TPM examples
TPM 2.0 configuration file
The following sample TPM 2.0 configuration file (tpm2.conf
) is for a device with a single Security Module:
# This defines the provider type for use by SMP (for verification) # and the TAP server (if configured). providerType=3 [module] # “modulename” identifies the secure element on the host. # e.g. /dev/tpm0, /dev/tpm1, etc. # This is not required on Windows platforms and must set to empty as follows: # modulename modulename=/dev/tpm0 # “moduleidstr” uniquely identifies a secure element, and is used to # associate the “modulename” with that secure element. The value is verified # with the underlying secure element during TAP library initialization. # During provisioning, the “smp_tpm2_getidstr_bin” tool displays the value # “moduleidstr” for the “modulename”. This should be used to set the correct # “moduleidstr” value in the configuration file. moduleidstr=************************************ # “moduleid” is the identifier provided to TAP applications to reference # the secure element. moduleid=1 # The credential file (cred.tpm2) must be provided in the same folder as # tpm2.conf credfile=cred.tpm2
Take ownership and provision the hardware TPM
This example procedure demonstrates how to take ownership and provision the TPM:
Clear the TPM.
$./moctpm2_takeownership --sm=/dev/tpm0 --c --credfile=cred.tpm2
Take ownership of the TPM.
$./moctpm2_takeownership --sm=/dev/tpm0 --lhpwd= --ehpwd= --shpwd= --credfile=cred.tpm2
Provision the TPM.
$./moctpm2_provision --sm=/dev/tpm0 --ekpwd= --srkpwd= --ekalg=rsa --srkalg=rsa--credfile=cred.tpm2
Configure tpm2.conf with the correct
moduleidstr
$./smp_tpm2_getidstr_bin --w --c=tpm2.conf
Note
To use a TPM emulator instead of a hardware TPM, use --sm=localhost
and specify the port with the --ep=<port>
option.
Take ownership and provision the hardware TPM (Windows)
Microsoft® Windows automatically takes ownership and provisions TPM 2.0. The owner authorization is created by Windows during TPM enablement.
We recommend initializing the TPM using the TPM.msc
snapin (see https://technet.microsoft.com/en-us/library/cc753140(v=ws.11).aspx). If TPM was initialized during BitLocker setup, save the recovery password as described by Microsoft (see https://technet.microsoft.com/en-us/library/cc766295(v=ws.10).aspx#BKMK_S3).
If BitLocker is not already enabled:
Configure the Group Policy to set the TPM Owner Authorization Value setting to Full (see https://technet.microsoft.com/en-us/library/jj131725(v=ws.11).aspx# BKMK_AuthValue).
Initialize the TPM and take ownership. Allow Windows to automatically generate the owner secret (see https://technet.microsoft.com/en-us/library/cc753140(v=ws.11).aspx).
Enable the BitLocker application for drive encryption.
If BitLocker is already enabled, and under Group Policy the TPM Owner Authorization Value setting is not set to
Full
:Configure the Group Policy. Set the TPM Owner Authorization Value setting to "Full". (see https://technet.microsoft.com/en-us/library/jj131725(v=ws.11).aspx#BKMK_AuthValue).
Change TPM owner password using the
TPM.msc
snapin (see https://docs.microsoft.com/en-us/windows/device-security/tpm/change-the-tpm-owner-password). The recovery password is required.
Note
To use a TPM emulator instead of a hardware TPM, use the
moctpm2_takeownership
andmoctpm2_provision
commands with option--sm=localhost
and specify the port with the--ep=<port>
option.
Create asymmetric storage keys for encrypt and decrypt operations
The following examples show how to create asymmetric storage keys for encrypt/decrypt operations in local mode.
$./moctpm2_createasymkey --kalg=rsa --ktype=storage --ksize=2048 --kpwd=mykeypass --es=pkcs1 --pub=mykey.pub --pri=mykey.pri --conf=./tpm2.conf
$./moctpm2_encrypt --kpwd=mykeypass --es=pkcs1 --pri=mykey.pri --idf=encryptinput.txt --odf=encryptout.bin --conf=./tpm2.conf
$./moctpm2_decrypt --kpwd=mykeypass --es=pkcs1 --pri=mykey.pri --idf=encryptout.bin --odf=decryptout.txt --conf=./tpm2.conf
Note
The --conf=./tpm2.conf
option is not required for client in server mode; instead, the --s
and --p
options are required.
