
TPM_Init

286Start of informative comment:
287TPM_Init is a physical method of initializing a TPM. There is no TPM_Init ordinal as this is a
288platform message sent on the platform internals to the TPM. On a PC this command arrives
289at the TPM via the LPC bus and informs the TPM that the platform is performing a boot
290process.
291TPM_Init puts the TPM into a state where it waits for the command TPM_Startup (which
292specifies the type of initialization that is required.
293End of informative comment.
294Definition
295TPM_Init();
296
297Operation of the TPM. This is not a command that any software can execute. It is inherent
298in the design of the TPM and the platform that the TPM resides on.
299Parameters
300None
301Description
3021.
303
304
305

The TPM_Init signal indicates to the TPM that platform initialization is taking place. The
TPM SHALL set the TPM into a state such that the only legal command to receive after
the TPM_Init is the TPM_Startup command. The TPM_Startup will further indicate to the
TPM how to handle and initialize the TPM resources.

3062.
307
308
309
310
311

The platform design MUST be that the TPM is not the only component undergoing
initialization. If the TPM_Init signal forces the TPM to perform initialization then the
platform MUST ensure that ALL components of the platform receive an initialization
signal. This is to prevent an attacker from causing the TPM to initialize to a state where
various masquerades are allowable. For instance, on a PC causing the TPM to initialize
and expect measurements in PCR0 but the remainder of the platform does not initialize.

3123. The design of the TPM MUST be such that the ONLY mechanism that signals TPM_Init
313
also signals initialization to the other platform components.
314Actions
3151. The TPM sets TPM_STANY_FLAGS -> postInitialise to TRUE.

75
76

6

Level 2 Revision 116 28 February 2011
TCG Published

77TPM Main Part 3 Commands

TCG © Copyright

78Specification Version 1.2

3163.2

TPM_Startup

317Start of informative comment:
318TPM_Startup is always preceded by TPM_Init, which is the physical indication (a system319wide reset) that TPM initialization is necessary.
320There are many events on a platform that can cause a reset and the response to these
321events can require different operations to occur on the TPM. The mere reset indication does
322not contain sufficient information to inform the TPM as to what type of reset is occurring.
323Additional information known by the platform initialization code needs transmitting to the
324TPM. The TPM_Startup command provides the mechanism to transmit the information.
325The TPM can startup in three different modes:
326A “clear” start where all variables go back to their default or non-volatile set state
327A “save” start where the TPM recovers appropriate information and restores various values
328based on a prior TPM_SaveState. This recovery requires an invocation of TPM_Init to be
329successful.
330A failing "save" start must shut down the TPM. The CRTM cannot leave the TPM in a state
331where an untrusted upper software layer could issue a "clear" and then extend PCR's and
332thus mimic the CRTM.
333A “deactivated” start where the TPM turns itself off and requires another TPM_Init before
334the TPM will execute in a fully operational state.
335End of informative comment.
336Incoming Parameters and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_COMMAND

2

4

UINT32

paramSize

Total number of input bytes including paramSize and tag

3

4

1S

4

TPM_COMMAND_CODE

ordinal

Command ordinal TPM_ORD_Startup

4

2

2S

2

TPM_STARTUP_TYPE

startupType

Type of startup that is occurring

Type

Name

Description

#

SZ

1

#

SZ

337Outgoing Parameters and Sizes
PARAM

HMAC

#

SZ

#

SZ

1

2

TPM_TAG

tag

TPM_TAG_RSP_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

1S

4

TPM_RESULT

returnCode

The return code of the operation.

2S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_Startup

338Description
339TPM_Startup MUST be generated by a trusted entity (the RTM or the TPM, for example).
340

1. If the TPM is in failure mode

79Level 2 Revision 116 28 February 2011
80

7
TCG Published

81Copyright © TCG
82
83

TPM Main Part 3 Commands
Specification Version 1.2

341

a. TPM_STANY_FLAGS -> postInitialize is still set to FALSE

342

b. The TPM returns TPM_FAILEDSELFTEST

343Actions
3441. If TPM_STANY_FLAGS -> postInitialise is FALSE,
345

a. Then the TPM MUST return TPM_INVALID_POSTINIT, and exit this capability

3462. If stType = TPM_ST_CLEAR
347
348

a. Ensure that sessions associated with resources TPM_RT_CONTEXT, TPM_RT_AUTH,
TPM_RT_DAA_TPM, and TPM_RT_TRANS are invalidated

349

b. Reset TPM_STCLEAR_DATA -> PCR[] values to each correct default value

350

i.

351

ii. pcrReset is TRUE, set to 0xFF..FF

352

pcrReset is FALSE, set to 0x00..00

c. Set the following TPM_STCLEAR_FLAGS to their default state

353

i.

354

ii. PhysicalPresenceLock

355

iii. disableForceClear

356

PhysicalPresence

d. The TPM MAY initialize auditDigest to all zeros

357
358

i. If not initialized to all zeros, the TPM SHALL ensure that auditDigest contains
a valid value.

359
360
361

ii. If initialization fails, the TPM SHALL set auditDigest to all zeros and SHALL set
the internal TPM state so that the TPM returns TPM_FAILEDSELFTEST to all
subsequent commands.

362
363

e. The TPM SHALL set TPM_STCLEAR_FLAGS -> deactivated to the same state as
TPM_PERMANENT_FLAGS -> deactivated

364

f. The TPM MUST set the TPM_STANY_DATA fields to:

365

i.

366

ii. TPM_STANY_DATA->contextCount is set to 0

367

iii. TPM_STANY_DATA->contextList is set to 0

368

TPM_STANY_DATA->contextNonceSession is set to all zeros

g. The TPM MUST set TPM_STCLEAR_DATA fields to:

369

i.

370

ii. countID to zero

371

iii. ownerReference to TPM_KH_OWNER

372

h. The TPM MUST set the following TPM_STCLEAR_FLAGS to

373
374

i.
i.

375
84
85

Invalidate contextNonceKey

bGlobalLock to FALSE

Determine which keys should remain in the TPM
i.

For each key that has a valid preserved value in the TPM

8

Level 2 Revision 116 28 February 2011
TCG Published

86TPM Main Part 3 Commands

TCG © Copyright

87Specification Version 1.2

376

(1)

if parentPCRStatus is TRUE then call TPM_FlushSpecific(keyHandle)

377

(2)

if isVolatile is TRUE then call TPM_FlushSpecific(keyHandle)

378

ii. Keys under control of the OwnerEvict flag MUST stay resident in the TPM

3793. If stType = TPM_ST_STATE
380
381

a. If the TPM has no state to restore, the TPM MUST set the internal state such that it
returns TPM_FAILEDSELFTEST to all subsequent commands.

382
383
384

b. The TPM MAY determine for each session type (authorization, transport, DAA, …) to
release or maintain the session information. The TPM reports how it manages sessions
in the TPM_GetCapability command.

385
386
387

c. The TPM SHALL take all necessary actions to ensure that all PCRs contain valid
preserved values. If the TPM is unable to successfully complete these actions, it SHALL
enter the TPM failure mode.

388
389
390

i. For resettable PCR the TPM MUST set the value of TPM_STCLEAR_DATA ->
PCR[]to the resettable PCR default value. The TPM MUST NOT restore a resettable
PCR to a preserved value

391
392
393
394
395
396
397

d. The TPM MAY initialize auditDigest to all zeros.
i. Otherwise, the TPM SHALL take all actions necessary to ensure that
auditDigest contains a valid value. If the TPM is unable to successfully complete
these actions, the TPM SHALL initialize auditDigest to all zeros and SHALL set the
internal state such that the TPM returns TPM_FAILEDSELFTEST to all
subsequent commands.
e. The TPM MUST restore the following flags to their preserved states:

398

i.

399

ii. All values in TPM_STCLEAR_DATA

All values in TPM_STCLEAR_FLAGS

400

f. The TPM MUST restore all keys that have a valid preserved value.

401
402

g. The TPM resumes normal operation. If the TPM is unable to resume normal
operation, it SHALL enter the TPM failure mode.

4034. If stType = TPM_ST_DEACTIVATED
404

a. Invalidate sessions

405
406

i. Ensure that all resources associated with saved and active sessions are
invalidated

407

b. Set the TPM_STCLEAR_FLAGS to their default state.

408

c. Set TPM_STCLEAR_FLAGS -> deactivated to TRUE

4095. The TPM MUST ensure that state associated with TPM_SaveState is invalidated
4106. The TPM MUST set TPM_STANY_FLAGS -> postInitialise to FALSE

88Level 2 Revision 116 28 February 2011
89

9
TCG Published

90Copyright © TCG
91
92

4113.3

TPM Main Part 3 Commands
Specification Version 1.2

TPM_SaveState

412Start of informative comment:
413This warns a TPM to save some state information.
414If the relevant shielded storage is non-volatile, this command need have no effect.
415If the relevant shielded storage is volatile and the TPM alone is unable to detect the loss of
416external power in time to move data to non-volatile memory, this command should be
417presented before the TPM enters a low or no power state.
418Resettable PCRs are tied to platform state that does not survive a sleep state. If the PCRs
419did not reset, they would falsely indicate that the platform state was already present when it
420came out of sleep. Since some setup is required first, there would be a gap where PCRs
421indicated the wrong state. Therefore, the PCRs must be recreated.
422Any loaded keys may be preserved. Keys with parentPCRStatus TRUE are not given priority
423because of security concerns. Rather, since the key might be part of a storage tree that
424requires PCR value transitions, it might not be directly loadable after
425TPM_Startup(ST_STATE). For a TPM implementation that does not save all loaded keys, the
426platform should issue a TPM_SaveContext / TPM_LoadContext sequence for those loaded
427keys. contextNonceKey will be restored, guaranteeing that the saved key context can be
428restored.
429End of informative comment.
430Incoming Parameters and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_COMMAND

2

4

UINT32

paramSize

Total number of input bytes including paramSize and tag

3

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_SaveState.

Type

Name

Description

#

SZ

1

#

SZ

1S

4

431Outgoing Parameters and Sizes
PARAM

HMAC

#

SZ

#

SZ

1

2

TPM_TAG

tag

TPM_TAG_RSP_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

1S

4

TPM_RESULT

returnCode

The return code of the operation.

2S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_SaveState.

432Description
4331. Preserved values MUST be non-volatile.
4342. If data is never stored in a volatile medium, that data MAY be used as preserved data. In
435
such cases, no explicit action may be required to preserve that data.

93
94

10

Level 2 Revision 116 28 February 2011
TCG Published

95TPM Main Part 3 Commands

TCG © Copyright

96Specification Version 1.2

4363. If an explicit action is required to preserve data, it MUST be possible for the TPM to
437
determine whether preserved data is valid.
4384. If a parameter mirrored by any preserved value is altered, all preserved values MUST be
439
declared invalid.
4405. The TPM MAY declare all preserved values invalid in response to any command other
441
than TPM_Init.
442Actions
4431. Store TPM_STCLEAR_DATA -> PCR contents except for
444

a. If the PCR attribute pcrReset is TRUE

445

b. Any platform identified debug PCR

4462. The auditDigest MUST be handled according to the audit requirements as reported by
447
TPM_GetCapability.
448
449
450

a. If the ordinalAuditStatus is TRUE for the TPM_SaveState ordinal and the auditDigest
is being stored in the saved state, the saved auditDigest MUST include the
TPM_SaveState input parameters and MUST NOT include the output parameters.

4513. All values in TPM_STCLEAR_DATA MUST be preserved.
4524. All values in TPM_STCLEAR_FLAGS MUST be preserved.
4535. The contents of any key that is currently loaded SHOULD be preserved if the key's
454
parentPCRStatus indicator is TRUE.
4556. The contents of any key that has TPM_KEY_CONTROL_OWNER_EVICT set MUST be
456
preserved
4577. The contents of any key that is currently loaded MAY be preserved.
4588. The contents of sessions (authorization, transport, DAA, etc.) MAY be preserved as
459
reported by TPM_GetCapability.

97Level 2 Revision 116 28 February 2011
98

11
TCG Published

99Copyright © TCG
100
101

4604.

TPM Main Part 3 Commands
Specification Version 1.2

Admin Testing

4614.1

TPM_SelfTestFull

462Start of informative comment:
463TPM_SelfTestFull tests all of the TPM capabilities.
464Unlike TPM_ContinueSelfTest, which may optionally return immediately and then perform
465the tests, TPM_SelfTestFull always performs the tests and then returns success or failure.
466End of informative comment.
467Incoming Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_COMMAND

2

4

UINT32

paramSize

Total number of input bytes including paramSize and tag

3

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_SelfTestFull

Type

Name

Description

#

SZ

1

#

1S

SZ

4

468Outgoing Operands and Sizes
PARAM

HMAC

#

SZ

#

SZ

1

2

TPM_TAG

tag

TPM_TAG_RSP_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

1S

4

TPM_RESULT

returnCode

The return code of the operation.

2S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_SelfTestFull

469Actions
4701. TPM_SelfTestFull SHALL cause a TPM to perform self-test of each TPM internal function.
471

a. If the self-test succeeds, return TPM_SUCCESS.

472

b. If the self-test fails, return TPM_FAILEDSELFTEST.

4732. Failure of any test results in overall failure, and the TPM goes into failure mode.
4743. If the TPM has not executed the action of TPM_ContinueSelfTest, the TPM
475

a. MAY perform the full self-test.

476

b. MAY return TPM_NEEDS_SELFTEST.

102
103

12

Level 2 Revision 116 28 February 2011
TCG Published

104TPM Main Part 3 Commands

TCG © Copyright

105Specification Version 1.2

4774.2

TPM_ContinueSelfTest

478Start of informative comment:
479TPM_ContinueSelfTest informs the TPM that it should complete the self-test of all TPM
480functions.
481The TPM may return success immediately and then perform the self-test, or it may perform
482the self-test and then return success or failure.
483End of informative comment.
484Incoming Operands and Sizes
PARAM
#

SZ

1

4

SZ

1S

4

Name

Description

TPM_TAG

tag

TPM_TAG_RQU_COMMAND

UINT32

4

3

#

Type

2

2

HMAC

paramSize

Total number of input bytes including paramSize and tag

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_ContinueSelfTest

Type

Name

Description

485Outgoing Operands and Sizes
PARAM

HMAC

#

SZ

#

SZ

1

2

TPM_TAG

tag

TPM_TAG_RSP_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

1S

4

TPM_RESULT

returnCode

The return code of the operation.

2S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_ContinueSelfTest

486Description
4871. Prior to executing the actions of TPM_ContinueSelfTest, if the TPM receives a command
488
C1 that uses an untested TPM function, the TPM MUST take one of these actions:
489

a. The TPM MAY return TPM_NEEDS_SELFTEST

490
491

i. This indicates that the TPM has not tested the internal resources required to
execute C1.

492

ii. The TPM does not execute C1.

493
494

iii. The caller MUST issue TPM_ContinueSelfTest before re-issuing the command
C1.

495
496
497

(1) If the TPM permits TPM_SelfTestFull prior to completing the actions of
TPM_ContinueSelfTest, the caller MAY issue TPM_SelfTestFull rather than
TPM_ContinueSelfTest.

498

b. The TPM MAY return TPM_DOING_SELFTEST

499
500

i. This indicates that the TPM is doing the actions of TPM_ContinueSelfTest
implicitly, as if the TPM_ContinueSelfTest command had been issued.

501

ii. The TPM does not execute C1.

106Level 2 Revision 116 28 February 2011
107

13
TCG Published

108Copyright © TCG
109
110

502
503
504

TPM Main Part 3 Commands
Specification Version 1.2

iii. The caller MUST wait for the actions of TPM_ContinueSelfTest to complete
before reissuing the command C1.
c. The TPM MAY return TPM_SUCCESS or an error code associated with C1.

505
506

i. This
indicates
that
the
TPM
has
completed
TPM_ContinueSelfTest and has completed the command C1.

507

ii. The error code MAY be TPM_FAILEDSELFTEST.

the

actions

of

508Actions
5091. If TPM_PERMANENT_FLAGS -> FIPS is TRUE or TPM_PERMANENT_FLAGS -> TPMpost
510
is TRUE
511

a. The TPM MUST run all self-tests

5122. Else
513

a. The TPM MUST complete all self-tests that are outstanding

514

i.

Instead of completing all outstanding self-tests the TPM MAY run all self-tests

5153. The TPM either
516

a. MAY immediately return TPM_SUCCESS

517
518
519
520

111
112

i. When TPM_ContinueSelfTest finishes execution, it MUST NOT respond to the
caller with a return code.
b. MAY
complete
the
TPM_FAILEDSELFTEST.

self-test

and

14

then

return

TPM_SUCCESS

Level 2 Revision 116 28 February 2011
TCG Published

or

113TPM Main Part 3 Commands

TCG © Copyright

114Specification Version 1.2

5214.3

TPM_GetTestResult

522Start of informative comment:
523TPM_GetTestResult provides manufacturer specific information regarding the results of the
524self-test. This command will work when the TPM is in self-test failure mode. The reason for
525allowing this command to operate in the failure mode is to allow TPM manufacturers to
526obtain diagnostic information.
527End of informative comment.
528Incoming Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_COMMAND

2

4

UINT32

paramSize

Total number of input bytes including paramSize and tag

3

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_GetTestResult

Type

Name

Description

#

SZ

1

#

SZ

1S

4

529Outgoing Operands and Sizes
PARAM

HMAC

#

SZ

#

SZ

1

2

TPM_TAG

tag

TPM_TAG_RSP_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

1S

4

TPM_RESULT

returnCode

The return code of the operation.

2S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_GetTestResult

4

4

3S

4

UINT32

outDataSize

The size of the outData area

5

<>

4S

<>

BYTE[]

outData

The outData this is manufacturer specific

530Description
531This command will work when the TPM is in self test failure mode or limited operation
532mode.
533Actions
5341. The TPM SHALL respond to this command with a manufacturer specific block of
535
information that describes the result of the latest self-test
5362. The information MUST NOT contain any data that uniquely identifies an individual TPM.

115Level 2 Revision 116 28 February 2011
116

15
TCG Published

117Copyright © TCG
118
119

5375.

TPM Main Part 3 Commands
Specification Version 1.2

Admin Opt-in

5385.1

TPM_SetOwnerInstall

539Start of informative comment:
540When enabled but without an owner this command sets the PERMANENT flag that allows or
541disallows the ability to insert an owner.
542End of informative comment.
543Incoming Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_COMMAND

2

4

UINT32

paramSize

Total number of input bytes including paramSize and tag

3

4

1S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_SetOwnerInstall

4

1

2S

1

BOOL

state

State to which ownership flag is to be set.

Type

Name

Description

#

SZ

1

#

SZ

544Outgoing Operands and Sizes
PARAM

HMAC

#

SZ

#

SZ

1

2

TPM_TAG

tag

TPM_TAG_RSP_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

1S

4

TPM_RESULT

returnCode

The return code of the operation.

2S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_SetOwnerInstall

545Action
5461. If the TPM has a current owner, this command immediately returns with
547
TPM_SUCCESS.
5482. The TPM validates the assertion of physical presence. The TPM then sets the value of
549
TPM_PERMANENT_FLAGS -> ownership to the value in state.

120
121

16

Level 2 Revision 116 28 February 2011
TCG Published

122TPM Main Part 3 Commands

TCG © Copyright

123Specification Version 1.2

5505.2

TPM_OwnerSetDisable

551Start of informative comment:
552The TPM owner sets the PERMANENT disable flag to TRUE or FALSE.
553End of informative comment.
554Incoming Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of input bytes including paramSize and tag

3

4

1S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_OwnerSetDisable

4

1

2S

1

BOOL

disableState

Value for disable state

5

4

TPM_AUTHHANDLE

authHandle

The authorization session handle used for owner authentication.

#

SZ

1

#

SZ

2H1

20

TPM_NONCE

authLastNonceEven

Even nonce previously generated by TPM to cover inputs

6

20

3H1

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

7

1

4H1

1

BOOL

continueAuthSession

The continue use flag for the authorization session handle

8

20

TPM_AUTHDATA

ownerAuth

The authorization session digest for inputs and owner authentication.
HMAC key: ownerAuth.

555Outgoing Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RSP_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

#

SZ

1

#

SZ

5

1

6

20

TPM_RESULT

returnCode

The return code of the operation.

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_OwnerSetDisable

2H1

20

TPM_NONCE

nonceEven

Even nonce newly generated by TPM to cover outputs

3H1

20

4

2S
4

1S

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

4H1

1

BOOL

continueAuthSession

Continue use flag, TRUE if handle is still active

TPM_AUTHDATA

resAuth

The authorization session digest for the returned parameters. HMAC key:
ownerAuth.

556Action
5571. The TPM SHALL authenticate the command as coming from the TPM Owner. If
558
unsuccessful, the TPM SHALL return TPM_AUTHFAIL.
5592. The TPM SHALL set the TPM_PERMANENT_FLAGS -> disable flag to the value in the
560
disableState parameter.

124Level 2 Revision 116 28 February 2011
125

17
TCG Published

126Copyright © TCG
127
128

5615.3

TPM Main Part 3 Commands
Specification Version 1.2

TPM_PhysicalEnable

562Start of informative comment:
563Sets the PERMANENT disable flag to FALSE using physical presence as authorization.
564End of informative comment.
565Incoming Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_COMMAND

2

4

UINT32

paramSize

Total number of input bytes including paramSize and tag

3

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_PhysicalEnable

Type

Name

Description

#

SZ

1

#

1S

SZ

4

566Outgoing Operands and Sizes
PARAM

HMAC

#

SZ

#

SZ

1

2

TPM_TAG

tag

TPM_TAG_RSP_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

1S

4

TPM_RESULT

returnCode

The return code of the operation.

2S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_PhysicalEnable

567Action
5681. Validate that physical presence is being asserted, if not return TPM_BAD_PRESENCE
5692. The TPM SHALL set the TPM_PERMANENT_FLAGS.disable value to FALSE.

129
130

18

Level 2 Revision 116 28 February 2011
TCG Published

131TPM Main Part 3 Commands

TCG © Copyright

132Specification Version 1.2

5705.4

TPM_PhysicalDisable

571Start of informative comment:
572Sets the PERMANENT disable flag to TRUE using physical presence as authorization
573End of informative comment.
574Incoming Operands and Sizes
PARAM

HMAC

#

SZ

#

1

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_COMMAND

2

4

UINT32

paramSize

Total number of input bytes including paramSize and tag

3

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_PhysicalDisable

Type

Name

Description

1S

SZ

4

575Outgoing Operands and Sizes
PARAM

HMAC

#

SZ

#

1

2

TPM_TAG

tag

TPM_TAG_RSP_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

SZ

1S

4

TPM_RESULT

returnCode

The return code of the operation.

2S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_PhysicalDisable

576Action
5771. Validate that physical presence is being asserted, if not return TPM_BAD_PRESENCE
5782. The TPM SHALL set the TPM_PERMANENT_FLAGS.disable value to TRUE.

133Level 2 Revision 116 28 February 2011
134

19
TCG Published

135Copyright © TCG
136
137

5795.5

TPM Main Part 3 Commands
Specification Version 1.2

TPM_PhysicalSetDeactivated

580Start of informative comment:
581Changes the TPM persistant deactivated flag using physical presence as authorization.
582This command is not available when the TPM is disabled.
583End of informative comment.
584Incoming Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_COMMAND

2

4

UINT32

paramSize

Total number of input bytes including paramSize and tag

3

4

1S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_PhysicalSetDeactivated

4

1

2S

1

BOOL

state

State to which deactivated flag is to be set.

Type

Name

Description

#

SZ

1

#

SZ

585Outgoing Operands and Sizes
PARAM

HMAC

#

SZ

#

SZ

1

2

TPM_TAG

tag

TPM_TAG_RSP_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

1S

4

TPM_RESULT

returnCode

The return code of the operation.

2S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_PhysicalSetDeactivated

586Action
5871. Validate that physical presence is being asserted, if not return TPM_BAD_PRESENCE
5882. The TPM SHALL set the TPM_PERMANENT_FLAGS.deactivated flag to the value in the
589
state parameter.

138
139

20

Level 2 Revision 116 28 February 2011
TCG Published

140TPM Main Part 3 Commands

TCG © Copyright

141Specification Version 1.2

5905.6

TPM_SetTempDeactivated

591Start of informative comment:
592This command allows the operator of the platform to deactivate the TPM until the next boot
593of the platform.
594This command requires operator authentication. The operator can provide the
595authentication by either the assertion of physical presence or presenting the operator
596AuthData value.
597End of informative comment.
598Incoming Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of input bytes including paramSize and tag

3

4

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_SetTempDeactivated

4

4

4

TPM_AUTHHANDLE

authHandle

Auth handle for operation validation. Session type MUST be OIAP

2H1

20

TPM_NONCE

authLastNonceEven

Even nonce previously generated by TPM to cover inputs

#

SZ

1

#

SZ

1S

5

20

3H1

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

6

1

4H1

1

BOOL

continueAuthSession

The continue use flag for the authorization session handle

7

20

TPM_AUTHDATA

operatorAuth

HMAC key: operatorAuth

599Outgoing Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RSP_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

#

SZ

1

#

SZ

5

1

6

20

TPM_RESULT

returnCode

The return code of the operation.

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_SetTempDeactivated

2H1

20

TPM_NONCE

nonceEven

Even nonce newly generated by TPM to cover outputs

3H1

20

4

2S
4

1S

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

4H1

1

BOOL

continueAuthSession

Continue use flag, TRUE if handle is still active

TPM_AUTHDATA

resAuth

The authorization session digest for the returned parameters. HMAC key:
operatorAuth.

600Action
6011. If tag = TPM_TAG_RQU_AUTH1_COMMAND
602

a. If TPM_PERMANENT_FLAGS -> operator is FALSE return TPM_NOOPERATOR

603
604

b. Validate command
TPM_AUTHFAIL

and

142Level 2 Revision 116 28 February 2011
143

parameters

using

21
TCG Published

operatorAuth,

on

error

return

144Copyright © TCG
145
146

TPM Main Part 3 Commands
Specification Version 1.2

6052. Else
606

a. If physical presence is not asserted the TPM MUST return TPM_BAD_PRESENCE

6073. The TPM SHALL set the TPM_STCLEAR_FLAGS.deactivated flag to the value TRUE.

147
148

22

Level 2 Revision 116 28 February 2011
TCG Published

149TPM Main Part 3 Commands

TCG © Copyright

150Specification Version 1.2

6085.7

TPM_SetOperatorAuth

609Start of informative comment:
610This command allows the setting of the operator AuthData value.
611There is no confidentiality applied to the operator authentication as the value is sent under
612the assumption of being local to the platform. If there is a concern regarding the path
613between the TPM and the keyboard then unless the keyboard is using encryption and a
614secure channel an attacker can read the values.
615End of informative comment.
616Incoming Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_COMMAND

2

4

UINT32

paramSize

Total number of input bytes including paramSize and tag

3

4

1S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_SetOperatorAuth

4

20

2S

20

TPM_SECRET

operatorAuth

The operator AuthData

Type

Name

Description

TPM_TAG

tag

TPM_TAG_RSP_COMMAND

#

SZ

1

#

SZ

617Outgoing Operands and Sizes
PARAM
#

SZ

1

2

2

4

3

4

HMAC
#

SZ

UINT32

paramSize

Total number of output bytes including paramSize and tag

1S

4

TPM_RESULT

returnCode

The return code of the operation.

2S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_SetOperatorAuth

618Action
6191. If physical presence is not asserted the TPM MUST return TPM_BAD_PRESENCE
6202. The TPM SHALL set the TPM_PERMANENT_DATA -> operatorAuth
6213. The TPM SHALL set TPM_PERMANENT_FLAGS -> operator to TRUE

151Level 2 Revision 116 28 February 2011
152

23
TCG Published

153Copyright © TCG
154
155

6226.

TPM Main Part 3 Commands
Specification Version 1.2

Admin Ownership

6236.1

TPM_TakeOwnership

624Start of informative comment:
625This command inserts the TPM Ownership value into the TPM.
626End of informative comment.
627Incoming Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of input bytes including paramSize and tag

3

4

1S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_TakeOwnership

4

2

2S

2

TPM_PROTOCOL_ID

protocolID

The ownership protocol in use.

5

4

3S

4

UINT32

encOwnerAuthSize

The size of the encOwnerAuth field

6

<>

4S

<>

BYTE[ ]

encOwnerAuth

The owner AuthData encrypted with PUBEK

7

4

5S

4

UINT32

encSrkAuthSize

The size of the encSrkAuth field

8

<>

6S

<>

BYTE[ ]

encSrkAuth

The SRK AuthData encrypted with PUBEK

9

<>

7S

<>

TPM_KEY12

srkParams

Structure containing all parameters of new SRK. pubKey.keyLength &
encSize are both 0. This structure MAY be TPM_KEY12.

10

4

TPM_AUTHHANDLE

authHandle

The authorization session handle used for this command

#

SZ

1

#

SZ

2H1

20

TPM_NONCE

authLastNonceEven

Even nonce previously generated by TPM to cover inputs

11

20

3H1

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

12

1

4H1

1

BOOL

continueAuthSession

The continue use flag for the authorization session handle

13

20

TPM_AUTHDATA

ownerAuth

Authorization session digest for input params. HMAC key: the new
ownerAuth value. See actions for validation operations

628

156
157

24

Level 2 Revision 116 28 February 2011
TCG Published

158TPM Main Part 3 Commands

TCG © Copyright

159Specification Version 1.2

629Outgoing Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RSP_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

#

SZ

1

#

SZ

1S

4

TPM_RESULT

returnCode

The return code of the operation.

2S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_TakeOwnership

4

<>

3S

<>

TPM_KEY

srkPub

Structure containing all parameters of new SRK. srkPub.encData is set to
0. This structure MAY be TPM_KEY12.

5

20

2H1

20

TPM_NONCE

nonceEven

Even nonce newly generated by TPM to cover outputs

3H1

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

4H1

1

BOOL

continueAuthSession

Continue use flag, TRUE if handle is still active

TPM_AUTHDATA

resAuth

The authorization session digest for the returned parameters. HMAC key:
the new ownerAuth value

6

1

7

20

630Description
631The type of the output srkPub MUST be the same as the type of the input srkParams, either
632both TPM_KEY or both TPM_KEY12.
633Actions
6341. If TPM_PERMANENT_DATA -> ownerAuth is valid return TPM_OWNER_SET
6352. If TPM_PERMANENT_FLAGS -> ownership is FALSE return TPM_INSTALL_DISABLED
6363. If
TPM_PERMANENT_DATA
637
TPM_NO_ENDORSEMENT

->

endorsementKey

is

invalid

return

6384. Verify that authHandle is of type OIAP on error return TPM_AUTHFAIL
6395. If protocolID is not TPM_PID_OWNER, the TPM MAY return TPM_BAD_PARAMETER
6406. Create A1 a TPM_SECRET by decrypting encOwnerAuth using PRIVEK as the key
641

a. This requires that A1 was encrypted using the PUBEK

642

b. Validate that A1 is a length of 20 bytes, on error return TPM_BAD_KEY_PROPERTY

6437. Validate the command and parameters using A1 and ownerAuth, on error return
644
TPM_AUTHFAIL
6458. Validate srkParams
646
647

a. If
srkParams
->
TPM_INVALID_KEYUSAGE

648

b. If srkParams -> migratable is TRUE return TPM_INVALID_KEYUSAGE

649
650

c. If srkParams -> algorithmParms -> algorithmID is NOT TPM_ALG_RSA return
TPM_BAD_KEY_PROPERTY

651
652

d. If
srkParams
->
algorithmParms
->
encScheme
TPM_ES_RSAESOAEP_SHA1_MGF1 return TPM_BAD_KEY_PROPERTY

160Level 2 Revision 116 28 February 2011
161

keyUsage

is

25
TCG Published

not

TPM_KEY_STORAGE

is

return

NOT

162Copyright © TCG
163
164

TPM Main Part 3 Commands
Specification Version 1.2

653
654

e. If srkParams -> algorithmParms -> sigScheme is NOT TPM_SS_NONE return
TPM_BAD_KEY_PROPERTY

655
656

f. srkParams -> algorithmParms -> parms -> keyLength MUST be greater than or equal
to 2048, on error return TPM_BAD_KEY_PROPERTY

657
658

g. If srkParams -> algorithmParms -> parms -> exponentSize is not 0, return
TPM_BAD_KEY_PROPERTY

659

h. If TPM_PERMANENT_FLAGS -> FIPS is TRUE

660
661

i. If srkParams
TPM_NOTFIPS

->

authDataUsage

specifies

TPM_AUTH_NEVER

return

6629. Generate K1 according to the srkParams, on error return TPM_BAD_KEY_PROPERTY
663

a. This includes copying PCRInfo from srkParams to K1

66410.Create A2 a TPM_SECRET by decrypting encSrkAuth using the PRIVEK
665

a. This requires A2 to be encrypted using the PUBEK

666

b. Validate that A2 is a length of 20 bytes, on error return TPM_BAD_KEY_PROPERTY

667

c. Store A2 in K1 -> usageAuth

66811.Store K1 in TPM_PERMANENT_DATA -> srk
66912.Store A1 in TPM_PERMANENT_DATA -> ownerAuth
67013.Create TPM_PERMANENT_DATA -> contextKey according to the rules for the algorithm
671
in use by the TPM to save context blobs
67214.Create TPM_PERMANENT_DATA -> delegateKey according to the rules for the algorithm
673
in use by the TPM to save delegate blobs
67415.Create TPM_PERMANENT_DATA -> tpmProof by using the TPM RNG
67516.Export TPM_PERMANENT_DATA -> srk as srkPub
67617.Set TPM_PERMANENT_FLAGS -> readPubek to FALSE
67718.Calculate resAuth using the newly established TPM_PERMANENT_DATA -> ownerAuth

165
166

26

Level 2 Revision 116 28 February 2011
TCG Published

167TPM Main Part 3 Commands

TCG © Copyright

168Specification Version 1.2

6786.2

TPM_OwnerClear

679Start of informative comment:
680The TPM_OwnerClear command performs the clear operation under Owner authentication.
681This command is available until the Owner executes the TPM_DisableOwnerClear, at which
682time any further invocation of this command returns TPM_CLEAR_DISABLED.
683End of informative comment.
684Incoming Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of input bytes including paramSize and tag

3

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_OwnerClear

4

4

TPM_AUTHHANDLE

authHandle

The authorization session handle used for owner authentication.

#

SZ

1

#

SZ

1S

4

2H1

20

TPM_NONCE

authLastNonceEven

Even nonce previously generated by TPM to cover inputs

5

20

3H1

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

6

1

4H1

1

BOOL

continueAuthSession

Ignored

7

20

TPM_AUTHDATA

ownerAuth

The authorization session digest for inputs and owner authentication.
HMAC key: ownerAuth.

685Outgoing Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RSP_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

#

SZ

1

#

SZ

5

1

6

TPM_RESULT

returnCode

The return code of the operation.

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_OwnerClear

2H1

20

TPM_NONCE

nonceEven

Even nonce newly generated by TPM to cover outputs

3H1

20

4

2S
4

1S

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

4H1

1

BOOL

continueAuthSession

Fixed value FALSE

TPM_AUTHDATA

resAuth

The authorization session digest for the returned parameters. HMAC key:
old ownerAuth.

20

686Actions
6871. Verify that the TPM Owner authorizes the command and all of the input, on error return
688
TPM_AUTHFAIL.
6892. If TPM_PERMANENT_FLAGS
690
TPM_CLEAR_DISABLED.

->

disableOwnerClear

6913. Unload all loaded keys.
692

a. This includes owner evict keys

169Level 2 Revision 116 28 February 2011
170

27
TCG Published

is

TRUE

then

return

171Copyright © TCG
172
173

693
694

TPM Main Part 3 Commands
Specification Version 1.2

b. If TPM_PERMANENT_FLAGS -> FIPS is TRUE, the memory locations containing
secret or private keys MUST be set to all zeros.

6954. The TPM MUST NOT modify the following TPM_PERMANENT_DATA items
696

a. endorsementKey

697

b. revMajor

698

c. revMinor

699

d. manuMaintPub

700

e. auditMonotonicCounter

701

f. monotonicCounter

702

g. pcrAttrib

703

h. rngState

704

i.

EKReset

705

j.

lastFamilyID

706

k. tpmDAASeed

707

l.

708

m. daaProof

709

n. daaBlobKey

authDIR[0]

7105. The TPM MUST invalidate the following TPM_PERMANENT_DATA items and any internal
711
resources associated with these items
712

a. ownerAuth

713

b. srk

714

c. delegateKey

715

d. delegateTable

716

e. contextKey

717

f. tpmProof

718

g. operatorAuth

7196. The TPM MUST reset to manufacturing defaults the following TPM_PERMANENT_DATA
720
items
721

a. noOwnerNVWrite MUST be set to 0

722

b. ordinalAuditStatus

723

c. restrictDelegate

7247. The TPM MUST invalidate or reset all fields of TPM_STANY_DATA
725

a. Nonces SHALL be reset

726

b. Lists (e.g. contextList) SHALL be invalidated

7278. The TPM MUST invalidate or reset all fields of TPM_STCLEAR_DATA except the PCR’s
174
175

28

Level 2 Revision 116 28 February 2011
TCG Published

176TPM Main Part 3 Commands

TCG © Copyright

177Specification Version 1.2

728

a. Nonces SHALL be reset

729

b. Lists (e.g. contextList) SHALL be invalidated

730

c. deferredPhysicalPresence MUST be set to 0

7319. The TPM MUST set the following TPM_PERMANENT_FLAGS to their default values
732

a. disable

733

b. deactivated

734

c. readPubek

735

d. disableOwnerClear

736

e. disableFullDALogicInfo

737

f. allowMaintenance

738

g. readSRKPub

73910.The TPM MUST set the following TPM_PERMANENT_FLAGS
740

a. ownership to TRUE

741

b. operator to FALSE

742

c. maintenanceDone to FALSE

74311.The TPM releases all TPM_PERMANENT_DATA -> monotonicCounter settings
744
745
746

a. This includes invalidating all currently allocated counters. The result will be no
currently allocated counters and the new owner will need to allocate counters. The
actual count value will continue to increase.

74712.The TPM MUST deallocate all defined NV storage areas where
748

a.

TPM_NV_PER_OWNERWRITE is TRUE if nvIndex does not have the “D” bit set

749

b.

TPM_NV_PER_OWNERREAD is TRUE if nvIndex does not have the “D” bit set

750

c. The TPM MUST NOT deallocate any other currently defined NV storage areas.

75113.The TPM MUST invalidate all familyTable entries
75214.The TPM MUST terminate all sessions, active or saved.

178Level 2 Revision 116 28 February 2011
179

29
TCG Published

180Copyright © TCG
181
182

7536.3

TPM Main Part 3 Commands
Specification Version 1.2

TPM_ForceClear

754Start of informative comment:
755The TPM_ForceClear command performs the Clear operation under physical access. This
756command is available until the execution of the TPM_DisableForceClear, at which time any
757further invocation of this command returns TPM_CLEAR_DISABLED.
758TPM_ForceClear can succeed even if no owner is installed. In that case, it does whatever
759TPM_OwnerClear actions that it can.
760End of informative comment.
761Incoming Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_COMMAND

2

4

UINT32

paramSize

Total number of input bytes including paramSize and tag

3

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_ForceClear

Type

Name

Description

#

SZ

1

#

1S

SZ

4

762Outgoing Operands and Sizes
PARAM

HMAC

#

SZ

#

SZ

1

2

TPM_TAG

tag

TPM_TAG_RSP_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

1S

4

TPM_RESULT

returnCode

The return code of the operation.

2S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_ForceClear

763Actions
7641. The TPM SHALL check for the assertion of physical presence, if not present return
765
TPM_BAD_PRESENCE
7662. If TPM_STCLEAR_FLAGS -> disableForceClear is TRUE return TPM_CLEAR_DISABLED
7673. The TPM SHALL execute the actions of TPM_OwnerClear (except for the TPM Owner
768
authentication check)

183
184

30

Level 2 Revision 116 28 February 2011
TCG Published

185TPM Main Part 3 Commands

TCG © Copyright

186Specification Version 1.2

7696.4

TPM_DisableOwnerClear

770Start of informative comment:
771The TPM_DisableOwnerClear command disables the ability to execute the TPM_OwnerClear
772command permanently. Once invoked the only method of clearing the TPM will require
773physical access to the TPM.
774After the execution of TPM_ForceClear, ownerClear is re-enabled and must be explicitly
775disabled again by the new TPM Owner.
776End of informative comment.
777Incoming Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of input bytes including paramSize and tag

3

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_DisableOwnerClear

4

4

TPM_AUTHHANDLE

authHandle

The authorization session handle used for owner authentication.

#

SZ

1

#

SZ

1S

4

2H1

20

TPM_NONCE

authLastNonceEven

Even nonce previously generated by TPM to cover inputs

5

20

3H1

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

6

1

4H1

1

BOOL

continueAuthSession

The continue use flag for the authorization session handle

7

20

TPM_AUTHDATA

ownerAuth

The authorization session digest for inputs and owner authentication.
HMAC key: ownerAuth.

778Outgoing Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RSP_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

#

SZ

1

#

SZ

5

1

6

TPM_RESULT

returnCode

The return code of the operation.

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_DisableOwnerClear

2H1

20

TPM_NONCE

nonceEven

Even nonce newly generated by TPM to cover outputs

3H1

20

4

2S
4

1S

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

4H1

1

BOOL

continueAuthSession

Continue use flag, TRUE if handle is still active

TPM_AUTHDATA

resAuth

The authorization session digest for the returned parameters. HMAC key:
ownerAuth.

20

779Actions
7801. The TPM verifies that the authHandle properly authorizes the owner.
7812. The TPM sets the TPM_PERMANENT_FLAGS -> disableOwnerClear flag to TRUE.

187Level 2 Revision 116 28 February 2011
188

31
TCG Published

189Copyright © TCG
190
191

TPM Main Part 3 Commands
Specification Version 1.2

7823. When this flag is TRUE the only mechanism that can clear the TPM is the
783
TPM_ForceClear command. The TPM_ForceClear command requires physical access to
784
the TPM to execute.

192
193

32

Level 2 Revision 116 28 February 2011
TCG Published

194TPM Main Part 3 Commands

TCG © Copyright

195Specification Version 1.2

7856.5

TPM_DisableForceClear

786Start of informative comment:
787The TPM_DisableForceClear command disables the execution of the TPM_ForceClear
788command until the next startup cycle. Once this command is executed, the TPM_ForceClear
789is disabled until another startup cycle is run.
790End of informative comment.
791Incoming Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_COMMAND

2

4

UINT32

paramSize

Total number of input bytes including paramSize and tag

3

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_DisableForceClear

Type

Name

Description

#

SZ

1

#

1S

SZ

4

792Outgoing Operands and Sizes
PARAM

HMAC

#

SZ

#

SZ

1

2

TPM_TAG

tag

TPM_TAG_RSP_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

1S

4

TPM_RESULT

returnCode

The return code of the operation.

2S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_DisableForceClear

793Actions
7941. The TPM sets the TPM_STCLEAR_FLAGS.disableForceClear flag in the TPM that disables
795
the execution of the TPM_ForceClear command.

196Level 2 Revision 116 28 February 2011
197

33
TCG Published

198Copyright © TCG
199
200

7966.6

TPM Main Part 3 Commands
Specification Version 1.2

TSC_PhysicalPresence

797Start of informative comment:
798Some TPM operations require the indication of a human’s physical presence at the platform.
799The presence of the human either provides another indication of platform ownership or a
800mechanism to ensure that the execution of the command is not the result of a remote
801software process.
802This command allows a process on the platform to indicate the assertion of physical
803presence. As this command is executable by software there must be protections against the
804improper invocation of this command.
805The physicalPresenceHWEnable and physicalPresenceCMDEnable indicate the ability for
806either SW or HW to indicate physical presence. These flags can be reset until the
807physicalPresenceLifetimeLock is set. The platform manufacturer should set these flags to
808indicate the capabilities of the platform the TPM is bound to.
809The command provides two sets of functionality. The first is to enable, permanently, either
810the HW or the SW ability to assert physical presence. The second is to allow SW, if enabled,
811to assert physical presence.
812End of informative comment.
813Incoming Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_COMMAND

2

4

UINT32

paramSize

Total number of input bytes including paramSize and tag

3

4

1S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TSC_ORD_PhysicalPresence.

4

2

2S

2

TPM_PHYSICAL_PRESENCE

physicalPresence

The state to set the TPM’s Physical Presence flags.

#

SZ

1

#

SZ

814Outgoing Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RSP_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

#

SZ

1

#

SZ

1S

4

TPM_RESULT

returnCode

The return code of the operation.

2S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TSC_ORD_PhysicalPresence.

815Actions
8161. For documentation ease, the bits break into two categories. The first is the lifetime
817
settings and the second is the assertion settings.
818
819
820
821
201
202

a. Define A1 to be the lifetime settings: TPM_PHYSICAL_PRESENCE_LIFETIME_LOCK,
TPM_PHYSICAL_PRESENCE_HW_ENABLE, TPM_PHYSICAL_PRESENCE_CMD_ENABLE,
TPM_PHYSICAL_PRESENCE_HW_DISABLE,
and
TPM_PHYSICAL_PRESENCE_CMD_DISABLE
34

Level 2 Revision 116 28 February 2011
TCG Published

203TPM Main Part 3 Commands

TCG © Copyright

204Specification Version 1.2

822
823

b. Define A2 to be the assertion settings: TPM_PHYSICAL_PRESENCE_LOCK,
TPM_PHYSICAL_PRESENCE_PRESENT, and TPM_PHYSICAL_PRESENCE_NOTPRESENT

824Lifetime lock settings
8252. If any A1 setting is present
826
827

a. If TPM_PERMANENT_FLAGS -> physicalPresenceLifetimeLock is TRUE, return
TPM_BAD_PARAMETER

828

b. If any A2 setting is present return TPM_BAD_PARAMETER

829
830
831

c. If both physicalPresence -> TPM_PHYSICAL_PRESENCE_HW_ENABLE and
physicalPresence -> TPM_PHYSICAL_PRESENCE_HW_DISABLE are TRUE, return
TPM_BAD_PARAMETER.

