On Sun, 2020-07-12 at 17:38 -0400, Ken Goldman wrote: > On 2/27/2020 3:57 PM, James Prestwood wrote: > > I am learning lots from this discussion, so thank you. I had > > assumed that the parent key crypto had to match the child key, RSA > > vs EC, but sounds like that is not the case. And yes, this sounds > > like a much better way to go now that I have a bit more info on it. > > I know this old. Just FYI: > > The TPM WG debated this for a while, but decided that the TPM should > not enforce parent / child algorithm matching. It's for the > application to decide. Heh, they're lucky they made that decision otherwise we'd likely have been deprecating RSA keys (see below). > I also note that parent keys wrap their child keys using a symmetric > key, typically AES, not an RSA or ECC key. The load time would be > the same for an ECC or RSA parent, because it's not using the > asymmetric key. But that's not actually the problem. The problem is that if the primary parent doesn't exist, it has to be created. The TCG PC provisioning guide did require that the RSA storage parent be provisioned at 81000001 but that seems largely to be ignored, leading to most TPM2 key using applications, like the TPM2 engines, having to run TPM2_CreatePrimary themselves. The time taken to run TPM2_CreatePrimary for an RSA key is prohibitive, which is why we always use EC parent keys. If you look at both my engine and the Intel one, there's simply no provision for creating RSA parents, although you may use the NV version if it exists. I also note that if we're using loadable, not importable keys which, again, is the majority use case, we actually don't care about the asymmetric part of the parent, so it would have been nice to have some type of partial create primary where it only derived the symmetric key and thus would save a huge amount of time for the RSA key and even a bit of time for the EC one. > This different from TPM 1.2, which always uses parent RSA wrapping. > > The asymmetric key is used for: > > 1 - import (key backup, using externally generated keys) > 2 - Salted sessions > > While both are useful, they're not typically used in a > critical path. There's a third critical advantage: because TPM 1.2 isn't crypto agile, the parent is actually present in the TPM and doesn't have to be created on the fly. James