Note
On Windows platforms, in local mode, when the --conf
option is not specified, the configuration file location defaults to %ProgramData%\Mocana\NanoTAP\tpm2.conf
.
Create asymmetric storage keys for sign and verify operations
The following examples show how to create asymmetric signing keys for sign/verify operations in local mode.
$./moctpm2_createasymkey --kalg=rsa --ktype=sign --ksize=2048 --kpwd=mykeypass --ss=pkcs1 --pub=mykey.pub --pri=mykey.pri --conf=./tpm2.conf
$./moctpm2_sign --halg=sha256 --kpwd=mykeypass --pri=mykey.pri --idf=testdata.txt --osf=signout.bin --conf=./tpm2.conf
$./moctpm2_verify --halg=sha256 --kpwd=mykeypass --pri=mykey.pri --idf=testdata.txt --isf=signout.bin --conf=./tpm2.conf
Note
The --conf=./tpm2.conf
option is not required for client in server mode; instead, the --s
and --p
options are required.
Note
On Windows platforms, in local mode, when the --conf
option is not specified, the configuration file location defaults to %ProgramData%\Mocana\WinTAP\tpm2.conf
.
Seal and unseal data with a password
The following examples show how to seal/unseal data with a password in local mode.
$./moctpm2_sealdata --auth=mysealpass --idf=encryptinput.txt --odf=sealout.bin --conf=./tpm2.conf
$./moctpm2_unsealdata --auth=mysealpass --idf=sealout.bin --odf=unsealout.txt --conf=./tpm2.conf
Note
The --conf=./tpm2.conf
option is not required for client in server mode; instead, the --s
and --p
options are required.
Note
On Windows platforms, in local mode, when the --conf
option is not specified, the configuration file location defaults to %ProgramData%\Mocana\WinTAP\tpm2.conf
.
Create attestation keys to obtain a quote of the TPM PCRs
The following examples show how to create attestation keys to obtain a quote of the TPM PCRs in local mode.
$./moctpm2_createasymkey --kalg=rsa --ktype=attest --ksize=2048 --ss=pkcs1 --pub=mykey.pub --pri=mykey.pri --kpwd=mykeypass --conf=./tpm2.conf
$./moctpm2_getquote --halg=sha256 --ss=pkcs1 --pri=mykey.pri --idf=quoteinput.txt --odf=quoteout.bin --osf=quoteoutsign.bin --kpwd=mykeypass --conf=./tpm2.conf
$./moctpm2_verifyquote --halg=sha256 --pri=mykey.pri --idf=quoteout.bin --isf=quoteoutsign.bin --kpwd=mykeypass --conf=./tpm2.conf
Note
The --conf=./tpm2.conf
option is not required for client in server mode; instead, the --s
and --p
options are required.
Note
On Windows platforms, in local mode, when the --conf
option is not specified, the configuration file location defaults to %ProgramData%\Mocana\WinTAP\tpm2.conf
.
Read and extend PCRs
The following examples show how to read and extend PCRs in local mode.
$./moctpm2_gettrusteddata --tdtype=measurement --tdsubtype=1 --tdidx=1 --odf=gettrustedout.bin --conf=./tpm2.conf
$./moctpm2_updatetrusteddata --tdtype=measurement --tdsubtype=1 --tdidx=1 --odf=updatetrustedout.bin --idf=updatetrustedin.txt --conf=./tpm2.conf
Note
The --conf=./tpm2.conf
option is not required for client in server mode; instead, the --s
and --p
options are required.
Note
On Windows platforms, in local mode, when the --conf
option is not specified, the configuration file location defaults to %ProgramData%\Mocana\WinTAP\tpm2.conf
.