832
833
834

d. If both physicalPresence -> TPM_PHYSICAL_PRESENCE_CMD_ENABLE and
physicalPresence -> TPM_PHYSICAL_PRESENCE_CMD_DISABLE are TRUE, return
TPM_BAD_PARAMETER.

835
836

e. If physicalPresence -> TPM_PHYSICAL_PRESENCE_HW_ENABLE is TRUE Set
TPM_PERMANENT_FLAGS -> physicalPresenceHWEnable to TRUE

837
838

f. If physicalPresence -> TPM_PHYSICAL_PRESENCE_HW_DISABLE is TRUE Set
TPM_PERMANENT_FLAGS -> physicalPresenceHWEnable to FALSE

839
840

g. If physicalPresence -> TPM_PHYSICAL_PRESENCE_CMD_ENABLE is TRUE, Set
TPM_PERMANENT_FLAGS -> physicalPresenceCMDEnable to TRUE.

841
842

h. If physicalPresence -> TPM_PHYSICAL_PRESENCE_CMD_DISABLE is TRUE, Set
TPM_PERMANENT_FLAGS -> physicalPresenceCMDEnable to FALSE.

843

i.

844
845

If physicalPresence -> TPM_PHYSICAL_PRESENCE_LIFETIME_LOCK is TRUE
i.

j.

Set TPM_PERMANENT_FLAGS -> physicalPresenceLifetimeLock to TRUE

Return TPM_SUCCESS

846SW physical presence assertion
8473. If any A2 setting is present
848

a. If any A1 setting is present return TPM_BAD_PARAMETER

849
850

i. This check here just for consistency, the prior checks would have already
ensured that this was ok

851
852

b. If TPM_PERMANENT_FLAGS -> physicalPresenceCMDEnable is FALSE, return
TPM_BAD_PARAMETER

853
854

c. If both physicalPresence -> TPM_PHYSICAL_PRESENCE_LOCK and physicalPresence
-> TPM_PHYSICAL_PRESENCE_PRESENT are TRUE, return TPM_BAD_PARAMETER

855
856
857

d. If
both
physicalPresence
->
TPM_PHYSICAL_PRESENCE_PRESENT
and
physicalPresence -> TPM_PHYSICAL_PRESENCE_NOTPRESENT are TRUE, return
TPM_BAD_PARAMETER

858
859

e. If
TPM_STCLEAR_FLAGS
TPM_BAD_PARAMETER

205Level 2 Revision 116 28 February 2011
206

->

physicalPresenceLock

35
TCG Published

is

TRUE,

return

207Copyright © TCG
208
209

860

TPM Main Part 3 Commands
Specification Version 1.2

f. If physicalPresence -> TPM_PHYSICAL_PRESENCE_LOCK is TRUE

861

i.

862

ii. Set TPM_STCLEAR_FLAGS -> physicalPresenceLock to TRUE

863

iii. Return TPM_SUCCESS

864

g. If physicalPresence -> TPM_PHYSICAL_PRESENCE_PRESENT is TRUE

865
866

i.

Set TPM_STCLEAR_FLAGS -> physicalPresence to TRUE

h. If physicalPresence -> TPM_PHYSICAL_PRESENCE_NOTPRESENT is TRUE

867
868

Set TPM_STCLEAR_FLAGS -> physicalPresence to FALSE

i.
i.

Set TPM_STCLEAR_FLAGS -> physicalPresence to FALSE

Return TPM_SUCCESS

8694. Else // There were no A1 or A2 parameters set
870

210
211

a. Return TPM_BAD_PARAMETER

36

Level 2 Revision 116 28 February 2011
TCG Published

212TPM Main Part 3 Commands

TCG © Copyright

213Specification Version 1.2

8716.7

TSC_ResetEstablishmentBit

872Start of informative comment:
873The PC TPM Interface Specification (TIS) specifies setting tpmEstablished to TRUE upon
874execution of the HASH_START sequence. The setting implies the creation of a Trusted
875Operating System on the platform. Platforms will use the value of tpmEstablished to
876determine if operations necessary to maintain the security perimeter are necessary.
877The tpmEstablished bit provides a non-volatile, secure reporting that a HASH_START was
878previously run on the platform. When a platform makes use of the tpmEstablished bit, the
879platform can reset tpmEstablished as the operation is no longer necessary.
880For example, a platform could use tpmEstablished to ensure that, if HASH_START had ever
881been, executed the platform could use the value to invoke special processing. Once the
882processing is complete the platform will wish to reset tpmEstablished to avoid invoking the
883special process again.
884The TPM_PERMANENT_FLAGS -> tpmEstablished bit described in the TPM specifications
885uses positive logic. The TPM_ACCESS register uses negative logic, so that TRUE is reflected
886as a 0.
887End of informative comment.
888Incoming Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_COMMAND

2

4

UINT32

paramSize

Total number of input bytes including paramSize and tag

3

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TSC_ORD_ResetEstablishmentBit

Type

Name

Description

#

SZ

1

#

1S

SZ

4

889Outgoing Operands and Sizes
PARAM

HMAC

#

SZ

#

SZ

1

2

TPM_TAG

tag

TPM_TAG_RSP_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

1S

4

TPM_RESULT

returnCode

The return code of the operation.

2S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TSC_ORD_ResetEstablishmentBit

890Actions
8911. Validate the assertion of locality 3 or locality 4
8922. Set TPM_PERMANENT_FLAGS -> tpmEstablished to FALSE
8933. Return TPM_SUCCESS

214Level 2 Revision 116 28 February 2011
215

37
TCG Published

216Copyright © TCG
217
218

TPM Main Part 3 Commands
Specification Version 1.2

8947. The Capability Commands
895Start of informative comment:
896The TPM has numerous capabilities that a remote entity may wish to know about. These
897items include support of algorithms, key sizes, protocols and vendor-specific additions. The
898TPM_GetCapability command allows the TPM to report back to the requestor what type of
899TPM it is dealing with.
900The request for information requires the requestor to specify which piece of information that
901is required. The request does not allow the “merging” of multiple requests and returns only
902a single piece of information.
903In failure mode, the TPM returns a limited set of information that includes the TPM
904manufacturer and version.
905In version 1.2 with the deletion of TPM_GetCapabilitySigned the way to obtain a signed
906listing of the capabilities is to create a transport session, perform TPM_GetCapability
907commands to list the information and then close the transport session using
908TPM_ReleaseTransportSigned.
909End of informative comment.
9101. The standard information provided in TPM_GetCapability MUST NOT provide unique
911
information
912
913
914

219
220

a. The TPM has no control of information placed into areas on the TPM like the NV store
that is reported by the TPM. Configuration information for these areas could conceivably
be unique

38

Level 2 Revision 116 28 February 2011
TCG Published

221TPM Main Part 3 Commands

TCG © Copyright

222Specification Version 1.2

9157.1

TPM_GetCapability

916Start of informative comment:
917This command returns current information regarding the TPM.
918The limitation on what can be returned in failure mode restricts the information a
919manufacturer may return when capArea indicates TPM_CAP_MFR.
920End of informative comment.
921Incoming Parameters and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_COMMAND

2

4

UINT32

paramSize

Total number of input bytes including paramSize and tag

3

4

1S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_GetCapability

4

4

2S

4

TPM_CAPABILITY_AREA

capArea

Partition of capabilities to be interrogated

5

4

3S

4

UINT32

subCapSize

Size of subCap parameter

6

<>

4S

<>

BYTE[]

subCap

Further definition of information

Type

Name

Description

#

SZ

1

#

SZ

922Outgoing Parameters and Sizes
PARAM

HMAC

#

SZ

#

SZ

1

2

TPM_TAG

tag

TPM_TAG_RSP_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

1S

4

TPM_RESULT

returnCode

The return code of the operation.

2S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_GetCapability

4

4

3S

4

UINT32

respSize

The length of the returned capability response

5

<>

4S

<>

BYTE[ ]

resp

The capability response

923

223Level 2 Revision 116 28 February 2011
224

39
TCG Published

225Copyright © TCG
226
227

TPM Main Part 3 Commands
Specification Version 1.2

924Actions
9251. The TPM validates the capArea and subCap indicators. If the information is available,
926
the TPM creates the response field and fills in the actual information.
9272. The structure document contains the list of caparea and subCap values
9283. If the TPM is in failure mode or limited operation mode, the TPM MUST return
929

a. TPM_CAP_VERSION

930

b. TPM_CAP_VERSION_VAL

931

c. TPM_CAP_MFR

932

d. TPM_CAP_PROPERTY -> TPM_CAP_PROP_MANUFACTURER

933

e. TPM_CAP_PROPERTY -> TPM_CAP_PROP_DURATION

934

f. TPM_CAP_PROPERTY -> TPM_CAP_PROP_TIS_TIMEOUT

935

g. The TPM MAY return any other capability.

228
229

40

Level 2 Revision 116 28 February 2011
TCG Published

230TPM Main Part 3 Commands

TCG © Copyright

231Specification Version 1.2

9367.2

TPM_SetCapability

937Start of informative comment:
938This command sets values in the TPM.
939A setValue that is inconsistent with the capArea and subCap is considered a bad
940parameter.
941End of informative comment.
942Incoming Parameters and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of input bytes including paramSize and tag

3

4

1S

4

TPM_COMMAND_CODE

ordinal

ordinal: TPM_ORD_SetCapability

4

4

2S

4

TPM_CAPABILITY_AREA

capArea

Partition of capabilities to be set

5

4

3S

4

UINT32

subCapSize

Size of subCap parameter

6

<>

4S

<>

BYTE[]

subCap

Further definition of information

7

4

5S

4

UINT32

setValueSize

The size of the value to set

8

<>

6S

<>

BYTE[]

setValue

The value to set

9

4

TPM_AUTHHANDLE

authHandle

The authorization session handle used for owner authentication.

#

SZ

1

#

SZ

2H1

20

TPM_NONCE

authLastNonceEven

Even nonce previously generated by TPM to cover inputs

10

20

3H1

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

11

1

4H1

1

BOOL

continueAuthSession

The continue use flag for the authorization session handle

12

20

TPM_AUTHDATA

ownerAuth

Authorization. HMAC key: owner.usageAuth.

232Level 2 Revision 116 28 February 2011
233

41
TCG Published

234Copyright © TCG
235
236

TPM Main Part 3 Commands
Specification Version 1.2

943Outgoing Parameters and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RSP_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

#

SZ

1

#

SZ

5

1

6

TPM_RESULT

returnCode

The return code of the operation.

4

TPM_COMMAND_CODE

ordinal

ordinal: TPM_ORD_SetCapability

2H1

20

TPM_NONCE

nonceEven

Even nonce newly generated by TPM to cover outputs

3H1

20

4

2S
4

1S

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

4H1

1

BOOL

continueAuthSession

Continue use flag, TRUE if handle is still active

TPM_AUTHDATA

resAuth

Authorization HMAC key:owner.usageAuth.

20

944Actions
9451. If tag = TPM_TAG_RQU_AUTH1_COMMAND, validate the command and parameters
946
using ownerAuth, return TPM_AUTHFAIL on error
9472. The TPM validates the capArea and subCap indicators, including the ability to set value
948
based on any set restrictions
9493. If the capArea and subCap indicators conform with one of the entries in the structure
950
TPM_CAPABILITY_AREA (Values for TPM_SetCapability)
951

a. The TPM sets the relevant flag/data to the value of setValue parameter.

9524. Else
953

237
238

a. Return the error code TPM_BAD_PARAMETER.

42

Level 2 Revision 116 28 February 2011
TCG Published

239TPM Main Part 3 Commands

TCG © Copyright

240Specification Version 1.2

9547.3

TPM_GetCapabilityOwner

955Start of informative comment:
956TPM_GetCapabilityOwner enables the TPM Owner to retrieve all the non-volatile flags and
957the volatile flags in a single operation.
958The flags summarize many operational aspects of the TPM. The information represented by
959some flags is private to the TPM Owner. So, for simplicity, proof of ownership of the TPM
960must be presented to retrieve the set of flags. When necessary, the flags that are not private
961to the Owner can be deduced by Users via other (more specific) means.
962The normal TPM authentication mechanisms are sufficient to prove the integrity of the
963response. No additional integrity check is required.
964End of informative comment.
965Incoming Operands and Sizes
PARAM

HMAC
#

Type

SZ

Name

Description

#

SZ

1

2

TPM_TAG

tag

TPM_TAG_RQU_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of input bytes including paramSize and tag

3

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_GetCapabilityOwner

4

4

TPM_AUTHHANDLE

authHandle

The authorization handle used for Owner authorization.

1S

4

2H1

20

TPM_NONCE

authLastNonceEven

Even nonce previously generated by TPM to cover inputs

5

20

3H1

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

6

1

4H1

1

BOOL

continueAuthSession

The continue use flag for the authorization handle

7

20

TPM_AUTHDATA

ownerAuth

The authorization digest for inputs and owner authorization. HMAC key:
OwnerAuth.

966
967Outgoing Operands and Sizes
PARAM

HMAC
#

Type

SZ

Name

Description

#

SZ

1

2

TPM_TAG

tag

TPM_TAG_RSP_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

1S

4

TPM_RESULT

returnCode

The return code of the operation. See section 4.3.

2S

4

TPM_COMMAND_CODE

ordinal

Ordinal: TPM_ORD_GetCapabilityOwner

4

4

3S

4

TPM_VERSION

version

A properly filled out version structure.

5

4

4S

4

UINT32

non_volatile_flags

The current state of the non-volatile flags.

6

4

5S

4

UINT32

volatile_flags

The current state of the volatile flags.

7

20

2H1

20

TPM_NONCE

nonceEven

Even nonce newly generated by TPM to cover outputs

3H1

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

4H1

1

BOOL

continueAuthSession

Continue use flag, TRUE if handle is still active

TPM_AUTHDATA

resAuth

The authorization digest for the returned parameters. HMAC key: OwnerAuth.

8

1

9

20

241Level 2 Revision 116 28 February 2011
242

43
TCG Published

243Copyright © TCG
244
245

TPM Main Part 3 Commands
Specification Version 1.2

968
969Description
970For 31>=N>=0
9711.
972
973
974

Bit-N of the TPM_PERMANENT_FLAGS structure is the Nth bit after the opening bracket
in the definition of TPM_PERMANENT_FLAGS in the version of the specification
indicated by the parameter “version”. The bit immediately after the opening bracket is
the 0th bit.

9752. Bit-N of the TPM_STCLEAR_FLAGS structure is the Nth bit after the opening bracket in
976
the definition of TPM_STCLEAR_FLAGS in the version of the specification indicated by
977
the parameter “version”. The bit immediately after the opening bracket is the 0 th bit.
9783. Bit-N of non_volatile_flags corresponds to the Nth bit in TPM_PERMANENT_FLAGS, and
979
the lsb of non_volatile_flags corresponds to bit0 of TPM_PERMANENT_FLAGS
9804. Bit-N of volatile_flags corresponds to the Nth bit in TPM_STCLEAR_FLAGS, and the lsb
981
of volatile_flags corresponds to bit0 of TPM_STCLEAR_FLAGS
982Actions
9831. The TPM validates that the TPM Owner authorizes the command.
9842. The TPM creates the parameter non_volatile_flags by setting each bit to the same state
985
as the corresponding bit in TPM_PERMANENT_FLAGS. Bits in non_volatile_flags for
986
which there is no corresponding bit in TPM_PERMANENT_FLAGS are set to zero.
9873. The TPM creates the parameter volatile_flags by setting each bit to the same state as the
988
corresponding bit in TPM_STCLEAR_FLAGS. Bits in volatile_flags for which there is no
989
corresponding bit in TPM_STCLEAR_FLAGS are set to zero.
9904. The TPM generates the parameter “version”.
9915. The TPM returns non_volatile_flags, volatile_flags and version to the caller.

246
247

44

Level 2 Revision 116 28 February 2011
TCG Published

248TPM Main Part 3 Commands

TCG © Copyright

249Specification Version 1.2

9928.

Auditing

9938.1

Audit Generation

994Start of informative comment:
995The TPM generates an audit event in response to the TPM successfully executing a
996command that has the audit flag set to TRUE for that command ordinal.
997The TPM maintains an extended value for all audited operations.
998End of informative comment.
999Description
10001. The TPM extends the audit digest whenever the ordinalAuditStatus is TRUE for the
1001
ordinal about to be executed.
10022. The TPM extends the audit digest only when a command is successfully executed.
1003
1004

a. If the ordinal is unknown, unimplemented, or cannot be determined, no auditing is
performed.

10053. Corner cases
1006
1007
1008

a. TPM_SaveState: Only the input parameters are audited, and the audit occurs before
the state is saved. If an error occurs while or after the state is saved, the audit still
occurs.

1009
1010
1011

b. TPM_SetOrdinalAuditStatus: In the case where the ordinalToAudit is TPM_ORD_SetOrdinalAuditStatus, audit is based on the initial state, not the final
state.

1012Actions
1013The TPM will execute the ordinal and perform auditing in the following manner:
10141. Execute command
1015

a. Execution implies the performance of the listed actions for the ordinal.

10162. If the command will return TPM_SUCCESS
1017
1018
1019

a. If TPM_STANY_DATA -> auditDigest is all zeros
i. Increment TPM_PERMANENT_DATA -> auditMonotonicCounter by 1
b. Create A1 a TPM_AUDIT_EVENT_IN structure

1020
1021

i. Set A1 -> inputParms to the digest of the input parameters from the
command

1022
1023

1. Digest value according to the HMAC digest rules of the "above the
line" parameters (i.e. the first HMAC digest calculation).

1024
1025

ii. Set
A1
->
auditCount
auditMonotonicCounter

250Level 2 Revision 116 28 February 2011
251

45
TCG Published

to

TPM_PERMANENT_DATA

->

252Copyright © TCG
253
254

TPM Main Part 3 Commands
Specification Version 1.2

1026
1027

c. Set TPM_STANY_DATA
auditDigest || A1)

1028

d. Create A2 a TPM_AUDIT_EVENT_OUT structure

->

auditDigest

to

SHA-1

(TPM_STANY_DATA

->

1029
1030

i. Set A2 -> outputParms to the digest of the output parameters from the
command

1031
1032

1. Digest value according to the HMAC digest rules of the "above the
line" parameters (i.e. the first HMAC digest calculation).

1033
1034

ii. Set
A2
->
auditCount
auditMonotonicCounter

1035
1036

e. Set TPM_STANY_DATA
auditDigest || A2)

->

auditDigest

to

TPM_PERMANENT_DATA

to

SHA-1

(TPM_STANY_DATA

1037

255
256

46

Level 2 Revision 116 28 February 2011
TCG Published

->
->

257TPM Main Part 3 Commands

TCG © Copyright

258Specification Version 1.2

10388.2

Effect of audit failing

1039Start of informative comment:
1040The TPM audit process could have an internal error when attempting to audit a command.
1041To indicate the audit failure, the TPM will return TPM_AUDITFAIL_SUCCESSFUL. This new
1042functionality changes the 1.1 TPM functionality when this condition occurs.
1043Since no audit occurs if the command fails, The TPM_AUDITFAIL_UNSUCCESSFUL return
1044code is no longer used.
1045End of informative comment.
10461. When, in performing the audit process, the TPM has an internal failure (unable to write,
1047
SHA-1 failure etc.) the TPM MUST set the internal TPM state such that the TPM returns
1048
the TPM_FAILEDSELFTEST error on subsequent attempts to execute a command.
10492. The return code for the command uses the following rules
1050

a. Command result success, audit success -> return TPM_SUCCESS

1051

b. Command result failure, no audit -> return command result failure

1052

c. Command result success, audit failure -> return TPM_AUDITFAIL_SUCCESSFUL

10533.
1054
1055
1056

If the TPM is permanently nonrecoverable after an audit failure, then the TPM MUST
always
return
TPM_FAILEDSELFTEST
for
every
command
other
than
TPM_GetTestResult. This state must persist regardless of power cycling, the execution
of TPM_Init or any other actions.

259Level 2 Revision 116 28 February 2011
260

47
TCG Published

261Copyright © TCG
262
263

10578.3

TPM Main Part 3 Commands
Specification Version 1.2

TPM_GetAuditDigest

1058Start of informative comment:
1059This returns the current audit digest. The external audit log has the responsibility to track
1060the parameters that constitute the audit digest.
1061This value may be unique to an individual TPM. The value however will be changing at a
1062rate set by the TPM Owner. Those attempting to use this value may find it changing without
1063their knowledge. This value represents a very poor source of tracking uniqueness.
1064End of informative comment.
1065Incoming Parameters and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_COMMAND

2

4

UINT32

paramSize

Total number of input bytes including paramSize and tag

3

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_GetAuditDigest

4

4

UINT32

startOrdinal

The starting ordinal for the list of audited ordinals

Type

Name

Description

#

SZ

1

#

SZ

1066Outgoing Parameters and Sizes
PARAM

HMAC

#

SZ

#

SZ

1

2

TPM_TAG

Tag

TPM_TAG_RSP_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

TPM_RESULT

returnCode

The return code of the operation.

5

10

TPM_COUNTER_VALUE

counterValue

The current value of the audit monotonic counter

4

20

TPM_DIGEST

auditDigest

Log of all audited events

5

1

BOOL

more

TRUE if the output does not contain a full list of audited ordinals

5

4

UINT32

ordSize

Size of the ordinal list in bytes

6

<>

BYTE[]

ordList

List of ordinals that are audited.

1067Description
10681. This command is never audited.
1069Actions
10701. The TPM sets auditDigest to TPM_STANY_DATA -> auditDigest
10712. The TPM sets counterValue to TPM_PERMANENT_DATA -> auditMonotonicCounter
10723. The TPM creates an ordered list of audited ordinals. The list starts at startOrdinal listing
1073
each ordinal that is audited.
1074
1075
264
265

a. If startOrdinal is 0 then the first ordinal that could be audited would be TPM_OIAP
(ordinal 0x0000000A)

48

Level 2 Revision 116 28 February 2011
TCG Published

266TPM Main Part 3 Commands

TCG © Copyright

267Specification Version 1.2

1076

b. The next ordinal would be TPM_OSAP (ordinal 0x0000000B)

10774. If the ordered list does not fit in the output buffer the TPM sets more to TRUE
10785. Return TPM_STANY_DATA -> auditDigest as auditDigest

268Level 2 Revision 116 28 February 2011
269

49
TCG Published

270Copyright © TCG
271
272

10798.4

TPM Main Part 3 Commands
Specification Version 1.2

TPM_GetAuditDigestSigned

1080Start of informative comment:
1081The signing of the audit log returns the entire digest value and the list of currently audited
1082commands.
1083The inclusion of the list of audited commands as an atomic operation is to tie the current
1084digest value with the list of commands that are being audited.
1085Note to future architects
1086When auditing functionality is active in a TPM, it may seem logical to remove this ordinal
1087from the active set of ordinals as the signing functionality of this command could be
1088handled in a signed transport session. While true, this command has a secondary affect
1089also, resetting the audit log digest. As the reset requires TPM Owner authentication, there
1090must be some way in this command to reflect the TPM Owner wishes. By requiring that a
1091TPM Identity key be the only key that can sign and reset, the TPM Owner’s authentication is
1092implicit in the execution of the command (TPM Identity Keys are created and controlled by
1093the TPM Owner only). Hence, while one might want to remove an ordinal this is not one that
1094can be removed if auditing is functional.
1095End of informative comment.
1096Incoming Parameters and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of input bytes including paramSize and tag

3

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_GetAuditDigestSigned

4

4

TPM_KEY_HANDLE

keyHandle

The handle of a loaded key that can perform digital signatures.

5

1

2S

1

BOOL

closeAudit

Indication if audit session should be closed

6

20

3S

20

TPM_NONCE

antiReplay

A nonce to prevent replay attacks

7

4

TPM_AUTHHANDLE

authHandle

The authorization session handle used for key authentication.

#

SZ

1

#

1S

SZ

4

2H1

20

TPM_NONCE

authLastNonceEven

Even nonce previously generated by TPM to cover inputs

8

3H1

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

1

4H1

1

BOOL

continueAuthSession

The continue use flag for the authorization session handle

10

273
274

20

9

20

TPM_AUTHDATA

keyAuth

Authorization. HMAC key: key.usageAuth.

50

Level 2 Revision 116 28 February 2011
TCG Published

275TPM Main Part 3 Commands

TCG © Copyright

276Specification Version 1.2

1097Outgoing Parameters and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RSP_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

#

SZ

1

#

SZ

1S

4

TPM_RESULT

returnCode

The return code of the operation.

2S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_GetAuditDigestSigned

4

10

3S

10

TPM_COUNTER_VALUE

counterValue

The value of the audit monotonic counter

5

20

4S

20

TPM_DIGEST

auditDigest

Log of all audited events

6

20

5S

20

TPM_DIGEST

ordinalDigest

Digest of all audited ordinals

7

4

6S

4

UINT32

sigSize

The size of the sig parameter

8

<>

7S

<>

BYTE[]

sig

The signature of the area

9

20

2H1

20

TPM_NONCE

nonceEven

Even nonce newly generated by TPM to cover outputs

3H1

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

4H1

1

BOOL

continueAuthSession

Continue use flag, TRUE if handle is still active

TPM_AUTHDATA

resAuth

Authorization HMAC key: key.usageAuth.

10

1

11

20

1098Actions
10991. Validate the AuthData and parameters using keyAuth, return TPM_AUTHFAIL on error
11002. Validate that keyHandle -> keyUsage is TPM_KEY_SIGNING, TPM_KEY_IDENTITY or
1101
TPM_KEY_LEGACY, if not return TPM_INVALID_KEYUSAGE
11023. The TPM validates that the key pointed to by keyHandle has a signature scheme of
1103
TPM_SS_RSASSAPKCS1v15_SHA1
or
TPM_SS_RSASSAPKCS1v15_INFO,
return
1104
TPM_INVALID_KEYUSAGE on error
11054. Create D1 a TPM_SIGN_INFO structure and set the structure defaults
1106

a. Set D1 -> fixed to “ADIG”

1107

b. Set D1 -> replay to antiReplay

1108
1109

c. Create D3 a list of all audited ordinals as defined in the TPM_GetAuditDigest
UINT32[] ordList outgoing parameter

1110

d. Create D4 the SHA-1 of D3

1111

e. Set auditDigest to TPM_STANY_DATA -> auditDigest

1112

f. Set counterValue to TPM_PERMANENT_DATA -> auditMonotonicCounter

1113

g. Create D2 the concatenation of auditDigest || counterValue || D4

1114

h. Set D1 -> data to D2

1115
1116

i. Create a digital signature of the SHA-1 of D1 by using the signature scheme for
keyHandle

1117

j.

Set ordinalDigest to D4

11185. If closeAudit == TRUE
277Level 2 Revision 116 28 February 2011
278

51
TCG Published

279Copyright © TCG
280
281

1119

TPM Main Part 3 Commands
Specification Version 1.2

a. If keyHandle->keyUsage is TPM_KEY_IDENTITY

1120

i.

1121

b. Else

1122

i.

282
283

TPM_STANY_DATA -> auditDigest MUST be set to all zeros.
Return TPM_INVALID_KEYUSAGE

52

Level 2 Revision 116 28 February 2011
TCG Published

284TPM Main Part 3 Commands

TCG © Copyright

285Specification Version 1.2

11238.5

TPM_SetOrdinalAuditStatus

1124Start of informative comment:
1125Set the audit flag for a given ordinal. Requires the authentication of the TPM Owner.
1126End of informative comment.
1127Incoming Parameters and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of input bytes including paramSize and tag

3

4

1S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_SetOrdinalAuditStatus

4

4

2S

4

TPM_COMMAND_CODE

ordinalToAudit

The ordinal whose audit flag is to be set

5

1

3S

1

BOOL

auditState

Value for audit flag

6

4

TPM_AUTHHANDLE

authHandle

The authorization session handle used for owner authentication.

#

SZ

1

#

SZ

2H1

20

TPM_NONCE

authLastNonceEven

Even nonce previously generated by TPM to cover inputs

7

20

3H1

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

8

1

4H1

1

BOOL

continueAuthSession

The continue use flag for the authorization session handle

9

20

TPM_AUTHDATA

ownerAuth

HMAC key: ownerAuth.

Type

Name

Description

1128Outgoing Parameters and Sizes
PARAM

HMAC

#

SZ

#

SZ

1

2

TPM_TAG

tag

TPM_TAG_RSP_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

5

1

6

TPM_RESULT

returnCode

The return code of the operation.

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_SetOrdinalAuditStatus

2H1

20

TPM_NONCE

nonceEven

Even nonce newly generated by TPM to cover outputs

3H1

20

4

2S
4

1S

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

4H1

1

BOOL

continueAuthSession

Continue use flag, TRUE if handle is still active

TPM_AUTHDATA

resAuth

The authorization session digest for the returned parameters. HMAC key:
ownerAuth.

20

1129Actions
11301. Validate the AuthData to execute the command and the parameters
11312. Validate that the ordinal points to a valid TPM ordinal, return TPM_BADINDEX on error
1132

a. Valid TPM ordinal means an ordinal that the TPM implementation supports

11333. Set the non-volatile flag associated with ordinalToAudit to the value in auditState

286Level 2 Revision 116 28 February 2011
287

53
TCG Published

288Copyright © TCG
289
290

11349.

TPM Main Part 3 Commands
Specification Version 1.2

Administrative Functions - Management

11359.1

TPM_FieldUpgrade

1136Start of informative comment:
1137The TPM needs a mechanism to allow for updating the protected capabilities once a TPM is
1138in the field. Given the varied nature of TPM implementations there will be numerous
1139methods of performing an upgrade of the protected capabilities. This command, when
1140implemented, provides a manufacturer specific method of performing the upgrade.
1141The manufacturer can determine, within the listed requirements, how to implement this
1142command. The command may be more than one command and actually a series of
1143commands.
1144The IDL definition is to create an ordinal for the command. However, the remaining
1145parameters are manufacturer specific.
1146The policy to determine when it is necessary to perform the actions of TPM_RevokeTrust is
1147outside the TPM spec and determined by other TCG workgroups.
1148TPM_FieldUpgrade is gated by either owner authorization or deferred assertion of Physical
1149Presence
(via
the
TPM_STCLEAR_DATA
->
deferredPhysicalPresence
->
1150unownedFieldUpgrade flag). This gating is acknowledgement that the entity that sets the
1151security policy for a platform must approve field upgrade for that platform. This gating can
1152block a global attack on TPMs when the TPME’s privilege information (private key) has been
1153compromised. For blocking to be effective in an unowned TPM, the TPM’s ownership flag
1154must be FALSE. (This prevents software from taking ownership and executing
1155TPM_FieldUpgrade with owner authorization.)
1156If an owner is present, field upgrade MUST be owner authorized, as the actions indicate.
1157This prevents an attacker from using physical presence to upgrade a TPM without detection
1158by the owner.
1159The advantages of deferred assertion of Physical Presence are that it:
1160

•

permits a TPM to be upgraded if taking ownership is undesirable or impractical.

1161
1162

•

permits a TPM to be upgraded in the OS environment (where Physical Presence
typically cannot be asserted), when the TPM has no owner.

1163If it is acceptable to take ownership of a TPM temporarily, an alternative to deferred
1164assertion of Physical Presence is the process: (1) take ownership; (2) perform an owner
1165authorized field upgrade; (3) clear the owner from the TPM.
1166There is no requirement for patch confidentiality. Confidentiality may be implemented
1167using a manufacturer specific mechanism, and may use a global secret such as a
1168symmetric encryption key.
1169The TPM may set the volatile deactivated flag to TRUE if a reboot is required after the field
1170upgrade. There is no requirement to do so.
1171The TPM must check owner authorization before changing the TPM state or beginning the
1172upgrade. This prevents a non-owner from mounting a denial-of-service attack. It is
1173understood that a TPM may not be able to stage the entire upgrade patch inside the TPM
291
292

54

Level 2 Revision 116 28 February 2011
TCG Published

293TPM Main Part 3 Commands

TCG © Copyright

294Specification Version 1.2

1174before checking owner authorization. That TPM may be forced to move the patch outside
1175the owner authorization HMAC.
1176Ideally, if the upgrade fails (e.g., due to an authentication failure) the TPM firmware should
1177remain unchanged. It is understood that a TPM may not be able to stage the entire upgrade
1178patch inside the TPM for authentication before beginning the upgrade. On a failure, that
1179TPM may be forced to roll the firmware back to a ROMed version. It may go into an upgrade
1180failure state, where it requires a successful field upgrade before continuing.
1181If a field upgrade adds or deletes features, the security implications must be analyzed. The
1182associated state must be set to prevent attacks. See, for example, allowMaintenance in Part
11832. In addition, if a field upgrade adds maintenance commands, it must atomically install
1184the manufacturer’s maintenance public key.
1185End of informative comment.
1186IDL Definition
1187TPM_RESULT TPM_FieldUpgrade(
1188
[in, out] TPM_AUTH* ownerAuth,
1189
…);
1190Type
1191This is an optional command and a TPM is not required to implement this command in any
1192form.
1193Parameters
Type

Name

Description

TPM_AUTH

ownerAuth

Authentication from TPM owner to execute command

…

Remaining parameters are manufacturer specific

1194Description
1195The patch integrity and authenticity verification mechanisms in the TPM MUST not require
1196the TPM to hold a global secret. The definition of global secret is a secret value shared by
1197more than one TPM.
1198The TPME is not allowed to pre-store or use unique identifiers in the TPM for the purpose of
1199field upgrade. The TPM MUST NOT use the endorsement key for identification or encryption
1200in the upgrade process. The upgrade process MAY use a TPM Identity to deliver upgrade
1201information to specific TPM’s.
1202The upgrade process SHOULD only change protected capabilities. The upgrade process
1203SHOULD NOT change shielded locations.
1204The upgrade process MUST NOT change the disabled or deactivated state from TRUE to
1205FALSE.
1206The upgrade process SHOULD only access data in shielded locations where this data is
1207necessary to validate the TPM Owner, validate the TPME and manipulate the blob.

295Level 2 Revision 116 28 February 2011
296

55
TCG Published

297Copyright © TCG
298
299

TPM Main Part 3 Commands
Specification Version 1.2

1208The execution of a TPM_FieldUpgrade command in a TPM MUST leave the TPM in a state
1209that conforms to a version of TCG's TPM specification and conforms to any extant TCG1210defined credentials (certificates) that attest to that upgraded TPM.
1211The security target used to valuate this TPM MUST include this command in the TOE.
1212If the owner authorization fails, the state of the TPM (volatile, nonvolatile, and firmware)
1213MUST remain unchanged. The only exception shall be the dictionary attack mitigation
1214state, which should process the authentication failure.
1215Actions
1216The TPM SHALL perform the following when executing the command:
12171. If TPM Owner is installed
1218
1219

a. Validate the command and parameters using TPM owner authentication, return
TPM_AUTHFAIL on error

12202. Else
1221
1222

a. If TPM_STCLEAR_DATA -> deferredPhysicalPresence -> unownedFieldUpgrade is
FALSE return TPM_BAD_PRESENCE.

12233. Validate that the upgrade information was sent by the TPME. The validation mechanism
1224
MUST use a strength of function that is at least the same strength of function as a
1225
digital signature performed using a 2048 bit RSA key.
12264. Validate that the upgrade target is the appropriate TPM model and version.
12275. Process the upgrade information and update the protected capabilities
12286. Set the TPM_PERMANENT_DATA -> revMajor and TPM_PERMANENT_DATA -> revMinor
1229
to the values indicated in the upgrade. The selection of the value is a manufacturer
1230
option.
1231
1232

a. The TPM MAY validate that the upgrade major and minor revision are monotonically
increasing.

1233
1234

b. The TPM MAY allow upgrade with a major and minor revision that is less than
currently installed in the TPM.

12357. The TPM MAY set the TPM_STCLEAR_FLAGS.deactivated to TRUE

300
301

56

Level 2 Revision 116 28 February 2011
TCG Published

302TPM Main Part 3 Commands

TCG © Copyright

303Specification Version 1.2

12369.2

TPM_SetRedirection

1237Start of informative comment:
1238The redirection command attaches a key to a redirection receiver.
1239When making the connection to a GPIO channel the authorization restrictions are set at
1240connection time and not for each invocation that uses the channel.
1241End of informative comment.
1242Incoming Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of input bytes including paramSize and tag

3

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_SetRedirection

4

4

TPM_KEY_HANDLE

keyHandle

The keyHandle identifier of a loaded key that can implement redirection.

5

4

2S

4

TPM_COMMAND_CODE

redirCmd

The command to execute

6

4

3S

4

UINT32

inputDataSize

The size of the input data

7

<>

4S

<>

BYTE

inputData

Manufacturer parameter

8

4

TPM_AUTHHANDLE

authHandle

The authorization session handle used for keyHandle authorization

#

SZ

1

#

SZ

1S

4

2H1

20

TPM_NONCE

authLastNonceEven

Even nonce previously generated by TPM to cover inputs

9

20

3H1

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

10

1

4H1

1

BOOL

continueAuthSession

The continue use flag for the authorization session handle

11

20

TPM_AUTHDATA

ownerAuth

HMAC key ownerAuth

1243Outgoing Operands and Sizes
PARAM

HMAC
#

Type

SZ

Name

Description

#

SZ

1

2

TPM_TAG

tag

TPM_TAG_RSP_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

5

1

6

20

TPM_RESULT

returnCode

The return code of the operation.

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_SetRedirection

2H1

20

TPM_NONCE

nonceEven

Even nonce newly generated by TPM to cover outputs

3H1

20

4

2S
4

1S

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

4H1

1

BOOL

continueAuthSession

Continue use flag, TRUE if handle is still active

TPM_AUTHDATA

resAuth

The authorization session digest for the returned parameters. HMAC key:
key.usageAuth

1244
1245Action
12461. If tag == TPM_TAG_RQU_AUTH1_COMMAND
304Level 2 Revision 116 28 February 2011
305

57
TCG Published

306Copyright © TCG
307
308

1247
1248

TPM Main Part 3 Commands
Specification Version 1.2

a. Validate the command and parameters using TPM Owner authentication, on error
return TPM_AUTHFAIL

12492. if redirCmd == TPM_REDIR_GPIO
1250
1251

a. Validate that keyHandle points to a loaded key, return TPM_INVALID_KEYHANDLE
on error

1252

b. Validate the key attributes specify redirection, return TPM_BAD_TYPE on error

1253

c. Validate that inputDataSize is 4, return TPM_BAD_PARAM_SIZE on error

1254
1255

d. Validate
that
inputData
TPM_BAD_PARAMETER on error

1256

e. Map C1 to the TPM_GPIO_CONFIG_CHANNEL structure indicated by inputData

1257

f. If C1 -> attr specifies TPM_GPIO_ATTR_OWNER

1258
1259

i.

to

a

valid

GPIO

channel,

return

If tag != TPM_TAG_RQU_AUTH1_COMMAND return TPM_AUTHFAIL

g. If C1 -> attr specifies TPM_GPIO_ATTR_PP

1260
1261
1262

points

i. If TPM_STCLEAR_FLAGS
TPM_BAD_PRESENCE

->

physicalPresence

==

FALSE,

then

return

h. Return TPM_SUCCESS

12633. The TPM MAY support other redirection types. These types may be specified by TCG or
1264
provided by the manufacturer.

309
310

58

Level 2 Revision 116 28 February 2011
TCG Published

311TPM Main Part 3 Commands

TCG © Copyright

312Specification Version 1.2

12659.3

TPM_ResetLockValue

1266Start of informative comment:
1267Command that resets the TPM dictionary attack mitigation values
1268This allows the TPM owner to cancel the effect of a number of successive authorization
1269failures. Dictionary attack mitigation is vendor specific, and the actions here are one
1270possible implementation. The TPM may treat an authorization failure outside the mitigation
1271time as a normal failure and not disable the command.
1272If this command itself has an authorization failure, it is blocked for the remainder of the
1273lock out period. This prevents a dictionary attack on the owner authorization using this
1274command.
1275It is understood that this command allows the TPM owner to perform a dictionary attack on
1276other authorization values by alternating a trial and this command. Similarly, delegating
1277this command allows the owner’s delegate to perform a dictionary attack.
1278End of informative comment.
1279Incoming Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of input bytes including paramSize and tag

3

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_ResetLockValue

4

4

TPM_AUTHHANDLE

authHandle

The authorization session handle used for TPM Owner authorization

#

SZ

1

#

SZ

1S

4

2H1

20

TPM_NONCE

authLastNonceEven

Even nonce previously generated by TPM to cover inputs

5

20

3H1

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

6

1

4H1

1

BOOL

continueAuthSession

The continue use flag for the authorization session handle

7

20

TPM_AUTHDATA

ownerAuth

HMAC key TPM Owner auth

Type

Name

Description

1280Outgoing Operands and Sizes
PARAM

HMAC

#

SZ

#

SZ

1

2

TPM_TAG

tag

TPM_TAG_RSP_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

5

1

6

20

TPM_RESULT

returnCode

The return code of the operation.

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_ResetLockValue

2H1

20

TPM_NONCE

nonceEven

Even nonce newly generated by TPM to cover outputs

3H1

20

4

2S
4

1S

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

4H1

1

BOOL

continueAuthSession

Continue use flag, TRUE if handle is still active

TPM_AUTHDATA

resAuth

HMAC key: TPM Owner auth

313Level 2 Revision 116 28 February 2011
314

59
TCG Published

315Copyright © TCG
316
317

TPM Main Part 3 Commands
Specification Version 1.2

1281Action
12821. If TPM_STCLEAR_DATA -> disableResetLock is TRUE return TPM_AUTHFAIL
1283
1284

a. The internal dictionary attack mechanism will set TPM_STCLEAR_DATA ->
disableResetLock to FALSE when the timeout period expires

12852. If the command and parameters validation using ownerAuth fails
1286

a. Set TPM_STCLEAR_DATA -> disableResetLock to TRUE

1287

b. Restart the TPM dictionary attack lock out period

1288

c. Return TPM_AUTHFAIL

12893. Reset the internal TPM dictionary attack mitigation mechanism
1290
1291

318
319

a. The mechanism is vendor specific and can include time outs, reboots, and other
mitigation strategies

60

Level 2 Revision 116 28 February 2011
TCG Published

320TPM Main Part 3 Commands

TCG © Copyright

321Specification Version 1.2

129210.
129310.1

Storage functions
TPM_Seal

1294Start of informative comment:
1295The SEAL operation allows software to explicitly state the future “trusted” configuration that
1296the platform must be in for the secret to be revealed. The SEAL operation also implicitly
1297includes the relevant platform configuration (PCR-values) when the SEAL operation was
1298performed. The SEAL operation uses the tpmProof value to BIND the blob to an individual
1299TPM.
1300If the UNSEAL operation succeeds, proof of the platform configuration that was in effect
1301when the SEAL operation was performed is returned to the caller, as well as the secret data.
1302This proof may, or may not, be of interest. If the SEALed secret is used to authenticate the
1303platform to a third party, a caller is normally unconcerned about the state of the platform
1304when the secret was SEALed, and the proof may be of no interest. On the other hand, if the
1305SEALed secret is used to authenticate a third party to the platform, a caller is normally
1306concerned about the state of the platform when the secret was SEALed. Then the proof is of
1307interest.
1308For example, if SEAL is used to store a secret key for a future configuration (probably to
1309prove that the platform is a particular platform that is in a particular configuration), the
1310only requirement is that that key can be used only when the platform is in that future
1311configuration. Then there is no interest in the platform configuration when the secret key
1312was SEALed. An example of this case is when SEAL is used to store a network
1313authentication key.
1314On the other hand, suppose an OS contains an encrypted database of users allowed to log
1315on to the platform. The OS uses a SEALED blob to store the encryption key for the user1316database. However, the nature of SEAL is that any SW stack can SEAL a blob for any other
1317software stack. Hence, the OS can be attacked by a second OS replacing both the SEALED1318blob encryption key, and the user database itself, allowing untrusted parties access to the
1319services of the OS. To thwart such attacks, SEALED blobs include the past SW
1320configuration. Hence, if the OS is concerned about such attacks, it may check to see
1321whether the past configuration is one that is known to be trusted.
1322TPM_Seal requires the encryption of one parameter (“Secret”). For the sake of uniformity
1323with other commands that require the encryption of more than one parameter, the string
1324used for XOR encryption is generated by concatenating a nonce (created during the OSAP
1325session) with the session shared secret and then hashing the result.
1326The sealed data blob does not have a protected identifier. On a platform that does not
1327prevent unauthorized access to data, a data blob can be exchanged by a lower layer without
1328detection. The upper layer software must take additional measures to protect the relation
1329between its identifier of the data blob and the blob itself.
1330End of informative comment.

322Level 2 Revision 116 28 February 2011
323

61
TCG Published

324Copyright © TCG
325
326

TPM Main Part 3 Commands
Specification Version 1.2

1331Incoming Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of input bytes including paramSize and tag

3

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_Seal.

4

4

TPM_KEY_HANDLE

keyHandle

Handle of a loaded key that can perform seal operations.

5

20

2S

20

TPM_ENCAUTH

encAuth

The encrypted AuthData for the sealed data.

6

4

3S

4

UINT32

pcrInfoSize

The size of the pcrInfo parameter. If 0 there are no PCR registers in use

7

<>

4S

<>

TPM_PCR_INFO

pcrInfo

The PCR selection information. The caller MAY use TPM_PCR_INFO_LONG.

8

4

5S

4

UINT32

inDataSize

The size of the inData parameter

9

<>

6S

<>

BYTE[ ]

inData

The data to be sealed to the platform and any specified PCRs

10

4

TPM_AUTHHANDLE

authHandle

The authorization session handle used for keyHandle authorization.
Must be an OSAP session for this command.

