Skip to content
Snippets Groups Projects
Forked from KED Software Projects / Miscellaneous / KED U-Boot Fork
Source project has a limited visibility.
  • mario.six@gdsys.cc's avatar
    0f4b2ba1
    tpm: Add function to load keys via their parent's SHA1 hash · 0f4b2ba1
    mario.six@gdsys.cc authored
    
    If we want to load a key into a TPM, we need to know the designated parent
    key's handle, so that the TPM is able to insert the key at the correct place in
    the key hierarchy.
    
    However, if we want to load a key whose designated parent key we also
    previously loaded ourselves, we first need to memorize this parent key's handle
    (since the handles for the key are chosen at random when they are inserted into
    the TPM). If we are, however, unable to do so, for example if the parent key is
    loaded into the TPM during production, and its child key during the actual
    boot, we must find a different mechanism to identify the parent key.
    
    To solve this problem, we add a function that allows U-Boot to load a key into
    the TPM using their designated parent key's SHA1 hash, and the corresponding
    auth data.
    
    Signed-off-by: default avatarMario Six <mario.six@gdsys.cc>
    Reviewed-by: default avatarSimon Glass <sjg@chromium.org>
    0f4b2ba1
    History
    tpm: Add function to load keys via their parent's SHA1 hash
    mario.six@gdsys.cc authored
    
    If we want to load a key into a TPM, we need to know the designated parent
    key's handle, so that the TPM is able to insert the key at the correct place in
    the key hierarchy.
    
    However, if we want to load a key whose designated parent key we also
    previously loaded ourselves, we first need to memorize this parent key's handle
    (since the handles for the key are chosen at random when they are inserted into
    the TPM). If we are, however, unable to do so, for example if the parent key is
    loaded into the TPM during production, and its child key during the actual
    boot, we must find a different mechanism to identify the parent key.
    
    To solve this problem, we add a function that allows U-Boot to load a key into
    the TPM using their designated parent key's SHA1 hash, and the corresponding
    auth data.
    
    Signed-off-by: default avatarMario Six <mario.six@gdsys.cc>
    Reviewed-by: default avatarSimon Glass <sjg@chromium.org>