What is AIK in TPM?

What is AIK in TPM?

What’s an AIK? A. An Attestation Identity Key is a special purpose TPM-resident RSA key that is used to provide platform authentication based on the attestation capability of the TPM.

What is TPM key Attestation?

TPM key attestation is the ability of the entity requesting a certificate to cryptographically prove to a CA that the RSA key in the certificate request is protected by either “a” or “the” TPM that the CA trusts. The TPM trust model is discussed more in the Deployment overview section later in this topic.

What is EK certificate?

An EK certificate is used to bind an identity, in terms of specific security attributes, to a TPM. The primary use of an EK certificate is to authenticate device identity during AIK certificate issuance.

What is Endorsement key?

The endorsement key is an encryption key that is permanently embedded in the Trusted Platform Module (TPM) security hardware, generally at the time of manufacture. TPM operations that involve signing pieces of data can make use of the endorsement key to allow other components to verify that the data can be trusted.

What data is stored in TPM?

TPM (Trusted Platform Module) is a computer chip (microcontroller) that can securely store artifacts used to authenticate the platform (your PC or laptop). These artifacts can include passwords, certificates, or encryption keys.

Should you clear a computer’s TPM?

However, even if the TPM is not cleared before a new operating system is installed, most TPM functionality will probably work correctly. Clearing the TPM resets it to an unowned state. Clearing the TPM can result in data loss.

Can a TPM be used as an AIK?

For an AIK to be used, one need to send the signed AIK to a privacy CA (Certificate Authority). Last issue, is can I trust the CA? If not, one can use Direct Anonymous Attestation (DAA), which will prove the keys used come from a valid TPM through a Zero-Knowledge-Proof.

What does a CA need to know about an AIK?

A CA needs to know that it can trust an AIK, and that it is not being provided just any key that was created outside a TPM and can be used anywhere. This trust is formed by AIK activation, which is a process defined by the TPM that can be used to transfer trust from a TPM endorsement key (EK) to an AIK.

What do you need to know about TPM key attestation?

In general, TPM key attestation is based on the following pillars: Every TPM ships with a unique asymmetric key, called the Endorsement Key (EK), burned by the manufacturer. We refer to the public portion of this key as EKPub and the associated private key as EKPriv.

Can a signature be used outside of a TPM?

Since the signature is created using the AIK private key, which can only be used in the TPM that created it, the CA can trust that the attested key is truly non-migratable and cannot be used outside that TPM.