#

SZ

1

#

SZ

1S

4

2H1

20

TPM_NONCE

authLastNonceEven

Even nonce previously generated by TPM to cover inputs

11

20

3H1

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

12

1

4H1

1

BOOL

continueAuthSession

Ignored

13

20

TPM_AUTHDATA

pubAuth

The authorization session digest for inputs and keyHandle. HMAC key:
key.usageAuth.

1332Outgoing Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RSP_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

#

SZ

1

#

SZ

1S

4

TPM_RESULT

returnCode

The return code of the operation.

2S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_Seal.

4

<>

3S

<>

TPM_STORED_DATA

sealedData

Encrypted, integrity-protected data object that is the result of the TPM_Seal operation.

5

20

2H1

20

TPM_NONCE

nonceEven

Even nonce newly generated by TPM to cover outputs

3H1

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

4H1

1

BOOL

continueAuthSession

Continue use flag, fixed value of FALSE

TPM_AUTHDATA

resAuth

The authorization session digest for the returned parameters. HMAC key:
key.usageAuth.

6

1

7

20

1333Description
1334TPM_Seal is used to encrypt private objects that can only be decrypted using TPM_Unseal.
1335Actions
13361. Validate the authorization to use the key pointed to by keyHandle
13372. If the inDataSize is 0 the TPM returns TPM_BAD_PARAMETER
327
328

62

Level 2 Revision 116 28 February 2011
TCG Published

329TPM Main Part 3 Commands

TCG © Copyright

330Specification Version 1.2

13383. If the keyUsage field of the key indicated by keyHandle does not have the value TPM_KEY_STORAGE, the TPM must return the error code TPM_INVALID_KEYUSAGE.
13404. If the keyHandle points to a migratable key then the TPM MUST return the error code TPM_INVALID_KEY_USAGE.
13425. Determine the version of pcrInfo
1343

a. If pcrInfoSize is 0

1344

i.

1345

b. Else

1346

i.

1347

ii. If X1 -> tag is TPM_TAG_PCR_INFO_LONG

1348

set V1 to 1
Point X1 as TPM_PCR_INFO_LONG structure to pcrInfo
(1)

1349

Set V1 to 2

iii. Else

1350

(1)

Set V1 to 1

13516. If V1 is 1 then
1352

a. Create S1 a TPM_STORED_DATA structure

13537. else
1354

a. Create S1 a TPM_STORED_DATA12 structure

1355

b. Set S1 -> et to 0

13568. Set S1 -> encDataSize to 0
13579. Set S1 -> encData to all zeros
135810.Set S1 -> sealInfoSize to pcrInfoSize
135911.If pcrInfoSize is not 0 then
1360

a. if V1 is 1 then

1361
1362

i. Validate pcrInfo as a valid TPM_PCR_INFO structure, return TPM_BADINDEX
on error

1363

ii. Set S1 -> sealInfo -> pcrSelection to pcrInfo -> pcrSelection

1364

iii. Create h1 the composite hash of the PCR selected by pcrInfo -> pcrSelection

1365

iv. Set S1 -> sealInfo -> digestAtCreation to h1

1366

v. Set S1 -> sealInfo -> digestAtRelease to pcrInfo -> digestAtRelease

1367

b. else

1368
1369

i. Validate pcrInfo as TPM_BADINDEX on error

1370

ii. Set S1 -> sealInfo -> creationPCRSelection to pcrInfo -> creationPCRSelection

1371

iii. Set S1 -> sealInfo -> releasePCRSelection to pcrInfo -> releasePCRSelection

1372

iv. Set S1 -> sealInfo -> digestAtRelease to pcrInfo -> digestAtRelease

331Level 2 Revision 116 28 February 2011
332

a

valid

TPM_PCR_INFO_LONG

63
TCG Published

structure,

return

333Copyright © TCG
334
335

TPM Main Part 3 Commands
Specification Version 1.2

1373

v. Set S1 -> sealInfo -> localityAtRelease to pcrInfo -> localityAtRelease

1374
1375

vi. Create h2 the composite hash of the TPM_STCLEAR_DATA -> PCR selected by
pcrInfo -> creationPCRSelection

1376

vii. Set S1 -> sealInfo -> digestAtCreation to h2

1377
1378

viii.
Set S1 -> sealInfo -> localityAtCreation to TPM_STANY_FLAGS ->
localityModifier

137912.Create a1 by decrypting encAuth according to the ADIP indicated by authHandle.
138013.The TPM provides NO validation of a1. Well-known values (like all zeros) are valid and
1381
possible.
138214.Create S2 a TPM_SEALED_DATA structure
1383

a. Set S2 -> payload to TPM_PT_SEAL

1384

b. Set S2 -> tpmProof to TPM_PERMANENT_DATA -> tpmProof

1385

c. Create h3 the SHA-1 of S1

1386

d. Set S2 -> storedDigest to h3

1387

e. Set S2 -> authData to a1

1388

f. Set S2 -> dataSize to inDataSize

1389

g. Set S2 -> data to inData

139015.Validate that the size of S2 can be encrypted by the key pointed to by keyHandle, return
1391
TPM_BAD_DATASIZE on error
139216.Create s3 the encryption of S2 using the key pointed to by keyHandle
139317.Set continueAuthSession to FALSE
139418.Set S1 -> encDataSize to the size of s3
139519.Set S1 -> encData to s3
139620.Return S1 as sealedData

336
337

64

Level 2 Revision 116 28 February 2011
TCG Published

338TPM Main Part 3 Commands

TCG © Copyright

339Specification Version 1.2

139710.2

TPM_Unseal

1398Start of informative comment:
1399The TPM_Unseal operation will reveal TPM_Seal’ed data only if it was encrypted on this
1400platform and the current configuration (as defined by the named PCR contents) is the one
1401named as qualified to decrypt it. Internally, TPM_Unseal accepts a data blob generated by a
1402TPM_Seal operation. TPM_Unseal decrypts the structure internally, checks the integrity of
1403the resulting data, and checks that the PCR named has the value named during TPM_Seal.
1404Additionally, the caller must supply appropriate AuthData for blob and for the key that was
1405used to seal that data.
1406If the integrity, platform configuration and authorization checks succeed, the sealed data is
1407returned to the caller; otherwise, an error is generated.
1408End of informative comment.
1409Incoming Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_AUTH2_COMMAND

2

4

UINT32

paramSize

Total number of input bytes including paramSize and tag

3

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_Unseal.

4

4

TPM_KEY_HANDLE

parentHandle

Handle of a loaded key that can unseal the data.

5

<>

TPM_STORED_DATA

inData

The encrypted data generated by TPM_Seal.

6

4

TPM_AUTHHANDLE

authHandle

The authorization session handle used for parentHandle.

2H1

20

TPM_NONCE

authLastNonceEven

Even nonce previously generated by TPM to cover inputs

7

20

3H1

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

8

1

4H1

1

BOOL

continueAuthSession

The continue use flag for the authorization session handle

9

20

TPM_AUTHDATA

parentAuth

The authorization session digest for inputs and parentHandle. HMAC
key: parentKey.usageAuth.

10

4

TPM_AUTHHANDLE

dataAuthHandle

The authorization session handle used to authorize inData.

#

SZ

1

#

1S

2S

SZ

4

<>

2H2

20

TPM_NONCE

dataLastNonceEven

Even nonce previously generated by TPM

11

20

3H2

20

TPM_NONCE

datanonceOdd

Nonce generated by system associated with entityAuthHandle

12

1

4H2

1

BOOL

continueDataSession

Continue usage flag for dataAuthHandle.

13

20

TPM_AUTHDATA

dataAuth

The authorization session digest for the encrypted entity. HMAC key:
entity.usageAuth.

340Level 2 Revision 116 28 February 2011
341

65
TCG Published

342Copyright © TCG
343
344

TPM Main Part 3 Commands
Specification Version 1.2

1410Outgoing Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RSP_AUTH2_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

#

SZ

1

#

SZ

1S

4

TPM_RESULT

returnCode

The return code of the operation.

2S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_Unseal.

4

4

3S

4

UINT32

secretSize

The used size of the output area for secret

5

<>

4S

<>

BYTE[ ]

secret

Decrypted data that had been sealed

6

20

2H1

20

TPM_NONCE

nonceEven

Even nonce newly generated by TPM to cover outputs

3H1

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

4H1

1

BOOL

continueAuthSession

Continue use flag, TRUE if handle is still active

TPM_AUTHDATA

resAuth

The authorization session digest for the returned parameters. HMAC
key: parentKey.usageAuth.

7

1

8

20

9

20

1

11

20

TPM_NONCE

dataNonceEven

Even nonce newly generated by TPM.

3H2
10

2H2

20

TPM_NONCE

datanonceOdd

Nonce generated by system associated with dataAuthHandle

4H2

1

BOOL

continueDataSession

Continue use flag, TRUE if handle is still active

TPM_AUTHDATA

dataAuth

The authorization session digest used for the dataAuth session. HMAC
key: entity.usageAuth.

20

1411Actions
14121. The TPM MUST validate that parentAuth authorizes the use of the key in parentHandle,
1413
on error return TPM_AUTHFAIL
14142. If the keyUsage field of the key indicated by parentHandle does not have the value
1415
TPM_KEY_STORAGE, the TPM MUST return the error code TPM_INVALID_KEYUSAGE.
14163. The TPM MUST check that the TPM_KEY_FLAGS -> Migratable flag has the value FALSE
1417
in the key indicated by parentHandle. If not, the TPM MUST return the error code
1418
TPM_INVALID_KEYUSAGE
14194. Determine the version of inData
1420

a. If inData -> tag = TPM_TAG_STORED_DATA12

1421

i.

1422

ii. Map S2 a TPM_STORED_DATA12 structure to inData

1423

Set V1 to 2

b. Else If inData -> ver = 1.1

1424

i.

1425

ii. Map S2 a TPM_STORED_DATA structure to inData

1426

c. Else

1427

i.

Set V1 to 1

Return TPM_BAD_VERSION

14285. Create d1 by decrypting S2 -> encData using the key pointed to by parentHandle
14296. Validate d1
345
346

66

Level 2 Revision 116 28 February 2011
TCG Published

347TPM Main Part 3 Commands

TCG © Copyright

348Specification Version 1.2

1430

a. d1 MUST be a TPM_SEALED_DATA structure

1431

b. d1 -> tpmProof MUST match TPM_PERMANENT_DATA -> tpmProof

1432

c. Set S2 -> encDataSize to 0

1433

d. Set S2 -> encData to all zeros

1434

e. Create h1 the SHA-1 of S2

1435

f. d1 -> storedDigest MUST match h1

1436

g. d1 -> payload MUST be TPM_PT_SEAL

1437

h. Any failure MUST return TPM_NOTSEALED_BLOB

14387. If S2 -> sealInfoSize is not 0 then
1439

a. If V1 is 1 then

1440

i.

1441
1442

ii. Create h2 the composite hash of the PCR selected by S2 -> pcrInfo ->
pcrSelection

1443

Validate that S2 -> pcrInfo is a valid TPM_PCR_INFO structure

b. If V1 is 2 then

1444

i.

1445
1446

ii. Create h2 the composite hash of the TPM_STCLEAR_DATA -> PCR selected by
S2 -> pcrInfo -> releasePCRSelection

1447
1448

iii. Check that S2 -> pcrInfo -> localityAtRelease for TPM_STANY_DATA ->
localityModifier is TRUE

1449
1450

(1)
For example if TPM_STANY_DATA -> localityModifier was 2 then S2 ->
pcrInfo -> localityAtRelease -> TPM_LOC_TWO would have to be TRUE

1451
1452

Validate that S2 -> pcrInfo is a valid TPM_PCR_INFO_LONG structure

c. Compare h2 with
TPM_WRONGPCRVAL

S2

->

pcrInfo

->

digestAtRelease,

on

mismatch

return

14538. The TPM MUST validate authorization to use d1 by checking that the HMAC calculation
1454
using d1 -> authData as the shared secret matches the dataAuth. Return
1455
TPM_AUTHFAIL on mismatch.
14569. If V1 is 2 and S2 -> et specifies encryption (i.e. is not all zeros) then
1457

a. If tag is not TPM_TAG_RQU_AUTH2_COMMAND, return TPM_AUTHFAIL

1458
1459

b. Verify that the authHandle session type is TPM_PID_OSAP or TPM_PID_DSAP, return
TPM_BAD_MODE on error.

1460

c. If the MSB of S2 -> et is TPM_ET_XOR

1461
1462
1463

i. Use MGF1 to create string X1 of length sealedDataSize. The inputs to MGF1
are; authLastnonceEven, nonceOdd, “XOR”, and authHandle -> sharedSecret. The
four concatenated values form the Z value that is the seed for MFG1.

1464

ii. Create o1 by XOR of d1 -> data and X1

1465

d. Else

349Level 2 Revision 116 28 February 2011
350

67
TCG Published

351Copyright © TCG
352
353

TPM Main Part 3 Commands
Specification Version 1.2

1466
1467

i. Create o1 by encrypting d1 -> data using the algorithm indicated by inData ->
et

1468

ii. Key is from authHandle -> sharedSecret

1469

iii. IV is SHA-1 of (authLastNonceEven || nonceOdd)

1470

e. Set continueAuthSession to FALSE

147110.else
1472

a. Set o1 to d1 -> data

147311.Set the return secret as o1
147412.Return TPM_SUCCESS

354
355

68

Level 2 Revision 116 28 February 2011
TCG Published

356TPM Main Part 3 Commands

TCG © Copyright

357Specification Version 1.2

147510.3

TPM_UnBind

1476Start of informative comment:
1477TPM_UnBind takes the data blob that is the result of a Tspi_Data_Bind command and
1478decrypts it for export to the User. The caller must authorize the use of the key that will
1479decrypt the incoming blob.
1480TPM_UnBind operates on a block-by-block basis, and has no notion of any relation between
1481one block and another.
1482End of informative comment.
1483Incoming Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of input bytes including paramSize and tag

3

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_UnBind.

4

4

TPM_KEY_HANDLE

keyHandle

The keyHandle identifier of a loaded key that can perform UnBind
operations.

5

4

2S

4

UINT32

inDataSize

The size of the input blob

6

<>

3S

<>

BYTE[ ]

inData

Encrypted blob to be decrypted

7

4

TPM_AUTHHANDLE

authHandle

The handle used for keyHandle authorization

#

SZ

1

#

1S

SZ

4

2H1

20

TPM_NONCE

authLastNonceEven

Even nonce previously generated by TPM to cover inputs

8

20

3H1

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

9

1

4H1

1

BOOL

continueAuthSession

The continue use flag for the authorization session handle

10

20

TPM_AUTHDATA

privAuth

The authorization session digest that authorizes the inputs and use of
keyHandle. HMAC key: key.usageAuth.

358Level 2 Revision 116 28 February 2011
359

69
TCG Published

360Copyright © TCG
361
362

TPM Main Part 3 Commands
Specification Version 1.2

1484Outgoing Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RSP_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

#

SZ

1

#

SZ

1S

4

TPM_RESULT

returnCode

The return code of the operation.

2S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_UnBind

4

4

3S

4

UINT32

outDataSize

The length of the returned decrypted data

5

<>

4S

<>

BYTE[ ]

outData

The resulting decrypted data.

6

20

2H1

20

TPM_NONCE

nonceEven

Even nonce newly generated by TPM to cover outputs

3H1

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

4H1

1

BOOL

continueAuthSession

Continue use flag, TRUE if handle is still active

TPM_AUTHDATA

resAuth

The authorization session digest for the returned parameters. HMAC key:
key.usageAuth.

7

1

8

20

1485Description
1486TPM_UnBind SHALL operate on a single block only.
1487Actions
1488The TPM SHALL perform the following:
14891. If the inDataSize is 0 the TPM returns TPM_BAD_PARAMETER
14902. Validate the AuthData to use the key pointed to by keyHandle
14913. If the keyUsage field of the key referenced by keyHandle does not have the value
1492
TPM_KEY_BIND or TPM_KEY_LEGACY, the TPM must return the error code
1493
TPM_INVALID_KEYUSAGE
14944. Decrypt the inData using the key pointed to by keyHandle
14955. if (keyHandle -> encScheme does not equal TPM_ES_RSAESOAEP_SHA1_MGF1) and
1496
(keyHandle -> keyUsage equals TPM_KEY_LEGACY),
1497
1498

a. The payload does not have TPM specific markers to validate, so no consistency check
can be performed.

1499
1500

b. Set the output parameter outData to the value of the decrypted value of inData.
(Padding associated with the encryption wrapping of inData SHALL NOT be returned.)

1501
1502

c. Set the output parameter outDataSize to the size of outData, as deduced from the
decryption process.

15036. else
1504
1505

a. Interpret the decrypted data under the assumption that it is a TPM_BOUND_DATA
structure, and validate that the payload type is TPM_PT_BIND

1506
1507
1508

b. Set the output parameter outData to the value of TPM_BOUND_DATA ->
payloadData. (Other parameters of TPM_BOUND_DATA SHALL NOT be returned.
Padding associated with the encryption wrapping of inData SHALL NOT be returned.)

363
364

70

Level 2 Revision 116 28 February 2011
TCG Published

365TPM Main Part 3 Commands

TCG © Copyright

366Specification Version 1.2

1509
1510

c. Set the output parameter outDataSize to the size of outData, as deduced from the
decryption process and the interpretation of TPM_BOUND_DATA.

15117. Return the output parameters.

367Level 2 Revision 116 28 February 2011
368

71
TCG Published

369Copyright © TCG
370
371

151210.4

TPM Main Part 3 Commands
Specification Version 1.2

TPM_CreateWrapKey

1513Start of informative comment:
1514The TPM_CreateWrapKey command both generates and creates a secure storage bundle for
1515asymmetric keys.
1516The newly created key can be locked to a specific PCR value by specifying a set of PCR
1517registers.
1518The key blob does not have a protected identifier. On a platform that does not prevent
1519unauthorized access to data, a key blob can be exchanged by a lower layer without
1520detection. The upper layer software must take additional measures to protect the relation
1521between its identifier of the key blob and the blob itself.
1522End of informative comment.
1523Incoming Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of input bytes including paramSize and tag

3

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_CreateWrapKey

4

4

TPM_KEY_HANDLE

parentHandle

Handle of a loaded key that can perform key wrapping.

5

20

2S

20

TPM_ENCAUTH

dataUsageAuth

Encrypted usage AuthData for the key.

6

20

3S

20

TPM_ENCAUTH

dataMigrationAuth

Encrypted migration AuthData for the key.

7

<>

4S

<>

TPM_KEY

keyInfo

Information about key to be created, pubkey.keyLength and
keyInfo.encData elements are 0. MAY be TPM_KEY12

8

4

TPM_AUTHHANDLE

authHandle

parent key authorization. Must be an OSAP session.

#

SZ

1

#

SZ

1S

4

2H1

20

TPM_NONCE

authLastNonceEven

Even nonce previously generated by TPM to cover inputs

9

20

3H1

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

10

1

4H1

1

BOOL

continueAuthSession

Ignored

11

20

TPM_AUTHDATA

pubAuth

Authorization HMAC key: parentKey.usageAuth.

1524Outgoing Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RSP_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

#

SZ

1

#

SZ

1S

4

TPM_RESULT

returnCode

The return code of the operation.

2S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_CreateWrapKey

4

<>

3S

<>

TPM_KEY

wrappedKey

The TPM_KEY structure which includes the public and encrypted private
key. MAY be TPM_KEY12

5

20

2H1

20

TPM_NONCE

nonceEven

Even nonce newly generated by TPM to cover outputs

3H1

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

4H1

1

BOOL

continueAuthSession

Continue use flag, fixed at FALSE

6

372
373

1

72

Level 2 Revision 116 28 February 2011
TCG Published

374TPM Main Part 3 Commands

TCG © Copyright

375Specification Version 1.2

7

20

TPM_AUTHDATA

376Level 2 Revision 116 28 February 2011
377

resAuth

73
TCG Published

Authorization HMAC key: parentKey.usageAuth.

378Copyright © TCG
379
380

TPM Main Part 3 Commands
Specification Version 1.2

1525 Actions
1526The TPM SHALL do the following:
15271. Validate the AuthData to use the key pointed to by parentHandle. Return
1528
TPM_AUTHFAIL on any error.
15292. Validate the session type for parentHandle is OSAP.
15303. If the TPM is not designed to create a key of the type requested in keyInfo, return the
1531
error code TPM_BAD_KEY_PROPERTY
15324. Verify that parentHandle->keyUsage equals TPM_KEY_STORAGE
15335. If parentHandle -> keyFlags -> migratable is TRUE and keyInfo -> keyFlags -> migratable
1534
is FALSE then return TPM_INVALID_KEYUSAGE
15356. Validate key parameters
1536
1537

a. keyInfo
->
keyUsage
MUST
NOT
be
TPM_KEY_IDENTITY
TPM_KEY_AUTHCHANGE. If it is, return TPM_INVALID_KEYUSAGE

1538
1539

b. If
keyInfo
->
keyFlags
TPM_INVALID_KEYUSAGE

->

migrateAuthority

is

TRUE

then

or
return

15407. If TPM_PERMANENT_FLAGS -> FIPS is TRUE then
1541

a. If keyInfo -> keySize is less than 1024 return TPM_NOTFIPS

1542

b. If keyInfo -> authDataUsage specifies TPM_AUTH_NEVER return TPM_NOTFIPS

1543

c. If keyInfo -> keyUsage specifies TPM_KEY_LEGACY return TPM_NOTFIPS

15448. If keyInfo -> keyUsage equals TPM_KEY_STORAGE or TPM_KEY_MIGRATE
1545

i.

1546

ii. encScheme MUST be TPM_ES_RSAESOAEP_SHA1_MGF1

1547

iii. sigScheme MUST be TPM_SS_NONE

1548

iv. key size MUST be 2048

1549

v. exponentSize MUST be 0

algorithmID MUST be TPM_ALG_RSA

15509. Determine the version of key
1551

a. If keyInfo -> ver is 1.1

1552

i.

1553

ii. Map wrappedKey to a TPM_KEY structure

1554

iii. Validate all remaining TPM_KEY structures

1555

Set V1 to 1

b. Else if keyInfo -> tag is TPM_TAG_KEY12

1556

i.

1557

ii. Map wrappedKey to a TPM_KEY12 structure

1558

iii. Validate all remaining TPM_KEY12 structures

381
382

Set V1 to 2

74

Level 2 Revision 116 28 February 2011
TCG Published

383TPM Main Part 3 Commands

TCG © Copyright

384Specification Version 1.2

155910.Create DU1 by decrypting dataUsageAuth according to the ADIP indicated by
1560
authHandle
156111.Create DM1 by decrypting dataMigrationAuth according to the ADIP indicated by
1562
authHandle
156312.Set continueAuthSession to FALSE
156413.Generate asymmetric key according to algorithm information in keyInfo
156514.Fill in the wrappedKey structure with information from the newly generated key.
1566

a. Set wrappedKey -> encData -> usageAuth to DU1

1567
1568

b. If the KeyFlags -> migratable bit is set to 1, the wrappedKey -> encData ->
migrationAuth SHALL contain the decrypted value from dataMigrationAuth.

1569
1570

c. If the KeyFlags -> migratable bit is set to 0, the wrappedKey -> encData ->
migrationAuth SHALL be set to the value tpmProof

157115.If keyInfo->PCRInfoSize is non-zero
1572
1573
1574

a. If V1 is 1
i. Set wrappedKey -> pcrInfo to a TPM_PCR_INFO structure using the
pcrSelection to indicate the PCR’s in use

1575

b. Else

1576

i.

1577

c. Set wrappedKey -> pcrInfo to keyInfo -> pcrInfo

Set wrappedKey -> pcrInfo to a TPM_PCR_INFO_LONG structure

1578
1579

d. Set wrappedKey -> digestAtCreation to the TPM_COMPOSITE_HASH indicated by
creationPCRSelection

1580

e. If V1 is 2 set wrappedKey -> localityAtCreation to TPM_STANY_DATA -> locality

158116.Encrypt the private portions of the wrappedKey structure using the key in parentHandle
158217.Return the newly generated key in the wrappedKey parameter

385Level 2 Revision 116 28 February 2011
386

75
TCG Published

387Copyright © TCG
388
389

158310.5

TPM Main Part 3 Commands
Specification Version 1.2

TPM_LoadKey2

1584Start of informative comment:
1585Before the TPM can use a key to either wrap, unwrap, unbind, seal, unseal, sign or perform
1586any other action, it needs to be present in the TPM. The TPM_LoadKey2 function loads the
1587key into the TPM for further use.
1588The TPM assigns the key handle. The TPM always locates a loaded key by use of the handle.
1589The assumption is that the handle may change due to key management operations. It is the
1590responsibility of upper level software to maintain the mapping between handle and any
1591label used by external software.
1592To permit this mapping between handle and upper software labels (called key handle
1593virtualization), the key handle returned by TPM_LoadKey2 must not be included in the
1594response HMAC. This may cause problems if several keys are authorized using the same
1595authorization data. Care should be taken to assign different authorization data to each key.
1596This command has the responsibility of enforcing restrictions on the use of keys. For
1597example, when attempting to load a STORAGE key it will be checked for the restrictions on
1598a storage key (2048 size etc.).
1599The load command must maintain a record of whether any previous key in the key
1600hierarchy was bound to a PCR using parentPCRStatus.
1601The flag parentPCRStatus enables the possibility of checking that a platform passed
1602through some particular state or states before finishing in the current state. A grandparent
1603key could be linked to state-1, a parent key could linked to state-2, and a child key could be
1604linked to state-3, for example. The use of the child key then indicates that the platform
1605passed through states 1 and 2 and is currently in state 3, in this example. TPM_Startup
1606with stType == TPM_ST_CLEAR indicates that the platform has been reset, so the platform
1607has not passed through the previous states. Hence keys with parentPCRStatus==TRUE
1608must be unloaded if TPM_Startup is issued with stType == TPM_ST_CLEAR.
1609If a TPM_KEY structure has been decrypted AND the integrity test using "pubDataDigest"
1610has passed AND the key is non-migratory, the key must have been created by the TPM. So
1611there is every reason to believe that the key poses no security threat to the TPM. While there
1612is no known attack from a rogue migratory key, there is a desire to verify that a loaded
1613migratory key is a real key, arising from a general sense of unease about execution of
1614arbitrary data as a key. Ideally a consistency check would consist of an encrypt/decrypt
1615cycle, but this may be expensive. For RSA keys, it is therefore suggested that the
1616consistency test consists of dividing the supposed RSA product by the supposed RSA prime,
1617and checking that there is no remainder.
1618End of informative comment.

390
391

76

Level 2 Revision 116 28 February 2011
TCG Published

392TPM Main Part 3 Commands

TCG © Copyright

393Specification Version 1.2

1619Incoming Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of input bytes including paramSize and tag

3

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_LoadKey2.

4

4

TPM_KEY_HANDLE

parentHandle

TPM handle of parent key.

5

<>

TPM_KEY

inKey

Incoming key structure, both encrypted private and clear public portions.
MAY be TPM_KEY12

6

4

TPM_AUTHHANDLE

authHandle

The authorization session handle used for parentHandle authorization.

#

SZ

1

#

SZ

1S

2S

4

<>

2H1

20

TPM_NONCE

authLastNonceEven

Even nonce previously generated by TPM to cover inputs

7

20

3H1

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

8

1

4H1

1

BOOL

continueAuthSession

The continue use flag for the authorization session handle

9

20

TPM_AUTHDATA

parentAuth

The authorization session digest for inputs and parentHandle. HMAC key:
parentKey.usageAuth.

Type

Name

Description

1620Outgoing Operands and Sizes
PARAM

HMAC

#

SZ

#

SZ

1

2

TPM_TAG

tag

TPM_TAG_RSP_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

20

TPM_RESULT

returnCode

The return code of the operation.

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_LoadKey2

TPM_KEY_HANDLE

inkeyHandle

Internal TPM handle where decrypted key was loaded.

4

5

4

2S
4

1S

1

7

20

TPM_NONCE

nonceEven

Even nonce newly generated by TPM to cover outputs

3H1
6

2H1

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

4H1

1

BOOL

continueAuthSession

Continue use flag, TRUE if handle is still active

TPM_AUTHDATA

resAuth

The authorization session digest for the returned parameters. HMAC key:
parentKey.usageAuth.

20

1621Actions
1622The TPM SHALL perform the following steps:
16231. Validate the command and the parameters using parentAuth and parentHandle ->
1624
usageAuth
16252. If
parentHandle
->
1626
TPM_INVALID_KEYUSAGE

keyUsage

is

NOT

TPM_KEY_STORAGE

return

16273. If the TPM is not designed to operate on a key of the type specified by inKey, return the
1628
error code TPM_BAD_KEY_PROPERTY
16294. The TPM MUST handle both TPM_KEY and TPM_KEY12 structures
16305. Decrypt the inKey -> privkey to obtain TPM_STORE_ASYMKEY structure using the key
1631
in parentHandle
394Level 2 Revision 116 28 February 2011
395

77
TCG Published

396Copyright © TCG
397
398

TPM Main Part 3 Commands
Specification Version 1.2

16326. Validate the integrity of inKey and decrypted TPM_STORE_ASYMKEY
1633
1634

a. Reproduce inKey -> TPM_STORE_ASYMKEY -> pubDataDigest using the fields of
inKey, and check that the reproduced value is the same as pubDataDigest

16357. Validate the consistency of the key and it’s key usage.
1636
1637
1638
1639
1640
1641

a. If inKey -> keyFlags -> migratable is TRUE, the TPM SHALL verify consistency of the
public and private components of the asymmetric key pair. If inKey -> keyFlags ->
migratable is FALSE, the TPM MAY verify consistency of the public and private
components of the asymmetric key pair. The consistency of an RSA key pair MAY be
verified by dividing the supposed (P*Q) product by a supposed prime and checking that
there is no remainder.

1642
1643

b. If inKey -> keyUsage is TPM_KEY_IDENTITY, verify that inKey->keyFlags->migratable
is FALSE. If it is not, return TPM_INVALID_KEYUSAGE

1644

c. If inKey -> keyUsage is TPM_KEY_AUTHCHANGE, return TPM_INVALID_KEYUSAGE

1645
1646

d. If inKey -> keyFlags -> migratable equals 0 then verify that TPM_STORE_ASYMKEY
-> migrationAuth equals TPM_PERMANENT_DATA -> tpmProof

1647

e. Validate the mix of encryption and signature schemes

1648

f. If TPM_PERMANENT_FLAGS -> FIPS is TRUE then

1649

i.

1650
1651

ii. If keyInfo
TPM_NOTFIPS

1652

iii. If keyInfo -> keyUsage specifies TPM_KEY_LEGACY return TPM_NOTFIPS

1653

If keyInfo -> keySize is less than 1024 return TPM_NOTFIPS
->

authDataUsage

specifies

TPM_AUTH_NEVER

return

g. If inKey -> keyUsage is TPM_KEY_STORAGE or TPM_KEY_MIGRATE

1654

i.

1655

ii. Key size MUST be 2048

1656

iii. exponentSize MUST be 0

1657

iv. sigScheme MUST be TPM_SS_NONE

1658

algorithmID MUST be TPM_ALG_RSA

h. If inKey -> keyUsage is TPM_KEY_IDENTITY

1659

i.

1660

ii. Key size MUST be 2048

1661

iii. exponentSize MUST be 0

1662

iv. encScheme MUST be TPM_ES_NONE

1663

i.

1664
1665
1666

If the decrypted inKey -> pcrInfo is NULL,
i. The TPM MUST set the internal indicator to indicate that the key is not using
any PCR registers.

j.

1667
1668

399
400

algorithmID MUST be TPM_ALG_RSA

Else
i. The TPM MUST store pcrInfo in a manner that allows the TPM to calculate a
composite hash whenever the key will be in use

78

Level 2 Revision 116 28 February 2011
TCG Published

401TPM Main Part 3 Commands

TCG © Copyright

402Specification Version 1.2

1669
1670

ii. The TPM MUST handle both version 1.1 TPM_PCR_INFO and 1.2
TPM_PCR_INFO_LONG structures according to the type of TPM_KEY structure

1671
1672
1673

(1)
The TPM MUST validate the TPM_PCR_INFO or TPM_PCR_INFO_LONG
structures for legal values.
However, the digestAtRelease and
localityAtRelease are not validated for authorization until use time.

16748. Perform any processing necessary to make TPM_STORE_ASYMKEY key available for
1675
operations
16769. Load key and key information into internal memory of the TPM. If insufficient memory
1677
exists return error TPM_NOSPACE.
167810.Assign inKeyHandle according to internal TPM rules.
167911.Set InKeyHandle -> parentPCRStatus to parentHandle -> parentPCRStatus.
168012.If parentHandle indicates that it is using PCR registers, then set inKeyHandle ->
1681
parentPCRStatus to TRUE.

403Level 2 Revision 116 28 February 2011
404

79
TCG Published

405Copyright © TCG
406
407

10.6

1682

TPM Main Part 3 Commands
Specification Version 1.2

TPM_GetPubKey

1683Start of informative comment:
1684The owner of a key may wish to obtain the public key value from a loaded key. This
1685information may have privacy concerns so the command must have authorization from the
1686key owner.
1687End of informative comment.
1688Incoming Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of input bytes including paramSize and tag

3

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_GetPubKey.

4

4

TPM_KEY_HANDLE

keyHandle

TPM handle of key.

5

4

TPM_AUTHHANDLE

authHandle

The authorization session handle used for keyHandle authorization.

#

SZ

1

#

SZ

1S

4

2H1

20

TPM_NONCE

authLastNonceEven

Even nonce previously generated by TPM to cover inputs

20

3H1

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

7

1

4H1

1

BOOL

continueAuthSession

The continue use flag for the authorization session handle

8

20

TPM_AUTHDATA

keyAuth

Authorization HMAC key: key.usageAuth.

Type

Name

Description

6

1689Outgoing Operands and Sizes
PARAM

HMAC

#

SZ

#

SZ

1

2

TPM_TAG

tag

TPM_TAG_RSP_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

1S

4

TPM_RESULT

returnCode

The return code of the operation.

2S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_GetPubKey.

4

<>

3S

<>

TPM_PUBKEY

pubKey

Public portion of key in keyHandle.

5

20

2H1

20

TPM_NONCE

nonceEven

Even nonce newly generated by TPM to cover outputs

3H1

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

4H1

1

BOOL

continueAuthSession

Continue use flag, TRUE if handle is still active

TPM_AUTHDATA

resAuth

Authorization. HMAC key: key.usageAuth.

6

1

7

20

1690Actions
1691The TPM SHALL perform the following steps:
16921. If tag = TPM_TAG_RQU_AUTH1_COMMAND then
1693
1694

a. Validate the command parameters using keyHandle -> usageAuth, on error return
TPM_AUTHFAIL

16952. Else
408
409

80

Level 2 Revision 116 28 February 2011
TCG Published

410TPM Main Part 3 Commands

TCG © Copyright

411Specification Version 1.2

1696
1697

a. Verify that keyHandle -> authDataUsage is TPM_NO_READ_PUBKEY_AUTH
TPM_AUTH_NEVER, on error return TPM_AUTHFAIL

or

16983. If keyHandle == TPM_KH_SRK then
1699
1700

a. If
TPM_PERMANENT_FLAGS
TPM_INVALID_KEYHANDLE

->

readSRKPub

is

FALSE

then

return

17014. If keyHandle -> pcrInfoSize is not 0
1702

a. If keyHandle -> keyFlags has pcrIgnoredOnRead set to FALSE

1703
1704

i. Create a digestAtRelease according to the specified PCR registers and compare
to keyHandle -> digestAtRelease and if a mismatch return TPM_WRONGPCRVAL

1705

ii. If specified validate any locality requests

17065. Create a TPM_PUBKEY structure and return

412Level 2 Revision 116 28 February 2011
413

81
TCG Published

414Copyright © TCG
415
416

170710.7

TPM Main Part 3 Commands
Specification Version 1.2

TPM_Sealx

1708Start of informative comment:
1709The TPM_Sealx command works exactly like the TPM_Seal command with the additional
1710requirement of encryption for the inData parameter. This command also places in the
1711sealed blob the information that the TPM_Unseal also requires encryption.
1712TPM_Sealx requires the use of 1.2 data structures. The actions are the same as TPM_Seal
1713without the checks for 1.1 data structure usage.
1714The method of incrementing the symmetric key counter value is different from that used by
1715some standard crypto libraries (e.g. openSSL, Java JCE) that increment the entire counter
1716value. TPM users should be aware of this to avoid errors when the counter wraps.
1717End of informative comment.
1718Incoming Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of input bytes including paramSize and tag

3

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_Sealx

4

4

TPM_KEY_HANDLE

keyHandle

Handle of a loaded key that can perform seal operations.

5

20

2S

20

TPM_ENCAUTH

encAuth

The encrypted AuthData for the sealed data.

6

4

3S

4

UINT32

pcrInfoSize

The size of the pcrInfo parameter. If 0 there are no PCR registers in use

7

<>

4S

<>

TPM_PCR_INFO

pcrInfo

MUST use TPM_PCR_INFO_LONG.

8

4

5S

4

UINT32

inDataSize

The size of the inData parameter

9

<>

6S

<>

BYTE[ ]

inData

The data to be sealed to the platform and any specified PCRs

10

4

TPM_AUTHHANDLE

authHandle

The authorization session handle used for keyHandle authorization.
Must be an OSAP session for this command.

#

SZ

1

#

1S

SZ

4

2H1

20

TPM_NONCE

authLastNonceEven

Even nonce previously generated by TPM to cover inputs

11

3H1

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

12

1

4H1

1

BOOL

continueAuthSession

Ignored

13

417
418

20

20

TPM_AUTHDATA

pubAuth

The authorization session digest for inputs and keyHandle. HMAC key: key.usageAuth.

82

Level 2 Revision 116 28 February 2011
TCG Published

419TPM Main Part 3 Commands

TCG © Copyright

420Specification Version 1.2

1719Outgoing Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RSP_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

#

SZ

1

#

SZ

1S

4

TPM_RESULT

returnCode

The return code of the operation.

2S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_Sealx

4

<>

3S

4

TPM_STORED_DATA

sealedData

Encrypted, integrity-protected data object that is the result of the TPM_Sealx operation.

5

20

2H1

20

TPM_NONCE

nonceEven

Even nonce newly generated by TPM to cover outputs

3H1

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

4H1

1

BOOL

continueAuthSession

Continue use flag, fixed value of FALSE

TPM_AUTHDATA

resAuth

The authorization session digest for the returned parameters. HMAC key:
key.usageAuth.

6

1

7

20

1720Actions
17211. Validate the authorization to use the key pointed to by keyHandle
17222. If the inDataSize is 0 the TPM returns TPM_BAD_PARAMETER
17233. If the keyUsage field of the key indicated by keyHandle does not have the value
1724
TPM_KEY_STORAGE, the TPM must return the error code TPM_INVALID_KEYUSAGE.
17254. If the keyHandle points to a migratable key then the TPM MUST return the error code
1726
TPM_INVALID_KEY_USAGE.
17275. Create S1 a TPM_STORED_DATA12 structure
17286. Set S1 -> encDataSize to 0
17297. Set S1 -> encData to all zeros
17308. Set S1 -> sealInfoSize to pcrInfoSize
17319. If pcrInfoSize is not 0 then
1732
1733

a. Validate pcrInfo as a valid TPM_PCR_INFO_LONG structure, return TPM_BADINDEX
on error

1734

b. Set S1 -> sealInfo -> creationPCRSelection to pcrInfo -> creationPCRSelection

1735

c. Set S1 -> sealInfo -> releasePCRSelection to pcrInfo -> releasePCRSelection

1736

d. Set S1 -> sealInfo -> digestAtRelease to pcrInfo -> digestAtRelease

1737

e. Set S1 -> sealInfo -> localityAtRelease to pcrInfo -> localityAtRelease

1738
1739

f. Create h2 the composite hash of the TPM_STCLEAR_DATA -> PCR selected by
pcrInfo -> creationPCRSelection

1740

g. Set S1 -> sealInfo -> digestAtCreation to h2

1741

h. Set S1 -> sealInfo -> localityAtCreation to TPM_STANY_DATA -> localityModifier

174210.Create S2 a TPM_SEALED_DATA structure
421Level 2 Revision 116 28 February 2011
422

83
TCG Published

423Copyright © TCG
424
425

TPM Main Part 3 Commands
Specification Version 1.2

174311.Create a1 by decrypting encAuth according to the ADIP indicated by authHandle.
1744

a. If authHandle indicates XOR encryption for the AuthData secrets

1745

i.

1746
1747

(1) TPM_ET_KEY is added because TPM_Unseal uses zero as a special value
indicating no encryption.

1748

b. Else

1749

i.

Set S1 -> et to TPM_ET_XOR || TPM_ET_KEY

Set S1 -> et to the algorithm indicated by authHandle

175012.The TPM provides NO validation of a1. Well-known values (like all zeros) are valid and
1751
possible.
175213.If authHandle indicates XOR encryption
1753
1754
1755

a. Use MGF1 to create string X2 of length inDataSize. The inputs to MGF1 are;
authLastNonceEven, nonceOdd, “XOR”, and authHandle -> sharedSecret. The four
concatenated values form the Z value that is the seed for MFG1.

1756

b. Create o1 by XOR of inData and X2

175714.Else
1758

a. Create o1 by decrypting inData using the algorithm indicated by authHandle

1759

b. Key is from authHandle -> sharedSecret

1760

c. CTR is SHA-1 of (authLastNonceEven || nonceOdd)

176115.Create S2 a TPM_SEALED_DATA structure
1762

a. Set S2 -> payload to TPM_PT_SEAL

1763

b. Set S2 -> tpmProof to TPM_PERMANENT_DATA -> tpmProof

1764

c. Create h3 the SHA-1 of S1

1765

d. Set S2 -> storedDigest to h3

1766

e. Set S2 -> authData to a1

1767

f. Set S2 -> dataSize to inDataSize

1768

g. Set S2 -> data to o1

176916.Validate that the size of S2 can be encrypted by the key pointed to by keyHandle, return
1770
TPM_BAD_DATASIZE on error
177117.Create s3 the encryption of S2 using the key pointed to by keyHandle
177218.Set continueAuthSession to FALSE
177319.Set S1 -> encDataSize to the size of s3
177420.Set S1 -> encData to s3
177521.Return S1 as sealedData

426
427

84

Level 2 Revision 116 28 February 2011
TCG Published

428TPM Main Part 3 Commands

TCG © Copyright

429Specification Version 1.2

177611.
Migration
1777Start of informative comment:
1778The migration of a key from one TPM to another is a vital aspect to many use models of the
1779TPM. The migration commands are the commands that allow this operation to occur.
1780There are two types of migratable keys, the version 1.1 migratable keys and the version 1.2
1781certifiable migratable keys.
1782End of informative comment.
178311.1

TPM_CreateMigrationBlob

1784Start of informative comment:
1785The TPM_CreateMigrationBlob command implements the first step in the process of moving
1786a migratable key to a new parent or platform. Execution of this command requires
1787knowledge of the migrationAuth field of the key to be migrated.
1788Migrate mode is generally used to migrate keys from one TPM to another for backup,
1789upgrade or to clone a key on another platform. To do this, the TPM needs to create a data
1790blob that another TPM can deal with. This is done by loading in a backup public key that
1791will be used by the TPM to create a new data blob for a migratable key.
1792The TPM Owner does the selection and authorization of migration public keys at any time
1793prior
to
the
execution
of
TPM_CreateMigrationBlob
by
performing
the
1794TPM_AuthorizeMigrationKey command.
1795IReWrap mode is used directly to move the key to a new parent (on either this platform or
1796another). The TPM simply re-encrypts the key using a new parent, and outputs a normal
1797encrypted element that can be subsequently used by a TPM_LoadKey command.
1798TPM_CreateMigrationBlob implicitly cannot be used to migrate a non-migratory key. No
1799explicit check is required. Only the TPM knows tpmProof. Therefore, it is impossible for the
1800caller to submit an AuthData value equal to tpmProof and migrate a non-migratory key.
1801End of informative comment.

430Level 2 Revision 116 28 February 2011
431

85
TCG Published

432Copyright © TCG
433
434

TPM Main Part 3 Commands
Specification Version 1.2

1802Incoming Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_AUTH2_COMMAND

2

4

UINT32

paramSize

Total number of input bytes including paramSize and tag

3

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_CreateMigrationBlob

4

4

TPM_KEY_HANDLE

parentHandle

Handle of the parent key that can decrypt encData.

5

2

2S

2

TPM_MIGRATE_SCHEME

migrationType

The migration type, either MIGRATE or REWRAP

6

<>

3S

<>

TPM_MIGRATIONKEYAUTH

migrationKeyAuth

Migration public key and its authorization session digest.

7

4

4S

4

UINT32

encDataSize

The size of the encData parameter

8

<>

5S

<>

BYTE[ ]

encData

The encrypted entity that is to be modified.

9

4

TPM_AUTHHANDLE

parentAuthHandle

The authorization session handle used for the parent key.

#

SZ

1

#

1S

SZ

4

2H1

20

TPM_NONCE

authLastNonceEven

Even nonce previously generated by TPM to cover inputs

20

3H1

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with parentAuthHandle

11

1

4H1

1

BOOL

continueAuthSession

Continue use flag for parent session

12

20

20

TPM_AUTHDATA

parentAuth

Authorization HMAC key: parentKey.usageAuth.

13

4

10

TPM_AUTHHANDLE

entityAuthHandle

The authorization session handle used for the encrypted entity.