NVRAM operations (read, write, create, and delete)
The following examples illustrate how to perform NVRAM operations to read, write, create, and delete policies in TAP local mode.
$./moctpm2_getpolicystoragelist --conf=./tpm2.conf
$./moctpm2_createpolicystorage --psidx=0x01000001 --psize=64 --pstype=ordinary --pspwd=mykeypass --conf=./tpm2.conf
$./moctpm2_setpolicystorage --psidx=0x01000001 --pstype=ordinary --idf=policyin.txt --pspwd=mykeypass --conf=./tpm2.conf
$./moctpm2_delpolicystorage --psidx=0x01000001 --pssize=64 --pstype=ordinary --pspwd=mykeypass --conf=./tpm2.conf
The following examples illustrate usage in TAP remote mode.
Set up the path to the libraries.
$ export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/opt/trustpoint/lib
Retrieve the certificate from its location (0x01c08001).
$ /opt/trustpoint/bin/moctpm2_getpolicystorage --s=127.0.0.1 --psidx=0x01c08001 --odf=cert.der
Verify the certificate.
$ openssl x509 -in cert.der -inform DER -text -noout
Note
The --conf=./tpm2.conf
option is not required for client in server mode; instead, the --s
and --p
options are required.
Note
On Windows platforms, in local mode, when the --conf
option is not specified, the configuration file location defaults to %ProgramData%\Mocana\WinTAP\tpm2.conf
.
Key duplication process on a hardware TPM
The following examples show how to duplicate keys to a destination TPM from an active (i.e., currently in use) source TPM.
Read the Storage Root Key (SRK) public key BLOB on the destination TPM device.
$./moctpm2_readpublicblob --eid=0x81000000 --pub=test/srk_backup.pub --conf=tpm2.conf
where
srk_backup.pub
is the output file for the SRK public key BLOB of the destination TPM.Generate an asymmetric duplicable signing key under SRK on the source TPM device by running the following command:
$./moctpm2_createasymkey --kalg=rsa --ktype=sign --ksize=2048 --kpwd=mykeypass --ss=pkcs1 --pub=test/dupkey.pub --pri=test/dupkey.pri --conf=tpm2.conf
where
dupkey.pub
is the output file for the duplicable public key, anddupkey.pri
is the output file is for the duplicable private key BLOB.Ensure that the sign operation using this signing key is successful on the source device by running the following commands:
$ echo “Test Data” > test/testdata.txt
$./moctpm2_sign --halg=sha256 --kpwd=mykeypass --pri=test/dupkey.pri --idf=test/testdata.txt --osf=test/signout.bin --conf=tpm2.conf
where
testdata.txt
is the input file to be signed, andsignout.bin
is the output file for the signature BLOB.$./moctpm2_verify --halg=sha256 --kpwd=mykeypass --pri=test/dupkey.pri --idf=test/testdata.txt --isf=test/signout.bin --conf=tpm2.conf
This command should display the message “signature verified successfully.”
Create a duplicate BLOB of the signing key on the source device. Use the public key BLOB created at step 1 above on the destination device by running the following command:
$./moctpm2_duplicatekey --kpwd=mykeypass --pri=test/dupkey.pri --newpr=test/srk_backup.pub --odf=test/newkeyblob.dup --conf=tpm2.conf
where the
newkeyblob.dup
output file contains the duplicated BLOB.Import the duplicated BLOB on the destination device by running the following command:
$./moctpm2_importduplicatekey --kalg=rsa --ktype=sign --ksize=2048 --kpwd=mykeypass --ss=pkcs1 --dup=test/newkeyblob.dup --pri=test/duplicatedkey.pri --pub=test/duplicatedkey.pub --conf=tpm2.conf
where
duplicatedkey.pri
is the duplicated private key BLOB, andduplicatedkey.pub
is the duplicated public key BLOB on the destination device. The duplicate key is created under the SRK of the destination device, along with the public and private key BLOBs.Ensure that the sign operation using the duplicated key is successful on destination device by running the following commands:
$ echo “Test Data” > test/testdata.txt
$./moctpm2_sign --halg=sha256 --kpwd=mykeypass --pri=test/duplicatedkey.pri --idf=test/testdata.txt --osf=test/signout.bin --conf=tpm2.conf
where
testdata.txt
is the input file to be signed using the duplicated key, andsignout.bin
is the output file that contains the signature BLOB.$./moctpm2_verify --halg=sha256 --kpwd=mykeypass --pri=test/duplicatedkey.pri --idf=test/testdata.txt --isf=test/signout.bin --conf=tpm2.conf
This command should display the message “signature verified successfully.”
