TPM examples

TPM 2.0 configuration file

The following sample TPM 2.0 configuration file (tpm2.conf) is for a device with a single Security Module:

# This defines the provider type for use by SMP (for verification)
# and the TAP server (if configured).
providerType=3

[module]
# “modulename” identifies the secure element on the host.
# e.g. /dev/tpm0, /dev/tpm1, etc.
# This is not required on Windows platforms and must set to empty as follows:

# modulename
modulename=/dev/tpm0

# “moduleidstr” uniquely identifies a secure element, and is used to
# associate the “modulename” with that secure element. The value is verified 
# with the underlying secure element during TAP library initialization.
# During provisioning, the “smp_tpm2_getidstr_bin” tool displays the value
# “moduleidstr” for the “modulename”. This should be used to set the correct
# “moduleidstr” value in the configuration file.
moduleidstr=************************************

# “moduleid” is the identifier provided to TAP applications to reference
# the secure element.
moduleid=1

# The credential file (cred.tpm2) must be provided in the same folder as
# tpm2.conf
credfile=cred.tpm2

Take ownership and provision the hardware TPM

This example procedure demonstrates how to take ownership and provision the TPM:

Clear the TPM.

$./moctpm2_takeownership --sm=/dev/tpm0 --c --credfile=cred.tpm2

Take ownership of the TPM.

$./moctpm2_takeownership --sm=/dev/tpm0 --lhpwd= --ehpwd= --shpwd= --credfile=cred.tpm2

Provision the TPM.

$./moctpm2_provision --sm=/dev/tpm0 --ekpwd= --srkpwd= --ekalg=rsa --srkalg=rsa--credfile=cred.tpm2

Configure tpm2.conf with the correct moduleidstr
```
$./smp_tpm2_getidstr_bin --w --c=tpm2.conf
```

Note

To use a TPM emulator instead of a hardware TPM, use --sm=localhost and specify the port with the --ep=<port> option.

Take ownership and provision the hardware TPM (Windows)

Microsoft® Windows automatically takes ownership and provisions TPM 2.0. The owner authorization is created by Windows during TPM enablement.

We recommend initializing the TPM using the TPM.msc snapin (see https://technet.microsoft.com/en-us/library/cc753140(v=ws.11).aspx). If TPM was initialized during BitLocker setup, save the recovery password as described by Microsoft (see https://technet.microsoft.com/en-us/library/cc766295(v=ws.10).aspx#BKMK_S3).

If BitLocker is not already enabled:
1. Configure the Group Policy to set the TPM Owner Authorization Value setting to Full (see https://technet.microsoft.com/en-us/library/jj131725(v=ws.11).aspx# BKMK_AuthValue).
2. Initialize the TPM and take ownership. Allow Windows to automatically generate the owner secret (see https://technet.microsoft.com/en-us/library/cc753140(v=ws.11).aspx).
3. Enable the BitLocker application for drive encryption.
If BitLocker is already enabled, and under Group Policy the TPM Owner Authorization Value setting is not set to Full:
1. Configure the Group Policy. Set the TPM Owner Authorization Value setting to "Full". (see https://technet.microsoft.com/en-us/library/jj131725(v=ws.11).aspx#BKMK_AuthValue).
2. Change TPM owner password using the TPM.msc snapin (see https://docs.microsoft.com/en-us/windows/device-security/tpm/change-the-tpm-owner-password). The recovery password is required.
Note
To use a TPM emulator instead of a hardware TPM, use the moctpm2_takeownership and moctpm2_provision commands with option --sm=localhost and specify the port with the --ep=<port> option.

Create asymmetric storage keys for encrypt and decrypt operations

The following examples show how to create asymmetric storage keys for encrypt/decrypt operations in local mode.

$./moctpm2_createasymkey --kalg=rsa --ktype=storage --ksize=2048 --kpwd=mykeypass --es=pkcs1 --pub=mykey.pub --pri=mykey.pri --conf=./tpm2.conf

$./moctpm2_encrypt --kpwd=mykeypass --es=pkcs1 --pri=mykey.pri --idf=encryptinput.txt --odf=encryptout.bin --conf=./tpm2.conf

$./moctpm2_decrypt --kpwd=mykeypass --es=pkcs1 --pri=mykey.pri --idf=encryptout.bin --odf=decryptout.txt --conf=./tpm2.conf

Note

The --conf=./tpm2.conf option is not required for client in server mode; instead, the --s and --p options are required.

