TPM Quick ref

TODO: this page looks very outdated. glossary.md does not exist, git.chromium.org does not exist. Delete it?

This page is meant to help keep track of TPM use across the system. It may not be up to date at any given point, but it's a wiki so you know what to do.

Details

• TPM ownership management
• TPM_Clear is done (as in vboot_reference) but in the firmware code itself on switch between dev and verified modes and in recovery. (TODO: link code)
• TPM owner password clearing (triggered at sign-in by chrome):
• PCR extend (no active use elsewhere):
• NVRAM use for OS rollback attack protection
• Tamper evident storage
• Tamper-evident storage for avoiding runtime device management mode changes
• User key/passphrase and cached data protection
• A TPM in a Chrome device has an EK certificate that is signed by an intermediate certificate authority that is dedicated to the specific TPMs allocated for use in Chrome devices. OS-level self-validation of the platform TPM should be viable with this or chaining any other trust expectations.
• TPM is used for per-user certificate storage (NSS+PKCS#11) using opencryptoki but soon to be replaced by chaps. Update links here when chaps stabilizes (Each user's pkcs#11 key store is kept in their homedir to ensure it is tied to the local user account). This functionality includes VPN and 802.1x-related keypairs.