2H2

20

TPM_NONCE

entitylastNonceEven

Even nonce previously generated by TPM

14

20

3H2

20

TPM_NONCE

entitynonceOdd

Nonce generated by system associated with entityAuthHandle

15

1

4H2

1

BOOL

continueEntitySession

Continue use flag for entity session

16

20

TPM_AUTHDATA

entityAuth

Authorization HMAC key: entity.migrationAuth.

1803

435
436

86

Level 2 Revision 116 28 February 2011
TCG Published

437TPM Main Part 3 Commands

TCG © Copyright

438Specification Version 1.2

1804Outgoing Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RSP_AUTH2_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

#

SZ

1

#

SZ

1S

4

TPM_RESULT

returnCode

The return code of the operation.

2S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_CreateMigrationBlob

4

4

3S

4

UINT32

randomSize

The used size of the output area for random

5

<>

4S

<>

BYTE[ ]

random

String used for xor encryption

6

4

5S

4

UINT32

outDataSize

The used size of the output area for outData

7

<>

6S

<>

BYTE[ ]

outData

The modified, encrypted entity.

8

20

3H1

20

TPM_NONCE

nonceEven

Even nonce newly generated by TPM to cover outputs

4H1

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with parentAuthHandle

5H1

1

BOOL

continueAuthSession

Continue use flag for parent key session

20

TPM_AUTHDATA

resAuth

Authorization. HMAC key: parentKey.usageAuth.

3H2

20

TPM_NONCE

entityNonceEven

Even nonce newly generated by TPM to cover entity

4H2

20

TPM_NONCE

entitynonceOdd

Nonce generated by system associated with entityAuthHandle

5 H2

1

BOOL

continueEntitySession

Continue use flag for entity session

TPM_AUTHDATA

entityAuth

Authorization HMAC key: entity.migrationAuth.

9

1

10

20

11

20

12

1

13

20

1805Description
1806The TPM does not check the PCR values when migrating values locked to a PCR.
1807The second authorization session (using entityAuth) MUST be OIAP because OSAP does not
1808have a suitable entityType
1809Actions
18101. Validate that parentAuth authorizes the use of the key pointed to by parentHandle.
18112. Validate that parentHandle -> keyUsage is TPM_KEY_STORAGE, if not return
1812
TPM_INVALID_KEYUSAGE
18133. Create d1 a TPM_STORE_ASYMKEY structure by decrypting encData using the key
1814
pointed to by parentHandle.
1815

a. Verify that d1 -> payload is TPM_PT_ASYM.

18164. Validate that entityAuth authorizes the migration of d1. The validation MUST use d1 ->
1817
migrationAuth as the secret.
18185. Validate that migrationKeyAuth -> digest is the SHA-1 hash of (migrationKeyAuth ->
1819
migrationKey || migrationKeyAuth -> migrationScheme || TPM_PERMANENT_DATA ->
1820
tpmProof).
18216. If migrationType == TPM_MS_MIGRATE the TPM SHALL perform the following actions:
1822

a. Build two byte arrays, K1 and K2:

439Level 2 Revision 116 28 February 2011
440

87
TCG Published

441Copyright © TCG
442
443

TPM Main Part 3 Commands
Specification Version 1.2

1823
1824

i. K1 = d1.privKey[0..19] (d1.privKey.keyLength + 16 bytes of d1.privKey.key),
sizeof(K1) = 20

1825

ii. K2 = d1.privKey[20..131] (position 16-127 of d1 . privKey.key), sizeof(K2) = 112

1826

b. Build M1 a TPM_MIGRATE_ASYMKEY structure

1827

i.

1828

ii. TPM_MIGRATE_ASYMKEY.usageAuth = d1.usageAuth

1829

iii. TPM_MIGRATE_ASYMKEY.pubDataDigest = d1. pubDataDigest

1830

iv. TPM_MIGRATE_ASYMKEY.partPrivKeyLen = 112 – 127.

1831

v. TPM_MIGRATE_ASYMKEY.partPrivKey = K2

1832
1833

TPM_MIGRATE_ASYMKEY.payload = TPM_PT_MIGRATE

c. Create o1 (which SHALL be 198 bytes for a 2048 bit RSA key) by performing the
OAEP encoding of m using OAEP parameters of

1834

i.

1835

ii. pHash = d1->migrationAuth

1836

iii. seed = s1 = K1

m = M1 the TPM_MIGRATE_ASYMKEY structure

1837
1838

d. Create r1 a random value from the TPM RNG. The size of r1 MUST be the size of o1.
Return r1 in the Random parameter.

1839

e. Create x1 by XOR of o1 with r1

1840

f. Copy r1 into the output field “random”.

1841

g. Encrypt x1 with the migration public key included in migrationKeyAuth.

18427. If migrationType == TPM_MS_REWRAP the TPM SHALL perform the following actions:
1843
1844

a. Rewrap the key using the public key in migrationKeyAuth, keeping the existing
contents of that key.

1845

b. Set randomSize to 0 in the output parameter array

18468. Else
1847

444
445

a. Return TPM_BAD_PARAMETER

88

Level 2 Revision 116 28 February 2011
TCG Published

446TPM Main Part 3 Commands

TCG © Copyright

447Specification Version 1.2

184811.2

TPM_ConvertMigrationBlob

1849Start of informative comment:
1850This command takes a migration blob and creates a normal wrapped blob. The migrated
1851blob must be loaded into the TPM using the normal TPM_LoadKey function.
1852Note that the command migrates private keys, only. The migration of the associated public
1853keys is not specified by TPM because they are not security sensitive. Migration of the
1854associated public keys may be specified in a platform specific specification. A TPM_KEY
1855structure must be recreated before the migrated key can be used by the target TPM in a
1856TPM_LoadKey command.
1857End of informative comment.
1858Incoming Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of input bytes including paramSize and tag

3

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_ConvertMigrationBlob.

4

4

TPM_KEY_HANDLE

parentHandle

Handle of a loaded key that can decrypt keys.

5

4

2S

4

UINT32

inDataSize

Size of inData

6

<>

3S

<>

BYTE [ ]

inData

The XOR’d and encrypted key

7

4

4S

4

UINT32

randomSize

Size of random

8

<>

5S

<>

BYTE [ ]

random

Random value used to hide key data.

9

4

TPM_AUTHHANDLE

authHandle

The authorization session handle used for keyHandle.

#

SZ

1

#

1S

SZ

4

2H1

20

TPM_NONCE

authLastNonceEven

Even nonce previously generated by TPM to cover inputs

10

20

3H1

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

11

1

4H1

1

BOOL

continueAuthSession

The continue use flag for the authorization session handle

12

20

TPM_AUTHDATA

parentAuth

The authorization session digest that authorizes the inputs and the
migration of the key in parentHandle. HMAC key: parentKey.usageAuth

1859

448Level 2 Revision 116 28 February 2011
449

89
TCG Published

450Copyright © TCG
451
452

TPM Main Part 3 Commands
Specification Version 1.2

1860Outgoing Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RSP_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

#

SZ

1

#

SZ

1S

4

TPM_RESULT

returnCode

The return code of the operation.

2S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_ConvertMigrationBlob

4

4

3S

4

UINT32

outDataSize

The used size of the output area for outData

5

<>

4S

<>

BYTE[ ]

outData

The encrypted private key that can be loaded with TPM_LoadKey

6

20

2H1

20

TPM_NONCE

nonceEven

Even nonce newly generated by TPM to cover outputs

3H1

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

4H1

1

BOOL

continueAuthSession

Continue use flag, TRUE if handle is still active

TPM_AUTHDATA

resAuth

The authorization session digest for the returned parameters. HMAC key:
parentKey.usageAuth

7

1

8

20

1861Action
1862The TPM SHALL perform the following:
18631. Validate the AuthData to use the key in parentHandle
18642. If the keyUsage field of the key referenced by parentHandle does not have the value
1865
TPM_KEY_STORAGE, the TPM must return the error code TPM_INVALID_KEYUSAGE
18663. Create d1 by decrypting the inData area using the key in parentHandle
18674. Create o1 by XOR d1 and random parameter
18685. Create m1 a TPM_MIGRATE_ASYMKEY structure, seed and pHash by OAEP decoding o1
18696. Create k1 by combining seed and the TPM_MIGRATE_ASYMKEY -> partPrivKey field
18707. Create d2 a TPM_STORE_ASYMKEY structure
1871

a.

1872

b. Set d2 -> payload = TPM_PT_ASYM

1873

c. Set d2 -> usageAuth to m1 -> usageAuth

1874

d. Set d2 -> migrationAuth to pHash

1875

e. Set d2 -> pubDataDigest to m1 -> pubDataDigest

1876

f. Set d2 -> privKey field to k1

Verify that m1 -> payload == TPM_PT_MIGRATE

18778. Create outData using the key in parentHandle to perform the encryption

453
454

90

Level 2 Revision 116 28 February 2011
TCG Published

455TPM Main Part 3 Commands

TCG © Copyright

456Specification Version 1.2

187811.3

TPM_AuthorizeMigrationKey

1879Start of informative comment:
1880This command creates an authorization blob, to allow the TPM owner to specify which
1881migration facility they will use and allow users to migrate information without further
1882involvement with the TPM owner.
1883It is the responsibility of the TPM Owner to determine whether migrationKey is appropriate
1884for migration. The TPM checks just the cryptographic strength of migrationKey.
1885End of informative comment.
1886Incoming Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of input bytes including paramSize and tag

3

4

1S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_AuthorizeMigrationKey

4

2

2S

2

TPM_MIGRATE_SCHEME

migrationScheme

Type of migration operation that is to be permitted for this key.

4

<>

3S

<>

TPM_PUBKEY

migrationKey

The public key to be authorized.

5

4

TPM_AUTHHANDLE

authHandle

The authorization session handle used for owner authentication.

#

SZ

1

#

SZ

2H1

20

TPM_NONCE

authLastNonceEven

Even nonce previously generated by TPM to cover inputs

6

20

3H1

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

7

1

4H1

1

BOOL

continueAuthSession

The continue use flag for the authorization session handle

8

20

TPM_AUTHDATA

ownerAuth

The authorization session digest for inputs and owner authorization.
HMAC key: ownerAuth.

1887Outgoing Operands and Sizes
PARAM
#

SZ

1

4

3

4

#

SZ

Type

Name

Description

TPM_TAG

2

2

HMAC

tag

TPM_TAG_RSP_AUTH1_COMMAND

UINT32

paramSize

Total number of output bytes including paramSize and tag

1S

4

TPM_RESULT

returnCode

The return code of the operation.

2S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_AuthorizeMigrationKey

4

<>

3S

<>

TPM_MIGRATIONKEYAUTH

outData

Returned public key and authorization session digest.

5

20

2H1

20

TPM_NONCE

nonceEven

Even nonce newly generated by TPM to cover outputs

3H1

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

4H1

1

BOOL

continueAuthSession

Continue use flag, TRUE if handle is still active

TPM_AUTHDATA

resAuth

The authorization session digest for the returned parameters. HMAC
key: ownerAuth.

6

1

7

20

1888
1889Action
1890The TPM SHALL perform the following:
457Level 2 Revision 116 28 February 2011
458

91
TCG Published

459Copyright © TCG
460
461

TPM Main Part 3 Commands
Specification Version 1.2

18911. Check that the cryptographic strength of migrationKey is at least that of a 2048 bit RSA
1892
key. If migrationKey is an RSA key, this means that migrationKey MUST be 2048 bits or
1893
greater and MUST use the default exponent.
18942. Validate the AuthData to use the TPM by the TPM Owner
18953. Create a f1 a TPM_MIGRATIONKEYAUTH structure
18964. Verify
that
migrationKey->
1897
TPM_ES_RSAESOAEP_SHA1_MGF1,
1898
TPM_INAPPROPRIATE_ENC if it is not

algorithmParms
and
return

->
the

encScheme
error

is
code

18995. Set f1 -> migrationKey to the input migrationKey
19006. Set f1 -> migrationScheme to the input migrationScheme
19017. Create
v1
by
concatenating
1902
TPM_PERMANENT_DATA -> tpmProof)

(migrationKey

||

migrationScheme

19038. Create h1 by performing a SHA-1 hash of v1
19049. Set f1 -> digest to h1
190510.Return f1 as outData

462
463

92

Level 2 Revision 116 28 February 2011
TCG Published

||

464TPM Main Part 3 Commands

TCG © Copyright

465Specification Version 1.2

190611.4

TPM_MigrateKey

1907Start of informative comment:
1908The TPM_MigrateKey command performs the function of a migration authority.
1909The command is relatively simple; it just decrypts the input packet (coming from
1910TPM_CreateMigrationBlob or TPM_CMK_CreateBlob) and then re-encrypts it with the input
1911public key. The output of this command would then be sent to TPM_ConvertMigrationBlob
1912or TPM_CMK_ConvertMigration on the target TPM.
1913TPM_MigrateKey does not make ANY assumptions about the contents of the encrypted blob.
1914Since it does not have the XOR string, it cannot actually determine much about the key
1915that is being migrated.
1916This command exists to permit the TPM to be a migration authority. If used in this way, it is
1917expected that the physical security of the system containing the TPM and the AuthData
1918value for the MA key would be tightly controlled.
1919To prevent the execution of this command using any other key as a parent key, this
1920command works only if keyUsage for maKeyHandle is TPM_KEY_MIGRATE.
1921End of informative comment.
1922Incoming Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of input bytes including paramSize and tag

3

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_MigrateKey

4

4

TPM_KEY_HANDLE

maKeyHandle

Handle of the key to be used to migrate the key.

5

<>

2S

<>

TPM_PUBKEY

pubKey

Public key to which the blob is to be migrated

6

4

3S

4

UINT32

inDataSize

The size of inData

7

<>

4S

<>

BYTE[ ]

inData

The input blob

8

4

TPM_AUTHHANDLE

maAuthHandle

The authorization session handle used for maKeyHandle.

#

SZ

1

#

1S

SZ

4

2H1

20

TPM_NONCE

authLastNonceEven

Even nonce previously generated by TPM to cover inputs

9

20

3H1

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with certAuthHandle

10

1

4H1

1

BOOL

continueAuthSession

The continue use flag for the authorization session handle

11

20

TPM_AUTHDATA

keyAuth

The authorization session digest for the inputs and key to be signed.
HMAC key: maKeyHandle.usageAuth.

466Level 2 Revision 116 28 February 2011
467

93
TCG Published

468Copyright © TCG
469
470

TPM Main Part 3 Commands
Specification Version 1.2

1923Outgoing Operands and Sizes
Param

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RSP_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

#

Sz

1

#

Sz

1S

4

TPM_RESULT

returnCode

The return code of the operation.

2S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_MigrateKey

4

4

3S

4

UINT32

outDataSize

The used size of the output area for outData

5

<>

4S

<>

BYTE[ ]

outData

The re-encrypted blob

6

20

2H1

20

TPM_NONCE

nonceEven

Even nonce newly generated by TPM

3H1

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with certAuthHandle

4H1

1

BOOL

continueAuthSession

Continue use flag for cert key session

TPM_AUTHDATA

keyAuth

The authorization session digest for the target key. HMAC key:
maKeyHandle.usageAuth

7

1

8

20

1924Actions
19251. Validate that keyAuth authorizes the use of the key pointed to by maKeyHandle
19262. The TPM validates that the key pointed to by maKeyHandle has a key usage value of
1927
TPM_KEY_MIGRATE,
and
that
the
allowed
encryption
scheme
is
1928
TPM_ES_RSAESOAEP_SHA1_MGF1.
19293. The TPM validates that pubKey is of a size supported by the TPM and that its size is
1930
consistent with the input blob and maKeyHandle.
19314. The TPM decrypts inData and re-encrypts it using pubKey.

471
472

94

Level 2 Revision 116 28 February 2011
TCG Published

473TPM Main Part 3 Commands

TCG © Copyright

474Specification Version 1.2

193211.5

TPM_CMK_SetRestrictions

1933Start of informative comment:
1934This command is used by the Owner to dictate the usage of a certified-migration key with
1935delegated authorization (authorization other than actual owner authorization).
1936This command is provided for privacy reasons and must not itself be delegated, because a
1937certified-migration-key may involve a contractual relationship between the Owner and an
1938external entity.
1939Since restrictions are validated at DSAP session use, there is no need to invalidate DSAP
1940sessions when the restriction value changes.
1941End of informative comment.
1942Incoming Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of input bytes incl. paramSize and tag

3

4

1S

4

TPM_COMMAND_CODE

ordinal

Ordinal: TPM_ORD_CMK_SetRestrictions

4

4

2S

4

TPM_CMK_DELEGATE

restriction

The bit mask of how to set the restrictions on CMK keys

5

4

TPM_AUTHHANDLE

authHandle

The authorization session handle TPM Owner authentication

#

SZ

1

#

SZ

2H1

20

TPM_NONCE

authLastNonceEven

Even nonce previously generated by TPM to cover inputs

6

20

3H1

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

7

1

4H1

1

BOOL

continueAuthSession

The continue use flag for the authorization session handle

8

20

TPM_AUTHDATA

ownerAuth

The authorization session digest. HMAC key:ownerAuth

Type

Name

Description

1943Outgoing Operands and Sizes
PARAM

HMAC

#

SZ

#

SZ

1

2

TPM_TAG

tag

TPM_TAG_RSP_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of output bytes

3

4

5

1

6

TPM_RESULT

returnCode

The return code of the operation

4

TPM_COMMAND_CODE

ordinal

Ordinal: TPM_ORD_CMK_SetRestrictions

2H1

20

TPM_NONCE

nonceEven

Even nonce newly generated by TPM to cover outputs

3H1

20

4

2S
4

1S

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

4H1

1

BOOL

continueAuthSession

Continue use flag, TRUE if handle is still active

TPM_AUTHDATA

resAuth

Authorization HMAC key: ownerAuth.

20

1944Description
1945TPM_PERMANENT_DATA -> restrictDelegate is used as follows
19461. If the session type is TPM_PID_DSAP and TPM_KEY -> keyFlags -> migrateAuthority is
1947
TRUE
475Level 2 Revision 116 28 February 2011
476

95
TCG Published

477Copyright © TCG
478
479

1948

TPM Main Part 3 Commands
Specification Version 1.2

a. If

1949TPM_KEY_USAGE
is
TPM_KEY_SIGNING
1950TPM_CMK_DELEGATE_SIGNING is TRUE, or

and

restrictDelegate

->

1951TPM_KEY_USAGE
is
TPM_KEY_STORAGE
1952TPM_CMK_DELEGATE_STORAGE is TRUE, or

and

restrictDelegate

->

1953TPM_KEY_USAGE is TPM_KEY_BIND and restrictDelegate -> TPM_CMK_DELEGATE_BIND
1954is TRUE, or
1955TPM_KEY_USAGE
is
TPM_KEY_LEGACY
1956TPM_CMK_DELEGATE_LEGACY is TRUE, or

and

restrictDelegate

->

1957TPM_KEY_USAGE
is
TPM_KEY_MIGRATE
1958TPM_CMK_DELEGATE_MIGRATE is TRUE

and

restrictDelegate

->

1959then the key can be used.
1960

b. Else return TPM_INVALID_KEYUSAGE.

1961Actions
19621. Validate the ordinal and parameters using TPM Owner authentication, return
1963
TPM_AUTHFAIL on error
19642. Set TPM_PERMANENT_DATA -> TPM_CMK_DELEGATE -> restrictDelegate = restriction
19653. Return TPM_SUCCESS

480
481

96

Level 2 Revision 116 28 February 2011
TCG Published

482TPM Main Part 3 Commands

TCG © Copyright

483Specification Version 1.2

196611.6

TPM_CMK_ApproveMA

1967Start of informative comment:
1968This command creates an authorization ticket, to allow the TPM owner to specify which
1969Migration Authorities they approve and allow users to create certified-migration-keys
1970without further involvement with the TPM owner.
1971It is the responsibility of the TPM Owner to determine whether a particular Migration
1972Authority is suitable to control migration
1973End of informative comment.
1974Incoming Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of input bytes including paramSize and tag

3

4

1S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_CMK_ApproveMA

4

20

2S

20

TPM_DIGEST

migrationAuthorityDigest

A digest of a TPM_MSA_COMPOSITE structure (itself one or more
digests of public keys belonging to migration authorities)

5

4

TPM_AUTHHANDLE

authHandle

The authorization session handle used for owner authentication.

#

SZ

1

#

SZ

2H1

20

TPM_NONCE

authLastNonceEven

Even nonce previously generated by TPM to cover inputs

6

20

3H1

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

7

1

4H1

1

BOOL

continueAuthSession

The continue use flag for the authorization session handle

8

20

TPM_AUTHDATA

ownerAuth

Authorization HMAC, key: ownerAuth.

1975Outgoing Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RSP_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

#

SZ

1

#

SZ

1S

4

TPM_RESULT

returnCode

The return code of the operation.

2S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_CMK_ApproveMA

4

20

3S

20

TPM_HMAC

outData

HMAC of migrationAuthorityDigest

5

20

2H1

20

TPM_NONCE

nonceEven

Even nonce newly generated by TPM to cover outputs

3H1

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

4H1

1

BOOL

continueAuthSession

Continue use flag, TRUE if handle is still active

TPM_AUTHDATA

resAuth

Authorization HMAC, key: ownerAuth.

6

1

7

20

1976Action
1977The TPM SHALL perform the following:
19781. Validate the AuthData to use the TPM by the TPM Owner
19792. Create M2 a TPM_CMK_MA_APPROVAL structure
484Level 2 Revision 116 28 February 2011
485

97
TCG Published

486Copyright © TCG
487
488

1980

TPM Main Part 3 Commands
Specification Version 1.2

a. Set M2 ->migrationAuthorityDigest to migrationAuthorityDigest

19813. Set outData = HMAC(M2) using tpmProof as the secret
19824. Return TPM_SUCCESS

489
490

98

Level 2 Revision 116 28 February 2011
TCG Published

491TPM Main Part 3 Commands

TCG © Copyright

492Specification Version 1.2

198311.7

TPM_CMK_CreateKey

1984Start of informative comment:
1985The TPM_CMK_CreateKey command both generates and creates a secure storage bundle for
1986asymmetric keys whose migration is controlled by a migration authority.
1987TPM_CMK_CreateKey is very similar to TPM_CreateWrapKey, but: (1) the resultant key must
1988be a migratable key and can be migrated only by TPM_CMK_CreateBlob; (2) the command is
1989Owner authorized via a ticket.
1990TPM_CMK_CreateKey creates an otherwise normal migratable key except that (1)
1991migrationAuth is an HMAC of the migration authority and the new key’s public key, signed
1992by tpmProof (instead of being tpmProof); (2) the migrationAuthority bit is set TRUE; (3) the
1993payload type is TPM_PT_MIGRATE_RESTRICTED.
1994The migration-selection/migration authority is specified by passing in a public key (actually
1995the digests of one or more public keys, so more than one migration authority can be
1996specified).
1997End of informative comment.
1998Incoming Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_AUTH1_COMMAND

4

UINT32

paramSize

Total number of input bytes including paramSize and tag

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_CMK_CreateKey

TPM_KEY_HANDLE

parentHandle

Handle of a loaded key that can perform key wrapping.

20

TPM_ENCAUTH

dataUsageAuth

Encrypted usage AuthData for the key.

3S

<>

TPM_KEY12

keyInfo

Information about key to be created, pubkey.keyLength and
keyInfo.encData elements are 0. MUST be TPM_KEY12

20

4S

20

TPM_HMAC

migrationAuthorityApproval

A ticket, created by the TPM Owner using TPM_CMK_ApproveMA,
approving a TPM_MSA_COMPOSITE structure

8

20

5S

20

TPM_DIGEST

migrationAuthorityDigest

The digest of a TPM_MSA_COMPOSITE structure

9

4

TPM_AUTHHANDLE

authHandle

The authorization session handle used for parent key authorization.
Must be an OSAP session.

#

SZ

#

1
2
3

4

4

4

5

20

2S

6

<>

7

1S

SZ

4

2H1

20

TPM_NONCE

authLastNonceEven

Even nonce previously generated by TPM to cover inputs

10

20

3H1

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

11

1

4H1

1

BOOL

continueAuthSession

Ignored

12

20

TPM_AUTHDATA

pubAuth

The authorization session digest that authorizes the use of the public
key in parentHandle. HMAC key: parentKey.usageAuth.

493Level 2 Revision 116 28 February 2011
494

99
TCG Published

495Copyright © TCG
496
497

TPM Main Part 3 Commands
Specification Version 1.2

1999Outgoing Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RSP_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

#

SZ

1

#

SZ

1S

4

TPM_RESULT

returnCode

The return code of the operation.

2S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_CMK_CreateKey

4

<>

3S

<>

TPM_KEY12

wrappedKey

The TPM_KEY structure which includes the public and encrypted private
key. MUST be TPM_KEY12

5

20

2H1

20

TPM_NONCE

nonceEven

Even nonce newly generated by TPM to cover outputs

3H1

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

4H1

1

BOOL

continueAuthSession

Continue use flag, fixed at FALSE

TPM_AUTHDATA

resAuth

The authorization session digest for the returned parameters. HMAC key:
parentKey.usageAuth.

6

1

7

20

2000Actions
2001The TPM SHALL do the following:
20021. Validate the AuthData to use the key pointed to by parentHandle. Return
2003
TPM_AUTHFAIL on any error
20042. Validate the session type for parentHandle is OSAP
20053. If the TPM is not designed to create a key of the type requested in keyInfo, return the
2006
error code TPM_BAD_KEY_PROPERTY
20074. Verify that parentHandle->keyUsage equals TPM_KEY_STORAGE
20085. Verify that parentHandle-> keyFlags-> migratable == FALSE
20096. If keyInfo -> keyFlags -> migratable is FALSE, return TPM_INVALID_KEYUSAGE
20107. If keyInfo -> keyFlags -> migrateAuthority is FALSE , return TPM_INVALID_KEYUSAGE
20118. Verify that the migration authority is authorized
2012

a. Create M1 a TPM_CMK_MA_APPROVAL structure

2013
2014
2015

i.

Set M1 ->migrationAuthorityDigest to migrationAuthorityDigest

b. Verify that migrationAuthorityApproval == HMAC(M1) using tpmProof as the secret
and return error TPM_MA_AUTHORITY on mismatch

20169. Validate key parameters
2017
2018

a. keyInfo
->
keyUsage
MUST
NOT
be
TPM_KEY_IDENTITY
TPM_KEY_AUTHCHANGE. If it is, return TPM_INVALID_KEYUSAGE

201910.If TPM_PERMANENT_FLAGS -> FIPS is TRUE then
2020

a. If keyInfo -> keySize is less than 1024 return TPM_NOTFIPS

2021

b. If keyInfo -> authDataUsage specifies TPM_AUTH_NEVER return TPM_NOTFIPS

2022

c. If keyInfo -> keyUsage specifies TPM_KEY_LEGACY return TPM_NOTFIPS

498
499

100

Level 2 Revision 116 28 February 2011
TCG Published

or

500TPM Main Part 3 Commands

TCG © Copyright

501Specification Version 1.2

202311.If keyInfo -> keyUsage equals TPM_KEY_STORAGE or TPM_KEY_MIGRATE
2024

a. algorithmID MUST be TPM_ALG_RSA

2025

b. encScheme MUST be TPM_ES_RSAESOAEP_SHA1_MGF1

2026

c. sigScheme MUST be TPM_SS_NONE

2027

d. key size MUST be 2048

2028

e. exponentSize MUST be 0

202912.If keyInfo -> tag is NOT TPM_TAG_KEY12 return error TPM_INVALID_STRUCTURE
203013.Map wrappedKey to a TPM_KEY12 structure
203114.Create DU1 by decrypting dataUsageAuth according to the ADIP indicated by
2032
authHandle.
203315.Set continueAuthSession to FALSE
203416.Generate asymmetric key according to algorithm information in keyInfo
203517.Fill in the wrappedKey structure with information from the newly generated key.
2036

a. Set wrappedKey -> encData -> usageAuth to DU1

2037

b. Set wrappedKey -> encData -> payload to TPM_PT_MIGRATE_RESTRICTED

2038
2039

c. Create thisPubKey, a TPM_PUBKEY structure containing wrappedKey’s public key
and algorithm parameters

2040

d. Create M2 a TPM_CMK_MIGAUTH structure

2041

i.

2042

ii. Set M2 -> pubKeyDigest to SHA-1 (thisPubKey)

2043
2044

Set M2 -> msaDigest to migrationAuthorityDigest

e. Set wrappedKey -> encData -> migrationAuth equal to HMAC(M2), using tpmProof as
the shared secret

204518.If keyInfo->PCRInfoSize is non-zero
2046

a. Set wrappedKey -> pcrInfo to a TPM_PCR_INFO_LONG structure

2047

b. Set wrappedKey -> pcrInfo to keyInfo -> pcrInfo

2048
2049

c. Set wrappedKey -> digestAtCreation to the TPM_COMPOSITE_HASH indicated by
creationPCRSelection

2050

d. Set wrappedKey -> localityAtCreation to TPM_STANY_FLAGS -> localityModifier

205119.Encrypt the private portions of the wrappedKey structure using the key in parentHandle
205220.Return the newly generated key in the wrappedKey parameter

502Level 2 Revision 116 28 February 2011
503

101
TCG Published

504Copyright © TCG
505
506

205311.8

TPM Main Part 3 Commands
Specification Version 1.2

TPM_CMK_CreateTicket

2054Start of informative comment:
2055The TPM_CMK_CreateTicket command uses a public key to verify the signature over a
2056digest.
2057TPM_CMK_CreateTicket returns a ticket that can be used to prove to the same TPM that
2058signature verification with a particular public key was successful.
2059End of informative comment.
2060Incoming Operands and Sizes
PARAM

HMAC

Type

Name

Description

TPM_TAG

tag

TPM_TAG_RQU_AUTH1_COMMAND

UINT32

paramSize

Total number of input bytes including paramSize and tag

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_CMK_CreateTicket

<>

TPM_PUBKEY

verificationKey

The public key to be used to check signatureValue

3S

20

TPM_DIGEST

signedData

The data to be verified

4

4S

4

UINT32

signatureValueSize

The size of the signatureValue

7

<>

5S

<>

BYTE[]

signatureValue

The signatureValue to be verified

8

4

TPM_AUTHHANDLE

authHandle

The authorization session handle used for owner authentication.

#

SZ

#

SZ

1

2

2

4

3

4

1S

4

4

<>

2S

5

20

6

2H1

20

TPM_NONCE

authLastNonceEven

Even nonce previously generated by TPM to cover inputs

9

3H1

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

10

1

4H1

1

BOOL

continueAuthSession

Ignored

11

507
508

20

20

TPM_AUTHDATA

pubAuth

The authorization session digest for inputs and owner. HMAC key:
ownerAuth.

102

Level 2 Revision 116 28 February 2011
TCG Published

509TPM Main Part 3 Commands

TCG © Copyright

510Specification Version 1.2

2061Outgoing Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RSP_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

#

SZ

1

#

SZ

1S

4

TPM_RESULT

returnCode

The return code of the operation.

2S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_CMK_CreateTicket

4

20

3S

20

TPM_HMAC

sigTicket

Ticket that proves digest created on this TPM

5

20

2H1

20

TPM_NONCE

nonceEven

Even nonce newly generated by TPM to cover outputs

3H1

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

4H1

1

BOOL

continueAuthSession

Continue use flag

TPM_AUTHDATA

resAuth

Authorization. HMAC key:. ownerAuth.

6

1

7

20

2062Actions
2063The TPM SHALL do the following:
20641. Validate the TPM Owner authentication to use the command
20652. Validate that the key type and algorithm are correct
2066

a. Validate that verificationKey -> algorithmParms -> algorithmID == TPM_ALG_RSA

2067

b. Validate that verificationKey -> algorithmParms ->encScheme == TPM_ES_NONE

2068
2069

c. Validate
that
verificationKey
->algorithmParms
->sigScheme
TPM_SS_RSASSAPKCS1v15_SHA1 or TPM_SS_RSASSAPKCS1v15_INFO

is

20703. Use verificationKey to verify that signatureValue is a valid signature on signedData, and
2071
return error TPM_BAD_SIGNATURE on mismatch
20724. Create M2 a TPM_CMK_SIGTICKET
2073

a. Set M2 -> verKeyDigest to the SHA-1 (verificationKey)

2074

b. Set M2 -> signedData to signedData

20755. Set sigTicket = HMAC(M2) signed by using tpmProof as the secret
20766. Return TPM_SUCCESS

511Level 2 Revision 116 28 February 2011
512

103
TCG Published

513Copyright © TCG
514
515

207711.9

TPM Main Part 3 Commands
Specification Version 1.2

TPM_CMK_CreateBlob

2078Start of informative comment:
2079TPM_CMK_CreateBlob command is very similar to TPM_CreateMigrationBlob, except that it:
2080(1) uses an extra ticket (restrictedKeyAuth) instead of a migrationAuth authorization
2081session;
(2)
uses
the
migration
options
TPM_MS_RESTRICT_MIGRATE
or
2082TPM_MS_RESTRICT_APPROVE; (3) produces a wrapped key blob whose migrationAuth is
2083independent of tpmProof.
2084If the destination (parent) public key is the MA, migration is implicitly permitted. Further
2085checks are required if the MA is not the destination (parent) public key, and merely selects
2086a migration destination: (1) sigTicket must prove that restrictTicket was signed by the MA;
2087(2) restrictTicket must vouch that the target public key is approved for migration to the
2088destination (parent) public key. (Obviously, this more complex method may also be used by
2089an MA to approve migration to that MA.) In both cases, the MA must be one of the MAs
2090implicitly listed in the migrationAuth of the target key-to-be-migrated.
2091When the migrationType is TPM_MS_RESTRICT_MIGRATE, restrictTicket and sigTicket are
2092unused. The TPM may test that the corresponding sizes are zero, so the caller should set
2093them to zero for interoperability.
2094End of informative comment.

516
517

104

Level 2 Revision 116 28 February 2011
TCG Published

518TPM Main Part 3 Commands

TCG © Copyright

519Specification Version 1.2

2095Incoming Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of input bytes including paramSize and tag

3

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_CMK_CreateBlob

4

4

TPM_KEY_HANDLE

parentHandle

Handle of the parent key that can decrypt encData.

5

2

2S

2

TPM_MIGRATE_SCHEME

migrationType

The migration type, either TPM_MS_RESTRICT_MIGRATE or TPM_MS_RESTRICT_APPROVE.

6

<>

3S

<>

TPM_MIGRATIONKEYAUTH

migrationKeyAuth

Migration public key and its authorization session digest.

7

20

4S

20

TPM_DIGEST

pubSourceKeyDigest

The digest of the TPM_PUBKEY of the entity to be migrated

8

4

5S

4

UINT32

msaListSize

The size of the msaList parameter, which is a variable length
TPM_MSA_COMPOSITE structure

9

<>

6S

<>

TPM_MSA_COMPOSITE

msaList

One or more digests of public keys belonging to migration authorities

10

4

7S

4

UINT32

restrictTicketSize

The size of the restrictTicket parameter

11

<>

8S

<>

BYTE[]

restrictTicket

If migrationType is TPM_MS_RESTRICT_APPROVE, a TPM_CMK_AUTH structure, containing the digests of the public keys
belonging to the Migration Authority, the destination parent key and the key-to-be-migrated.

12

4

9S

4

UINT32

sigTicketSize

The size of the sigTicket parameter

13

<>

10S

<>

BYTE[]

sigTicket

If migrationType is TPM_MS_RESTRICT_APPROVE, a TPM_HMAC
structure, generated by the TPM, signaling a valid signature over
restrictTicket

14

4

11S

4

UINT32

encDataSize

The size of the encData parameter

15

<>

12S

<>

BYTE[]

encData

The encrypted entity that is to be modified.

16

4

TPM_AUTHHANDLE

parentAuthHandle

The authorization session handle used for the parent key.

#

SZ

1

#

1S

SZ

4

2H1

20

TPM_NONCE

authLastNonceEven

Even nonce previously generated by TPM to cover inputs

17

20

3H1

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with parentAuthHandle

18

1

4H1

1

BOOL

continueAuthSession

Continue use flag for parent session

19

20

20

TPM_AUTHDATA

parentAuth

HMAC key: parentKey.usageAuth.

520Level 2 Revision 116 28 February 2011
521

105
TCG Published

522Copyright © TCG
523
524

TPM Main Part 3 Commands
Specification Version 1.2

2096Outgoing Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RSP_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

#

SZ

1

#

SZ

1S

4

TPM_RESULT

returnCode

The return code of the operation.

2S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_CMK_CreateBlob

4

4

3S

4

UINT32

randomSize

The used size of the output area for random

5

<>

4S

<>

BYTE[ ]

random

String used for xor encryption

6

4

5S

4

UINT32

outDataSize

The used size of the output area for outData

7

<>

6S

<>

BYTE[ ]

outData

The modified, encrypted entity.

8

20

3H1

20

TPM_NONCE

nonceEven

Even nonce newly generated by TPM to cover outputs

4H1

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with parentAuthHandle

5H1

1

BOOL

continueAuthSession

Continue use flag for parent key session

20

TPM_AUTHDATA

resAuth

HMAC key: parentKey.usageAuth.

9

1

10

20

2097Description
2098The TPM does not check the PCR values when migrating values locked to a PCR.
2099Actions
21001. Validate that parentAuth authorizes the use of the key pointed to by parentHandle.
21012. The TPM MAY verify that migrationType == migrationKeyAuth -> migrationScheme and
2102
return TPM_BAD_MODE on error.
2103

a. The TPM MAY ignore migrationType.

21043. Verify that parentHandle-> keyFlags-> migratable == FALSE
21054. Create d1 by decrypting encData using the key pointed to by parentHandle.
21065. Verify that the digest within migrationKeyAuth is legal for this TPM and public key
21076. Verify
that
d1
->
payload
2108
TPM_PT_MIGRATE_EXTERNAL

==

TPM_PT_MIGRATE_RESTRICTED

or

21097. Verify that the migration authorities in msaList are authorized to migrate this key
2110

a. Create M2 a TPM_CMK_MIGAUTH structure

2111

i.

2112

ii. Set M2 -> pubKeyDigest to pubSourceKeyDigest

2113
2114

Set M2 -> msaDigest to SHA-1[msaList]

b. Verify that d1 -> migrationAuth == HMAC(M2) using tpmProof as the secret and
return error TPM_MA_AUTHORITY on mismatch

21158. If migrationKeyAuth -> migrationScheme == TPM_MS_RESTRICT_MIGRATE
2116

525
526

a. Verify that intended migration destination is an MA:

106

Level 2 Revision 116 28 February 2011
TCG Published

527TPM Main Part 3 Commands

TCG © Copyright

528Specification Version 1.2

2117
2118
2119

i. For one of n=1 to n=(msaList -> MSAlist), verify that SHA-1[migrationKeyAuth
-> migrationKey] == msaList -> migAuthDigest[n]
b. Validate that the MA key is the correct type

2120
2121

i. Validate that migrationKeyAuth -> migrationKey -> algorithmParms ->
algorithmID == TPM_ALG_RSA

2122
2123

ii. Validate that migrationKeyAuth -> migrationKey -> algorithmParms ->
encScheme is an encryption scheme supported by the TPM

2124
2125

iii. Validate that migrationKeyAuth
sigScheme is TPM_SS_NONE

2126

c. The TPM MAY validate that restrictTicketSize is zero.

2127

d. The TPM MAY validate that sigTicketSize is zero.

->

migrationKey

->algorithmParms

->

21289. else If migrationKeyAuth -> migrationScheme == TPM_MS_RESTRICT_APPROVE
2129
2130
2131
2132

a. Verify that the intended migration destination has been approved by the MSA:
i. Verify that for one of the n=1 to n=(msaList -> MSAlist) values of msaList ->
migAuthDigest[n], sigTicket == HMAC (V1) using tpmProof as the secret where V1
is a TPM_CMK_SIGTICKET structure such that:

2133

(1)

V1 -> verKeyDigest = msaList -> migAuthDigest[n]

2134

(2)

V1 -> signedData = SHA-1[restrictTicket]

2135
2136

ii. If [restrictTicket -> destinationKeyDigest] != SHA-1[migrationKeyAuth ->
migrationKey], return error TPM_MA_DESTINATION

2137
2138

iii. If [restrictTicket -> sourceKeyDigest] != pubSourceKeyDigest, return error
TPM_MA_SOURCE

213910.Else return with error TPM_BAD_PARAMETER.
214011.Build two bytes array, K1 and K2, using d1:
2141
2142
2143

a. K1
=
TPM_STORE_ASYMKEY.privKey[0..19]
(TPM_STORE_ASYMKEY.privKey.keyLength
+
16
bytes
of
TPM_STORE_ASYMKEY.privKey.key), sizeof(K1) = 20

2144
2145

b. K2
=
TPM_STORE_ASYMKEY.privKey[20..131]
TPM_STORE_ASYMKEY . privKey.key), sizeof(K2) = 112

(position

16-127

of

214612.Build M1 a TPM_MIGRATE_ASYMKEY structure
2147

a. TPM_MIGRATE_ASYMKEY.payload = TPM_PT_CMK_MIGRATE

2148

b. TPM_MIGRATE_ASYMKEY.usageAuth = TPM_STORE_ASYMKEY.usageAuth

2149

c. TPM_MIGRATE_ASYMKEY.pubDataDigest = TPM_STORE_ASYMKEY. pubDataDigest

2150

d. TPM_MIGRATE_ASYMKEY.partPrivKeyLen = 112 – 127.

2151

e. TPM_MIGRATE_ASYMKEY.partPrivKey = K2

215213.Create o1 (which SHALL be 198 bytes for a 2048 bit RSA key) by performing the OAEP
2153
encoding of m using OAEP parameters m, pHash, and seed
2154

a. m is the previously created M1

529Level 2 Revision 116 28 February 2011
530

107
TCG Published

531Copyright © TCG
532
533

TPM Main Part 3 Commands
Specification Version 1.2

2155

b. pHash = SHA-1( SHA-1[msaList] || pubSourceKeyDigest)

2156

c. seed = s1 = the previously created K1

215714.Create r1 a random value from the TPM RNG. The size of r1 MUST be the size of o1.
2158
Return r1 in the random parameter
215915.Create x1 by XOR of o1 with r1
216016.Copy r1 into the output field “random”
216117.Encrypt x1 with the migrationKeyAuth-> migrationKey

534
535

108

Level 2 Revision 116 28 February 2011
TCG Published

536TPM Main Part 3 Commands

TCG © Copyright

537Specification Version 1.2

216211.10

TPM_CMK_ConvertMigration

2163Start of informative comment:
2164TPM_CMK_ConvertMigration completes the migration of certified migration blobs.
2165This command takes a certified migration blob and creates a normal wrapped blob with
2166payload type TPM_PT_MIGRATE_EXTERNAL. The migrated blob must be loaded into the
2167TPM using the normal TPM_LoadKey function.
2168Note that the command migrates private keys, only. The migration of the associated public
2169keys is not specified by TPM because they are not security sensitive. Migration of the
2170associated public keys may be specified in a platform specific specification. A TPM_KEY
2171structure must be recreated before the migrated key can be used by the target TPM in a
2172TPM_LoadKey command.
2173TPM_CMK_ConvertMigration checks that one of the MAs implicitly listed in the
2174migrationAuth of the target key has approved migration of the target key to the destination
2175(parent) key, and that the settings (flags etc.) in the target key are those of a CMK.
2176End of informative comment.
2177Incoming Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_AUTH1_COMMAND

4

UINT32

paramSize

Total number of input bytes including paramSize and tag

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_CMK_ConvertMigration

TPM_KEY_HANDLE

parentHandle

Handle of a loaded key that can decrypt keys.

60

TPM_CMK_AUTH

restrictTicket

The digests of public keys belonging to the Migration Authority, the
destination parent key and the key-to-be-migrated.

3S

20

TPM_HMAC

sigTicket

A signature ticket, generated by the TPM, signaling a valid signature
over restrictTicket

<>

4S

<>

TPM_KEY12

migratedKey

The public key of the key-to-be-migrated. The private portion MUST be
TPM_MIGRATE_ASYMKEY properly XOR’d

8

4

5S

4

UINT32

msaListSize

The size of the msaList parameter, which is a variable length
TPM_MSA_COMPOSITE structure

9

<>

6S

<>

TPM_MSA_COMPOSITE

msaList

One or more digests of public keys belonging to migration authorities

10

4

7S

4

UINT32

randomSize

Size of random

11

<>

8S

<>

BYTE [ ]

random

Random value used to hide key data.

12

4

TPM_AUTHHANDLE

authHandle

The authorization session handle used for keyHandle.

#

SZ

#

1
2
3

4

4

4

5

60

2S

6

20

7

1S

SZ

4

2H1

20

TPM_NONCE

authLastNonceEven

Even nonce previously generated by TPM to cover inputs

13

20

3H1

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

14

1

4H1

1

BOOL

continueAuthSession

The continue use flag for the authorization session handle

15

20

TPM_AUTHDATA

parentAuth

Authorization HMAC: parentKey.usageAuth

538Level 2 Revision 116 28 February 2011
539

109
TCG Published

540Copyright © TCG
541
542

TPM Main Part 3 Commands
Specification Version 1.2

2178Outgoing Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RSP_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

#

SZ

1

#

SZ

1S

4

TPM_RESULT

returnCode

The return code of the operation.

