search

intel / vtpm-td

Other
35 stars 11 forks source link

EK Cert shall be provisioned with both RSA2048 and ECP384 #100

Open mxu9 opened 1 year ago

mxu9 commented 1 year ago

In EK Credential Spec v2.3 Section 2.2.1.5: For TPMs designed to meet Windows [22], the High Range can be used for additional RSA 2048 or ECC NIST P256 keys, but the first RSA 2048 and ECC NIST P256 key MUST be provisioned in the Low Range. It means EK Cert of RSA2048 is mandatory.

But in EK Credential Spec v2.4 Section 2.2.1.4: NOTE 2: Earlier versions of this specification (V2.1 - V2.3) required that for TPMs designed to meet a specific operating system, the low range had to be used for the RSA 2048 EK and the ECC NIST P256 EK. This has been removed as of version 2.4. The reader should consult their respective operating system requirements.

To be compatible with both rev 2.3 and rev 2.4, EK of RSA2048 and ECP384 shall be both provisioned.

jyao1 commented 1 year ago

Should we use RSA3072 and ECP384 ? Otherwise it is NOT CNSA compliance.