Fixing the TPM: Hardware Security Modules Done Right

Re:Fixing the TPM: Hardware Security Modules Done Right by vladvasiliu on Saturday August 19, 2023 @04:04AM (#37186609)

> Can't you already do that with an existing TPM? You just set an owner authentication password and an endorsement authentication password and no application can use it anymore unless you provide the password.

How would one go about doing that?

[ Parent | on HN ]

Re:Fixing the TPM: Hardware Security Modules Done Right by zauguin on Monday August 21, 2023 @01:35PM (#37212763)

On Linux with tpm2-tools installed you can run

To set the owner password (mainly for Storage) ``` tpm2_changeauth -c owner file:- ```

To set the endorsement password (e.g. to verify that the TPM is authentic): ``` tpm2_changeauth -c endorsement file:- ```

To set the lockout password (to recover the system without requiring a full reset): ``` tpm2_changeauth -c endorsement file:- ```

[ Parent | on HN ]