2S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_CMK_ConvertMigration

4

4

3S

4

UINT32

outDataSize

The used size of the output area for outData

5

<>

4S

<>

BYTE[ ]

outData

The encrypted private key that can be loaded with TPM_LoadKey

6

20

2H1

20

TPM_NONCE

nonceEven

Even nonce newly generated by TPM to cover outputs

3H1

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

4H1

1

BOOL

continueAuthSession

Continue use flag, TRUE if handle is still active

TPM_AUTHDATA

resAuth

Authorization HMAC key .usageAuth

7

1

8

20

2179Action
21801. Validate the AuthData to use the key in parentHandle
21812. If the keyUsage field of the key referenced by parentHandle does not have the value
2182
TPM_KEY_STORAGE, the TPM must return the error code TPM_INVALID_KEYUSAGE
21833. Create d1 by decrypting the migratedKey -> encData area using the key in parentHandle
21844. Create o1 by XOR d1 and random parameter
21855. Create m1 a TPM_MIGRATE_ASYMKEY, seed and pHash by OAEP decoding o1
21866. Create migratedPubKey a TPM_PUBKEY structure corresponding to migratedKey
2187

a. Verify that pHash == SHA-1( SHA-1[msaList] || SHA-1(migratedPubKey )

21887. Create k1 by combining seed and the TPM_MIGRATE_ASYMKEY -> partPrivKey field
21898. Create d2 a TPM_STORE_ASYMKEY structure.
2190

a. Set the TPM_STORE_ASYMKEY -> privKey field to k1

2191

b. Set d2 -> usageAuth to m1 -> usageAuth

2192

c. Set d2 -> pubDataDigest to m1 -> pubDataDigest

21939. Verify that parentHandle-> keyFlags -> migratable == FALSE
219410.Verify that m1 -> payload == TPM_PT_CMK_MIGRATE then set d2-> payload =
2195
TPM_PT_MIGRATE_EXTERNAL
219611.Verify that for one of the n=1 to n=(msaList -> MSAlist) values of msaList ->
2197
migAuthDigest[n] sigTicket == HMAC (V1) using tpmProof as the secret where V1 is a
2198
TPM_CMK_SIGTICKET structure such that:
2199

a. V1 -> verKeyDigest = msaList -> migAuthDigest[n]

2200

b. V1 -> signedData = SHA-1[restrictTicket]

220112.Create parentPubKey, a TPM_PUBKEY structure corresponding to parentHandle
543
544

110

Level 2 Revision 116 28 February 2011
TCG Published

545TPM Main Part 3 Commands

TCG © Copyright

546Specification Version 1.2

220213.If [restrictTicket -> destinationKeyDigest] != SHA-1(parentPubKey), return error
2203
TPM_MA_DESTINATION
220414.Verify that migratedKey is corresponding to d2
220515.If migratedKey -> keyFlags
2206
TPM_INVALID_KEYUSAGE

->

migratable

220716.If migratedKey -> keyFlags
2208
TPM_INVALID_KEYUSAGE

->

migrateAuthority

220917.If [restrictTicket ->
2210
TPM_MA_SOURCE

sourceKeyDigest]

!=

is

FALSE,
is

and

return

error

FALSE,

return

error

return

error

SHA-1(migratedPubKey),

221118.Create M2 a TPM_CMK_MIGAUTH structure
2212

a. Set M2 -> msaDigest to SHA-1[msaList]

2213

b. Set M2 -> pubKeyDigest to SHA-1[migratedPubKey]

221419.Set d2 -> migrationAuth = HMAC(M2) using tpmProof as the secret
221520.Create outData using the key in parentHandle to perform the encryption

547Level 2 Revision 116 28 February 2011
548

111
TCG Published

549Copyright © TCG
550
551

221612.
Maintenance
2217Start of informative comment:

TPM Main Part 3 Commands
Specification Version 1.2

Functions (optional)

2218When a maintenance archive is created with generateRandom FALSE, the maintenance blob
2219is XOR encrypted with the owner authorization before encryption with the maintenance
2220public key. This prevents the manufacturer from obtaining plaintext data. The receiving
2221TPM must have the same owner authorization as the sending TPM in order to XOR decrypt
2222the archive.
2223When generateRandom is TRUE, the maintenance blob is XOR encrypted with random data,
2224which is also returned. This permits someone trusted by the Owner to load the
2225maintenance archive into the replacement platform in the absence of the Owner and
2226manufacturer, without the Owner having to reveal information about his auth value. The
2227receiving and sending TPM's may have different owner authorizations. The random data is
2228transferred from the sending TPM owner to the receiving TPM owner out of band, so the
2229maintenance blob remains hidden from the manufacturer.
2230This is a typical maintenance sequence:
22311. Manufacturer:
2232•

generates maintenance key pair

2233•

gives public key to TPM1 owner

22342. TPM1: TPM_LoadManuMaintPub
2235•

load maintenance public key

22363. TPM1: TPM_CreateMaintenanceArchive
2237•

XOR encrypt with owner auth or random

2238•

encrypt the maintenance archive with maintenance public key

22394. TPM2:
2240•

Take ownership

2241•

Create and activate an AIK

2242•

Certify the SRK with the AIK, proving that the SRK came from a legitimate TPM

22434. Manufacturer:
2244•

decrypt maintenance archive with maintenance private key

2245•

(still XOR encrypted with owner auth or random)

2246•

validate the TPM2 SRK certification

2247•

encrypt the maintenance archive with TPM2 SRK public key

22485. TPM2: TPM_LoadMaintenanceArchive
2249•

decrypt the maintenance archive with SRK private key

2250•

XOR decrypt with owner auth or random

2251End of informative comment.
552
553

112

Level 2 Revision 116 28 February 2011
TCG Published

554TPM Main Part 3 Commands

TCG © Copyright

555Specification Version 1.2

2252

556Level 2 Revision 116 28 February 2011
557

113
TCG Published

558Copyright © TCG
559
560

TPM Main Part 3 Commands
Specification Version 1.2

2253
225412.1

TPM_CreateMaintenanceArchive

2255Start of informative comment:
2256This command creates the maintenance archive. It can only be executed by the owner, and
2257may be shut off with the TPM_KillMaintenanceFeature command.
2258End of informative comment.
2259Incoming Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of input bytes including paramSize and tag

3

4

1S

4

TPM_COMMAND_CODE

ordinal

Cmd ordinal: TPM_ORD_CreateMaintenanceArchive

4

1

2S

1

BOOL

generateRandom

Use RNG or Owner auth to generate ‘random’.

5

4

TPM_AUTHHANDLE

authHandle

The authorization session handle used for owner authentication.

#

SZ

1

#

SZ

2H1

20

TPM_NONCE

authLastNonceEven

Even nonce previously generated by TPM to cover inputs

20

3H1

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

7

1

4H1

1

BOOL

continueAuthSession

The continue use flag for the authorization session handle

8

20

TPM_AUTHDATA

ownerAuth

HMAC key: ownerAuth.

6

2260Outgoing Operands and Sizes
PARAM

HMAC
#

Type

SZ

Name

Description

#

SZ

1

2

TPM_TAG

tag

TPM_TAG_RSP_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

1S

4

TPM_RESULT

returnCode

The return code of the operation.

2S

4

TPM_COMMAND_CODE

ordinal

Cmd ordinal: TPM_ORD_CreateMaintenanceArchive

4

4

3S

4

UINT32

randomSize

Size of the returned random data. Will be 0 if generateRandom is FALSE.

5

<>

4S

<>

BYTE [ ]

random

Random data to XOR with result.

6

4

5S

4

UINT32

archiveSize

Size of the encrypted archive

7

<>

6S

<>

BYTE [ ]

archive

Encrypted key archive.

8

20

2H1

20

TPM_NONCE

nonceEven

Even nonce newly generated by TPM to cover outputs

3H1

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

4H1

1

BOOL

continueAuthSession

Continue use flag, TRUE if handle is still active

TPM_AUTHDATA

resAuth

The authorization session digest for the returned parameters. HMAC key:
ownerAuth.

9

1

10

20

2261Actions
2262Upon authorization being confirmed this command does the following:
561
562

114

Level 2 Revision 116 28 February 2011
TCG Published

563TPM Main Part 3 Commands

TCG © Copyright

564Specification Version 1.2

22631. Validates that the TPM_PERMANENT_FLAGS -> allowMaintenance is TRUE. If it is
2264
FALSE, the TPM SHALL return TPM_DISABLED_CMD and exit this capability.
22652. Validates the TPM Owner AuthData.
22663. If the value of TPM_PERMANENT_DATA -> manuMaintPub is zero, the TPM MUST
2267
return the error code TPM_KEYNOTFOUND
22684. Build a1 a TPM_KEY structure using the SRK. The encData field is not a normal
2269
TPM_STORE_ASYMKEY structure but rather a TPM_MIGRATE_ASYMKEY structure built
2270
using the following actions.
22715. Build a TPM_STORE_PRIVKEY structure from the SRK. This privKey element should be
2272
132 bytes long for a 2K RSA key.
22736. Create k1 and k2 by splitting the privKey element created in step 4 into 2 parts. k1 is
2274
the first 20 bytes of privKey, k2 contains the remainder of privKey.
22757. Build m1 by creating and filling in a TPM_MIGRATE_ASYMKEY structure
2276

a. m1 -> usageAuth is set to TPM_PERMANENT_DATA -> tpmProof

2277

b. m1 -> pubDataDigest is set to the digest value of the SRK fields from step 4

2278

c. m1 -> payload is set to TPM_PT_MAINT

2279

d. m1 -> partPrivKey is set to k2

22808. Create o1 (which SHALL be 198 bytes for a 2048 bit RSA key) by performing the OAEP
2281
encoding of m using OAEP parameters of
2282

a. m = TPM_MIGRATE_ASYMKEY structure (step 7)

2283

b. pHash = TPM_PERMANENT_DATA -> ownerAuth

2284

c. seed = s1 = k1 (step 6)

22859. If generateRandom = TRUE
2286
2287

a. Create r1 by obtaining values from the TPM RNG. The size of r1 MUST be the same
size as o1. Set random parameter to r1

228810.If generateRandom = FALSE
2289
2290

a. Create r1 by applying MGF1 to the TPM Owner AuthData. The size of r1 MUST be the
same size as o1. Set randomSize to 0.

229111.Create x1 by XOR of o1 with r1
229212.Encrypt x1 with the manuMaintPub key using the TPM_ES_RSAESOAEP_SHA1_MGF1
2293
encryption scheme.
229413.Set a1 -> encData to the encryption of x1
229514.Set TPM_PERMANENT_FLAGS -> maintenanceDone to TRUE
229615.Return a1 in the archive parameter

565Level 2 Revision 116 28 February 2011
566

115
TCG Published

567Copyright © TCG
568
569

229712.2

TPM Main Part 3 Commands
Specification Version 1.2

TPM_LoadMaintenanceArchive

2298Start of informative comment:
2299This command loads in a Maintenance archive that has been massaged by the
2300manufacturer to load into another TPM.
2301If the maintenance archive was created using the owner authorization for XOR encryption,
2302the current owner authorization must be used for decryption. The owner authorization does
2303not change.
2304If the maintenance archive was created using random data for the XOR encryption, the
2305vendor specific arguments must include the random data. The owner authorization may
2306change.
2307End of informative comment.
2308Incoming Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of input bytes including paramSize and tag

3

4

1S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_LoadMaintenanceArchive

4

4

2S

4

UINT32

archiveSize

Sice of the encrypted archive

5

<>

3S

<>

BYTE[]

archive

Encrypted key archive

…

…

Vendor specific arguments

TPM_AUTHHANDLE

authHandle

The authorization session handle used for owner authentication.

20

TPM_NONCE

authLastNonceEven

Even nonce previously generated by TPM to cover inputs

#

SZ

1

-

#

SZ

4

-

20

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

-

1

1

BOOL

continueAuthSession

The continue use flag for the authorization session handle

--

20

TPM_AUTHDATA

ownerAuth

The authorization session digest for inputs and owner authentication.
HMAC key: ownerAuth.

2309

570
571

116

Level 2 Revision 116 28 February 2011
TCG Published

572TPM Main Part 3 Commands

TCG © Copyright

573Specification Version 1.2

2310Outgoing Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RSP_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

4

TPM_RESULT

returnCode

The return code of the operation.

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_LoadMaintenanceArchive

..

..

Vendor specific arguments

20

TPM_NONCE

nonceEven

Even nonce newly generated by TPM to cover outputs

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

1

BOOL

continueAuthSession

Continue use flag, TRUE if handle is still active

TPM_AUTHDATA

resAuth

The authorization session digest for the returned parameters. HMAC key:
ownerAuth, the original value and not the new auth value

#

SZ

1

-

#

SZ

20

-

1

-

20

2311Description
2312The maintenance mechanisms in the TPM MUST not require the TPM to hold a global
2313secret. The definition of global secret is a secret value shared by more than one TPM.
2314The TPME is not allowed to pre-store or use unique identifiers in the TPM for the purpose of
2315maintenance. The TPM MUST NOT use the endorsement key for identification or encryption
2316in the maintenance process. The maintenance process MAY use a TPM Identity to deliver
2317maintenance information to specific TPM’s.
2318The maintenance process can only change the SRK, tpmProof and TPM Owner AuthData
2319fields.
2320The maintenance process can only access data in shielded locations where this data is
2321necessary to validate the TPM Owner, validate the TPME and manipulate the blob
2322The TPM MUST be conformant to the TPM specification, protection profiles and security
2323targets after maintenance. The maintenance MAY NOT decrease the security values from
2324the original security target.
2325The security target used to evaluate this TPM MUST include this command in the TOE.
2326Actions
2327The TPM SHALL perform the following when executing the command
23281. Validate the TPM Owner’s AuthData
23292. Validate that the maintenance information was sent by the TPME. The validation
2330
mechanism MUST use a strength of function that is at least the same strength of
2331
function as a digital signature performed using a 2048 bit RSA key.
23323. The packet MUST contain m2 as defined in section 12.1.
23334. Ensure that only the target TPM can interpret the maintenance packet. The protection
2334
mechanism MUST use a strength of function that is at least the same strength of
2335
function as a digital signature performed using a 2048 bit RSA key.

574Level 2 Revision 116 28 February 2011
575

117
TCG Published

576Copyright © TCG
577
578

TPM Main Part 3 Commands
Specification Version 1.2

23365. Execute the actions of TPM_OwnerClear.
23376. Process the maintenance information
2338

a. Update the SRK

2339

i.

Set the SRK usageAuth to be the same as the source TPM owner's AuthData

2340

b. Update TPM_PERMANENT_DATA -> tpmProof

2341

c. Update TPM_PERMANENT_DATA -> ownerAuth

23427. Set TPM_PERMANENT_FLAGS -> maintenanceDone to TRUE
2343

579
580

118

Level 2 Revision 116 28 February 2011
TCG Published

581TPM Main Part 3 Commands

TCG © Copyright

582Specification Version 1.2

234412.3

TPM_KillMaintenanceFeature

2345Start of informative comment:
2346The TPM_KillMaintencanceFeature is a permanent action that prevents ANYONE from
2347creating a maintenance archive. This action, once taken, is permanent until a new TPM
2348Owner is set.
2349This action is to allow those customers who do not want the maintenance feature to not
2350allow the use of the maintenance feature.
2351At the discretion of the Owner, it should be possible to kill the maintenance feature in such
2352a way that the only way to recover maintainability of the platform would be to wipe out the
2353root keys. This feature is mandatory in any TPM that implements the maintenance feature.
2354End of informative comment.
2355Incoming Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of input bytes including paramSize and tag

3

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_KillMaintenanceFeature

4

4

TPM_AUTHHANDLE

authHandle

The authorization session handle used for owner authentication.

#

SZ

1

#

SZ

1S

4

2H1

20

TPM_NONCE

authLastNonceEven

Even nonce previously generated by TPM to cover inputs

5

20

3H1

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

6

1

4H1

1

BOOL

continueAuthSession

The continue use flag for the authorization session handle

7

20

TPM_AUTHDATA

ownerAuth

HMAC key: ownerAuth.

2356Outgoing Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RSP_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

#

SZ

1

#

SZ

5

1

6

TPM_RESULT

returnCode

The return code of the operation.

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_KillMaintenanceFeature

2H1

20

TPM_NONCE

nonceEven

Even nonce newly generated by TPM to cover outputs

3H1

20

4

2S
4

1S

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

4H1

1

BOOL

continueAuthSession

Continue use flag, TRUE if handle is still active

TPM_AUTHDATA

resAuth

HMAC key: ownerAuth.

20

2357Actions
23581. Validate the TPM Owner AuthData
23592. Set the TPM_PERMANENT_FLAGS.allowMaintenance flag to FALSE.
583Level 2 Revision 116 28 February 2011
584

119
TCG Published

585Copyright © TCG
586
587

236012.4

TPM Main Part 3 Commands
Specification Version 1.2

TPM_LoadManuMaintPub

2361Start of informative comment:
2362The TPM_LoadManuMaintPub command loads the manufacturer’s public key for use in the
2363maintenance process. The command installs manuMaintPub in PERMANENT data storage
2364inside a TPM. Maintenance enables duplication of non-migratory data in protected storage.
2365There is therefore a security hole if a platform is shipped before the maintenance public key
2366has been installed in a TPM.
2367The command is expected to be used before installation of a TPM Owner or any key in TPM
2368protected storage. It therefore does not use authorization.
2369End of informative comment.
2370Incoming Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_COMMAND

2

4

UINT32

paramSize

Total number of input bytes including paramSize and tag

3

4

1S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_LoadManuMaintPub

4

20

2S

20

TPM_NONCE

antiReplay

AntiReplay and validation nonce

5

<>

3S

<>

TPM_PUBKEY

pubKey

The public key of the manufacturer to be in use for maintenance

#

SZ

1

#

SZ

2371Outgoing Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RSP_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

#

SZ

1

#

SZ

20

4

TPM_RESULT

returnCode

The return code of the operation.

2S
4

1S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_LoadManuMaintPub

3S

20

TPM_DIGEST

checksum

Digest of pubKey and antiReplay

2372Description
2373The pubKey MUST specify an algorithm whose strength is not less than the RSA algorithm
2374with 2048bit keys.
2375pubKey SHOULD unambiguously identify the entity that will perform the maintenance
2376process with the TPM Owner.
2377TPM_PERMANENT_DATA -> manuMaintPub SHALL exist in a TPM-shielded location, only.
2378If an entity (Platform Entity) does not support the maintenance process but issues a
2379platform credential for a platform containing a TPM that supports the maintenance process,
2380the value of TPM_PERMANENT_DATA -> manuMaintPub MUST be set to zero before the
2381platform leaves the entity’s control. That is, this ordinal can only be run once, and used to
2382either load the key or load a NULL key.
588
589

120

Level 2 Revision 116 28 February 2011
TCG Published

590TPM Main Part 3 Commands

TCG © Copyright

591Specification Version 1.2

2383Actions
2384The first valid TPM_LoadManuMaintPub command received by a TPM SHALL
23851. Store the parameter pubKey as TPM_PERMANENT_DATA -> manuMaintPub.
23862. Set checksum to SHA-1 of (pubKey || antiReplay)
23873. Export the checksum
23884. Subsequent
calls
2389
TPM_DISABLED_CMD.

to

592Level 2 Revision 116 28 February 2011
593

TPM_LoadManuMaintPub

121
TCG Published

SHALL

return

code

594Copyright © TCG
595
596

239012.5

TPM Main Part 3 Commands
Specification Version 1.2

TPM_ReadManuMaintPub

2391Start of informative comment:
2392The TPM_ReadManuMaintPub command is used to check whether the manufacturer’s
2393public maintenance key in a TPM has the expected value. This may be useful during the
2394manufacture process. The command returns a digest of the installed key, rather than the
2395key itself. This hinders discovery of the maintenance key, which may (or may not) be useful
2396for manufacturer privacy.
2397The command is expected to be used before installation of a TPM Owner or any key in TPM
2398protected storage. It therefore does not use authorization.
2399End of Informative Comments
2400Incoming Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_COMMAND

2

4

UINT32

paramSize

Total number of input bytes including paramSize and tag

3

4

1S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_ReadManuMaintPub

4

20

2S

20

TPM_NONCE

antiReplay

AntiReplay and validation nonce

#

SZ

1

#

SZ

2401Outgoing Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RSP_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

#

SZ

1

#

SZ

20

4

TPM_RESULT

returnCode

The return code of the operation.

2S
4

1S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_ReadManuMaintPub

3S

20

TPM_DIGEST

checksum

Digest of pubKey and antiReplay

2402Description
2403This command returns the hash of the antiReplay nonce and the previously loaded
2404manufacturer’s maintenance public key.
2405Actions
2406The TPM_ReadManuMaintPub command SHALL
24071. Create “checksum” by concatenating data to form (TPM_PERMANENT_DATA ->
2408
manuMaintPub ||antiReplay) and passing the concatenated data through SHA-1.
24092. Export the checksum

597
598

122

Level 2 Revision 116 28 February 2011
TCG Published

599TPM Main Part 3 Commands

TCG © Copyright

600Specification Version 1.2

241013.

Cryptographic Functions

241113.1

TPM_SHA1Start

2412Start of informative comment:
2413This capability starts the process of calculating a SHA-1 digest.
2414The exposure of the SHA-1 processing is a convenience to platforms in a mode that do not
2415have sufficient memory to perform SHA-1 themselves. As such, the use of SHA-1 is
2416restrictive on the TPM.
2417The TPM may not allow any other types of processing during the execution of a SHA-1
2418session. There is only one SHA-1 session active on a TPM. The exclusivity of a SHA-1
2419context is due to the relatively large volatile buffer it requires in order to hold the
2420intermediate results between the SHA-1 context commands. This buffer can be in
2421contradiction to other command needs.
2422After the execution of TPM_SHA1Start, and prior to TPM_SHA1Complete or
2423TPM_SHA1CompleteExtend, the receipt of any command other than TPM_SHA1Update will
2424cause the invalidation of the SHA-1 session.
2425End of informative comment.
2426Incoming Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_COMMAND

2

4

UINT32

paramSize

Total number of input bytes including paramSize and tag

3

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_SHA1Start

Type

Name

Description

#

SZ

1

#

SZ

1S

4

2427Outgoing Operands and Sizes
PARAM

HMAC

#

SZ

#

SZ

1

2

TPM_TAG

tag

TPM_TAG_RSP_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

4

4

TPM_RESULT

returnCode

The return code of the operation.

2S
4

1S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_SHA1Start

3S

4

UINT32

maxNumBytes

Maximum number of bytes that can be sent to TPM_SHA1Update. Must be a
multiple of 64 bytes.

2428Description
24291. This capability prepares the TPM for a subsequent TPM_SHA1Update,
2430
TPM_SHA1Complete or TPM_SHA1CompleteExtend command. The capability SHALL
2431
open a thread that calculates a SHA-1 digest.

601Level 2 Revision 116 28 February 2011
602

123
TCG Published

603Copyright © TCG
604
605

TPM Main Part 3 Commands
Specification Version 1.2

24322. After receipt of TPM_SHA1Start, and prior to the receipt of TPM_SHA1Complete or
2433
TPM_SHA1CompleteExtend, receipt of any command other than TPM_SHA1Update
2434
invalidates the SHA-1 session.
2435
2436

a. If the command received is TPM_ExecuteTransport, the SHA-1 session invalidation is
based on the wrapped command, not the TPM_ExecuteTransport ordinal.

2437
2438

b. A SHA-1 thread (start, update, complete) MUST take place either completely outside
a transport session or completely within a single transport session.

606
607

124

Level 2 Revision 116 28 February 2011
TCG Published

608TPM Main Part 3 Commands

TCG © Copyright

609Specification Version 1.2

243913.2

TPM_SHA1Update

2440Start of informative comment:
2441This capability inputs complete blocks of data into a pending SHA-1 digest. At the end of
2442the process, the digest remains pending.
2443End of informative comment.
2444Incoming Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_COMMAND

2

4

UINT32

paramSize

Total number of input bytes including paramSize and tag

3

4

1S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_SHA1Update

4

4

2S

4

UINT32

numBytes

The number of bytes in hashData. Must be a multiple of 64 bytes.

5

<>

3S

<>

BYTE [ ]

hashData

Bytes to be hashed

Type

Name

Description

#

SZ

1

#

SZ

2445Outgoing Operands and Sizes
PARAM

HMAC

#

SZ

#

SZ

1

2

TPM_TAG

tag

TPM_TAG_RSP_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

1S

4

TPM_RESULT

returnCode

The return code of the operation.

2S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_SHA1Update

2446Description
2447This command SHALL incorporate complete blocks of data into the digest of an existing
2448SHA-1 thread. Only integral numbers of complete blocks (64 bytes each) can be processed.
2449Actions
24501. If there is no existing SHA-1 thread, return TPM_SHA_THREAD
24512. If numBytes is not a multiple of 64
2452

a. Return TPM_SHA_ERROR

2453

b. The TPM MAY terminate the SHA-1 thread

24543. If numBytes is greater than maxNumBytes returned by TPM_SHA1Start
2455

a. Return TPM_SHA_ERROR

2456

b. The TPM MAY terminate the SHA-1 thread

24574. Incorporate hashData into the digest of the existing SHA-1 thread.
2458

610Level 2 Revision 116 28 February 2011
611

125
TCG Published

612Copyright © TCG
613
614

245913.3

TPM Main Part 3 Commands
Specification Version 1.2

TPM_SHA1Complete

2460Start of informative comment:
2461This capability terminates a pending SHA-1 calculation.
2462End of informative comment.
2463Incoming Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_COMMAND

2

4

UINT32

paramSize

Total number of input bytes including paramSize and tag

3

4

1S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_SHA1Complete

4

4

2S

4

UINT32

hashDataSize

Number of bytes in hashData, MUST be 64 or less

5

<>

3S

<>

BYTE [ ]

hashData

Final bytes to be hashed

Type

Name

Description

#

SZ

1

#

SZ

2464Outgoing Operands and Sizes
PARAM

HMAC

#

SZ

#

SZ

1

2

TPM_TAG

tag

TPM_TAG_RSP_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

20

4

TPM_RESULT

returnCode

The return code of the operation.

2S
4

1S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_SHA1Complete

3S

20

TPM_DIGEST

hashValue

The output of the SHA-1 hash.

2465Description
2466This command SHALL incorporate a partial or complete block of data into the digest of an
2467existing SHA-1 thread, and terminate that thread. hashDataSize MAY have values in the
2468range of 0 through 64, inclusive.
2469If the SHA-1 thread has received no bytes the TPM SHALL calculate the SHA-1 of the empty
2470buffer.

615
616

126

Level 2 Revision 116 28 February 2011
TCG Published

617TPM Main Part 3 Commands

TCG © Copyright

618Specification Version 1.2

247113.4

TPM_SHA1CompleteExtend

2472Start of informative comment:
2473This capability terminates a pending SHA-1 calculation and EXTENDS the result into a
2474Platform Configuration Register using a SHA-1 hash process.
2475This command is designed to complete a hash sequence and extend a PCR in memory-less
2476environments.
2477End of informative comment.
2478Incoming Operands and Sizes
PARAM

HMAC

Type

Name

Description

TPM_TAG

tag

TPM_TAG_RQU_COMMAND

UINT32

paramSize

Total number of input bytes including paramSize and tag

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_SHA1CompleteExtend

4

TPM_PCRINDEX

pcrNum

Index of the PCR to be modified

3S

4

UINT32

hashDataSize

Number of bytes in hashData, MUST be 64 or less

4S

<>

BYTE [ ]

hashData

Final bytes to be hashed

Type

Name

Description

#

SZ

#

SZ

1

2

2

4

3

4

1S

4

4

4

2S

5

4

6

<>

2479Outgoing Operands and Sizes
PARAM

HMAC

#

SZ

#

SZ

1

2

TPM_TAG

tag

TPM_TAG_RSP_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

1S

4

TPM_RESULT

returnCode

The return code of the operation.

2S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_SHA1CompleteExtend

4

20

3S

20

TPM_DIGEST

hashValue

The output of the SHA-1 hash.

5

20

4S

20

TPM_PCRVALUE

outDigest

The PCR value after execution of the command.

2480Description
2481This command SHALL incorporate a partial or complete block of data into the digest of an
2482existing SHA-1 thread, EXTEND the resultant digest into a PCR, and terminate the SHA-1
2483session. hashDataSize MAY have values in the range of 0 through 64, inclusive.
2484The SHA-1 session MUST terminate even if the command returns an error, e.g.
2485TPM_BAD_LOCALITY.
2486Actions
24875. Validate that pcrNum represents a legal PCR number. On error, return TPM_BADINDEX.
24886. Map V1 to TPM_STANY_DATA
24897. Map L1 to V1 -> localityModifier
619Level 2 Revision 116 28 February 2011
620

127
TCG Published

621Copyright © TCG
622
623

TPM Main Part 3 Commands
Specification Version 1.2

24908. If the current locality, held in L1, is not selected in TPM_PERMANENT_DATA -> pcrAttrib
2491
[pcrNum]. pcrExtendLocal, return TPM_BAD_LOCALITY
24929. Create H1 the TPM_DIGEST of the SHA-1 session ensuring that hashData, if any, is
2493
added to the SHA-1 session
249410.Perform the actions of TPM_Extend using H1 as the data and pcrNum as the PCR to
2495
extend

624
625

128

Level 2 Revision 116 28 February 2011
TCG Published

626TPM Main Part 3 Commands

TCG © Copyright

627Specification Version 1.2

249613.5

TPM_Sign

2497Start of informative comment:
2498The Sign command signs data and returns the resulting digital signature.
2499The TPM does not allow TPM_Sign with a TPM_KEY_IDENTITY (AIK) because TPM_Sign can
2500sign arbitrary data and could be used to fake a quote. (This could have been relaxed to
2501allow TPM_Sign with an AIK if the signature scheme is _INFO For an _INFO key, the
2502metadata prevents TPM_Sign from faking a quote.)
2503End of informative comment.
2504Incoming Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of input bytes including paramSize and tag

3

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_Sign.

4

4

TPM_KEY_HANDLE

keyHandle

The keyHandle identifier of a loaded key that can perform digital
signatures.

5

4

2s

4

UINT32

areaToSignSize

The size of the areaToSign parameter

6

<>

3s

<>

BYTE[]

areaToSign

The value to sign

7

4

TPM_AUTHHANDLE

authHandle

The authorization session handle used for keyHandle authorization

#

SZ

1

#

SZ

1S

4

2H1

20

TPM_NONCE

authLastNonceEven

Even nonce previously generated by TPM to cover inputs

8

20

3H1

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

9

1

4H1

1

BOOL

continueAuthSession

The continue use flag for the authorization session handle

10

20

TPM_AUTHDATA

privAuth

The authorization session digest that authorizes the use of keyHandle.
HMAC key: key.usageAuth

Type

Name

Description

2505Outgoing Operands and Sizes
PARAM

HMAC

#

SZ

#

SZ

1

2

TPM_TAG

tag

TPM_TAG_RSP_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

1S

4

TPM_RESULT

returnCode

The return code of the operation.

2S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_Sign.

4

4

3S

4

UINT32

sigSize

The length of the returned digital signature

5

<>

4S

<>

BYTE[ ]

sig

The resulting digital signature.

6

20

2H1

20

TPM_NONCE

nonceEven

Even nonce newly generated by TPM to cover outputs

3H1

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

4H1

1

BOOL

continueAuthSession

Continue use flag, TRUE if handle is still active

TPM_AUTHDATA

resAuth

The authorization session digest for the returned parameters. HMAC key:
key.usageAuth

7

1

8

20

628Level 2 Revision 116 28 February 2011
629

129
TCG Published

630Copyright © TCG
631
632

TPM Main Part 3 Commands
Specification Version 1.2

2506Description
2507The TPM MUST support all values of areaToSignSize that are legal for the defined signature
2508scheme and key size. The maximum value of areaToSignSize is determined by the defined
2509signature scheme and key size.
2510In the case of PKCS1v15_SHA1 the areaToSignSize MUST be TPM_DIGEST (the hash size of
2511a SHA-1 operation - see 8.5.1 TPM_SS_RSASSAPKCS1v15_SHA1). In the case of
2512PKCS1v15_DER the maximum size of areaToSign is k-11 octets, where k is limited by the
2513key size (see TPM_SS_RSASSAPKCS1v15_DER).
2514Actions
25151. The TPM validates the AuthData to use the key pointed to by keyHandle.
25162. If the areaToSignSize is 0 the TPM returns TPM_BAD_PARAMETER.
25173. Validate that keyHandle -> keyUsage is TPM_KEY_SIGNING or TPM_KEY_LEGACY, if not
2518
return the error code TPM_INVALID_KEYUSAGE
25194. The TPM verifies that the signature scheme and key size can properly sign the
2520
areaToSign parameter.
25215. If signature scheme is TPM_SS_RSASSAPKCS1v15_SHA1 then
2522

a. Validate that areaToSignSize is 20 return TPM_BAD_PARAMETER on error

2523

b. Set S1 to areaToSign

25246. Else if signature scheme is TPM_SS_RSASSAPKCS1v15_DER then
2525
2526

a. Validate that areaToSignSize is at least 11 bytes less than the key size, return
TPM_BAD_PARAMETER on error

2527

b. Set S1 to areaToSign

25287. else if signature scheme is TPM_SS_RSASSAPKCS1v15_INFO then
2529

a. Create S2 a TPM_SIGN_INFO structure

2530

b. Set S2 -> fixed to “SIGN”

2531

c. Set S2 -> replay to nonceOdd

2532
2533

i. If nonceOdd is not present due to an unauthorized command return
TPM_BAD_PARAMETER

2534

d. Set S2 -> dataLen to areaToSignSize

2535

e. Set S2 -> data to areaToSign

2536

f. Set S1 to the SHA-1(S2)

25378. Else return TPM_INVALID_KEYUSAGE
25389. The TPM computes the signature, sig, using the key referenced by keyHandle using S1
2539
as the value to sign
254010.Return the computed signature in Sig

633
634

130

Level 2 Revision 116 28 February 2011
TCG Published

635TPM Main Part 3 Commands

TCG © Copyright

636Specification Version 1.2

254113.6

TPM_GetRandom

2542Start of informative comment:
2543TPM_GetRandom returns the next bytesRequested bytes from the random number
2544generator to the caller.
2545It is recommended that a TPM implement the RNG in a manner that would allow it to return
2546RNG bytes such that the frequency of bytesRequested being more than the number of bytes
2547available is an infrequent occurrence.
2548End of informative comment.
2549Incoming Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_COMMAND

2

4

UINT32

paramSize

Total number of input bytes including paramSize and tag

3

4

1S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_GetRandom.

4

4

2S

4

UINT32

bytesRequested

Number of bytes to return

#

SZ

1

#

SZ

2550Outgoing Operands and Sizes
PARAM
#

SZ

1

4

3

4

#

SZ

Type

Name

Description

TPM_TAG

2

2

HMAC

tag

TPM_TAG_RSP_COMMAND

UINT32

paramSize

Total number of output bytes including paramSize and tag

1S

4

TPM_RESULT

returnCode

The return code of the operation.

2S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_GetRandom.

4

4

3S

4

UINT32

randomBytesSize

The number of bytes returned

5

<>

4S

<>

BYTE[ ]

randomBytes

The returned bytes

2551Actions
25521. The TPM determines if amount bytesRequested is available from the TPM.
25532. Set randomBytesSize to the number of bytes available from the RNG. This number MAY
2554
be less than bytesRequested.
25553. Set randomBytes to the next randomBytesSize bytes from the RNG

637Level 2 Revision 116 28 February 2011
638

131
TCG Published

639Copyright © TCG
640
641

255613.7

TPM Main Part 3 Commands
Specification Version 1.2

TPM_StirRandom

2557Start of informative comment:
2558TPM_StirRandom adds entropy to the RNG state.
2559End of informative comment.
2560Incoming Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_COMMAND

2

4

UINT32

paramSize

Total number of input bytes including paramSize and tag

3

4

1S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_StirRandom

4

4

2S

4

UINT32

dataSize

Number of bytes of input

5

<>

3S

<>

BYTE[ ]

inData

Data to add entropy to RNG state

Type

Name

Description

#

SZ

1

#

SZ

2561Outgoing Operands and Sizes
PARAM

HMAC

#

SZ

#

SZ

1

2

TPM_TAG

tag

TPM_TAG_RSP_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

1S

4

TPM_RESULT

returnCode

The return code of the operation.

2S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_StirRandom

2562Actions
25631. If dataSize is not less than 256 bytes, the TPM MAY return TPM_BAD_PARAMETER.
25642. The TPM updates the state of the current RNG using the appropriate mixing function.

642
643

132

Level 2 Revision 116 28 February 2011
TCG Published

644TPM Main Part 3 Commands

TCG © Copyright

645Specification Version 1.2

256513.8

TPM_CertifyKey

2566Start of informative comment:
2567The TPM_CertifyKey operation allows one key to certify the public portion of another key.
2568A TPM identity key may be used to certify non-migratable keys but is not permitted to
2569certify migratory keys or certified migration keys. As such, it allows the TPM to make the
2570statement “this key is held in a TPM-shielded location, and it will never be revealed.” For
2571this statement to have veracity, the Challenger must trust the policies used by the entity
2572that issued the identity and the maintenance policy of the TPM manufacturer.
2573Signing and legacy keys may be used to certify both migratable and non-migratable keys.
2574Then the usefulness of a certificate depends on the trust in the certifying key by the
2575recipient of the certificate.
2576The key to be certified must be loaded before TPM_CertifyKey is called.
2577The determination to use the TPM_CERTIFY_INFO or TPM_CERTIFY_INFO2 on the output is
2578based on which PCRs and what localities the certified key is restricted to. A key to be
2579certified that does not have locality restrictions and which uses no PCRs greater than PCR
2580#15 will cause this command to return and sign a TPM_CERTIFY_INFO structure, which
2581provides compatibility with V1.1 TPMs.
2582When this command is run to certify all other keys (those that use PCR #16 or higher, as
2583well as those limited by locality in any way), it will return and sign a TPM_CERTIFY_INFO2
2584structure.
2585TPM_CertifyKey does not support the case where (a) the certifying key requires a usage
2586authorization to be provided but (b) the key-to-be-certified does not. In such cases,
2587TPM_CertifyKey2 must be used. TPM_CertifyKey cannot be used to certify CMKs.
2588If a command tag (in the parameter array) specifies only one authorisation session, then the
2589TPM convention is that the first session listed is ignored (authDataUsage must be
2590TPM_AUTH_NEVER for this key) and the incoming session data is used for the second auth
2591session in the list. In TPM_CertifyKey, the first session is the certifying key and the second
2592session is the key-to-be-certified. In TPM_CertifyKey2, the first session is the key-to-be2593certified and the second session is the certifying key.
2594The key handles of both the certifying key and the key to be certified are not included in the
2595HMAC protecting the command. This permits key handle virtualization (swapping of keys
2596in and out of the TPM that results in different key handles while at the same time
2597maintaining key identifiers of upper layer software). In environments where the interface to
2598the TPM is accessible by other parties, the key handles not being protected allows an
2599attacker to change the handle of the key to be certified. This can be avoided by processing
2600this command within a transport session and making sure that antiReplay indeed contains
2601a nonce.
2602End of informative comment.

646Level 2 Revision 116 28 February 2011
647

133
TCG Published

648Copyright © TCG
649
650

TPM Main Part 3 Commands
Specification Version 1.2

2603Incoming Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_AUTH2_COMMAND

2

4

UINT32

paramSize

Total number of input bytes including paramSize and tag

3

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_CertifyKey

4

4

TPM_KEY_HANDLE

certHandle

Handle of the key to be used to certify the key.

5

4

TPM_KEY_HANDLE

keyHandle

Handle of the key to be certified.

6

20

TPM_NONCE

antiReplay

160 bits of externally supplied data (typically a nonce provided to
prevent replay-attacks)

7

4

TPM_AUTHHANDLE

certAuthHandle

The authorization session handle used for certHandle.

#

SZ

1

#

1S

2S

SZ

4

20

2H1

20

TPM_NONCE

authLastNonceEven

Even nonce previously generated by TPM to cover inputs

8

20

3H1

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with certAuthHandle

9

1

4H1

1

BOOL

continueAuthSession

The continue use flag for the authorization session handle

10

20

TPM_AUTHDATA

certAuth

The authorization session digest for inputs and certHandle. HMAC key:
certKey.auth.

11

4

TPM_AUTHHANDLE

keyAuthHandle

The authorization session handle used for the key to be signed.

2H2

20

TPM_NONCE

keylastNonceEven

Even nonce previously generated by TPM

12

3H2

20

TPM_NONCE

keynonceOdd

Nonce generated by system associated with keyAuthHandle

13

1

4H2

1

BOOL

continueKeySession

The continue use flag for the authorization session handle

14

651
652

20

20

TPM_AUTHDATA

keyAuth

The authorization session digest for the inputs and key to be signed.
HMAC key: key.usageAuth.

134

Level 2 Revision 116 28 February 2011
TCG Published

653TPM Main Part 3 Commands

TCG © Copyright

654Specification Version 1.2

2604Outgoing Operands and Sizes
Param

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RSP_AUTH2_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

#

Sz

1

#

Sz

1S

4

TPM_RESULT

returnCode

The return code of the operation.

2S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_CertifyKey

4

<>

3S

<>

TPM_CERTIFY_INFO

certifyInfo

TPM_CERTIFY_INFO or TPM_CERTIFY_INFO2 structure that
provides information relative to keyhandle

5

4

4S

4

UINT32

outDataSize

The used size of the output area for outData

6

<>

5S

<>

BYTE[ ]

outData

The signature of certifyInfo

7

20

2H1

20

TPM_NONCE

nonceEven

Even nonce newly generated by TPM

3H1

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with certAuthHandle

4H1

1

BOOL

continueAuthSession

Continue use flag for cert key session

20

TPM_AUTHDATA

resAuth

The authorization session digest for the returned parameters and
parentHandle. HMAC key: certKey -> auth.

2H2

20

TPM_NONCE

keyNonceEven

Even nonce newly generated by TPM

3H2

20

TPM_NONCE

keynonceOdd

Nonce generated by system associated with keyAuthHandle

4H2

1

BOOL

continueKeySession

Continue use flag for target key session

TPM_AUTHDATA

keyAuth

The authorization session digest for the target key. HMAC key:
key.auth.

8

1

9

20

10

20

11

1

12

20

2605Actions
26061. The TPM validates that the key pointed to by certHandle has a signature scheme of
2607
TPM_SS_RSASSAPKCS1v15_SHA1 or TPM_SS_RSASSAPKCS1v15_INFO
26082. Verify command and key AuthData values:
2609

a. If tag is TPM_TAG_RQU_AUTH2_COMMAND

2610
2611

i. The TPM verifies the AuthData in certAuthHandle provides authorization to
use the key pointed to by certHandle, return TPM_AUTHFAIL on error

2612
2613

ii. The TPM verifies the AuthData in keyAuthHandle provides authorization to
use the key pointed to by keyHandle, return TPM_AUTH2FAIL on error

2614

b. else if tag is TPM_TAG_RQU_AUTH1_COMMAND

2615
2616

i. Verify that authDataUsage is TPM_AUTH_NEVER for the key referenced by
certHandle, return TPM_AUTHFAIL on error.

2617
2618

ii. The TPM verifies the AuthData in keyAuthHandle provides authorization to
use the key pointed to by keyHandle, return TPM_AUTHFAIL on error

2619
2620
2621

c. else if tag is TPM_TAG_RQU_COMMAND
i. Verify that authDataUsage is TPM_AUTH_NEVER for the key referenced by
certHandle, return TPM_AUTHFAIL on error.

655Level 2 Revision 116 28 February 2011
656

135
TCG Published

657Copyright © TCG
658
659

2622
2623
2624

TPM Main Part 3 Commands
Specification Version 1.2

ii. Verify
that
authDataUsage
is
TPM_AUTH_NEVER
or
TPM_NO_READ_PUBKEY_AUTH for the key referenced by keyHandle, return
TPM_AUTHFAIL on error.

26253. If keyHandle -> payload is not TPM_PT_ASYM, return TPM_INVALID_KEYUSAGE.
26264. If the key pointed to by certHandle is an identity key (certHandle -> keyUsage is
2627
TPM_KEY_IDENTITY)
2628

a. If keyHandle -> keyFlags -> migratable is TRUE return TPM_MIGRATEFAIL

26295. Validate that certHandle -> keyUsage is TPM_KEY_SIGN, TPM_KEY_IDENTITY or
2630
TPM_KEY_LEGACY, if not return TPM_INVALID_KEYUSAGE
26316. Validate that keyHandle -> keyUsage is TPM_KEY_SIGN, TPM_KEY_STORAGE,
2632
TPM_KEY_IDENTITY,
TPM_KEY_BIND
or
TPM_KEY_LEGACY,
if
not
return
2633
TPM_INVALID_KEYUSAGE
26347. If keyHandle -> digestAtRelease requires the use of PCRs 16 or higher to calculate or if
2635
keyHandle -> localityAtRelease is not 0x1F
2636

a. Set V1 to 1.2

26378. Else
2638

a. Set V1 to 1.1

26399. If keyHandle -> pcrInfoSize is not 0
2640

a. If keyHandle -> keyFlags has pcrIgnoredOnRead set to FALSE

2641
2642
2643

i. Create a digestAtRelease according to the specified TPM_STCLEAR_DATA ->
PCR registers and compare to keyHandle -> digestAtRelease and if a mismatch
return TPM_WRONGPCRVAL

2644

ii. If specified validate any locality requests on error TPM_BAD_LOCALITY

2645

b. If V1 is 1.1

2646

i.

2647

ii. Fill in C1 with the information from the key pointed to by keyHandle

2648

iii. The TPM MUST set c1 -> pcrInfoSize to 44.

2649
2650

iv. The TPM MUST set c1 -> pcrInfo to a TPM_PCR_INFO structure properly filled
out using the information from keyHandle.

2651

v. The TPM MUST set c1 -> digestAtCreation to 20 bytes of 0x00.

Create C1 a TPM_CERTIFY_INFO structure

2652

c. Else

2653

i.

2654

ii. Fill in C1 with the information from the key pointed to by keyHandle

2655
2656

iii. Set C1 -> pcrInfoSize to the size of an appropriate TPM_PCR_INFO_SHORT
structure.

2657
2658

iv. Set C1 -> pcrInfo to a properly filled out TPM_PCR_INFO_SHORT structure,
using the information from keyHandle.