Note

On Windows platforms, in local mode, when the --conf option is not specified, the configuration file location defaults to %ProgramData%\Mocana\NanoTAP\tpm2.conf.

Create asymmetric storage keys for sign and verify operations

The following examples show how to create asymmetric signing keys for sign/verify operations in local mode.

$./moctpm2_createasymkey --kalg=rsa --ktype=sign --ksize=2048 --kpwd=mykeypass --ss=pkcs1 --pub=mykey.pub --pri=mykey.pri --conf=./tpm2.conf

$./moctpm2_sign --halg=sha256 --kpwd=mykeypass --pri=mykey.pri --idf=testdata.txt --osf=signout.bin --conf=./tpm2.conf

$./moctpm2_verify --halg=sha256 --kpwd=mykeypass --pri=mykey.pri --idf=testdata.txt --isf=signout.bin --conf=./tpm2.conf

Note

The --conf=./tpm2.conf option is not required for client in server mode; instead, the --s and --p options are required.

Note

On Windows platforms, in local mode, when the --conf option is not specified, the configuration file location defaults to %ProgramData%\Mocana\WinTAP\tpm2.conf.

Seal and unseal data with a password

The following examples show how to seal/unseal data with a password in local mode.

$./moctpm2_sealdata --auth=mysealpass --idf=encryptinput.txt --odf=sealout.bin --conf=./tpm2.conf

$./moctpm2_unsealdata --auth=mysealpass --idf=sealout.bin --odf=unsealout.txt --conf=./tpm2.conf

Note

The --conf=./tpm2.conf option is not required for client in server mode; instead, the --s and --p options are required.

Note

On Windows platforms, in local mode, when the --conf option is not specified, the configuration file location defaults to %ProgramData%\Mocana\WinTAP\tpm2.conf.

Create attestation keys to obtain a quote of the TPM PCRs

The following examples show how to create attestation keys to obtain a quote of the TPM PCRs in local mode.

$./moctpm2_createasymkey --kalg=rsa --ktype=attest --ksize=2048 --ss=pkcs1 --pub=mykey.pub --pri=mykey.pri --kpwd=mykeypass --conf=./tpm2.conf

$./moctpm2_getquote --halg=sha256 --ss=pkcs1 --pri=mykey.pri --idf=quoteinput.txt --odf=quoteout.bin --osf=quoteoutsign.bin --kpwd=mykeypass --conf=./tpm2.conf

$./moctpm2_verifyquote --halg=sha256 --pri=mykey.pri --idf=quoteout.bin --isf=quoteoutsign.bin --kpwd=mykeypass --conf=./tpm2.conf

Note

The --conf=./tpm2.conf option is not required for client in server mode; instead, the --s and --p options are required.

Note

On Windows platforms, in local mode, when the --conf option is not specified, the configuration file location defaults to %ProgramData%\Mocana\WinTAP\tpm2.conf.

Read and extend PCRs

The following examples show how to read and extend PCRs in local mode.

$./moctpm2_gettrusteddata --tdtype=measurement --tdsubtype=1 --tdidx=1 --odf=gettrustedout.bin --conf=./tpm2.conf

$./moctpm2_updatetrusteddata --tdtype=measurement --tdsubtype=1 --tdidx=1 --odf=updatetrustedout.bin --idf=updatetrustedin.txt --conf=./tpm2.conf

Note

The --conf=./tpm2.conf option is not required for client in server mode; instead, the --s and --p options are required.

Note

On Windows platforms, in local mode, when the --conf option is not specified, the configuration file location defaults to %ProgramData%\Mocana\WinTAP\tpm2.conf.

NVRAM operations (read, write, create, and delete)

The following examples illustrate how to perform NVRAM operations to read, write, create, and delete policies in TAP local mode.