Ensure that the sign operation using the original key on the source device can be verified using the duplicated key on the destination device by running the following commands:
$ echo “Test Data” > test/testdata.txt
$./moctpm2_sign --halg=sha256 --kpwd=mykeypass --pri=test/dupkey.pri --idf=test/testdata.txt --osf=test/signout.bin --conf=tpm2.conf
where
testdata.txt
is the input file to be signed using the duplicated key, andsignout.bin
is the output file that contains the signature BLOB.On the destination device, copy
test/textdata.txt
andtest/signout.bin
to the destination device for signature verification by running the following command:$./moctpm2_verify --halg=sha256 --kpwd=mykeypass --pri=test/duplicatedkey.pri --idf=test/testdata.txt --isf=test/signout.bin --conf=tpm2.conf=
This command should display the message “signature verified successfully.”
Reset dictionary attack lockout on a hardware TPM
If the TPM enters into a Dictionary Attack Lockout state due to excessive failed attempts to authenticate using incorrect credentials, the following command may be used to reset the condition on the TPM.
$./moctpm2_resetdalock --sm=/dev/tpm0 --credfile=cred.tpm2 --conf=tpm2.conf
where cred.tpm2
is the credentials file used during TPM provisioning.
This command permits future commands (with the correct credentials) to use the TPM without a wait imposed by a Dictionary Attack Lockout period.
Persist keys to TPM memory and usage
Keys may be persisted to TPM memory at a specified location (Key ID) for the purpose of using the Key ID instead of the key file for TPM operations.
The following examples illustrate usage in the TAP local mode of operation.
Create the key (optional).
$ ./moctpm2_createasymkey --kalg=rsa --ktype=sign --ksize=2048 --ss=pss256 --pub=mykey.pub --pri=mykey.pri --conf=./tpm2.conf
Persist key to TPM memory at key ID 0x81000100.
$ ./moctpm2_persistkeyobject --obj=mykey.pri –pid=0x81000100 --conf=./tpm2.conf
Read the persisted key.
$ ./moctpm2_getpersistedkeyobject --pid=0x81000100 --pri=persistedkey.pri --pub=persistedkey.pub --ksize=2048 --kalg=rsa --ktype=sign
Sign using key data read from
moctpm2_getpersistedkeyobject
.$./moctpm2_sign --halg=sha256 --ss=pss256 --idf=testdata.txt --osf=signout.bin --pri=persistedkey.pri --conf=./tpm2.conf
Remove the persisted key.
$./moctpm2_evictkeyobject --pid 0x81000100
The following examples illustrate usage in the TAP remote mode of operation.
Create the key (optional).
$./moctpm2_createasymkey --kalg=rsa --ktype=sign --ksize=2048 --ss=pss256 --pub=mykey.pub --pri=mykey.pri --s=127.0.0.1
Persist key to TPM memory at key ID 0x81000100.
$./moctpm2_persistkeyobject --obj=mykey.pri –pid=0x81000100 --s=127.0.0.1
Read the persisted key.
$./moctpm2_getpersistedkeyobject --pid=0x81000100 --pri=persistedkey.pri--pub=persistedkey.pub --ksize=2048 --kalg=rsa --ktype=sign --s=127.0.0.1
Sign using the persisted key.
$./moctpm2_sign --halg=sha256 --ss=pss256 --idf=testdata.txt --osf=signout.bin--pid=0x81000100 --s=127.0.0.1
Remove the persisted key.
$./moctpm2_evictkeyobject --pid 0x81000100 --s=127.0.0.1