• caglararli@hotmail.com
  • 05386281520

Is it safe to use a non-pcr key after verifying some pcr7 key is working find after os start on tpm2.0?

Çağlar Arlı      -    6 Views

Is it safe to use a non-pcr key after verifying some pcr7 key is working find after os start on tpm2.0?

If we reboot an OS and want to sign something using TPM. And let's say we want to secure the boot environment using pcr7 policy crypto key. Is it safe to use non-pcr policy key together with a pcr7 policy key?

More formally:

  1. In the program we want to use TPM to sign something. During its initialization, use pcr7 policy key to verify boot environment hasn't been changed.
  2. Then the program switch to use a non-policy key to start it's own job. (Do all kinds of stuff : signing , encypt , decrypt ...) The reason I want to use this is I notice that non-policy key has much better performance compare with pcr policy key.