2659

v. Set C1 -> migrationAuthoritySize to 0

660
661

Create C1 a TPM_CERTIFY_INFO2 structure

136

Level 2 Revision 116 28 February 2011
TCG Published

662TPM Main Part 3 Commands

TCG © Copyright

663Specification Version 1.2

266010.Else
2661

a. Create C1 a TPM_CERTIFY_INFO structure

2662

b. Fill in C1 with the information from the key pointed to by keyHandle

2663

c. The TPM MUST set c1 -> pcrInfoSize to 0

266411.Create TPM_DIGEST H1 which is the SHA-1 hash of keyHandle -> pubKey -> key. Note
2665
that <key> is the actual public modulus, and does not include any structure formatting.
266612.Set C1 -> pubKeyDigest to H1
266713.The TPM copies the antiReplay parameter to c1 -> data.
266814.The TPM sets certifyInfo to C1.
266915.The TPM creates m1, a message digest formed by taking the SHA-1 of c1.
2670
2671

a. The TPM then computes a signature using certHandle -> sigScheme. The resulting
signed blob is returned in outData.

664Level 2 Revision 116 28 February 2011
665

137
TCG Published

666Copyright © TCG
667
668

267213.9

TPM Main Part 3 Commands
Specification Version 1.2

TPM_CertifyKey2

2673Start of informative comment:
2674This command is based on TPM_CertifyKey, but includes the ability to certify a Certifiable
2675Migration Key (CMK), which requires extra input parameters.
2676TPM_CertifyKey2 always produces a TPM_CERTIFY_INFO2 structure.
2677TPM_CertifyKey2 does not support the case where (a) the key-to-be-certified requires a
2678usage authorization to be provided but (b) the certifying key does not.
2679If a command tag (in the parameter array) specifies only one authorisation session, then the
2680TPM convention is that the first session listed is ignored (authDataUsage must be
2681TPM_NO_READ_PUBKEY_AUTH or TPM_AUTH_NEVER for this key) and the incoming
2682session data is used for the second auth session in the list. In TPM_CertifyKey2, the first
2683session is the key to be certified and the second session is the certifying key.
2684The key handles of both the certifying key and the key to be certified are not included in the
2685HMAC protecting the command. This permits key handle virtualization (swapping of keys
2686in and out of the TPM that results in different key handles while at the same time
2687maintaining key identifiers of upper layer software). In environments where the interface to
2688the TPM is accessible by other parties, the key handles not being protected allows an
2689attacker to change the handle of the key to be certified. This can be avoided by processing
2690this command within a transport session and making sure that antiReplay indeed contains
2691a nonce.
2692End of informative comment.
2693Incoming Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_AUTH2_COMMAND

2

4

UINT32

paramSize

Total number of input bytes including paramSize and tag

3

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_CertifyKey2

4

4

TPM_KEY_HANDLE

keyHandle

Handle of the key to be certified.

5

4

TPM_KEY_HANDLE

certHandle

Handle of the key to be used to certify the key.

6

20

2S

20

TPM_DIGEST

migrationPubDigest

The digest of a TPM_MSA_COMPOSITE structure, containing at least
one public key of a Migration Authority

7

20

3S

20

TPM_NONCE

antiReplay

160 bits of externally supplied data (typically a nonce provided to
prevent replay-attacks)

8

4

TPM_AUTHHANDLE

keyAuthHandle

The authorization session handle used for the key to be signed.

#

SZ

1

#

1S

SZ

4

2H1

20

TPM_NONCE

keylastNonceEven

Even nonce previously generated by TPM

9

20

3H1

20

TPM_NONCE

keynonceOdd

Nonce generated by system associated with keyAuthHandle

10

1

4H1

1

BOOL

continueKeySession

The continue use flag for the authorization session handle

11

20

TPM_AUTHDATA

keyAuth

The authorization session digest for the inputs and key to be signed.
HMAC key: key.usageAuth.

12

4

TPM_AUTHHANDLE

certAuthHandle

The authorization session handle used for certHandle.

TPM_NONCE

authLastNonceEven

Even nonce previously generated by TPM to cover inputs

2H2

669
670

20

138

Level 2 Revision 116 28 February 2011
TCG Published

671TPM Main Part 3 Commands

TCG © Copyright

672Specification Version 1.2
13

20

3H2

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with certAuthHandle

14

1

4H2

1

BOOL

continueAuthSession

The continue use flag for the authorization session handle

15

20

TPM_AUTHDATA

certAuth

Authorization HMAC key: certKey.auth.

673Level 2 Revision 116 28 February 2011
674

139
TCG Published

675Copyright © TCG
676
677

TPM Main Part 3 Commands
Specification Version 1.2

2694Outgoing Operands and Sizes
Param

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RSP_AUTH2_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

#

Sz

1

#

Sz

1S

4

TPM_RESULT

returnCode

The return code of the operation.

2S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_CertifyKey2

4

<>

3S

<>

TPM_CERTIFY_INFO2

certifyInfo

TPM_CERTIFY_INFO2 relative to keyHandle

5

4

4S

4

UINT32

outDataSize

The used size of the output area for outData

6

<>

5S

<>

BYTE[ ]

outData

The signed public key.

7

20

2H1

20

TPM_NONCE

keyNonceEven

Even nonce newly generated by TPM

3H1

20

TPM_NONCE

keyNonceOdd

Nonce generated by system associated with certAuthHandle

4H1

1

BOOL

keyContinueAuthSession

Continue use flag for cert key session

20

TPM_AUTHDATA

keyResAuth

Authorization HMAC key: keyHandle -> auth.

2H2

20

TPM_NONCE

certNonceEven

Even nonce newly generated by TPM

3H2

20

TPM_NONCE

AuthLastNonceOdd

Nonce generated by system associated with certAuthHandle

1

BOOL

CertContinueAuthSession

Continue use flag for cert key session

20

TPM_AUTHDATA

certResAuth

Authorization HMAC key: certHandle -> auth.

8

1

9

20

10

20

11

1

12

20

4H2

2695Actions
26961. The TPM validates that the key pointed to by certHandle has a signature scheme of
2697
TPM_SS_RSASSAPKCS1v15_SHA1 or TPM_SS_RSASSAPKCS1v15_INFO
26982. Verify command and key AuthData values:
2699

a. If tag is TPM_TAG_RQU_AUTH2_COMMAND

2700
2701

i. The TPM verifies the AuthData in keyAuthHandle provides authorization to
use the key pointed to by keyHandle, return TPM_AUTHFAIL on error

2702
2703

ii. The TPM verifies the AuthData in certAuthHandle provides authorization to
use the key pointed to by certHandle, return TPM_AUTH2FAIL on error

2704

b. else if tag is TPM_TAG_RQU_AUTH1_COMMAND

2705
2706
2707

i. Verify
that
authDataUsage
is
TPM_AUTH_NEVER
or
TPM_NO_READ_PUBKEY_AUTH for the key referenced by keyHandle, return
TPM_AUTHFAIL on error

2708
2709

ii. The TPM verifies the AuthData in certAuthHandle provides authorization to
use the key pointed to by certHandle, return TPM_AUTH2FAIL on error

2710

c. else if tag is TPM_TAG_RQU_COMMAND

2711
2712
2713

678
679

i. Verify
that
authDataUsage
is
TPM_AUTH_NEVER
or
TPM_NO_READ_PUBKEY_AUTH for the key referenced by keyHandle, return
TPM_AUTHFAIL on error

140

Level 2 Revision 116 28 February 2011
TCG Published

680TPM Main Part 3 Commands

TCG © Copyright

681Specification Version 1.2

2714
2715

ii. Verify that authDataUsage is TPM_AUTH_NEVER for the key referenced by
certHandle, return TPM_AUTHFAIL on error.

27163. If the key pointed to by certHandle is an identity key (certHandle -> keyUsage is
2717
TPM_KEY_IDENTITY)
2718
2719
2720
2721

a. If keyHandle -> keyFlags -> migratable is TRUE and [keyHandle -> keyFlags->
migrateAuthority is FALSE or (keyHandle -> payload != TPM_PT_MIGRATE_RESTRICTED
and
keyHandle
->
payload
!=
TPM_PT_MIGRATE_EXTERNAL)]
return
TPM_MIGRATEFAIL

27224. Validate that certHandle -> keyUsage is TPM_KEY_SIGNING, TPM_KEY_IDENTITY or
2723
TPM_KEY_LEGACY, if not return TPM_INVALID_KEYUSAGE
27245. Validate that keyHandle -> keyUsage is TPM_KEY_SIGNING, TPM_KEY_STORAGE,
2725
TPM_KEY_IDENTITY,
TPM_KEY_BIND
or
TPM_KEY_LEGACY,
if
not
return
2726
TPM_INVALID_KEYUSAGE
27276. The TPM SHALL create a c1 a TPM_CERTIFY_INFO2 structure from the key pointed to
2728
by keyHandle
27297. Create TPM_DIGEST H1 which is the SHA-1 hash of keyHandle -> pubKey -> key. Note
2730
that <key> is the actual public modulus, and does not include any structure formatting.
27318. Set C1 -> pubKeyDigest to H1
27329. Copy the antiReplay parameter to c1 -> data
273310.Copy other keyHandle parameters into C1
273411.If
keyHandle
->
payload
2735
TPM_PT_MIGRATE_EXTERNAL

==

TPM_PT_MIGRATE_RESTRICTED

or

2736
2737

a. create thisPubKey, a TPM_PUBKEY structure containing the public key, algorithm
and parameters corresponding to keyHandle

2738

b. Verify that the migration authorization is valid for this key

2739

i.

2740

ii. Set M2 -> msaDigest to migrationPubDigest

2741

iii. Set M2 -> pubkeyDigest to SHA-1[thisPubKey]

2742
2743

iv. Verify that [keyHandle -> migrationAuth] == HMAC(M2) signed by using
tpmProof as the secret and return error TPM_MA_SOURCE on mismatch

Create M2 a TPM_CMK_MIGAUTH structure

2744

c. Set C1 -> migrationAuthority = SHA-1(migrationPubDigest || keyHandle -> payload)

2745

d. if keyHandle -> payload == TPM_PT_MIGRATE_RESTRICTED

2746
2747

i.

Set C1 -> payloadType = TPM_PT_MIGRATE_RESTRICTED

e. if keyHandle -> payload == TPM_PT_MIGRATE_EXTERNAL

2748

i.

Set C1 -> payloadType = TPM_PT_MIGRATE_EXTERNAL

274912.Else
2750

a. set C1 -> migrationAuthority = NULL

2751

b. set C1 -> migrationAuthoritySize =0

682Level 2 Revision 116 28 February 2011
683

141
TCG Published

684Copyright © TCG
685
686

2752

TPM Main Part 3 Commands
Specification Version 1.2

c. Set C1 -> payloadType = TPM_PT_ASYM

275313.If keyHandle -> pcrInfoSize is not 0
2754
2755

a. The TPM MUST set c1 -> pcrInfoSize to match the pcrInfoSize from the keyHandle
key.

2756

b. The TPM MUST set c1 -> pcrInfo to match the pcrInfo from the keyHandle key

2757

c. If keyHandle -> keyFlags has pcrIgnoredOnRead set to FALSE

2758
2759
2760

i. Create a digestAtRelease according to the specified TPM_STCLEAR_DATA ->
PCR registers and compare to keyHandle -> digestAtRelease and if a mismatch
return TPM_WRONGPCRVAL

2761

ii. If specified validate any locality requests on error TPM_BAD_LOCALITY

276214.Else
2763

a. The TPM MUST set c1 -> pcrInfoSize to 0

276415.The TPM creates m1, a message digest formed by taking the SHA-1 of c1
2765
2766

687
688

a. The TPM then computes a signature using certHandle -> sigScheme. The resulting
signed blob is returned in outData

142

Level 2 Revision 116 28 February 2011
TCG Published

689TPM Main Part 3 Commands

TCG © Copyright

690Specification Version 1.2

276714.
Endorsement
2768Start of informative comment:

Key Handling

2769There are two create EK commands. The first matches the 1.1 functionality. The second
2770provides the mechanism to enable revokeEK.
2771The TPM and platform manufacturer decide on the inclusion or exclusion of the ability to
2772execute revokeEK.
2773The restriction to have the TPM generate the EK does not remove the manufacturing option
2774to “squirt” the EK. During manufacturing, the TPM does not enforce all protections or
2775requirements; hence, the restriction on only TPM generation of the EK is also not in force.
2776End of informative comment.
27771. A TPM SHALL NOT install an EK unless generated on the TPM by execution of
2778
TPM_CreateEndorsementKeyPair or TPM_CreateRevocableEK

691Level 2 Revision 116 28 February 2011
692

143
TCG Published

693Copyright © TCG
694
695

277914.1

TPM Main Part 3 Commands
Specification Version 1.2

TPM_CreateEndorsementKeyPair

2780Start of informative comment:
2781This command creates the TPM endorsement key. It returns a failure code if an
2782endorsement key already exists.
2783End of informative comment.
2784Incoming Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_COMMAND

4

UINT32

paramSize

Total number of input bytes including paramSize and tag

#

SZ

1
2

#

SZ

3

4

1S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_CreateEndorsementKeyPair

4

20

2S

20

TPM_NONCE

antiReplay

Arbitrary data

5

<>

3S

<>

TPM_KEY_PARMS

keyInfo

Information about key to be created, this includes all algorithm parameters

Type

Name

Description

2785Outgoing Operands and Sizes
PARAM

HMAC

#

SZ

#

SZ

1

2

TPM_TAG

tag

TPM_TAG_RSP_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

1S

4

TPM_RESULT

returnCode

The return code of the operation.

2S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_CreateEndorsementKeyPair

4

<>

3S

<>

TPM_PUBKEY

pubEndorsementKey

The public endorsement key

5

20

4S

20

TPM_DIGEST

checksum

Hash of pubEndorsementKey and antiReplay

2786Actions
27871. If an EK already exists, return TPM_DISABLED_CMD
27882. Validate the keyInfo parameters for the key description
2789
2790

a. If the algorithm type is RSA the key length MUST be a minimum of 2048. For
interoperability the key length SHOULD be 2048

2791
2792

b. If the algorithm type is other than RSA the strength provided by the key MUST be
comparable to RSA 2048

2793

c. The other parameters of keyInfo (encScheme, sigScheme, etc.) are ignored.

27943. Create a key pair called the “endorsement key pair” using a TPM-protected capability.
2795
The type and size of key are that indicated by keyInfo.
Set encScheme to
2796
TPM_ES_RSAESOAEP_SHA1_MGF1.
27974. Create checksum by performing SHA-1 on the concatenation of (PUBEK || antiReplay)
27985. Store the PRIVEK
27996. Create TPM_PERMANENT_DATA -> tpmDAASeed from the TPM RNG
696
697

144

Level 2 Revision 116 28 February 2011
TCG Published

698TPM Main Part 3 Commands

TCG © Copyright

699Specification Version 1.2

28007. Create TPM_PERMANENT_DATA -> daaProof from the TPM RNG
28018. Create TPM_PERMANENT_DATA -> daaBlobKey from the TPM RNG
28029. Set TPM_PERMANENT_FLAGS -> CEKPUsed to TRUE
280310.Set TPM_PERMANENT_FLAGS -> enableRevokeEK to FALSE

700Level 2 Revision 116 28 February 2011
701

145
TCG Published

702Copyright © TCG
703
704

280414.2

TPM Main Part 3 Commands
Specification Version 1.2

TPM_CreateRevocableEK

2805Start of informative comment:
2806This command creates the TPM endorsement key. It returns a failure code if an
2807endorsement key already exists. The TPM vendor may have a separate mechanism to create
2808the EK and “squirt” the value into the TPM.
2809The input parameters specify whether the EK is capable of being reset, whether the
2810AuthData value to reset the EK will be generated by the TPM, and the new AuthData value
2811itself if it is not to be generated by the TPM. The output parameter is the new AuthData
2812value that must be used when resetting the EK (if it is capable of being reset).
2813The command TPM_RevokeTrust must be used to reset an EK (if it is capable of being
2814reset).
2815Owner authorisation is unsuitable for authorizing resetting of an EK: someone with
2816Physical Presence can remove a genuine Owner, install a new Owner, and revoke the EK.
2817The genuine Owner can reinstall, but the platform will have lost its original attestation and
2818may not be trusted by challengers. Therefore if a password is to be used to revoke an EK, it
2819must be a separate password, given to the genuine Owner.
2820In v1.2 an OEM has extra choices when creating EKs.
2821a) An OEM could manufacture all of its TPMs with enableRevokeEK==TRUE.
2822If the OEM has tracked the EKreset passwords for these TPMs, the OEM can give the
2823passwords to customers. The customers can use the passwords as supplied, change the
2824passwords, or clear the EKs and create new EKs with new passwords.
2825If EKreset passwords are random values, the OEM can discard those values and not give
2826them to customers. There is then a low probability (statistically zero) chance of a local DOS
2827attack to reset the EK by guessing the password. The chance of a remote DOS attack is zero
2828because Physical Presence must also be asserted to use TPM_RevokeTrust.
2829b) An OEM could manufacture some of its TPMs with enableRevokeEK==FALSE. Then the
2830EK can never be revoked, and the chance of even a local DOS attack on the EK is
2831eliminated.
2832End of informative comment.
2833This is an optional command

705
706

146

Level 2 Revision 116 28 February 2011
TCG Published

707TPM Main Part 3 Commands

TCG © Copyright

708Specification Version 1.2

2834Incoming Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_COMMAND

2

4

UINT32

paramSize

Total number of input bytes including paramSize and tag

3

4

1S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_CreateRevocableEK

4

20

2S

20

TPM_NONCE

antiReplay

Arbitrary data

5

<>

3S

<>

TPM_KEY_PARMS

keyInfo

Information about key to be created, this includes all algorithm parameters

6

1

4S

1

BOOL

generateReset

If TRUE use TPM RNG to generate EKreset. If FALSE use the passed
value inputEKreset

7

20

5S

20

TPM_NONCE

inputEKreset

The authorization value to be used with TPM_RevokeTrust if
generateReset==FALSE, else the parameter is present but ignored

#

SZ

1

#

SZ

2835Outgoing Operands and Sizes
PARAM

HMAC
#

Type

SZ

Name

Description

#

SZ

1

2

TPM_TAG

tag

TPM_TAG_RSP_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

1S

4

TPM_RESULT

returnCode

The return code of the operation.

2S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_CreateRevocableEK

4

<>

3S

<>

TPM_PUBKEY

pubEndorsementKey

The public endorsement key

5

20

4S

20

TPM_DIGEST

checksum

Hash of pubEndorsementKey and antiReplay

6

20

5S

20

TPM_NONCE

outputEKreset

The AuthData value to use TPM_RevokeTrust

2836Actions
28371. If an EK already exists, return TPM_DISABLED_CMD
28382. Perform the actions of TPM_CreateEndorsementKeyPair, if any errors return with error
28393. Set TPM_PERMANENT_FLAGS -> enableRevokeEK to TRUE
2840

a. If generateReset is TRUE then

2841

i.

2842

b. Else

2843

i.

Set TPM_PERMANENT_DATA -> EKreset to the next value from the TPM RNG
Set TPM_PERMANENT_DATA -> EKreset to inputEKreset

28444. Return PUBEK, checksum and Ekreset
28455.
2846
2847
2848

The outputEKreset AuthData is sent in the clear. There is no uniqueness on the TPM
available to actually perform encryption or use an encrypted channel. The assumption is
that this operation is occurring in a controlled environment and sending the value in the
clear is acceptable.

709Level 2 Revision 116 28 February 2011
710

147
TCG Published

711Copyright © TCG
712
713

284914.3

TPM Main Part 3 Commands
Specification Version 1.2

TPM_RevokeTrust

2850Start of informative comment:
2851This command clears the EK and sets the TPM back to a pure default state. The generation
2852of the AuthData value occurs during the generation of the EK. It is the responsibility of the
2853EK generator to properly protect and disseminate the RevokeTrust AuthData.
2854End of informative comment.
2855This is an optional command
2856Incoming Operands and Sizes
PARAM

HMAC
#

SZ

1

2

2

4

3

4

1S

4

4

20

2S

20

Name

Description

TPM_TAG

tag

TPM_TAG_RQU_COMMAND

UINT32

SZ

Type

#

paramSize

Total number of input bytes including paramSize and tag

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_RevokeTrust

TPM_NONCE

EKReset

The value that will be matched to EK Reset

Type

Name

Description

2857Outgoing Operands and Sizes
PARAM

HMAC

#

SZ

#

SZ

1

2

TPM_TAG

tag

TPM_TAG_RSP_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

1S

4

TPM_RESULT

returnCode

The return code of the operation.

2S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_RevokeTrust

2858Actions
28591. The TPM MUST validate that TPM_PERMANENT_FLAGS -> enableRevokeEK is TRUE,
2860
return TPM_PERMANENTEK on error
28612. The TPM MUST validate that the EKReset matches TPM_PERMANENT_DATA -> EKReset
2862
return TPM_AUTHFAIL on error.
28633. Ensure that physical presence is being asserted
28644. Perform the actions of TPM_OwnerClear (excepting the command authentication)
2865
2866

a. NV items with the pubInfo -> nvIndex D value set MUST be deleted. This changes the
TPM_OwnerClear handling of the same NV areas

2867

b. Set TPM_PERMANENT_FLAGS -> nvLocked to FALSE

28685. Invalidate TPM_PERMANENT_DATA -> tpmDAASeed
28696. Invalidate TPM_PERMANENT_DATA -> daaProof
28707. Invalidate TPM_PERMANENT_DATA -> daaBlobKey
28718. Invalidate the EK and any internal state associated with the EK
714
715

148

Level 2 Revision 116 28 February 2011
TCG Published

716TPM Main Part 3 Commands

TCG © Copyright

717Specification Version 1.2

287214.4

TPM_ReadPubek

2873Start of informative comment:
2874Return the endorsement key public portion. This value should have controls placed upon
2875access, as it is a privacy sensitive value.
2876The readPubek flag is set to FALSE by TPM_TakeOwnership and set to TRUE by
2877TPM_OwnerClear, thus mirroring if a TPM Owner is present.
2878End of informative comment.
2879Incoming Operands and Sizes
PARAM

HMAC
#

SZ

1

2

2

4

3

4

1S

4

4

20

2S

20

Name

Description

TPM_TAG

tag

TPM_TAG_RQU_COMMAND

UINT32

SZ

Type

#

paramSize

Total number of input bytes including paramSize and tag

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_ReadPubek

TPM_NONCE

antiReplay

Arbitrary data

Type

Name

Description

2880Outgoing Operands and Sizes
PARAM

HMAC

#

SZ

#

SZ

1

2

TPM_TAG

tag

TPM_TAG_RSP_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

1S

4

TPM_RESULT

returnCode

The return code of the operation.

2S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_ReadPubek

4

<>

3S

<>

TPM_PUBKEY

pubEndorsementKey

The public endorsement key

5

20

4S

20

TPM_DIGEST

checksum

Hash of pubEndorsementKey and antiReplay

2881Description
2882This command returns the PUBEK.
2883Actions
2884The TPM_ReadPubek command SHALL
28851. If TPM_PERMANENT_FLAGS -> readPubek is FALSE return TPM_DISABLED_CMD
28862. If no EK is present the TPM MUST return TPM_NO_ENDORSEMENT
28873. Create checksum by performing SHA-1 on the concatenation of (pubEndorsementKey ||
2888
antiReplay).
28894. Export the PUBEK and checksum.

718Level 2 Revision 116 28 February 2011
719

149
TCG Published

720Copyright © TCG
721
722

289014.5

TPM Main Part 3 Commands
Specification Version 1.2

TPM_OwnerReadInternalPub

2891Start of informative comment:
2892A TPM Owner authorized command that returns the public portion of the EK or SRK.
2893The keyHandle parameter is included in the incoming session authorization to prevent
2894alteration of the value, causing a different key to be read. Unlike most key handles, which
2895can be mapped by higher layer software, this key handle has only two fixed values.
2896End of informative comment.
2897Incoming Operands and Sizes
PARAM

HMAC
SZ

1

2

2

4

3

4

1S

4

4

4

2S

4

5

4

Description

TPM_TAG

tag

TPM_TAG_RQU_AUTH1_COMMAND

UINT32

paramSize

Total number of input bytes including paramSize and tag

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_OwnerReadInternalPub

TPM_KEY_HANDLE

keyHandle

Handle for either PUBEK or SRK

TPM_AUTHHANDLE

#

Name


#

authHandle

The authorization session handle used for owner authentication.

2H1

20

TPM_NONCE

authLastNonceEven

Even nonce previously generated by TPM to cover inputs

6

20

3H1

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

7

1

4H1

1

BOOL

continueAuthSession

The continue use flag for the authorization session handle

8

20

TPM_AUTHDATA

ownerAuth

The authorization session digest for inputs and owner authentication.
HMAC key: ownerAuth.

2898Outgoing Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RSP_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

#

SZ

1

#

SZ

1S

4

TPM_RESULT

returnCode

The return code of the operation.

2S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_OwnerReadInternalPub

4

<>

3S

<>

TPM_PUBKEY

publicPortion

The public portion of the requested key

5

20

2H1

20

TPM_NONCE

nonceEven

Even nonce newly generated by TPM to cover outputs

3H1

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

4H1

1

BOOL

continueAuthSession

Continue use flag, TRUE if handle is still active

TPM_AUTHDATA

resAuth

The authorization session digest for the returned parameters. HMAC key:
ownerAuth.

6

1

7

20

2899Actions
29001. Validate the parameters and TPM Owner AuthData for this command
29012. If keyHandle is TPM_KH_EK
2902
723
724

a. Set publicPortion to PUBEK
150

Level 2 Revision 116 28 February 2011
TCG Published

725TPM Main Part 3 Commands

TCG © Copyright

726Specification Version 1.2

29033. Else If keyHandle is TPM_KH_SRK
2904

a. Set publicPortion to the TPM_PUBKEY of the SRK

29054. Else return TPM_BAD_PARAMETER
29065. Export the public key of the referenced key

727Level 2 Revision 116 28 February 2011
728

151
TCG Published

729Copyright © TCG
730
731

290715.

TPM Main Part 3 Commands
Specification Version 1.2

Identity Creation and Activation

290815.1

TPM_MakeIdentity

2909Start of informative comment:
2910Generate a new Attestation Identity Key (AIK).
2911labelPrivCADigest identifies the privacy CA that the owner expects to be the target CA for
2912the AIK. The selection is not enforced by the TPM. It is advisory only. It is included
2913because the TSS cannot be trusted to send the AIK to the correct privacy CA. The privacy
2914CA can use this parameter to validate that it is the target privacy CA and label intended by
2915the TPM owner at the time the key was created. The label can be used to indicate an
2916application purpose.
2917End of informative comment.
2918Incoming Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_AUTH2_COMMAND

2

4

UINT32

paramSize

Total number of input bytes incl. paramSize and tag

3

4

1S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_MakeIdentity.

4

20

2S

20

TPM_ENCAUTH

identityAuth

Encrypted usage AuthData for the new identity

5

20

3S

20

TPM_CHOSENID_HASH

labelPrivCADigest

The digest of the identity label and privacy CA chosen for the AIK

6

<>

4S

<>

TPM_KEY

idKeyParams

Structure containing all parameters of new identity key.
pubKey.keyLength & idKeyParams.encData are both 0 MAY be TPM_KEY12

7

4

TPM_AUTHHANDLE

srkAuthHandle

The authorization session handle used for SRK authorization.

#

SZ

1

#

SZ

2H1

20

TPM_NONCE

srkLastNonceEven

Even nonce previously generated by TPM

8

3H1

20

TPM_NONCE

srknonceOdd

Nonce generated by system associated with srkAuthHandle

9

1

4H1

1

BOOL

continueSrkSession

Ignored

10

20

TPM_AUTHDATA

srkAuth

The authorization session digest for the inputs and the SRK. HMAC
key: srk.usageAuth.

11

4

TPM_AUTHHANDLE

authHandle

The authorization session handle used for owner authentication.
Session type MUST be OSAP.

2H2

20

TPM_NONCE

authLastNonceEven

Even nonce previously generated by TPM to cover inputs

12

20

3H2

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

13

1

4H2

1

BOOL

continueAuthSession

Ignored

14

732
733

20

20

20

TPM_AUTHDATA

ownerAuth

The authorization session digest for inputs and owner. HMAC key:
ownerAuth.

152

Level 2 Revision 116 28 February 2011
TCG Published

734TPM Main Part 3 Commands

TCG © Copyright

735Specification Version 1.2

2919Outgoing Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RSP_AUTH2_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

#

SZ

1

#

SZ

1S

4

TPM_RESULT

returnCode

The return code of the operation.

2S

4

TPM_COMMAND_CODE

ordinal

Command ordinal:TPM_ORD_MakeIdentity.

4

<>

3S

<>

TPM_KEY

idKey

The newly created identity key. MAY be TPM_KEY12

5

4

4S

4

UINT32

identityBindingSize

The used size of the output area for identityBinding

6

<>

5S

<>

BYTE[ ]

identityBinding

Signature of TPM_IDENTITY_CONTENTS using idKey.private.

7

20

2H2

20

TPM_NONCE

srkNonceEven

Even nonce newly generated by TPM.

3H2

20

TPM_NONCE

srknonceOdd

Nonce generated by system associated with srkAuthHandle

4H2

1

BOOL

continueSrkSession

Continue use flag. Fixed value of FALSE

TPM_AUTHDATA

srkAuth

The authorization session digest used for the outputs and srkAuth
session. HMAC key: srk.usageAuth.

8

1

9

20

10

20

1

12

20

TPM_NONCE

nonceEven

Even nonce newly generated by TPM to cover outputs

3H1
11

2H1

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

4H1

1

BOOL

continueAuthSession

Continue use flag. Fixed value of FALSE

20

TPM_AUTHDATA

resAuth

The authorization session digest for the returned parameters. HMAC key:
ownerAuth.

20

2920Description
2921The public key of the new TPM identity SHALL be identityPubKey. The private key of the
2922new TPM identity SHALL be tpm_signature_key.
2923Properties of the new identity
Type

Name

Description

TPM_PUBKEY

identityPubKey

This SHALL be the public key of a previously unused asymmetric key pair.

TPM_STORE_ASYMKEY

tpm_signature_key

This SHALL be the private key that forms a pair with identityPubKey and SHALL be
extant only in a TPM-shielded location.

2924

2925This capability also generates a TPM_KEY containing the tpm_signature_key.
2926If identityPubKey is stored on a platform it SHALL exist only in storage to which access is
2927controlled and is available to authorized entities.
2928The signing of TPM_ID_CONTENTS is not an authorized use of the key.
2929TPM_PCR_INFO_xxx “…AtRelease” values are not validated.

The

2930Actions
2931A Trusted Platform Module that receives a valid TPM_MakeIdentity command SHALL do the
2932following:
29331. Validate the idKeyParams parameters for the key description
736Level 2 Revision 116 28 February 2011
737

153
TCG Published

738Copyright © TCG
739
740

TPM Main Part 3 Commands
Specification Version 1.2

2934
2935

a. If the algorithm type is RSA, the key length MUST be a minimum of 2048 and MUST
use the default exponent. For interoperability the key length SHOULD be 2048.

2936
2937

b. If the algorithm type is other than RSA the strength provided by the key MUST be
comparable to RSA 2048

2938
2939

c. If the TPM is not designed to create a key of the requested type, return the error code
TPM_BAD_KEY_PROPERTY

2940

d. If TPM_PERMANENT_FLAGS -> FIPS is TRUE then

2941

i.

If authDataUsage specifies TPM_AUTH_NEVER return TPM_NOTFIPS

29422. Use authHandle to verify that the Owner authorized all TPM_MakeIdentity input
2943
parameters.
29443. Use srkAuthHandle to verify that the SRK owner authorized all TPM_MakeIdentity input
2945
parameters.
29464. Verify that idKeyParams -> keyUsage is TPM_KEY_IDENTITY. If it is not, return
2947
TPM_INVALID_KEYUSAGE
29485. Verify that idKeyParams -> keyFlags -> migratable is FALSE. If it is not, return
2949
TPM_INVALID_KEYUSAGE
29506. Create a1 by decrypting identityAuth according to the ADIP indicated by authHandle.
29517. Set continueAuthSession and continueSRKSession to FALSE.
29528. Determine the structure version
2953

a. If idKeyParams -> tag is TPM_TAG_KEY12

2954

i.

2955
2956

ii. Create idKey a TPM_KEY12 structure using idKeyParams as the default values
for the structure

2957

Set V1 to 2

b. If idKeyParams -> ver is 1.1

2958

i.

2959
2960

ii. Create idKey a TPM_KEY structure using idKeyParams as the default values
for the structure

Set V1 to 1

29619. Set the digestAtCreation values for pcrInfo
2962

a. For TPM_PCR_INFO_LONG include the locality of the current command

296310.Create an asymmetric key pair (identityPubKey and tpm_signature_key) using a TPM2964
protected capability, in accordance with the algorithm specified in idKeyParams
296511.Ensure that the AuthData information in A1 is properly stored in the idKey as
2966
usageAuth.
296712.Attach identityPubKey and tpm_signature_key to idKey
296813.Set idKey -> migrationAuth to TPM_PERMANENT_DATA-> tpmProof
296914.Ensure that all TPM_PAYLOAD_TYPE structures identify this key as TPM_PT_ASYM
297015.Encrypt the private portion of idKey using the SRK as the parent key

741
742

154

Level 2 Revision 116 28 February 2011
TCG Published

743TPM Main Part 3 Commands

TCG © Copyright

744Specification Version 1.2

297116.Create
a
TPM_IDENTITY_CONTENTS
structure
2972
labelPrivCADigest and the information from idKey

named

idContents

using

297317.Sign idContents using tpm_signature_key and TPM_SS_RSASSAPKCS1v15_SHA1. Store
2974
the result in identityBinding.

745Level 2 Revision 116 28 February 2011
746

155
TCG Published

747Copyright © TCG
748
749

297515.2

TPM Main Part 3 Commands
Specification Version 1.2

TPM_ActivateIdentity

2976Start of informative comment:
2977The purpose of TPM_ActivateIdentity is to twofold. The first purpose is to obtain assurance
2978that the credential in the TPM_SYM_CA_ATTESTATION is for this TPM. The second purpose
2979is to obtain the session key used to encrypt the TPM_IDENTITY_CREDENTIAL.
2980This is an extension to the 1.1 functionality of TPM_ActivateIdentity. The blob sent to from
2981the CA can be in the 1.1 format or the 1.2 format. The TPM determines the type from the
2982size or version information in the blob.
2983TPM_ActivateIdentity checks that the symmetric session key corresponds to a TPM-identity
2984before releasing that session key.
2985Only the Owner of the TPM has the privilege of activating a TPM identity. The Owner is
2986required to authorize the TPM_ActivateIdentity command. The owner may authorize the
2987command using either the TPM_OIAP or TPM_OSAP authorization protocols.
2988The creator of the ActivateIdentity package can specify if any PCR values are to be checked
2989before releasing the session key.
2990End of informative comment.
2991Incoming Parameters and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_AUTH2_COMMAND

2

4

UINT32

paramSize

Total number of input bytes incl. paramSize and tag

3

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_ActivateIdentity

4

4

TPM_KEY_HANDLE

idKeyHandle

Identity key to be activated

5

4

2S

4

UINT32

blobSize

Size of encrypted blob from CA

6

<>

3S

<>

BYTE [ ]

blob

The encrypted ASYM_CA_CONTENTS or TPM_EK_BLOB

7

4

TPM_AUTHHANDLE

idKeyAuthHandle

The authorization session handle used for ID key authorization.

#

SZ

1

#

1S

SZ

4

2H1

20

TPM_NONCE

idKeyLastNonceEven

Even nonce previously generated by TPM

8

20

3H1

20

TPM_NONCE

idKeynonceOdd

Nonce generated by system associated with idKeyAuthHandle

9

1

4H1

1

BOOL

continueIdKeySession

Continue usage flag for idKeyAuthHandle.

10

20

TPM_AUTHDATA

idKeyAuth

The authorization session digest for the inputs and ID key. HMAC key:
idKey.usageAuth.

11

4

TPM_AUTHHANDLE

authHandle

The authorization session handle used for owner authentication.

2H2

20

TPM_NONCE

authLastNonceEven

Even nonce previously generated by TPM to cover inputs

12

3H2

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

13

1

4H2

1

BOOL

continueAuthSession

The continue use flag for the authorization session handle

14

750
751

20

20

20

TPM_AUTHDATA

ownerAuth

The authorization session digest for inputs and owner. HMAC key:
ownerAuth.

156

Level 2 Revision 116 28 February 2011
TCG Published

752TPM Main Part 3 Commands

TCG © Copyright

753Specification Version 1.2

2992Outgoing Parameters and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RSP_AUTH2_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

#

SZ

1

#

SZ

1S

4

TPM_RESULT

returnCode

The return code of the operation.

2S

4

TPM_COMMAND_CODE

ordinal

Command ordinal:TPM_ORD_ActivateIdentity

4

<>

3S

<>

TPM_SYMMETRIC_KEY

symmetricKey

The decrypted symmetric key.

5

20

2H1

20

TPM_NONCE

idKeyNonceEven

Even nonce newly generated by TPM.

3H1

20

TPM_NONCE

idKeynonceOdd

Nonce generated by system associated with idKeyAuthHandle

4H1

1

BOOL

continueIdKeySession

Continue use flag, TRUE if handle is still active

TPM_AUTHDATA

idKeyAuth

The authorization session digest used for the returned parameters and
idKeyAuth session. HMAC key: idKey.usageAuth.

6

1

7

20

8

20

1

10

20

TPM_NONCE

nonceEven

Even nonce newly generated by TPM to cover outputs

3H2
9

2H2

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

4H2

1

BOOL

continueAuthSession

Continue use flag, TRUE if handle is still active

20

TPM_AUTHDATA

resAuth

The authorization session digest for the returned parameters. HMAC
key: ownerAuth.

20

2993Description
29941. The command TPM_ActivateIdentity activates a TPM identity created using the command
2995
TPM_MakeIdentity.
29962. The command assumes the availability of the private key associated with the identity.
2997
The command will verify the association between the keys during the process.
29983. The command will decrypt the input blob and extract the session key and verify the
2999
connection between the public and private keys. The input blob can be in 1.1 or 1.2
3000
format.
3001Actions
3002A Trusted Platform Module that receives a valid TPM_ActivateIdentity command SHALL do
3003the following:
30041. Using the authHandle field, validate the owner’s AuthData to execute the command and
3005
all of the incoming parameters.
30062. Using the idKeyAuthHandle, validate the AuthData to execute command and all of the
3007
incoming parameters
30083. Validate that the idKey is the public key of a valid TPM identity by checking that
3009
idKeyHandle -> keyUsage is TPM_KEY_IDENTITY. Return TPM_BAD_PARAMETER on
3010
mismatch
30114. Create H1 the digest of a TPM_PUBKEY derived from idKey
30125. Decrypt blob creating B1 using PRIVEK as the decryption key
30136. Determine the type and version of B1
754Level 2 Revision 116 28 February 2011
755

157
TCG Published

756Copyright © TCG
757
758

3014

TPM Main Part 3 Commands
Specification Version 1.2

a. If B1 -> tag is TPM_TAG_EK_BLOB then

3015

i.

3016

b. Else

3017
3018
3019

B1 is a TPM_EK_BLOB

i. B1 is a TPM_ASYM_CA_CONTENTS. As there is no tag for this structure it is
possible for the TPM to make a mistake here but other sections of the structure
undergo validation

30207. If B1 is a version 1.1 TPM_ASYM_CA_CONTENTS then
3021

a. Compare H1 to B1 -> idDigest on mismatch return TPM_BAD_PARAMETER

3022

b. Set K1 to B1 -> sessionKey

30238. If B1 is a TPM_EK_BLOB then
3024
3025

a. Validate that B1 -> ekType is TPM_EK_TYPE_ACTIVATE, return TPM_BAD_TYPE if
not.

3026

b. Assign A1 as a TPM_EK_BLOB_ACTIVATE structure from B1 -> blob

3027

c. Compare H1 to A1 -> idDigest on mismatch return TPM_BAD_PARAMETER

3028

d. If A1 -> pcrSelection is not NULL

3029

i.

3030
3031

ii. Compare
C1
to
A1
->
TPM_WRONGPCRVAL on a mismatch

3032
3033

e. If A1 -> pcrInfo specifies a locality ensure that the appropriate locality has
been asserted, return TPM_BAD_LOCALITY on error

3034

Compute a composite hash C1 using the PCR selection A1 -> pcrSelection
pcrInfo->digestAtRelease

and

return

f. Set K1 to A1 -> symmetricKey

30359. Return K1

759
760

158

Level 2 Revision 116 28 February 2011
TCG Published

761TPM Main Part 3 Commands

TCG © Copyright

762Specification Version 1.2

303616.
Integrity Collection
3037Start of informative comment:

and Reporting

3038This section deals with what commands have direct access to the PCR
3039End of informative comment.
30401. The TPM SHALL only allow the following commands to alter the value of
3041
TPM_STCLEAR_DATA -> PCR
3042

a. TPM_Extend

3043

b. TPM_SHA1CompleteExtend

3044

c. TPM_Startup

3045

d. TPM_PCR_Reset

763Level 2 Revision 116 28 February 2011
764

159
TCG Published

765Copyright © TCG
766
767

304616.1

TPM Main Part 3 Commands
Specification Version 1.2

TPM_Extend

3047Start of informative comment:
3048This adds a new measurement to a PCR
3049End of informative comment.
3050Incoming Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_COMMAND

2

4

UINT32

paramSize

Total number of input bytes including paramSize and tag

3

4

1S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_Extend.

4

4

2S

4

TPM_PCRINDEX

pcrNum

The PCR to be updated.

5

20

3S

20

TPM_DIGEST

inDigest

The 160 bit value representing the event to be recorded.

Type

Name

Description

#

SZ

1

#

SZ

3051Outgoing Operands and Sizes
PARAM

HMAC

#

SZ

#

SZ

1

2

TPM_TAG

tag

TPM_TAG_RSP_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

20

4

TPM_RESULT

returnCode

The return code of the operation.

2S
4

1S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_Extend.

3S

20

TPM_PCRVALUE

outDigest

The PCR value after execution of the command.

3052Description
3053Add a measurement value to a PCR
3054Actions
30551. Validate that pcrNum represents a legal PCR number. On error, return TPM_BADINDEX.
30562. Map L1 to TPM_STANY_FLAGS -> localityModifier
30573. Map P1 to TPM_PERMANENT_DATA -> pcrAttrib [pcrNum]. pcrExtendLocal
30584. If, for the value of L1, the corresponding bit is not set in the bit map P1, return
3059
TPM_BAD_LOCALITY
30605. Create c1 by concatenating (TPM_STCLEAR_DATA -> PCR[pcrNum] || inDigest). This
3061
takes the current PCR value and concatenates the inDigest parameter.
30626. Create h1 by performing a SHA-1 digest of c1.
30637. Store h1 to TPM_STCLEAR_DATA -> PCR[pcrNum]
30648. If TPM_PERMANENT_FLAGS -> disable is TRUE or TPM_STCLEAR_FLAGS -> deactivated
3065
is TRUE

768
769

160

Level 2 Revision 116 28 February 2011
TCG Published

770TPM Main Part 3 Commands

TCG © Copyright

771Specification Version 1.2

3066

a. Set outDigest to 20 bytes of 0x00

30679. Else
3068

a. Set outDigest to h1

772Level 2 Revision 116 28 February 2011
773

161
TCG Published

774Copyright © TCG
775
776

306916.2

TPM Main Part 3 Commands
Specification Version 1.2

TPM_PCRRead

3070Start of informative comment:
3071The TPM_PCRRead operation provides non-cryptographic reporting of the contents of a
3072named PCR.
3073End of informative comment.
3074Incoming Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_COMMAND

2

4

UINT32

paramSize

Total number of input bytes including paramSize and tag

3

4

1S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_PCRRead.

4

4

2S

4

TPM_PCRINDEX

pcrIndex

Index of the PCR to be read

Type

Name

Description

#

SZ

1

#

SZ

3075Outgoing Operands and Sizes
PARAM

HMAC

#

SZ

#

SZ

1

2

TPM_TAG

tag

TPM_TAG_RSP_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

20

4

TPM_RESULT

returnCode

The return code of the operation.

2S
4

1S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_PCRRead.

3S

20

TPM_PCRVALUE

outDigest

The current contents of the named PCR

3076Description
3077The TPM_PCRRead operation returns the current contents of the named register to the
3078caller.
3079Actions
30801. Validate that pcrIndex
3081
TPM_BADINDEX.

represents

a

legal

PCR

number.

On

error,

return

30822. Set outDigest to TPM_STCLEAR_DATA -> PCR[pcrIndex]
30833. Return TPM_SUCCESS
3084

777
778

162

Level 2 Revision 116 28 February 2011
TCG Published

779TPM Main Part 3 Commands

TCG © Copyright

780Specification Version 1.2

308516.3

TPM_Quote

3086Start of informative comment:
3087The TPM_Quote operation provides cryptographic reporting of PCR values. A loaded key is
3088required for operation. TPM_Quote uses a key to sign a statement that names the current
3089value of a chosen PCR and externally supplied data (which may be a nonce supplied by a
3090Challenger).
3091The term "ExternalData" is used because an important use of TPM_Quote is to provide a
3092digital signature on arbitrary data, where the signature includes the PCR values of the
3093platform at time of signing. Hence the "ExternalData" is not just for anti-replay purposes,
3094although it is (of course) used for that purpose in an integrity challenge.
3095TPM_Quote should not use a TPM_KEY_SIGNING, because there is no way for the remote
3096party to tell whether TPM_Quote or TPM_Sign created the signature. The exception is a
3097TPM_KEY_SIGNING key with the _INFO signature
scheme,
because
the
metadata
3098differentiates TPM_Sign from TPM_Quote.
3099End of informative comment.
3100Incoming Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of input bytes including paramSize and tag

3

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_Quote.

