Re: [tpm2] Conflicting TPM2 engines and storage formats

[David Woodhouse <dwmw2 at infradead.org>]

[-- Attachment #1: Type: text/plain, Size: 1176 bytes --]

On Tue, 2018-10-02 at 17:18 +0000, Fuchs, Andreas wrote:
> I'm still a bit confused about the TPM2LoadableKey vs TPM2ImportableKey.
> I don't know what the use for the latter would be, since I'd assume we just
> import such a key into the TPM and then use the Loadable derivate from it.
> 
> Also what's the OID that ended up in the actual fomat ?

Coming back to this part, as I reminded James about it by sending him a
patch that removed the 'type' field from his engine...


The TPM2ImportableKey type (says James) is an importable form of the
key that can be created without having access to the actual TPM. Each
time they're used, they need to be imported then loaded.

It seems to make sense to keep this in the same kind of PEM file as the
TPM2LoadableKey type that we're already using.

So... do we properly assign those OIDs and retain a type field? Or
could we have a simple 'loadable' optional boolean instead? Or even
(ab)use the parent field, since there are only a handful of valid
values for that (0x81xxxxxx and precisely four hierarchies).

For the loadable key type, is there any *additional* information that
needs to be stored? 


[-- Attachment #2: smime.p7s --]
[-- Type: application/x-pkcs7-signature, Size: 5213 bytes --]