$./moctpm2_getpolicystoragelist --conf=./tpm2.conf

$./moctpm2_createpolicystorage --psidx=0x01000001 --psize=64 --pstype=ordinary --pspwd=mykeypass --conf=./tpm2.conf

$./moctpm2_setpolicystorage --psidx=0x01000001 --pstype=ordinary --idf=policyin.txt --pspwd=mykeypass --conf=./tpm2.conf

$./moctpm2_delpolicystorage --psidx=0x01000001 --pssize=64 --pstype=ordinary --pspwd=mykeypass --conf=./tpm2.conf

The following examples illustrate usage in TAP remote mode.

Set up the path to the libraries.

$ export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/opt/trustpoint/lib

Retrieve the certificate from its location (0x01c08001).

$ /opt/trustpoint/bin/moctpm2_getpolicystorage --s=127.0.0.1 --psidx=0x01c08001 --odf=cert.der

Verify the certificate.

$ openssl x509 -in cert.der -inform DER -text -noout

Note

The --conf=./tpm2.conf option is not required for client in server mode; instead, the --s and --p options are required.

Note

On Windows platforms, in local mode, when the --conf option is not specified, the configuration file location defaults to %ProgramData%\Mocana\WinTAP\tpm2.conf.

Key duplication process on a hardware TPM

The following examples show how to duplicate keys to a destination TPM from an active (i.e., currently in use) source TPM.

Read the Storage Root Key (SRK) public key BLOB on the destination TPM device.
```
$./moctpm2_readpublicblob --eid=0x81000000 --pub=test/srk_backup.pub --conf=tpm2.conf
```
where srk_backup.pub is the output file for the SRK public key BLOB of the destination TPM.
Generate an asymmetric duplicable signing key under SRK on the source TPM device by running the following command:
```
$./moctpm2_createasymkey --kalg=rsa --ktype=sign --ksize=2048 --kpwd=mykeypass --ss=pkcs1 --pub=test/dupkey.pub --pri=test/dupkey.pri --conf=tpm2.conf
```
where dupkey.pub is the output file for the duplicable public key, and dupkey.pri is the output file is for the duplicable private key BLOB.

Ensure that the sign operation using this signing key is successful on the source device by running the following commands:

$ echo “Test Data” > test/testdata.txt

$./moctpm2_sign --halg=sha256 --kpwd=mykeypass --pri=test/dupkey.pri --idf=test/testdata.txt --osf=test/signout.bin --conf=tpm2.conf

where testdata.txt is the input file to be signed, and signout.bin is the output file for the signature BLOB.

$./moctpm2_verify --halg=sha256 --kpwd=mykeypass --pri=test/dupkey.pri --idf=test/testdata.txt --isf=test/signout.bin --conf=tpm2.conf

This command should display the message “signature verified successfully.”

Create a duplicate BLOB of the signing key on the source device. Use the public key BLOB created at step 1 above on the destination device by running the following command:
```
$./moctpm2_duplicatekey --kpwd=mykeypass --pri=test/dupkey.pri --newpr=test/srk_backup.pub --odf=test/newkeyblob.dup --conf=tpm2.conf
```
where the newkeyblob.dup output file contains the duplicated BLOB.
Import the duplicated BLOB on the destination device by running the following command:
```
$./moctpm2_importduplicatekey --kalg=rsa --ktype=sign --ksize=2048 --kpwd=mykeypass --ss=pkcs1 --dup=test/newkeyblob.dup --pri=test/duplicatedkey.pri --pub=test/duplicatedkey.pub --conf=tpm2.conf
```
where duplicatedkey.pri is the duplicated private key BLOB, and duplicatedkey.pub is the duplicated public key BLOB on the destination device. The duplicate key is created under the SRK of the destination device, along with the public and private key BLOBs.
Ensure that the sign operation using the duplicated key is successful on destination device by running the following commands:
```
$ echo “Test Data” > test/testdata.txt
```
```
$./moctpm2_sign --halg=sha256 --kpwd=mykeypass --pri=test/duplicatedkey.pri --idf=test/testdata.txt --osf=test/signout.bin --conf=tpm2.conf 
```
where testdata.txt is the input file to be signed using the duplicated key, and signout.bin is the output file that contains the signature BLOB.
```
$./moctpm2_verify --halg=sha256 --kpwd=mykeypass --pri=test/duplicatedkey.pri --idf=test/testdata.txt --isf=test/signout.bin --conf=tpm2.conf
```
This command should display the message “signature verified successfully.”
Ensure that the sign operation using the original key on the source device can be verified using the duplicated key on the destination device by running the following commands:
```
$ echo “Test Data” > test/testdata.txt
```
```
$./moctpm2_sign --halg=sha256 --kpwd=mykeypass --pri=test/dupkey.pri --idf=test/testdata.txt --osf=test/signout.bin --conf=tpm2.conf 
```
where testdata.txt is the input file to be signed using the duplicated key, and signout.bin is the output file that contains the signature BLOB.
On the destination device, copy test/textdata.txt and test/signout.bin to the destination device for signature verification by running the following command:
```
$./moctpm2_verify --halg=sha256 --kpwd=mykeypass --pri=test/duplicatedkey.pri --idf=test/testdata.txt --isf=test/signout.bin --conf=tpm2.conf=
```
This command should display the message “signature verified successfully.”

