[tpm2] How can I use a persisted object without it’s primary key?

[tpm2] How can I use a persisted object without it’s primary key?

[Rowan Moul]

[-- Attachment #1: Type: text/plain, Size: 557 bytes --]

Hello,
I’m just trying to get a better sense of how the TPM storage hierarchy works.

Say I create a primary key under the owner hierarchy, and then I create a signing key under that. I persist the signing key with tpm2_evictcontrol but I do NOT persist the primary key.
How am I able to use the signing key on subsequent boots without the primary key existing in the TPM memory? Isn’t it needed to decrypt the signing key? Or is the persisted signing key not encrypted by the primary key when it resides inside the TPM hardware?

Thanks,

Rowan