4

4

TPM_KEY_HANDLE

keyHandle

The keyHandle identifier of a loaded key that can sign the PCR values.

5

20

2S

20

TPM_NONCE

externalData

160 bits of externally supplied data (typically a nonce provided by a
server to prevent replay-attacks)

6

<>

3S

<>

TPM_PCR_SELECTION

targetPCR

The indices of the PCRs that are to be reported.

7

4

TPM_AUTHHANDLE

authHandle

The authorization session handle used for keyHandle authorization.

#

SZ

1

#

1S

SZ

4

2H1

20

TPM_NONCE

authLastNonceEven

Even nonce previously generated by TPM to cover inputs

8

20

3H1

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

9

1

4H1

1

BOOL

continueAuthSession

The continue use flag for the authorization session handle

10

20

TPM_AUTHDATA

privAuth

The authorization session digest for inputs and keyHandle. HMAC key:
key -> usageAuth.

781Level 2 Revision 116 28 February 2011
782

163
TCG Published

783Copyright © TCG
784
785

TPM Main Part 3 Commands
Specification Version 1.2

3101Outgoing Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RSP_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

#

SZ

1

#

SZ

1S

4

TPM_RESULT

returnCode

The return code of the operation.

2S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_Quote.

4

<>

3S

<>

TPM_PCR_COMPOSITE

pcrData

A structure containing the same indices as targetPCR, plus the
corresponding current PCR values.

5

4

4S

4

UINT32

sigSize

The used size of the output area for the signature

6

<>

5S

<>

BYTE[ ]

sig

The signed data blob.

7

20

2H1

20

TPM_NONCE

nonceEven

Even nonce newly generated by TPM to cover outputs

3H1

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

4H1

1

BOOL

continueAuthSession

Continue use flag, TRUE if handle is still active

TPM_AUTHDATA

resAuth

The authorization session digest for the returned parameters. HMAC key:
Key -> usageAuth.

8

1

9

20

3102Actions
31031. The TPM MUST validate the AuthData to use the key pointed to by keyHandle.
31042. Validate that keyHandle -> sigScheme is TPM_SS_RSASSAPKCS1v15_SHA1 or
3105
TPM_SS_RSASSAPKCS1v15_INFO, if not return TPM_INAPPROPRIATE_SIG.
31063. Validate that keyHandle -> keyUsage is TPM_KEY_SIGNING, TPM_KEY_IDENTITY, or
3107
TPM_KEY_LEGACY, if not return TPM_INVALID_KEYUSAGE
31084. Validate targetPCR
3109

a. targetPCR is a valid TPM_PCR_SELECTION structure

3110

b. On errors return TPM_INVALID_PCR_INFO

31115. Create H1 a SHA-1 hash of a TPM_PCR_COMPOSITE using the TPM_STCLEAR_DATA ->
3112
PCR indicated by targetPCR -> pcrSelect
31136. Create Q1 a TPM_QUOTE_INFO structure
3114

a. Set Q1 -> version to 1.1.0.0

3115

b. Set Q1 -> fixed to “QUOT”

3116

c. Set Q1 -> digestValue to H1

3117

d. Set Q1 -> externalData to externalData

31187. Sign SHA-1 hash of Q1 using keyHandle as the signature key
31198. Return the signature in sig

786
787

164

Level 2 Revision 116 28 February 2011
TCG Published

788TPM Main Part 3 Commands

TCG © Copyright

789Specification Version 1.2

312016.4

TPM_PCR_Reset

3121Start of informative comment:
3122For PCR with the pcrReset attribute set to TRUE, this command resets the PCR back to the
3123default value, this mimics the actions of TPM_Init. The PCR may have restrictions as to
3124which locality can perform the reset operation.
3125Sending a null pcrSelection results in an error is due to the requirement that the command
3126actually do something. If pcrSelection is null there are no PCR to reset and the command
3127would then do nothing.
3128For PCR that are resettable, the presence of a Trusted Operating System (TOS) can change
3129the behavior of TPM_PCR_Reset. The following pseudo code shows how the behavior
3130changes
3131At TPM_Startup
3132

If TPM_PCR_ATTRIBUTES->pcrReset is FALSE

3133

Set PCR to 0x00…00

3134

Else

3135

Set PCR to 0xFF…FF

3136At TPM_PCR_Reset
3137

If TPM_PCR_ATTRIBUTES->pcrReset is TRUE

3138

If TOSPresent

3139

Set PCR to 0x00…00

3140

Else

3141

Set PCR to 0xFF…FF

3142

Else

3143

Return error

3144The above pseudocode is for example only, for the details of a specific platform, the reader
3145must review the platform specific specification. The purpose of the above pseudocode is to
3146show that both pcrReset and the TOSPresent bit control the value in use to when the PCR
3147resets.
3148End of informative comment.
3149Incoming Parameters and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_COMMAND

2

4

UINT32

paramSize

Total number of input bytes including paramSize and tag

3

4

1S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_PCR_Reset

4

<>

2S

<>

TPM_PCR_SELECTION

pcrSelection

The PCR’s to reset

#

SZ

1

#

SZ

790Level 2 Revision 116 28 February 2011
791

165
TCG Published

792Copyright © TCG
793
794

TPM Main Part 3 Commands
Specification Version 1.2

3150Outgoing Parameters and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RSP_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

#

SZ

1

#

SZ

1S

4

TPM_RESULT

returnCode

The return code of the operation.

2S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_PCR_Reset

3151Description
3152This command resets PCR values back to the default value. The command MUST validate
3153that all PCR registers that are selected are available to be reset before resetting any PCR.
3154This command MUST either reset all selected PCR registers or none of the PCR registers.
3155Actions
31561. Validate that pcrSelection is valid
3157

a. is a valid TPM_PCR_SELECTION structure

3158

b. pcrSelection -> pcrSelect is non-zero

3159

c. On errors return TPM_INVALID_PCR_INFO

31602. Map L1 to TPM_STANY_FLAGS -> localityModifier
31613. For each PCR selected perform the following
3162
3163

a. If TPM_PERMANENT_DATA
TPM_NOTRESETABLE

3164
3165

b. If, for the value L1, the corresponding bit is clear in the bit map
TPM_PERMANENT_DATA -> pcrAttrib[pcrIndex].pcrResetLocal, return TPM_NOTLOCAL

->

pcrAttrib[pcrIndex].pcrReset

is

FALSE,

return

31664. For each PCR selected perform the following
3167

a. The PCR MAY only reset to 0x00…00 or 0xFF…FF

3168
3169

b. The logic to determine which value to use MUST be described by a platform specific
specification

795
796

166

Level 2 Revision 116 28 February 2011
TCG Published

797TPM Main Part 3 Commands

TCG © Copyright

798Specification Version 1.2

317016.5

TPM_Quote2

3171Start of informative comment:
3172The TPM_Quote2 operation provides cryptographic reporting of PCR values. A loaded key is
3173required for operation. TPM_Quote2 uses a key to sign a statement that names the current
3174value of a chosen PCR and externally supplied data (which may be a nonce supplied by a
3175Challenger).
3176The term "externalData" is used because an important use of TPM_Quote2 is to provide a
3177digital signature on arbitrary data, where the signature includes the PCR values of the
3178platform at time of signing. Hence the "externalData" is not just for anti-replay purposes,
3179although it is (of course) used for that purpose in an integrity challenge.
3180TPM_Quote2 differs from TPM_Quote in that TPM_Quote2 uses TPM_PCR_INFO_SHORT to
3181hold information relative to the PCR registers. TPM_PCR_INFO_SHORT includes locality
3182information to provide the requestor a more complete view of the current platform
3183configuration.
3184End of informative comment.
3185Incoming Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of input bytes including paramSize and tag

3

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_Quote2

4

4

TPM_KEY_HANDLE

keyHandle

The keyHandle identifier of a loaded key that can sign the PCR values.

5

20

2S

20

TPM_NONCE

externalData

160 bits of externally supplied data (typically a nonce provided by a
server to prevent replay-attacks)

6

<>

3S

<>

TPM_PCR_SELECTION

targetPCR

The indices of the PCRs that are to be reported.

7

1

4S

1

BOOL

addVersion

When TRUE add TPM_CAP_VERSION_INFO to the output

8

4

TPM_AUTHHANDLE

authHandle

The authorization session handle used for keyHandle authorization.

#

SZ

1

#

1S

SZ

4

2H1

20

TPM_NONCE

authLastNonceEven

Even nonce previously generated by TPM to cover inputs

9

20

3H1

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

10

1

4H1

1

BOOL

continueAuthSession

The continue use flag for the authorization session handle

11

20

TPM_AUTHDATA

privAuth

The authorization session digest for inputs and keyHandle. HMAC key:
key -> usageAuth.

799Level 2 Revision 116 28 February 2011
800

167
TCG Published

801Copyright © TCG
802
803

TPM Main Part 3 Commands
Specification Version 1.2

3186Outgoing Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RSP_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

#

SZ

1

#

SZ

1S

4

TPM_RESULT

returnCode

The return code of the operation.

2S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_Quote2

4

<>

3S

<>

TPM_PCR_INFO_SHORT

pcrData

The value created and signed for the quote

5

4

4S

4

UINT32

versionInfoSize

Size of the version info

6

<>

5S

<>

TPM_CAP_VERSION_INFO

versionInfo

The version info

7

4

6S

4

UINT32

sigSize

The used size of the output area for the signature

8

<>

7S

<>

BYTE[ ]

sig

The signed data blob.

9

20

2H1

20

TPM_NONCE

nonceEven

Even nonce newly generated by TPM to cover outputs

3H1

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

4H1

1

BOOL

continueAuthSession

Continue use flag, TRUE if handle is still active

TPM_AUTHDATA

resAuth

The authorization session digest for the returned parameters. HMAC key:
Key -> usageAuth.

10

1

11

20

3187Actions
31881. The TPM MUST validate the AuthData to use the key pointed to by keyHandle.
31892. Validate that keyHandle -> sigScheme is TPM_SS_RSASSAPKCS1v15_SHA1 or
3190
TPM_SS_RSASSAPKCS1v15_INFO, if not return TPM_INAPPROPRIATE_SIG.
31913. Validate that keyHandle -> keyUsage is TPM_KEY_SIGNING, TPM_KEY_IDENTITY, or
3192
TPM_KEY_LEGACY, if not return TPM_INVALID_KEYUSAGE
31934. Validate targetPCR is a valid TPM_PCR_SELECTION structure, on errors return
3194
TPM_INVALID_PCR_INFO
31955. Create H1 a SHA-1 hash of a TPM_PCR_COMPOSITE using the TPM_STCLEAR_DATA ->
3196
PCR[] indicated by targetPCR -> pcrSelect
31976. Create S1 a TPM_PCR_INFO_SHORT
3198

a. Set S1->pcrSelection to targetPCR

3199

b. Set S1->localityAtRelease to TPM_STANY_DATA -> localityModifier

3200

c. Set S1->digestAtRelease to H1

32017. Create Q1 a TPM_QUOTE_INFO2 structure
3202

a. Set Q1 -> fixed to “QUT2”

3203

b. Set Q1 -> infoShort to S1

3204

c. Set Q1 -> externalData to externalData

32058. If addVersion is TRUE
3206
804
805

a. Concatenate to Q1 a TPM_CAP_VERSION_INFO structure
168

Level 2 Revision 116 28 February 2011
TCG Published

806TPM Main Part 3 Commands

TCG © Copyright

807Specification Version 1.2

3207

b. Set the output parameters for versionInfo

32089. Else
3209

a. Set versionInfoSize to 0

3210

b. Return no bytes in versionInfo

321110.Sign a SHA-1 hash of Q1 using keyHandle as the signature key
321211.Return the signature in sig

808Level 2 Revision 116 28 February 2011
809

169
TCG Published

810Copyright © TCG
811
812

321317.
321417.1

TPM Main Part 3 Commands
Specification Version 1.2

Changing AuthData
TPM_ChangeAuth

3215Start of informative comment:
3216The TPM_ChangeAuth command allows the owner of an entity to change the AuthData for
3217the entity.
3218This command cannot invalidate the old entity. Therefore, the authorization change is only
3219effective if the application can guarantee that the old entity can be securely destroyed. If
3220not, two valid entities will exist, one with the old and one with the new authorization secret.
3221If this command is delegated, the delegated party can expand its key use privileges. That
3222party can create a copy of the key with known authorization, and it can then use the key
3223without any ordinal restrictions.
3224TPM_ChangeAuth requires the encryption of one parameter (“NewAuth”). For the sake of
3225uniformity with other commands that require the encryption of more than one parameter,
3226the parameters used for used encryption are generated from the authLastNonceEven
3227(created during the OSAP session), nonceOdd, and the session shared secret.
3228The parameter list to this command must always include two authorization sessions,
3229regardless of the state of authDataUsage for the respective keys.
3230End of informative comment.

813
814

170

Level 2 Revision 116 28 February 2011
TCG Published

815TPM Main Part 3 Commands

TCG © Copyright

816Specification Version 1.2

3231
Incoming Operands and Sizes

PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_AUTH2_COMMAND

2

4

UINT32

paramSize

Total number of input bytes including paramSize and tag

3

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_ChangeAuth

4

4

TPM_KEY_HANDLE

parentHandle

Handle of the parent key to the entity.

5

2

2S

2

TPM_PROTOCOL_ID

protocolID

The protocol in use.

6

20

3S

20

TPM_ENCAUTH

newAuth

The encrypted new AuthData for the entity

7

2

4S

2

TPM_ENTITY_TYPE

entityType

The type of entity to be modified

8

4

5S

4

UINT32

encDataSize

The size of the encData parameter

9

<>

6S

<>

BYTE[ ]

encData

The encrypted entity that is to be modified.

10

4

TPM_AUTHHANDLE

parentAuthHandle

The authorization session handle used for the parent key.

#

SZ

1

#

1S

SZ

4

2 H1

20

TPM_NONCE

authLastNonceEven

Even nonce previously generated by TPM to cover inputs

11

20

3 H1

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with parentAuthHandle

12

1

4 H1

1

BOOL

continueAuthSession

Ignored, parentAuthHandle is always terminated.

13

20

TPM_AUTHDATA

parentAuth

The authorization session digest for inputs and parentHandle. HMAC
key: parentKey.usageAuth.

14

4

TPM_AUTHHANDLE

entityAuthHandle

The authorization session handle used for the encrypted entity. The
session type MUST be OIAP

2 H2

20

TPM_NONCE

entitylastNonceEven

Even nonce previously generated by TPM

15

20

3 H2

20

TPM_NONCE

entitynonceOdd

Nonce generated by system associated with entityAuthHandle

16

1

4 H2

1

BOOL

continueEntitySession

Ignored, entityAuthHandle is always terminated.

17

20

TPM_AUTHDATA

entityAuth

The authorization session digest for the inputs and encrypted entity.
HMAC key: entity.usageAuth.

817Level 2 Revision 116 28 February 2011
818

171
TCG Published

819Copyright © TCG
820
821

TPM Main Part 3 Commands
Specification Version 1.2

3232Outgoing Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RSP_AUTH2_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

#

SZ

1

#

SZ

1S

4

TPM_RESULT

returnCode

The return code of the operation. See section 4.3.

2S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_ChangeAuth

4

4

3S

4

UINT32

outDataSize

The used size of the output area for outData

5

<>

4S

<>

BYTE[ ]

outData

The modified, encrypted entity.

6

20

2 H1

20

TPM_NONCE

nonceEven

Even nonce newly generated by TPM to cover outputs

3 H1

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with parentAuthHandle

4 H1

1

BOOL

continueAuthSession

Continue use flag, fixed value of FALSE

TPM_AUTHDATA

resAuth

The authorization session digest for the returned parameters and
parentHandle. HMAC key: parentKey.usageAuth.

7

1

8

20

9

20

1

11

20

TPM_NONCE

entityNonceEven

Even nonce newly generated by TPM to cover entity

3 H2
10

2 H2

20

TPM_NONCE

entitynonceOdd

Nonce generated by system associated with entityAuthHandle

4 H2

1

BOOL

continueEntitySession

Continue use flag, fixed value of FALSE

TPM_AUTHDATA

entityAuth

The authorization session digest for the returned parameters and entity.
HMAC key: entity.usageAuth, the original and not the new auth value

20

3233Description
32341. The parentAuthHandle session type MUST be TPM_PID_OSAP.
32352. In this capability, the SRK cannot be accessed as entityType TPM_ET_KEY, since the
3236
SRK is not wrapped by a parent key.
3237Actions
32381. Verify that entityType is one of TPM_ET_DATA, TPM_ET_KEY and return the error
3239
TPM_WRONG_ENTITYTYPE if not.
32402. Verify that parentAuthHandle session type is TPM_PID_OSAP return TPM_BAD_MODE
3241
on error
32423. Verify that entityAuthHandle session type is TPM_PID_OIAP return TPM_BAD_MODE on
3243
error
32444. If protocolID is not TPM_PID_ADCP, the TPM MUST return TPM_BAD_PARAMETER.
32455. The encData parameter MUST be the encData field from either the TPM_STORED_DATA
3246
or TPM_KEY structures.
32476. Create decryptAuth by decrypting newAuth according to the ADIP indicated by
3248
parentHandle.
32497. The TPM MUST validate the command using the AuthData in the parentAuth parameter
32508. Validate that parentHandle -> keyUsage is TPM_KEY_STORAGE, if not return
3251
TPM_INVALID_KEYUSAGE
822
823

172

Level 2 Revision 116 28 February 2011
TCG Published

824TPM Main Part 3 Commands

TCG © Copyright

825Specification Version 1.2

32529. After parameter validation, the TPM creates b1 by decrypting encData using the key
3253
pointed to by parentHandle.
325410.The TPM MUST validate that b1 is a
3255
TPM_STORE_ASYMKEY or a TPM_SEALED_DATA

valid

TPM

structure,

either

a

3256

a. Check the length and payload, return TPM_INVALID_STRUCTURE on any mismatch

3257
3258
3259

b. The TPM must validate the command using the authorization data entityAuth
parameter.
The HMAC key is TPM_STORE_ASYMKEY -> usageAuth or
TPM_SEALED_DATA -> authData.

326011.The TPM replaces the AuthData for b1 with decryptAuth created above.
326112.The TPM encrypts b1 using the appropriate mechanism for the type using the
3262
parentKeyHandle to provide the key information.
326313.The TPM MUST enforce the destruction of both the parentAuthHandle and
3264
entityAuthHandle sessions.

826Level 2 Revision 116 28 February 2011
827

173
TCG Published

828Copyright © TCG
829
830

326517.2

TPM Main Part 3 Commands
Specification Version 1.2

TPM_ChangeAuthOwner

3266Start of informative comment:
3267The TPM_ChangeAuthOwner command allows the owner of an entity to change the
3268AuthData for the TPM Owner or the SRK.
3269This command requires authorization from the current TPM Owner to execute.
3270TPM's targeted for an environment (e.g. a server) with long lasting sessions should not
3271invalidate all sessions.
3272End of informative comment.
3273Incoming Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of input bytes including paramSize and tag

3

4

1S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_ChangeAuthOwner

4

2

2S

2

TPM_PROTOCOL_ID

protocolID

The protocol in use.

5

20

3S

20

TPM_ENCAUTH

newAuth

The encrypted new AuthData for the entity

6

2

4S

2

TPM_ENTITY_TYPE

entityType

The type of entity to be modified

7

4

TPM_AUTHHANDLE

ownerAuthHandle

The authorization session handle used for the TPM Owner.

#

SZ

1

#

SZ

2H1

20

TPM_NONCE

authLastNonceEven

Even nonce previously generated by TPM to cover inputs

8

20

3H1

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with ownerAuthHandle

9

1

4H1

1

BOOL

continueAuthSession

Continue use flag the TPM ignores this value

10

20

TPM_AUTHDATA

ownerAuth

The authorization session digest for inputs and ownerHandle. HMAC key:
ownerAuth.

Type

Name

Description

3274Outgoing Operands and Sizes
PARAM

HMAC

#

SZ

#

SZ

1

2

TPM_TAG

tag

TPM_TAG_RSP_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

5
6

831
832

1
20

TPM_RESULT

returnCode

The return code of the operation.

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_ChangeAuthOwner

2H1

20

TPM_NONCE

nonceEven

Even nonce newly generated by TPM to cover outputs

3H1

20

4

2S
4

1S

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with ownerAuthHandle

4H1

1

BOOL

continueAuthSession

Continue use flag, fixed value of FALSE

TPM_AUTHDATA

resAuth

The authorization session digest for the returned parameters and
ownerHandle. HMAC key: ownerAuth, the original value and not the new
auth value

174

Level 2 Revision 116 28 February 2011
TCG Published

833TPM Main Part 3 Commands

TCG © Copyright

834Specification Version 1.2

3275Actions
32761. The TPM MUST validate the command using the AuthData in the ownerAuth parameter
32772. The ownerAuthHandle session type MUST be TPM_PID_OSAP
32783. If protocolID is not TPM_PID_ADCP, the TPM MUST return TPM_BAD_PARAMETER.
32794. Verify that entityType is either TPM_ET_OWNER or TPM_ET_SRK, and return the error
3280
TPM_WRONG_ENTITYTYPE if not.
32815. Create decryptAuth by decrypting newAuth according to the ADIP indicated by
3282
ownerAuthHandle.
32836. The TPM MUST enforce the destruction of the ownerAuthHandle session upon
3284
completion of this command (successful or unsuccessful). This includes setting
3285
continueAuthSession to FALSE
32867. Set the AuthData for the indicated entity to decryptAuth
32878. The TPM MUST invalidate all owner authorized OSAP and DSAP sessions, active or
3288
saved.
32899. The TPM MAY invalidate all sessions, active or saved

835Level 2 Revision 116 28 February 2011
836

175
TCG Published

837Copyright © TCG
838
839

329018.

TPM Main Part 3 Commands
Specification Version 1.2

Authorization Sessions

329118.1

TPM_OIAP

3292Incoming Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_COMMAND

2

4

UINT32

paramSize

Total number of input bytes including paramSize and tag

3

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_OIAP.

Type

Name

Description

#

SZ

1

#

1S

SZ

4

3293Outgoing Operands and Sizes
PARAM

HMAC

#

SZ

#

SZ

1

2

TPM_TAG

tag

TPM_TAG_RSP_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

1S

4

TPM_RESULT

returnCode

The return code of the operation.

2S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_OIAP.

4

4

TPM_AUTHHANDLE

authHandle

Handle that TPM creates that points to the authorization state.

5

20

TPM_NONCE

nonceEven

Nonce generated by TPM and associated with session.

3294Actions
32951. The TPM_OIAP command allows the creation of an authorization session handle and the
3296
tracking of the handle by the TPM. The TPM generates the handle and nonce.
32972. The TPM has an internal limit as to the number of handles that may be open at one
3298
time, so the request for a new handle may fail if there is insufficient space available.
32993. Internally the TPM will do the following:
3300
3301

a. TPM allocates space to save handle, protocol identification, both nonces and any
other information the TPM needs to manage the session.

3302

b. TPM generates authHandle and nonceEven, returns these to caller

33034. On each subsequent use of the OIAP session the TPM MUST generate a new nonceEven
3304
value.
33055. When TPM_OIAP is wrapped in an encrypted transport session, no input or output
3306
parameters are encrypted.

840
841

176

Level 2 Revision 116 28 February 2011
TCG Published

842TPM Main Part 3 Commands

TCG © Copyright

843Specification Version 1.2

3307
330818.1.1

Actions to validate an OIAP session

3309Start of informative comment:
3310This section describes the authorization-related actions of a TPM when it receives a
3311command that has been authorized with the OIAP protocol.
3312Many commands use OIAP authorization. The following description is therefore necessarily
3313abstract.
3314End of informative comment.
3315Actions
3316The TPM MUST perform the following operations:
33171. The TPM MUST verify that the authorization session handle (H, say) referenced in the
3318
command points to a valid session. If it does not, the TPM returns the error code
3319
TPM_INVALID_AUTHHANDLE
33202. The TPM SHALL retrieve the latest version of the caller’s nonce (nonceOdd) and
3321
continueAuthSession flag from the input parameter list, and store it in internal TPM
3322
memory with the authSession ‘H’.
33233. The TPM SHALL retrieve the latest version of the TPM’s nonce stored with the
3324
authorization session H (authLastNonceEven) computed during the previously executed
3325
command.
33264. The TPM MUST retrieve the secret AuthData (SecretE, say) of the target entity. The entity
3327
and its secret must have been previously loaded into the TPM.
3328

a. If the command using the OIAP session requires owner authorization

3329
3330

i. If TPM_STCLEAR_DATA -> ownerReference is TPM_KH_OWNER, the secret
AuthData is TPM_PERMANENT_DATA -> ownerAuth

3331

ii. If TPM_STCLEAR_DATA -> ownerReference is pointing to a delegate row

3332

(1) Set R1 a row index to TPM_STCLEAR_DATA -> ownerReference

3333
3334

(2) Set D1 a TPM_DELEGATE_TABLE_ROW to TPM_PERMANENT_DATA ->
delegateTable -> delRow[R1]

3335

(3) Set the secret AuthData to D1 -> authValue

3336

(4) Validate the TPM_DELEGATE_PUBLIC D1 -> pub

3337

(a)

Validate D1 -> pub -> permissions based on the command ordinal

3338

(b)

Validate D1 -> pub -> pcrInfo based on the PCR values

33395. The TPM SHALL perform a HMAC calculation using the entity secret data, ordinal, input
3340
command parameters and authorization parameters per Part 1 Object-Independent
3341
Authorization Protocol.
33426. The TPM SHALL compare HM to the AuthData value received in the input parameters. If
3343
they are different, the TPM returns the error code TPM_AUTHFAIL if the authorization
3344
session is the first session of a command, or TPM_AUTH2FAIL if the authorization
844Level 2 Revision 116 28 February 2011
845

177
TCG Published

846Copyright © TCG
847
848

3345
3346

TPM Main Part 3 Commands
Specification Version 1.2

session is the second session of a command. Otherwise, the TPM executes the command
which (for this example) produces an output that requires authentication.

33477. The TPM SHALL generate a nonce (nonceEven).
33488. The TPM creates an HMAC digest to authenticate the return code, return values and
3349
authorization parameters to the same entity secret per Part 1 Object-Independent
3350
Authorization Protocol.
33519. The TPM returns the return code, output parameters, authorization parameters and
3352
authorization session digest.
335310.If the output continueUse flag is FALSE, then the TPM SHALL terminate the session.
3354
Future references to H will return an error.
335511.Each time that access to an entity (e.g., key) is authorized using OIAP, the TPM MUST
3356
validate the TPM_PCR_INFO_xxx “…AtRelease” values if specified for the entity
3357
3358
3359

849
850

a. The TPM SHOULD validate the values before using the shared secret to validate the
command parameters. This prevents a dictionary attack on the shared secret when the
values are invalid for the entity.

178

Level 2 Revision 116 28 February 2011
TCG Published

851TPM Main Part 3 Commands

TCG © Copyright

852Specification Version 1.2

336018.2

TPM_OSAP

3361Start of informative comment:
3362The TPM_OSAP command creates the authorization session handle, the shared secret and
3363generates nonceEven and nonceEvenOSAP.
3364End of informative comment.
3365Incoming Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_COMMAND

2

4

UINT32

paramSize

Total number of input bytes including paramSize and tag

3

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_OSAP.

4

2

TPM_ENTITY_TYPE

entityType

The type of entity in use

5

4

UINT32

entityValue

The selection value based on entityType, e.g. a keyHandle #

6

20

TPM_NONCE

nonceOddOSAP

The nonce generated by the caller associated with the shared secret.

#

SZ

1

#

SZ

1S

4

3366Outgoing Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RSP_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

#

SZ

1

#

SZ

1S

4

TPM_RESULT

returnCode

The return code of the operation.

2S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_OSAP.

4

4

TPM_AUTHHANDLE

authHandle

Handle that TPM creates that points to the authorization state.

5

20

TPM_NONCE

nonceEven

Nonce generated by TPM and associated with session.

6

20

TPM_NONCE

nonceEvenOSAP

Nonce generated by TPM and associated with shared secret.

3367Description
33681. The TPM_OSAP command allows the creation of an authorization session handle and the
3369
tracking of the handle by the TPM. The TPM generates the handle, nonceEven and
3370
nonceEvenOSAP.
33712. The TPM has an internal limit on the number of handles that may be open at one time,
3372
so the request for a new handle may fail if there is insufficient space available.
33733. The TPM_OSAP allows the binding of an authorization to a specific entity. This allows
3374
the caller to continue to send in AuthData for each command but not have to request
3375
the information or cache the actual AuthData.
33764. When TPM_OSAP is wrapped in an encrypted transport session, no input or output
3377
parameters are encrypted.
33785. If the owner pointer is pointing to a delegate row, the TPM internally MUST treat the
3379
OSAP session as a DSAP session
853Level 2 Revision 116 28 February 2011
854

179
TCG Published

855Copyright © TCG
856
857

TPM Main Part 3 Commands
Specification Version 1.2

33806. TPM_ET_SRK or TPM_ET_KEYHANDLE with a value of TPM_KH_SRK MUST specify the
3381
SRK.
33827. If the entity is tied to PCR values, the PCR’s are not validated during the TPM_OSAP
3383
ordinal session creation. The PCR’s are validated when the OSAP session is used.
3384Actions
33851. The TPM creates S1 a storage area that keeps track of the information associated with
3386
the authorization.
33872. S1 MUST track the following information
3388

a. Protocol identification (i.e. TPM_PID_OSAP)

3389

b. nonceEven

3390

i.

Initialized to the next value from the TPM RNG

3391

c. shared secret

3392

d. ADIP encryption scheme from TPM_ENTITY_TYPE entityType

3393

e. Any other internal TPM state the TPM needs to manage the session

33943. The TPM MUST create and MAY track the following information
3395

a. nonceEvenOSAP

3396
33974.
3398
3399
3400
3401

i.

Initialized to the next value from the TPM RNG

The TPM calculates the shared secret using an HMAC calculation. The key for the HMAC
calculation is the secret AuthData assigned to the key handle identified by entityValue.
The input to the HMAC calculation is the concatenation of nonces nonceEvenOSAP and
nonceOddOSAP. The output of the HMAC calculation is the shared secret which is saved
in the authorization area associated with authHandle

34025. Check if the ADIP encryption scheme specified by entityType is supported, if not return
3403
TPM_INAPPROPRIATE_ENC.
34046. If entityType = TPM_ET_KEYHANDLE
3405
3406

a. The entity to authorize is a key held in the TPM. entityValue contains the keyHandle
that holds the key.

3407

b. If entityValue is TPM_KH_OPERATOR return TPM_BAD_HANDLE

34087. else if entityType = TPM_ET_OWNER
3409

a. This value indicates that the entity is the TPM owner. entityValue is ignored

3410
3411

b. The HMAC key is the secret pointed to by ownerReference (owner secret or delegated
secret)

34128. else if entityType = TPM_ET_SRK
3413

a. The entity to authorize is the SRK. entityValue is ignored.

34149. else if entityType = TPM_ET_COUNTER
3415

a. The entity is a monotonic counter, entityValue contains the counter handle

341610.else if entityType = TPM_ET_NV
858
859

180

Level 2 Revision 116 28 February 2011
TCG Published

860TPM Main Part 3 Commands

TCG © Copyright

861Specification Version 1.2

3417

a. The entity is a NV index, entityValue contains the NV index

341811.else return TPM_BAD_PARAMETER
341912.On each subsequent use of the OSAP session the TPM MUST generate a new nonce
3420
value.
342113.The TPM MUST ensure that OSAP shared secret is only available while the OSAP session
3422
is valid.
342314.The session MUST terminate upon any of the following conditions:
3424

a. The command that uses the session returns an error

3425

b. The resource is evicted from the TPM or otherwise invalidated

3426
3427

c. The session is used in any command for which the shared secret is used to encrypt
an input parameter (TPM_ENCAUTH)

3428

d. The TPM Owner is cleared

3429
3430

e. TPM_ChangeAuthOwner is executed and this session is attached to the owner
authorization

3431
3432

f. The
session
TPM_FlushSpecific

3433
3434

g. All OSAP sessions associated with the delegation table MUST be invalidated when
any of the following commands execute:

explicitly

terminated

with

continueAuth,

3435

i.

3436

ii. TPM_Delegate_CreateOwnerDelegation with Increment==TRUE

3437

iii. TPM_Delegate_LoadOwnerDelegation

TPM_Delegate_Manage

862Level 2 Revision 116 28 February 2011
863

181
TCG Published

TPM_Reset

or

864Copyright © TCG
865
866

TPM Main Part 3 Commands
Specification Version 1.2

3438
343918.2.1

Actions to validate an OSAP session

3440Start of informative comment:
3441This section describes the authorization-related actions of a TPM when it receives a
3442command that has been authorized with the OSAP protocol.
3443Many commands use OSAP authorization. The following description is therefore necessarily
3444abstract.
3445End of informative comment
3446Actions
34471. On reception of a command with ordinal C1 that uses an authorization session, the TPM
3448
SHALL perform the following actions:
34492. The TPM MUST have been able to retrieve the shared secret (Shared, say) of the target
3450
entity when the authorization session was established with TPM_OSAP. The entity and
3451
its secret must have been previously loaded into the TPM.
34523. The TPM MUST verify that the authorization session handle (H, say) referenced in the
3453
command points to a valid session. If it does not, the TPM returns the error code
3454
TPM_INVALID_AUTHHANDLE.
34554. The TPM MUST calculate the HMAC (HM1, say) of the command parameters according
3456
to Part 1 Object-Specific Authorization Protocol.
34575.
3458
3459
3460
3461

The TPM SHALL compare HM1 to the AuthData value received in the command. If they
are different, the TPM returns the error code TPM_AUTHFAIL if the authorization session
is the first session of a command, or TPM_AUTH2FAIL if the authorization session is the
second session of a command., the TPM executes command C1 which produces an
output (O, say) that requires authentication and uses a particular return code (RC, say).

34626. The TPM SHALL generate the latest version of the even nonce (nonceEven).
34637. The TPM MUST calculate the HMAC (HM2) of the return parameters according to section
3464
Part 1 Object-Specific Authorization Protocol.
34658. The TPM returns HM2 in the parameter list.
34669. The TPM SHALL retrieve the continue flag from the received command. If the flag is
3467
FALSE, the TPM SHALL terminate the session and destroy the thread associated with
3468
handle H.
346910.If the shared secret was used to provide confidentiality for data in the received
3470
command, the TPM SHALL terminate the session and destroy the thread associated with
3471
handle H.
347211.Each time that access to an entity (e.g., key) is authorized using OSAP, the TPM MUST
3473

a. ensure that the OSAP shared secret is that derived from the entity using TPM_OSAP

3474

b. validate the TPM_PCR_INFO_xxx “…AtRelease” values if specified for the entity

867
868

182

Level 2 Revision 116 28 February 2011
TCG Published

869TPM Main Part 3 Commands

TCG © Copyright

870Specification Version 1.2

3475
3476
3477

i. The TPM SHOULD validate the values before using the shared secret to
validate the command parameters. This prevents a dictionary attack on the
shared secret when the values are invalid for the entity.

871Level 2 Revision 116 28 February 2011
872

183
TCG Published

873Copyright © TCG
874
875

347818.3

TPM Main Part 3 Commands
Specification Version 1.2

TPM_DSAP

3479Start of informative comment:
3480The TPM_DSAP command creates the authorization session handle using a delegated
3481AuthData value passed into the command as an encrypted blob or from the internal
3482delegation table. It can be used to start an authorization session for a user key or the
3483owner.
3484As in TPM_OSAP, it generates a shared secret and generates nonceEven and
3485nonceEvenOSAP.
3486End of informative comment.
3487Incoming Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_COMMAND

2

4

UINT32

paramSize

Total number of input bytes including paramSize and tag

3

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_DSAP.

4

2

TPM_ENTITY_TYPE

entityType

The type of delegation information to use

5

4

TPM_KEY_HANDLE

keyHandle

Key for which delegated authority corresponds, or 0 if delegated owner activity.
Only relevant if entityValue equals TPM_DELEGATE_KEY_BLOB

6

20

TPM_NONCE

nonceOddDSAP

The nonce generated by the caller associated with the shared secret.

7

4

UINT32

entityValueSize

The size of entityValue.

#

SZ

1

8

<>

#

SZ

1S

2S

4

<>

BYTE [ ]

entityValue

Either TPM_DELEGATE_KEY_BLOB or TPM_DELEGATE_OWNER_BLOB or index
MUST not be empty
If entityType is TPM_ET_DEL_ROW then entityValue is a TPM_DELEGATE_INDEX

3488Outgoing Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RSP_COMMAND

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

#

SZ

1
2
3

4

#

SZ

1S

4

TPM_RESULT

returnCode

The return code of the operation.

2S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_DSAP.

4

4

TPM_AUTHHANDLE

authHandle

Handle that TPM creates that points to the authorization state.

5

20

TPM_NONCE

nonceEven

Nonce generated by TPM and associated with session.

6

20

TPM_NONCE

nonceEvenDSAP

Nonce generated by TPM and associated with shared secret.

3489Description
34901. The TPM_DSAP command allows the creation of an authorization session handle and the
3491
tracking of the handle by the TPM. The TPM generates the handle, nonceEven and
3492
nonceEvenOSAP.

876
877

184

Level 2 Revision 116 28 February 2011
TCG Published

878TPM Main Part 3 Commands

TCG © Copyright

879Specification Version 1.2

34932. The TPM has an internal limit on the number of handles that may be open at one time,
3494
so the request for a new handle may fail if there is insufficient space available.
34953. The TPM_DSAP allows the binding of a delegated authorization to a specific entity. This
3496
allows the caller to continue to send in AuthData for each command but not have to
3497
request the information or cache the actual AuthData.
34984. Each ordinal that uses the DSAP session MUST validate that TPM_PERMANENT_DATA
3499
-> restrictDelegate does not restrict delegation, based on keyHandle -> keyUsage and
3500
keyHandle -> keyFlags, return TPM_INVALID_KEYUSAGE on error.
35015. On each subsequent use of the DSAP session the TPM MUST generate a new nonce
3502
value and check if the ordinal to be executed has delegation to execute. The TPM MUST
3503
ensure that the DSAP shared secret is only available while the DSAP session is valid.
35046. When TPM_DSAP is wrapped in an encrypted transport session
3505

a. For input the only parameter encrypted is entityValue

3506

b. For output no parameters are encrypted

35077. The DSAP session MUST terminate under any of the following conditions
3508

a. The command that uses the session returns an error

3509

b. If attached to a key, when the key is evicted from the TPM or otherwise invalidated

3510
3511

c. The session is used in any command for which the shared secret is used to encrypt
an input parameter (TPM_ENCAUTH)

3512

d. The TPM Owner is cleared

3513
3514

e. TPM_ChangeAuthOwner is executed and this session is attached to the owner
authorization

3515
3516

f. The
session
TPM_FlushSpecific

3517
3518

g. All DSAP sessions MUST be invalidated when any of the following commands
execute:

explicitly

terminated

3519

i.

3520

TPM_Reset

or

iii. TPM_Delegate_LoadOwnerDelegation

3522

continueAuth,

ii. When Increment is TRUE

3521

with

iv. TPM_Delegate_Manage

TPM_Delegate_CreateOwnerDelegation

3523entityType = TPM_ET_DEL_OWNER_BLOB
3524

The entityValue parameter contains an owner delegation blob structure.

3525entityType = TPM_ET_DEL_ROW
3526
3527

The entityValue parameter contains a row number in the nv Delegation table which
should be used for the AuthData value.

3528entityType = TPM_DEL_KEY_BLOB
3529

The entityValue parameter contains a key delegation blob structure.

880Level 2 Revision 116 28 February 2011
881

185
TCG Published

882Copyright © TCG
883
884

TPM Main Part 3 Commands
Specification Version 1.2

3530Actions
35311. If entityType == TPM_ET_DEL_OWNER_BLOB
3532

a. Map entityValue to B1 a TPM_DELEGATE_OWNER_BLOB

3533
3534

b. Validate
that
B1
is
a
valid
TPM_WRONG_ENTITYTYPE on error

3535
3536

c. Locate B1 -> pub -> familyID in the TPM_FAMILY_TABLE and set familyRow to
indicate row, return TPM_BADINDEX if not found

3537

d. Set FR to TPM_FAMILY_TABLE.famTableRow[familyRow]

3538

e. If FR -> flags TPM_FAMFLAG_ENABLED is FALSE, return TPM_DISABLED_CMD

3539

f. Verify that B1->verificationCount equals FR -> verificationCount.

3540

g. Validate the integrity of the blob

TPM_DELEGATE_OWNER_BLOB,

3541

i.

3542

ii. Set B1 -> integrityDigest to all zeros

3543

iii. Create H3 the HMAC of B1 using tpmProof as the secret

3544

return

iv. Compare H2 to H3 return TPM_AUTHFAIL on mismatch

Copy B1 -> integrityDigest to H2

3545
3546

h. Create S1 a TPM_DELEGATE_SENSITIVE by decrypting B1 -> sensitiveArea using
TPM_DELEGATE_KEY

3547

i.

Validate S1 values

3548

i.

3549

ii. Return TPM_BAD_DELEGATE on error

3550

j.

S1 -> tag is TPM_TAG_DELEGATE_SENSITIVE

Set A1 to S1 -> authValue

35512. Else if entityType == TPM_ET_DEL_ROW
3552

a. Verify that entityValue points to a valid row in the delegation table.

3553

b. Set D1 to the delegation information in the row.

3554

c. Set A1 to D1->authValue.

3555
3556

d. Locate D1 -> familyID in the TPM_FAMILY_TABLE and set familyRow to indicate that
row, return TPM_BADINDEX if not found

3557

e. Set FR to TPM_FAMILY_TABLE.famTableRow[familyRow]

3558

f. If FR -> flags TPM_FAMFLAG_ENABLED is FALSE, return TPM_DISABLED_CMD

3559

g. Verify that D1->verificationCount equals FR -> verificationCount.

35603. Else if entityType == TPM_ET_DEL_KEY_BLOB
3561

a. Map entityValue to K1 a TPM_DELEGATE_KEY_BLOB

3562
3563

b. Validate
that
K1
is
a
TPM_WRONG_ENTITYTYPE on error

3564
3565

c. Locate K1 -> pub -> familyID in the TPM_FAMILY_TABLE and set familyRow to
indicate that row, return TPM_BADINDEX if not found

885
886

valid

186

TPM_DELEGATE_KEY_BLOB,

return

Level 2 Revision 116 28 February 2011
TCG Published

887TPM Main Part 3 Commands

TCG © Copyright

888Specification Version 1.2

3566

d. Set FR to TPM_FAMILY_TABLE.famTableRow[familyRow]

3567

e. If FR -> flags TPM_FAMFLAG_ENABLED is FALSE, return TPM_DISABLED_CMD

3568

f. Verify that K1 -> pub -> verificationCount equals FR -> verificationCount.

3569

g. Validate the integrity of the blob

3570

i.

3571

ii. Set K1 -> integrityDigest to all zeros

3572

iii. Create H3 the HMAC of K1 using tpmProof as the secret

3573

iv. Compare H2 to H3 return TPM_AUTHFAIL on mismatch

Copy K1 -> integrityDigest to H2

3574
3575

h. Validate that K1 -> pubKeyDigest identifies keyHandle, return TPM_KEYNOTFOUND
on error

3576
3577

i. Create S1 a TPM_DELEGATE_SENSITIVE by decrypting K1 -> sensitiveArea using
TPM_DELEGATE_KEY

3578

j.

Validate S1 values

3579

i.

3580

ii. Return TPM_BAD_DELEGATE on error

3581

S1 -> tag is TPM_TAG_DELEGATE_SENSITIVE

k. Set A1 to S1 -> authValue

35824. Else return TPM_BAD_PARAMETER
35835. Generate a new authorization session handle and reserve space to save protocol
3584
identification, shared secret, pcrInfo, both nonces, ADIP encryption scheme, delegated
3585
permission bits and any other information the TPM needs to manage the session.
35866. Read two new values from the RNG to generate nonceEven and nonceEvenOSAP.
35877.
3588
3589
3590

The TPM calculates the shared secret using an HMAC calculation. The key for the HMAC
calculation is A1. The input to the HMAC calculation is the concatenation of nonces
nonceEvenOSAP and nonceOddOSAP. The output of the HMAC calculation is the shared
secret which is saved in the authorization area associated with authHandle.

889Level 2 Revision 116 28 February 2011
890

187
TCG Published

891Copyright © TCG
892
893

359118.4

TPM Main Part 3 Commands
Specification Version 1.2

TPM_SetOwnerPointer

3592Start of informative comment:
3593This command will set a reference to which secret the TPM will use when executing an
3594owner secret related OIAP or OSAP session.
3595This command should only be used to provide an owner delegation function for legacy code
3596that does not itself support delegation. Normally, TPM_STCLEAR_DATA->ownerReference
3597points to TPM_KH_OWNER, indicating that OIAP and OSAP sessions should use the owner
3598authorization. This command allows ownerReference to point to an index in the delegation
3599table, indicating that OIAP and OSAP sessions should use the delegation authorization.
3600In use, a TSS supporting delegation would create and load the owner delegation and set the
3601owner pointer to that delegation. From then on, a legacy TSS application would use its OIAP
3602and OSAP sessions with the delegated owner authorization.
3603Since this command is not authorized, the ownerReference is open to DoS attacks.
3604Applications can attempt to recover from a failing owner authorization by resetting
3605ownerReference to an appropriate value.
3606This command intentionally does not clear OSAP sessions. A TPM 1.1 application gets the
3607benefit of owner delegation, while the original owner can use a pre-existing OSAP session
3608with the actual owner authorization.
3609End of informative comment.
3610Incoming Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_COMMAND

2

4

UINT32

paramSize

Total number of input bytes including paramSize and tag

3

4

1S

4

TPM_COMMAND_CODE

ordinal

Ordinal: TPM_ORD_SetOwnerPointer

4

2

2S

2

TPM_ENTITY_TYPE

entityType

The type of entity in use

5

4

3S

4

UINT32

entityValue

The selection value based on entityType

#

SZ

1

#

SZ

3611Outgoing Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RSP_COMMAND

2

4

UINT32

paramSize

Total number of output bytes

3

4

#

SZ

1

#

SZ

1S

4

TPM_RESULT

returnCode

The return code of the operation

2S

4

TPM_COMMAND_CODE

ordinal

Ordinal: TPM_ORD_SetOwnerPointer

3612Actions
36131. Map TPM_STCLEAR_DATA to V1
36142. If entityType = TPM_ET_DEL_ROW
894
895

188

Level 2 Revision 116 28 February 2011
TCG Published

896TPM Main Part 3 Commands

TCG © Copyright

897Specification Version 1.2

3615
3616

a. This value indicates that the entity is a delegate row. entityValue is a delegate index
in the delegation table.