Reset dictionary attack lockout on a hardware TPM

If the TPM enters into a Dictionary Attack Lockout state due to excessive failed attempts to authenticate using incorrect credentials, the following command may be used to reset the condition on the TPM.

$./moctpm2_resetdalock --sm=/dev/tpm0 --credfile=cred.tpm2 --conf=tpm2.conf

where cred.tpm2 is the credentials file used during TPM provisioning.

This command permits future commands (with the correct credentials) to use the TPM without a wait imposed by a Dictionary Attack Lockout period.

Persist keys to TPM memory and usage

Keys may be persisted to TPM memory at a specified location (Key ID) for the purpose of using the Key ID instead of the key file for TPM operations.

The following examples illustrate usage in the TAP local mode of operation.

Create the key (optional).

$ ./moctpm2_createasymkey --kalg=rsa --ktype=sign --ksize=2048 --ss=pss256 --pub=mykey.pub --pri=mykey.pri --conf=./tpm2.conf

Persist key to TPM memory at key ID 0x81000100.

$ ./moctpm2_persistkeyobject --obj=mykey.pri –pid=0x81000100 --conf=./tpm2.conf

Read the persisted key.

$ ./moctpm2_getpersistedkeyobject --pid=0x81000100 --pri=persistedkey.pri --pub=persistedkey.pub --ksize=2048 --kalg=rsa --ktype=sign

Sign using key data read from moctpm2_getpersistedkeyobject.

$./moctpm2_sign --halg=sha256 --ss=pss256 --idf=testdata.txt --osf=signout.bin --pri=persistedkey.pri --conf=./tpm2.conf

Remove the persisted key.

$./moctpm2_evictkeyobject --pid 0x81000100

The following examples illustrate usage in the TAP remote mode of operation.

Create the key (optional).

$./moctpm2_createasymkey --kalg=rsa --ktype=sign --ksize=2048 --ss=pss256 --pub=mykey.pub --pri=mykey.pri --s=127.0.0.1

Persist key to TPM memory at key ID 0x81000100.

$./moctpm2_persistkeyobject --obj=mykey.pri –pid=0x81000100 --s=127.0.0.1

Read the persisted key.

$./moctpm2_getpersistedkeyobject --pid=0x81000100 --pri=persistedkey.pri--pub=persistedkey.pub --ksize=2048 --kalg=rsa --ktype=sign --s=127.0.0.1

Sign using the persisted key.

$./moctpm2_sign --halg=sha256 --ss=pss256 --idf=testdata.txt --osf=signout.bin--pid=0x81000100 --s=127.0.0.1

Remove the persisted key.

$./moctpm2_evictkeyobject --pid 0x81000100 --s=127.0.0.1

In this section:

TPM examples

TPM 2.0 configuration file

Take ownership and provision the hardware TPM

Note

Take ownership and provision the hardware TPM (Windows)

Note

Create asymmetric storage keys for encrypt and decrypt operations

Note

Note

Create asymmetric storage keys for sign and verify operations

Note

Note

Seal and unseal data with a password

Note

Note

Create attestation keys to obtain a quote of the TPM PCRs

Note

Note

Read and extend PCRs

Note

Note

NVRAM operations (read, write, create, and delete)

Note

Note

Key duplication process on a hardware TPM

Reset dictionary attack lockout on a hardware TPM

Persist keys to TPM memory and usage

Search results