TPM 1.2 module, the
TPM 2.0 specification allows the platform user to create own
EK (Endorsement Key) using
EPS (Endorsement Primary Seed) and
EKTemplate and obtain a certificate signed by the Privacy CA corresponding to the public key.
TPM 2.0 specification
- the manufacturer can install the already generated certificate for the common template provided by the specification.
- the manufacturer must have already generated certificates for all templates with zero unique field.
My questions (can't find answers in specification);
- According to which protocol can a TPM administrator obtain certificates for an
EKpublic key that is generated not by a standard template, but by a template that contains a random set of bytes in a unique field (also
- Does the manufacturer keep secret
EPS? And if not, then he will understand that the key
EKgenerated with this template (the trust to the platform administrator)?