachment #1: Type: text/plain, Size: 4 bytes --]

good

[tpm2] Re: Calculating name of created AK- server side

[painololo]

[-- Attachment #1: Type: text/plain, Size: 4 bytes --]

good

[tpm2] Re: Calculating name of created AK- server side

[hoadao3493]

[-- Attachment #1: Type: text/plain, Size: 121 bytes --]

Thank you for sharing this great article. https://km888b.net hopes you will have many more articles for everyone to read.

[tpm2] Re: Calculating name of created AK- server side

[hoadao3493]

[-- Attachment #1: Type: text/plain, Size: 121 bytes --]

Thank you for sharing this great article. https://km888b.net hopes you will have many more articles for everyone to read.

[tpm2] Re: Calculating name of created AK- server side

[Imran Desai]

[-- Attachment #1: Type: text/plain, Size: 545 bytes --]

I see. A quick explainer :)

So AKname is not a secret. Neither is it possible to fake one. And so can be handed from the client to the server anytime. (tpm2_readpublic -c ak.ctx -n ak.name)

The credential challenge posed by the server (makecredential) wraps and encrypts a plaintext-credential using the EKpublic and AKname.

Only a client with access to the respective sensitive(private) portions of the EK and AK will have to load the keys on the TPM and it is then able to unwrap/decrypt the credentialBlob with credential-activation.

[tpm2] Re: Calculating name of created AK- server side

[kuba.michal.n]

[-- Attachment #1: Type: text/plain, Size: 763 bytes --]

Hello Imran! Thank You for your response 

I have read this tutorial before writing my question. It's just amazing :D
My question relates to this command:

tpm2_makecredential \
--tcti none \
--encryption-key rsa_ek.pub \
--secret file_input.data \
--name $loaded_key_name \ # this line :)
--credential-blob cred.out

Anonymity is not our concern. We want to ensure that only those computers which were handed by us to our employees can access internal resources. My idea was to generate EK and AK just like in tutorial, and then send EK certificate and public part of AK to some auth server. Then server would calculate the name and make use of tpm2_makecredential.

I have probably overlooked something really important.

Thank you in advance :D

[tpm2] Re: Calculating name of created AK- server side

[Imran Desai]

[-- Attachment #1: Type: text/plain, Size: 210 bytes --]

Hello kuba, welcome to the community.

Have you looked at this tutorial https://tpm2-software.github.io/2020/06/12/Remote-Attestation-With-tpm2-tools.html

Hopefully it should answer some of your questions.