| Cryptohomed is responsible for initialization of the TPM once it has been |
| enabled and activated. Ownership creates a Storage Root Key (SRK) on the TPM, |
| which is necessary to seal user keys (the system-wide cryptohome key and keys |
| used by opencryptoki+tpm are ultimately sealed by the SRK; see |
| http://trousers.sourceforge.net/pkcs11.html for more details on how opencryptoki |
| uses the SRK). The ownership process is in the tpm_init library, separate from |
| cryptohome, but the basic process is as follows: |
| |
| 1. If /sys/class/misc/tpm0/device/owned is 0 |
| and |
| /sys/class/misc/tpm0/device/enabled is 1 |
| then the initialize thread will attempt to initialize the TPM. |
| 2. An Endorsement Key (EK) will be created if it doesn't exist (some vendors do |
| not create one at the factory, as it is not required by the spec). |
| 3. Tspi_TPM_TakeOwnership will be called with the Trousers default well-known |
| ownership password, and the Chromium OS well-known SRK password. This may |
| take between 10s and 150s. |
| 4. If successful, the SRK's password is reset to a NULL string, and its use is |
| unrestricted (in other words, code using the SRK does not need to know the |
| owner password). |
| 5. Finally, the owner password is changed to a randomly-generated string that is |
| available to the user for the duration of that boot. |
| |
| Cryptohome uses the TPM merely for secure key storage to help protect the user |
| from data loss should their device be lost or compromised. Keys sealed by the |
| TPM can only be used on the TPM itself, meaning that offline or brute-force |
| attacks are difficult. |