3617
3618

b. Validate that entityValue points to a legal row within the delegate table stored within
the TPM. If not return TPM_BADINDEX

3619

i.

Set D1 to the delegation information in the row.

3620
3621

c. Locate D1 -> familyID in the TPM_FAMILY_TABLE and set familyRow to indicate that
row, return TPM_BADINDEX if not found.

3622

d. Set FR to TPM_FAMILY_TABLE.famTableRow[familyRow]

3623

e. If FR -> flags TPM_FAMFLAG_ENABLED is FALSE, return TPM_DISABLED_CMD

3624

f. Verify that B1->verificationCount equals FR -> verificationCount.

3625

g. The TPM sets V1-> ownerReference to entityValue

3626

h. Return TPM_SUCCESS

36273. else if entityType = TPM_ET_OWNER
3628

a. This value indicates that the entity is the TPM owner. entityValue is ignored.

3629

b. The TPM sets V1-> ownerReference to TPM_KH_OWNER

3630

c. Return TPM_SUCCESS

36314. Return TPM_BAD_PARAMETER

898Level 2 Revision 116 28 February 2011
899

189
TCG Published

900Copyright © TCG
901
902

363219.
363319.1

TPM Main Part 3 Commands
Specification Version 1.2

Delegation Commands
TPM_Delegate_Manage

3634Start of informative comment:
3635TPM_Delegate_Manage is the fundamental process for managing the Family tables,
3636including
enabling/disabling
Delegation
for
a
selected
Family.
Normally
3637TPM_Delegate_Manage must be executed at least once (to create Family tables for a
3638particular family) before any other type of Delegation command in that family can succeed.
3639TPM_Delegate_Manage is authorized by the TPM Owner if an Owner is installed, because
3640changing a table is a privileged Owner operation. If no Owner is installed,
3641TPM_Delegate_Manage requires no privilege to execute. This does not disenfranchise an
3642Owner, since there is no Owner, and simplifies loading of tables during platform
3643manufacture or on first-boot. Burn-out of TPM non-volatile storage by inappropriate use is
3644mitigated by the TPM’s normal limits on NV-writes in the absence of an Owner. Tables can
3645be locked after loading, to prevent subsequent tampering, and only unlocked by the Owner,
3646his delegate, or the act of removing the Owner (even if there is no Owner).
3647TPM_Delegate_Manage command is customized by opCode:
3648(1) TPM_FAMILY_ENABLE enables/disables use of a family and all the rows of the delegate
3649table belonging to that family,
3650(2) TPM_FAMILY_ADMIN can be used to prevent further management of the Tables until an
3651Owner is installed, or until the Owner is removed from the TPM. (Note that the Physical
3652Presence command TPM_ForceClear always enables further management, even if
3653TPM_ForceClear is used when no Owner is installed.)
3654 (3) TPM_FAMILY_CREATE creates a new family. Sessions are invalidated even in this case
3655because the lastFamilyID could wrap.
3656(4) TPM_FAMILY_INVALIDATE invalidates an existing family. The TPM_SELFTEST_FAILED
3657error code is returned because the familyRow has already been validated earlier. Failure
3658here indicates a malfunction of the TPM.
3659The rationale for Action 19.1 is that invalidating the family ID prevents the use of
3660associated delegate rows, whether or not those delegate rows are themselves invalidated.
3661Omitting the delegate row invalidation avoids an NV write.
3662End of informative comment.

903
904

190

Level 2 Revision 116 28 February 2011
TCG Published

905TPM Main Part 3 Commands

TCG © Copyright

906Specification Version 1.2

3663Incoming Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of input bytes including paramSize and tag

3

4

1S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_Delegate_Manage

4

4

2S

4

TPM_FAMILY_ID

familyID

The familyID that is to be managed

5

4

3s

4

TPM_FAMILY_OPERATION

opCode

Operation to be performed by this command.

6

4

4s

4

UINT32

opDataSize

Size in bytes of opData

7

<>

5s

<>

BYTE [ ]

opData

Data necessary to implement opCode

8

4

TPM_AUTHHANDLE

authHandle

The authorization session handle used for owner authentication.

2H1

20

TPM_NONCE

authLastNonceEven

Even nonce previously generated by TPM to cover inputs

#

SZ

1

#

SZ

9

20

3H1

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

10

1

4H1

1

BOOL

continueAuthSession

The continue use flag for the authorization session handle

11

20

TPM_AUTHDATA

ownerAuth

HMAC key: ownerAuth.

3664Outgoing Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RSP_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

#

SZ

1

#

SZ

1S

4

TPM_RESULT

returnCode

The return code of the operation

2S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_Delegate_Manage

4

4

3S

4

UINT32

retDataSize

Size in bytes of retData

5

<>

4S

<>

BYTE [ ]

retData

Returned data

6

20

2H1

20

TPM_NONCE

nonceEven

Even nonce newly generated by TPM to cover outputs

3H1

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

4H1

1

BOOL

continueAuthSession

Continue use flag, TRUE if handle is still active

TPM_AUTHDATA

resAuth

HMAC key: ownerAuth.

7

1

8

20

3665Action
36661. If opCode != TPM_FAMILY_CREATE
3667
3668

a. Locate familyID in the TPM_FAMILY_TABLE and set familyRow to indicate row,
return TPM_BADINDEX if not found

3669
3670

b. Set FR, a TPM_FAMILY_TABLE_ENTRY, to TPM_FAMILY_TABLE. famTableRow
[familyRow]

36712. If tag = TPM_TAG_RQU_AUTH1_COMMAND
3672
3673

a. Validate the command and parameters using ownerAuth, return TPM_AUTHFAIL on
error

907Level 2 Revision 116 28 February 2011
908

191
TCG Published

909Copyright © TCG
910
911

3674
3675

TPM Main Part 3 Commands
Specification Version 1.2

b. If the command is delegated (authHandle session type is TPM_PID_DSAP or through
ownerReference delegation)

3676

i.

3677

If opCode = TPM_FAMILY_CREATE
(1)

3678

The TPM MUST ignore familyID

ii. Else

3679
3680

(1)
Verify that the familyID associated with authHandle matches the
familyID parameter, return TPM_DELEGATE_FAMILY on error

36813. Else
3682

a. If TPM_PERMANENT_DATA -> ownerAuth is valid, return TPM_AUTHFAIL

3683
3684

b. If
opCode
!=
TPM_FAMILY_CREATE
and
FR
->
TPM_DELEGATE_ADMIN_LOCK is TRUE, return TPM_DELEGATE_LOCK

3685

c. Validate max NV writes without an owner

flags

3686

i.

3687

ii. Increment NV1 by 1

3688

iii. If NV1 > TPM_MAX_NV_WRITE_NOOWNER return TPM_MAXNVWRITES

3689

->

iv. Set TPM_PERMANENT_DATA -> noOwnerNVWrite to NV1

Set NV1 to TPM_PERMANENT_DATA -> noOwnerNVWrite

36904. The TPM invalidates sessions
3691

a. MUST invalidate all DSAP sessions

3692

b. MUST invalidate all OSAP sessions associated with the delegation table

3693

c. MUST set TPM_STCLEAR_DATA -> ownerReference to TPM_KH_OWNER

3694

d. MAY invalidate any other session

36955. If opCode == TPM_FAMILY_CREATE
3696
3697

a. Validate that sufficient space exists within the TPM to store an additional family and
map F2 to the newly allocated space.

3698

b. Validate that opData is a TPM_FAMILY_LABEL

3699
3700

i.

If opDataSize != sizeof(TPM_FAMILY_LABEL) return TPM_BAD_PARAM_SIZE

c. Map F2 to a TPM_FAMILY_TABLE_ENTRY

3701

i.

3702

ii. Set F2 -> familyLabel to opData

Set F2 -> tag to TPM_TAG_FAMILY_TABLE_ENTRY

3703

d. Increment TPM_PERMANENT_DATA -> lastFamilyID by 1

3704

e. Set F2 -> familyID = TPM_PERMANENT_DATA -> lastFamilyID

3705

f. Set F2 -> verificationCount = 1

3706

g. Set F2 -> flags -> TPM_FAMFLAG_ENABLED to FALSE

3707

h. Set F2 -> flags -> TPM_DELEGATE_ADMIN_LOCK to FALSE

3708

i.

912
913

Set retDataSize = 4

192

Level 2 Revision 116 28 February 2011
TCG Published

914TPM Main Part 3 Commands

TCG © Copyright

915Specification Version 1.2

3709

j.

3710

k. Return TPM_SUCCESS

Set retData = F2 -> familyID

37116. If authHandle is of type DSAP then continueAuthSession MUST set to FALSE
37127. If opCode == TPM_FAMILY_ADMIN
3713

a. Validate that opDataSize == 1, and that opData is a Boolean value.

3714

b. Set (FR -> flags -> TPM_DELEGATE_ADMIN_LOCK) = opData

3715

c. Set retDataSize = 0

3716

d. Return TPM_SUCCESS

37178. else If opCode == TPM_FAMILY_ENABLE
3718

a. Validate that opDataSize == 1, and that opData is a Boolean value.

3719

b. Set FR -> flags-> TPM_FAMFLAG_ENABLED = opData

3720

c. Set retDataSize = 0

3721

d. Return TPM_SUCCESS

37229. else If opCode == TPM_FAMILY_INVALIDATE
3723

a. Invalidate all data associated with familyRow

3724

i.

3725

ii. return TPM_SELFTEST_FAILED on failure

3726

b. The TPM MAY invalidate delegate rows that contain the same familyID.

All data is all information pointed to by FR

3727

c. Set retDataSize = 0

3728

d. Return TPM_SUCCESS

372910.Else return TPM_BAD_PARAMETER

916Level 2 Revision 116 28 February 2011
917

193
TCG Published

918Copyright © TCG
919
920

373019.2

TPM Main Part 3 Commands
Specification Version 1.2

TPM_Delegate_CreateKeyDelegation

3731Start of informative comment:
3732This command delegates privilege to use a key by creating a blob that can be used by
3733TPM_DSAP.
3734There is no check for appropriateness of the key’s key usage against the key permission
3735settings. If the key usage is incorrect, this command succeeds, but the delegated command
3736will fail.
3737These blobs CANNOT be used as input data for TPM_LoadOwnerDelegation because the
3738internal TPM delegate table can store owner delegations only.
3739(TPM_Delegate_CreateOwnerDelegation must be used to delegate Owner privilege.)
3740The publicInfo -> familyID can specify a disabled family row. The family row is checked
3741when the key delegation is used in a DSAP session, not when it is created.
3742End of informative comment.
3743Incoming Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_AUTH1_COMMAND

4

UINT32

paramSize

Total number of input bytes including paramSize and tag

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_Delegate_CreateKeyDelegation.

TPM_KEY_HANDLE

keyHandle

The keyHandle identifier of a loaded key.

<>

TPM_DELEGATE_PUBLIC

publicInfo

The public information necessary to fill in the blob

3S

20

TPM_ENCAUTH

delAuth

The encrypted new AuthData for the blob. The encryption key is the
shared secret from the authorization session protocol.

TPM_AUTHHANDLE

authHandle

The authorization session handle used for keyHandle authorization

2H1

20

TPM_NONCE

authLastNonceEven

Even nonce previously generated by TPM to cover inputs

#

SZ

#

1
2
3

4

4

4

5

<>

2S

6

20

7

4

1S

SZ

4

8

20

3H1

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

9

1

4H1

1

BOOL

continueAuthSession

Ignored

10

20

TPM_AUTHDATA

privAuth

The authorization session digest that authorizes the use of keyHandle.
HMAC key: key.usageAuth

3744

921
922

194

Level 2 Revision 116 28 February 2011
TCG Published

923TPM Main Part 3 Commands

TCG © Copyright

924Specification Version 1.2

3745Outgoing Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RSP_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

#

SZ

1

#

SZ

1S

4

TPM_RESULT

returnCode

The return code of the operation.

2S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_Delegate_CreateKeyDelegation

4

4

3S

4

UINT32

blobSize

The length of the returned blob

5

<>

4S

<>

TPM_DELEGATE_KEY_BLOB

blob

The partially encrypted delegation information.

6

20

2H1

20

TPM_NONCE

nonceEven

Even nonce newly generated by TPM to cover outputs

3H1

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

4H1

1

BOOL

continueAuthSession

Continue use flag. Fixed value of FALSE

TPM_AUTHDATA

resAuth

The authorization session digest for the returned parameters. HMAC key:
key.usageAuth

7

1

8

20

3746Description
37471. The use restrictions that may be present on the key pointed to by keyHandle are not
3748
enforced for this command. Stated another way, TPM_CreateKeyDelegation is not a use
3749
of the key.
3750Action
37511. Verify AuthData for the command and parameters using privAuth
37522. Locate publicInfo -> familyID in the TPM_FAMILY_TABLE and set familyRow to indicate
3753
row, return TPM_BADINDEX if not found
37543. If the key authentication is in fact a delegation, then the TPM SHALL validate the
3755
command and parameters using Delegation authorisation, then
3756
3757

a. Validate that authHandle -> familyID equals publicInfo -> familyID return
TPM_DELEGATE_FAMILY on error

3758
3759

b. If TPM_FAMILY_TABLE.famTableRow[ authHandle -> familyID] ->
TPM_FAMFLAG_ENABLED is FALSE, return error TPM_DISABLED_CMD.

3760
3761

c. Verify that the delegation bits in publicInfo do not grant more permissions then
currently delegated. Otherwise return error TPM_AUTHFAIL

flags

->

37624. Check that publicInfo -> delegateType is TPM_DEL_KEY_BITS
37635. Verify that authHandle indicates
3764
TPM_INVALID_AUTHHANDLE on error

an

OSAP

or

DSAP

session

return

37656. Create a1 by decrypting delAuth according to the ADIP indicated by authHandle.
37667. Create h1 the SHA-1 of TPM_STORE_PUBKEY structure of the key pointed to by
3767
keyHandle
37688. Create M1 a TPM_DELEGATE_SENSITIVE structure
3769

a. Set M1 -> tag to TPM_TAG_DELEGATE_SENSITIVE

925Level 2 Revision 116 28 February 2011
926

195
TCG Published

927Copyright © TCG
928
929

TPM Main Part 3 Commands
Specification Version 1.2

3770

b. Set M1 -> authValue to a1

3771
3772

c. The TPM MAY add additional information of a sensitive nature relative to the
delegation

37739. Create M2 the encryption of M1 using TPM_DELEGATE_KEY
377410.Create P1 a TPM_DELEGATE_KEY_BLOB
3775

a. Set P1 -> tag to TPM_TAG_DELG_KEY_BLOB

3776

b. Set P1 -> pubKeyDigest to H1

3777

c. Set P1 -> pub to PublicInfo

3778

d. Set P1 -> pub -> verificationCount to familyRow -> verificationCount

3779

e. Set P1 -> integrityDigest to all zeros

3780
3781
3782

f. The TPM sets additionalArea and additionalAreaSize appropriate for this TPM. The
information MAY include symmetric IV, symmetric mode of encryption and other data
that allows the TPM to process the blob in the future.

3783

g. Set P1 -> sensitiveSize to the size of M2

3784

h. Set P1 -> sensitiveArea to M2

378511.Calculate H2 the HMAC of P1 using tpmProof as the secret
378612.Set P1 -> integrityDigest to H2
378713.Ignore continueAuthSession on input set continueAuthSession to FALSE on output
378814.Return P1 as blob

930
931

196

Level 2 Revision 116 28 February 2011
TCG Published

932TPM Main Part 3 Commands

TCG © Copyright

933Specification Version 1.2

378919.3

TPM_Delegate_CreateOwnerDelegation

3790Start of informative comment:
3791TPM_Delegate_CreateOwnerDelegation delegates the Owner’s privilege to use a set of
3792command ordinals, by creating a blob. Such blobs can be used as input data for TPM_DSAP
3793or TPM_Delegate_LoadOwnerDelegation.
3794TPM_Delegate_CreateOwnerDelegation includes the ability to void all existing delegations
3795(by incrementing the verification count) before creating the new delegation. This ensures
3796that the new delegation will be the only delegation that can operate at Owner privilege in
3797this family. This new delegation could be used to enable a security monitor (a local separate
3798entity, or remote separate entity, or local host entity) to reinitialize a family and perhaps
3799perform external verification of delegation settings. Normally the ordinals for a delegated
3800security monitor would include TPM_Delegate_CreateOwnerDelegation (this command) in
3801order
to
permit
the
monitor
to
create
further
delegations,
and
3802TPM_Delegate_UpdateVerification to reactivate some previously voided delegations.
3803If the verification count is incremented and the new delegation does not delegate any
3804privileges (to any ordinals) at all, or uses an authorisation value that is then discarded, this
3805family’s delegations are all void and delegation must be managed using actual Owner
3806authorisation.
3807(TPM_Delegate_CreateKeyDelegation must be used to delegate privilege to use a key.)
3808End of informative comment.
3809Incoming Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of input bytes including paramSize and tag

3

4

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_Delegate_CreateOwnerDelegation.

#

SZ

1

#

1S

SZ

4

1

2S

1

BOOL

increment

Flag dictates whether verificationCount will be incremented

5

<>

3S

<>

TPM_DELEGATE_PUBLIC

publicInfo

The public parameters for the blob

6

20

4S

20

TPM_ENCAUTH

delAuth

The encrypted new AuthData for the blob. The encryption key is the
shared secret from the OSAP protocol.

7

4

TPM_AUTHHANDLE

authHandle

The authorization session handle TPM Owner authentication

2H1

20

TPM_NONCE

authLastNonceEven

Even nonce previously generated by TPM to cover inputs

20

3H1

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

9

1

4H1

1

BOOL

continueAuthSession

Ignored

10

20

TPM_AUTHDATA

ownerAuth

The authorization session digest. HMAC key:ownerAuth

8

934Level 2 Revision 116 28 February 2011
935

197
TCG Published

936Copyright © TCG
937
938

TPM Main Part 3 Commands
Specification Version 1.2

3810Outgoing Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RSP_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

#

SZ

1

#

SZ

1S

4

TPM_RESULT

returnCode

The return code of the operation.

2S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_Delegate_CreateOwnerDelegation.

4

4

3S

4

UINT32

blobSize

The length of the returned blob

5

<>

4S

<>

TPM_DELEGATE_OWNER_BLOB

blob

The partially encrypted delegation information.

6

20

2H1

20

TPM_NONCE

nonceEven

Even nonce newly generated by TPM to cover outputs

3H1

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

4H1

1

BOOL

continueAuthSession

Continue use flag. Fixed value of FALSE

TPM_AUTHDATA

resAuth

The authorization session digest for the returned parameters. HMAC key:
ownerAuth

7

1

8

20

3811Action
38121. The TPM SHALL authenticate the command using TPM Owner authentication. Return
3813
TPM_AUTHFAIL on failure.
38142. Locate publicInfo -> familyID in the TPM_FAMILY_TABLE and set familyRow to indicate
3815
the row return TPM_BADINDEX if not found
3816

a. Set FR to TPM_FAMILY_TABLE.famTableRow[familyRow]

38173. If the TPM Owner authentication is in fact a delegation
3818
3819

a. Validate that authHandle -> familyID equals publicInfo -> familyID return
TPM_DELEGATE_FAMILY on error

3820
3821

b. If FR -> flags
TPM_DISABLED_CMD.

3822
3823

c. Verify that the delegation bits in publicInfo do not grant more permissions then
currently delegated. Otherwise, return error TPM_AUTHFAIL.

->

TPM_FAMFLAG_ENABLED

is

FALSE,

return

error

38244. Check that publicInfo -> delegateType is TPM_DEL_OWNER_BITS
38255. Verify that authHandle indicates
3826
TPM_INVALID_AUTHHANDLE on error

an

OSAP

or

DSAP

session

return

38276. If increment == TRUE
3828

a. Increment FR -> verificationCount

3829

b. Set TPM_STCLEAR_DATA-> ownerReference to TPM_KH_OWNER

3830

c. The TPM invalidates sessions

3831

i.

3832

ii. MUST invalidate all OSAP sessions associated with the delegation table

3833

iii. MAY invalidate any other session

939
940

MUST invalidate all DSAP sessions

198

Level 2 Revision 116 28 February 2011
TCG Published

941TPM Main Part 3 Commands

TCG © Copyright

942Specification Version 1.2

38347. Create a1 by decrypting delAuth according to the ADIP indicated by authHandle.
38358. Create M1 a TPM_DELEGATE_SENSITIVE structure
3836

a. Set M1 -> tag to TPM_TAG_DELEGATE_SENSITIVE

3837

b. Set M1 -> authValue to a1

3838

c. Set other M1 fields as determined by the TPM vendor

38399. Create M2 the encryption of M1 using TPM_DELEGATE_KEY
384010.Create B1 a TPM_DELEGATE_OWNER_BLOB
3841

a. Set B1 -> tag to TPM_TAG_DELG_OWNER_BLOB

3842

b. Set B1 -> pub to publicInfo

3843

c. Set B1 -> sensitiveSize to the size of M2

3844

d. Set B1 -> sensitiveArea to M2

3845

e. Set B1 -> integrityDigest to all zeros

3846

f. Set B1 -> pub -> verificationCount to FR -> verificationCount

384711.The TPM sets additionalArea and additionalAreaSize appropriate for this TPM. The
3848
information MAY include symmetric IV, symmetric mode of encryption and other data
3849
that allows the TPM to process the blob in the future.
385012.Create H1 the HMAC of B1 using tpmProof as the secret
385113.Set B1 -> integrityDigest to H1
385214.Ignore continueAuthSession on input set continueAuthSession to FALSE on output
385315.Return B1 as blob

943Level 2 Revision 116 28 February 2011
944

199
TCG Published

945Copyright © TCG
946
947

385419.4

TPM Main Part 3 Commands
Specification Version 1.2

TPM_Delegate_LoadOwnerDelegation

3855Start of informative comment:
3856This command loads a delegate table row blob into a non-volatile delegate table row.
3857TPM_Delegate_LoadOwnerDelegation can be used during manufacturing or on first boot
3858(when no Owner is installed), or after an Owner is installed. If an Owner is installed,
3859TPM_Delegate_LoadOwnerDelegation requires Owner authorisation, and sensitive
3860information must be encrypted.
3861Burn-out of TPM non-volatile storage by inappropriate use is mitigated by the TPM’s normal
3862limits on NV-writes in the absence of an Owner. Tables can be locked after loading using
3863TPM_Delegate_Manage, to prevent subsequent tampering.
3864A management system outside the TPM is expected to manage the delegate table rows
3865stored on the TPM, and can overwrite any previously stored data. There is no way to
3866explicitly delete a delegation entry. A new entry can overwrite an invalid entry.
3867This command cannot be used to load key delegation blobs into the TPM
3868End of informative comment.
3869Incoming Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_AUTH1_COMMAND

4

UINT32

paramSize

Total number of input bytes incl. paramSize and tag

4

TPM_COMMAND_CODE

ordinal

Ordinal: TPM_ORD_Delegate_LoadOwnerDelegation

4

TPM_DELEGATE_INDEX

index

The index of the delegate row to be written

5

4

UINT32

blobSize

The size of the delegate blob

6

<>

5S

<>

TPM_DELEGATE_OWNER_BLOB

blob

Delegation information, including encrypted portions as appropriate

7

4

TPM_AUTHHANDLE

authHandle

The authorization session handle TPM Owner authentication

2H1

20

TPM_NONCE

authLastNonceEven

Even nonce previously generated by TPM to cover inputs

8

20

3H1

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

9

1

4H1

1

BOOL

continueAuthSession

The continue use flag for the authorization session handle

10

20

TPM_AUTHDATA

ownerAuth

The authorization session digest. HMAC key:ownerAuth

952Level 2 Revision 116 28 February 2011
953

201
TCG Published

954Copyright © TCG
955
956

TPM Main Part 3 Commands
Specification Version 1.2

3870Outgoing Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RSP_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of output bytes

3

4

#

SZ

1

#

SZ

6

1

7

TPM_RESULT

returnCode

The return code of the operation

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_Delegate_LoadOwnerDelegation

2H1

20

TPM_NONCE

nonceEven

Even nonce newly generated by TPM to cover outputs

3H1

20

4

2S
5

1S

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

4H1

1

BOOL

continueAuthSession

Continue use flag, TRUE if handle is still active

TPM_AUTHDATA

resAuth

Authorization HMAC key: ownerAuth.

20

3871Actions
38721. Map blob to D1 a TPM_DELEGATE_OWNER_BLOB.
3873

a. Validate that D1 -> tag == TPM_TAG_DELEGATE_OWNER_BLOB

38742. Locate D1 -> pub -> familyID in the TPM_FAMILY_TABLE and set familyRow to indicate
3875
row, return TPM_BADINDEX if not found
38763. Set FR to TPM_FAMILY_TABLE -> famTableRow[familyRow]
38774. If TPM Owner is installed
3878
3879

a. Validate the command and parameters using TPM Owner authentication, return
TPM_AUTHFAIL on error

3880
3881
3882

b. If the command is delegated (authHandle session type is TPM_PID_DSAP or through
ownerReference delegation), verify that D1 -> pub -> familyID matches authHandle ->
familyID, on error return TPM_DELEGATE_FAMILY

38835. Else
3884

a. If tag is not TPM_TAG_RQU_COMMAND, return TPM_AUTHFAIL

3885
3886

b. If
FR
->
flags
TPM_DELEGATE_LOCK

3887

c. Validate max NV writes without an owner

->

TPM_DELEGATE_ADMIN_LOCK

is

TRUE

3888

i.

3889

ii. Increment NV1 by 1

3890

iii. If NV1 > TPM_MAX_NV_WRITE_NOOWNER return TPM_MAXNVWRITES

3891

return

iv. Set PD -> noOwnerNVWrite to NV1

Set NV1 to PD -> noOwnerNVWrite

38926. If FR -> flags -> TPM_FAMFLAG_ENABLED is FALSE, return TPM_DISABLED_CMD
38937. If TPM Owner is installed, validate the integrity of the blob
3894

a. Copy D1 -> integrityDigest to H2

3895

b. Set D1 -> integrityDigest to all zeros

957
958

202

Level 2 Revision 116 28 February 2011
TCG Published

959TPM Main Part 3 Commands

TCG © Copyright

960Specification Version 1.2

3896

c. Create H3 the HMAC of D1 using tpmProof as the secret

3897

d. Compare H2 to H3, return TPM_AUTHFAIL on mismatch

38988. If TPM Owner is installed, create S1 a TPM_DELEGATE_SENSITIVE area by decrypting
3899
D1 -> sensitiveArea using TPM_DELEGATE_KEY. Otherwise set S1 = D1 -> sensitiveArea
39009. Validate S1
3901
3902

a. Validate
that
S1
->
tag
==
TPM_INVALID_STRUCTURE on error

TPM_TAG_DELEGATE_SENSITIVE,

return

390310.Validate that index is a valid value for delegateTable, return TPM_BADINDEX on error
390411.The TPM invalidates sessions
3905

a. MUST invalidate all DSAP sessions

3906

b. MUST invalidate all OSAP sessions associated with the delegation table

3907

c. MAY invalidate any other session

390812.Copy data to the delegate table row
3909
3910

a. Copy the TPM_DELEGATE_PUBLIC from D1 -> pub to TPM_DELEGATE_TABLE ->
delRow[index] -> pub.

3911
3912

b. Copy the TPM_SECRET from S1 -> authValue to TPM_DELEGATE_TABLE ->
delRow[index] -> authValue.

3913

c. Set TPM_STCLEAR_DATA-> ownerReference to TPM_KH_OWNER

3914

d. If authHandle is of type DSAP then continueAuthSession MUST set to FALSE

391513.Return TPM_SUCCESS

961Level 2 Revision 116 28 February 2011
962

203
TCG Published

963Copyright © TCG
964
965

391619.5

TPM Main Part 3 Commands
Specification Version 1.2

TPM_Delegate_ReadTable

3917Start of informative comment:
3918This command reads from the TPM the public contents of the family and delegate tables
3919that are stored on the TPM. Such data is required during external verification of tables.
3920There are no restrictions on the execution of this command; anyone can read this
3921information regardless of the state of the PCRs, regardless of whether they know any
3922specific AuthData value and regardless of whether or not the enable and admin bits are set
3923one way or the other.
3924End of informative comment.
3925Incoming Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_COMMAND

2

4

UINT32

paramSize

Total number of input bytes including paramSize and tag

3

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_Delegate_ReadTable

#

SZ

1

#

1S

SZ

4

3926Outgoing Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RSP_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

#

SZ

1

#

SZ

1S

4

TPM_RESULT

returnCode

The return code of the operation

2S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_Delegate_ReadTable

4

4

3S

4

UINT32

familyTableSize

Size in bytes of familyTable

5

<>

4S

<>

BYTE [ ]

familyTable

Array of TPM_FAMILY_TABLE_ENTRY elements

6

4

5S

4

UINT32

delegateTableSize

Size in bytes of delegateTable

7

<>

6S

<>

BYTE[]

delegateTable

Array of TPM_DELEGATE_INDEX and TPM_DELEGATE_PUBLIC
elements

3927Actions
39281. Set familyTableSize to the number
3929
sizeof(TPM_FAMILY_TABLE_ELEMENT).

of

valid

families

on

the

TPM

times

39302. Copy the valid entries in the internal family table to the output array familyTable
39313. Set delegateTableSize to the number of valid delegate table entries on the TPM times
3932
(sizeof(TPM_DELEGATE_PUBLIC) + 4).
39334. For each valid entry
3934

a. Write the TPM_DELEGATE_INDEX to delegateTable

3935

b. Copy the TPM_DELEGATE_PUBLIC to delegateTable

966
967

204

Level 2 Revision 116 28 February 2011
TCG Published

968TPM Main Part 3 Commands

TCG © Copyright

969Specification Version 1.2

39365. Return TPM_SUCCESS

970Level 2 Revision 116 28 February 2011
971

205
TCG Published

972Copyright © TCG
973
974

393719.6

TPM Main Part 3 Commands
Specification Version 1.2

TPM_Delegate_UpdateVerification

3938Start of informative comment:
3939TPM_UpdateVerification sets the verificationCount in an entity (a blob or a delegation row)
3940to the current family value, in order that the delegations represented by that entity will
3941continue to be accepted by the TPM.
3942End of informative comment.
3943Incoming Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of input bytes including paramSize and tag

3

4

1S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_Delegate_UpdateVerification

4

4

2S

4

UINT32

inputSize

The size of inputData

5

<>

3S

<>

BYTE

inputData

TPM_DELEGATE_KEY_BLOB or TPM_DELEGATE_OWNER_BLOB
or TPM_DELEGATE_INDEX

6

4

TPM_AUTHHANDLE

authHandle

The authorization session handle used for owner authentication.

#

SZ

1

#

SZ

2H1

20

TPM_NONCE

authLastNonceEven

Even nonce previously generated by TPM to cover inputs

20

3H1

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

8

1

4H1

1

BOOL

continueAuthSession

The continue use flag for the authorization session handle

9

20

TPM_AUTHDATA

ownerAuth

Authorization HMAC key: ownerAuth.

7

975
976

206

Level 2 Revision 116 28 February 2011
TCG Published

977TPM Main Part 3 Commands

TCG © Copyright

978Specification Version 1.2

3944Outgoing Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RSP_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

#

SZ

1

#

SZ

1S

4

TPM_RESULT

returnCode

The return code of the operation

2S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_Delegate_UpdateVerification

4

4

3S

4

UINT32

outputSize

The size of the output

5

<>

4S

<>

BYTE

outputData

TPM_DELEGATE_KEY_BLOB or TPM_DELEGATE_OWNER_BLOB

6

20

2H1

20

TPM_NONCE

nonceEven

Even nonce newly generated by TPM to cover outputs

3H1

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

4H1

1

BOOL

continueAuthSession

Continue use flag, TRUE if handle is still active

TPM_AUTHDATA

resAuth

The authorization session digest for the returned parameters. HMAC key:
ownerAuth.

7

1

8

20

3945Actions
39461. Verify the TPM Owner, directly or indirectly through delegation, authorizes the command
3947
and parameters, on error return TPM_AUTHFAIL
39482. Determine
the
type
of
inputData
(TPM_DELEGATE_TABLE_ROW
or
3949
TPM_DELEGATE_OWNER_BLOB or TPM_DELEGATE_KEY_BLOB) and map D1 to that
3950
structure
3951
3952

a. Mapping to TPM_DELEGATE_TABLE_ROW requires taking inputData as a tableIndex
and locating the appropriate row in the table

39533. If D1 is a TPM_DELEGATE_OWNER_BLOB or TPM_DELEGATE_KEY_BLOB, validate the
3954
integrity of D1
3955

a. Copy D1 -> integrityDigest to H2

3956

b. Set D1 -> integrityDigest to all zeros

3957

c. Create H3 the HMAC of D1 using tpmProof as the secret

3958

d. Compare H2 to H3 return TPM_AUTHFAIL on mismatch

39594. Locate (D1 -> pub -> familyID) in the TPM_FAMILY_TABLE and set familyRow to indicate
3960
row, return TPM_BADINDEX if not found
39615. Set FR to TPM_FAMILY_TABLE.famTableRow[familyRow]
39626. If delegated, verify that family of the delegated Owner-auth is the same as D1:
3963
(authHandle -> familyID) == (D1 -> pub -> familyID); otherwise return error
3964
TPM_DELEGATE_FAMILY
39657. If delegated, verify that the family of the delegated Owner-auth is enabled: if (authHandle
3966
-> familyID -> flags TPM_FAMFLAG_ENABLED) is FALSE, return TPM_DISABLED_CMD
39678. Set D1 -> verificationCount to FR -> verificationCount

979Level 2 Revision 116 28 February 2011
980

207
TCG Published

981Copyright © TCG
982
983

TPM Main Part 3 Commands
Specification Version 1.2

39689. If D1 is a TPM_DELEGATE_OWNER_BLOB or TPM_DELEGATE_KEY_BLOB set the
3969
integrity of D1
3970

a. Set D1 -> integrityDigest to all zeros

3971

b. Create H1 the HMAC of D1 using tpmProof as the secret

3972

c. Set D1 -> integrityDigest to H1

397310.If D1 is a blob recreate the blob and return it

984
985

208

Level 2 Revision 116 28 February 2011
TCG Published

986TPM Main Part 3 Commands

TCG © Copyright

987Specification Version 1.2

397419.7

TPM_Delegate_VerifyDelegation

3975Start of informative comment:
3976TPM_VerifyDelegation interprets a delegate blob and returns success or failure, depending
3977on whether the blob is currently valid. The delegate blob is NOT loaded into the TPM.
3978End of informative comment.
3979Incoming Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_COMMAND

2

4

UINT32

paramSize

Total number of input bytes including paramSize and tag

3

4

1S

4

TPM_COMMAND_CODE

ordinal

Command ordinal, TPM_ORD_Delegate_VerifyDelegation

4

4

2S

4

UINT32

delegationSize

The length of the delegated information blob

5

<>

3S

<>

BYTE[ ]

delegation

TPM_DELEGATE_KEY_BLOB or TPM_DELEGATE_OWNER_BLOB

Type

Name

Description

#

SZ

1

#

SZ

3980Outgoing Operands and Sizes
PARAM

HMAC

#

SZ

#

SZ

1

2

TPM_TAG

tag

TPM_TAG_RSP_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

1S

4

TPM_RESULT

returnCode

The return code of the operation.

2S

4

TPM_COMMAND_CODE

ordinal

Command ordinal, TPM_Delegate_VerifyDelegation

3981Actions
39821. Determine
the
type
of
blob,
If
3983
TPM_TAG_DELGATE_OWNER_BLOB then
3984

delegation

->

tag

is

equal

to

a. Map D1 a TPM_DELEGATE_OWNER_BLOB to delegation

39852. Else if delegation -> tag = TPM_TAG_DELG_KEY_BLOB
3986

a. Map D1 a TPM_DELEGATE_KEY_BLOB to delegation

39873. Else return TPM_BAD_PARAMETER
39884. Locate D1 -> familyID in the TPM_FAMILY_TABLE and set familyRow to indicate row,
3989
return TPM_BADINDEX if not found
39905. Set FR to TPM_FAMILY_TABLE.famTableRow[familyRow]
39916. If FR -> flags TPM_FAMFLAG_ENABLED is FALSE, return TPM_DISABLED_CMD
39927. Validate that D1 -> pub -> verificationCount matches FR -> verificationCount, on
3993
mismatch return TPM_FAMILYCOUNT
39948. Validate the integrity of D1
3995

a. Copy D1 -> integrityDigest to H2

988Level 2 Revision 116 28 February 2011
989

209
TCG Published

990Copyright © TCG
991
992

TPM Main Part 3 Commands
Specification Version 1.2

3996

b. Set D1 -> integrityDigest to all zeros

3997

c. Create H3 the HMAC of D1 using tpmProof as the secret

3998

d. Compare H2 to H3 return TPM_AUTHFAIL on mismatch

39999. Create S1 a TPM_DELEGATE_SENSITIVE area by decrypting D1 -> sensitiveArea using
4000
TPM_DELEGATE_KEY
400110.Validate S1 values
4002

a. S1 -> tag is TPM_TAG_DELEGATE_SENSITIVE

4003

b. Return TPM_BAD_PARAMETER on error

400411.Return TPM_SUCCESS

993
994

210

Level 2 Revision 116 28 February 2011
TCG Published

995TPM Main Part 3 Commands

TCG © Copyright

996Specification Version 1.2

400520.
Non-volatile
4006Start of informative comment:

Storage

4007This section handles the allocation and use of the TPM non-volatile storage.
4008End of informative comment.
4009If nvIndex refers to the DIR, the TPM ignores actions containing access control checks that
4010have no meaning for the DIR. The TPM only checks the owner authorization.

997Level 2 Revision 116 28 February 2011
998

211
TCG Published

999Copyright © TCG
1000
1001

TPM Main Part 3 Commands
Specification Version 1.2

4011
401220.1

TPM_NV_DefineSpace

4013Start of informative comment:
4014This establishes the space necessary for the indicated index. The definition will include the
4015access requirements for writing and reading the area.
4016
4017

Previously defined space at the index and new size is non-zero (and space is available,
etc.) –> redefine the index

4018
4019

No previous space at the index and new size is non-zero (and space is available,
etc.)-> define the index

4020

Previously defined space at the index and new size is 0 -> delete the index

4021

No previous space at the index and new size is 0 -> error

4022The space definition size does not include the area needed to manage the space.
4023Setting TPM_PERMANENT_FLAGS -> nvLocked TRUE when it is already TRUE is not an
4024error.
4025End of informative comment.
4026Incoming Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of input bytes including paramSize and tag

3

4

1S

4

TPM_COMMAND_CODE

ordinal

Ordinal, TPM_ORD_NV_DefineSpace

4

<>

2S

<>

TPM_NV_DATA_PUBLIC

pubInfo

The public parameters of the NV area

5

20

3S

20

TPM_ENCAUTH

encAuth

The encrypted AuthData, only valid if the attributes require subsequent
authorization

6

4

TPM_AUTHHANDLE

authHandle

The authorization session handle used for ownerAuth

#

SZ

1

#

SZ

2H1

20

TPM_NONCE

authLastNonceEven

Even nonce previously generated by TPM to cover inputs

7

20

3H1

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

8

1

4H1

1

BOOL

continueAuthSession

The continue use flag for the authorization session handle

9

20

TPM_AUTHDATA

ownerAuth

The authorization session digest HMAC key: ownerAuth

Type

Name

Description

4027Outgoing Operands and Sizes
PARAM

HMAC

#

SZ

#

SZ

1

2

TPM_TAG

tag

TPM_TAG_RSP_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

1002
1003

20

4

TPM_RESULT

returnCode

The return code of the operation.

2S
4

1S

4

TPM_COMMAND_CODE

ordinal

ordinal, TPM_ORD_NV_DefineSpace

2H1

20

TPM_NONCE

nonceEven

Even nonce newly generated by TPM to cover outputs

212

Level 2 Revision 116 28 February 2011
TCG Published

1004TPM Main Part 3 Commands

TCG © Copyright

1005Specification Version 1.2
3H1
5

1

6

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

4H1

1

BOOL

continueAuthSession

Continue use flag, fixed to FALSE

TPM_AUTHDATA

ownerAuth

The authorization session digest HMAC key: ownerAuth

20

4028Description
4029For the case where pubInfo -> dataSize is 0, pubInfo -> pcrInfoRead and pubInfo ->
4030pcrInfoWrite are not used. However, since the general principle is to validate parameters
4031before changing state, the TPM SHOULD parse pubInfo completely before invalidating the
4032data area.
4033Actions
40341. If pubInfo -> nvIndex == TPM_NV_INDEX_LOCK and tag = TPM_TAG_RQU_COMMAND
4035

a. If pubInfo -> dataSize is not 0, the command MAY return TPM_BADINDEX.

4036

b. Set TPM_PERMANENT_FLAGS -> nvLocked to TRUE

4037

c. Return TPM_SUCCESS

40382. If TPM_PERMANENT_FLAGS -> nvLocked is FALSE then all authorization checks except
4039
for the Max NV writes are ignored
4040
4041
4042
4043

a. Ignored checks include physical presence, owner authorization, 'D' bit check,
bGlobalLock, no authorization with a TPM owner present, bWriteSTClear, the check that
pubInfo -> dataSize is 0 in Action 5.c. (the no-authorization case) , disabled and
deactivated.

4044
4045
4046

i. The check that pubInfo -> dataSize is 0 is still enforced in Action 6.f.
(returning after deleting a previously defined storage area) and Action 9.f. (not
allowing a space of size 0 to be defined).

4047

ii. If ownerAuth is present, the TPM MAY check the authorization HMAC.

4048

b. The check for pubInfo -> nvIndex == TPM_NV_INDEX0 in Action 3. is not ignored.

40493. If pubInfo -> nvIndex has the D bit (bit 28) set to a 1 or pubInfo -> nvIndex ==
4050
TPM_NV_INDEX0 then
4051

a. Return TPM_BADINDEX

4052
4053

b. The D bit specifies an index value that is set in manufacturing and can never be
deleted or added to the TPM

4054

c. Index value TPM_NV_INDEX0 is reserved and cannot be defined

40554. If tag = TPM_TAG_RQU_AUTH1_COMMAND then
4056
4057

a. The TPM MUST validate the command and parameters using the TPM Owner
authentication and ownerAuth, on error return TPM_AUTHFAIL

4058

b. authHandle session type MUST be OSAP

4059

c. Create A1 by decrypting encAuth according to the ADIP indicated by authHandle.

40605. else
4061

a. Validate the assertion of physical presence. Return TPM_BAD_PRESENCE on error.

1006Level 2 Revision 116 28 February 2011
1007

213
TCG Published

1008Copyright © TCG
1009
1010

TPM Main Part 3 Commands
Specification Version 1.2

4062

b. If TPM Owner is present then return TPM_OWNER_SET.

4063
4064

c. If pubInfo -> dataSize is 0 then return TPM_BAD_DATASIZE. Setting the size to 0
represents an attempt to delete the value without TPM Owner authentication.

4065

d. Validate max NV writes without an owner

4066

i.

4067

ii. Increment NV1 by 1

4068

iii. If NV1 > TPM_MAX_NV_WRITE_NOOWNER return TPM_MAXNVWRITES

4069

iv. Set NV1_INCREMENTED to TRUE

4070
4071

Set NV1 to TPM_PERMANENT_DATA -> noOwnerNVWrite

e. Set A1 to encAuth. There is no nonce or authorization to create the encryption string,
hence the AuthData value is passed in the clear

40726. If pubInfo -> nvIndex points to a valid previously defined storage area then
4073

a. Map D1 a TPM_NV_DATA_SENSITIVE to the storage area

4074

b. If D1 -> attributes specifies TPM_NV_PER_GLOBALLOCK then

4075
4076
4077

i. If TPM_STCLEAR_FLAGS
TPM_AREA_LOCKED

->

bGlobalLock

is

TRUE

then

return

c. If D1 -> attributes specifies TPM_NV_PER_WRITE_STCLEAR

4078

i.

If D1 -> pubInfo -> bWriteSTClear is TRUE then return TPM_AREA_LOCKED

4079
4080

d. Invalidate the data area currently pointed to by D1 and ensure that if the area is
reallocated no residual information is left

4081

e. If NV1_INCREMENTED is TRUE

4082
4083

i.

Set TPM_PERMANENT_DATA -> noOwnerNVWrite to NV1

f. The TPM invalidates authorization sessions

4084

i.

4085

ii. MAY invalidate any other authorization session

4086

g. If pubInfo -> dataSize is 0 then return TPM_SUCCESS

MUST invalidate all authorization sessions associated with D1

40877. Parse pubInfo -> pcrInfoRead
4088

a. Validate pcrInfoRead structure on error return TPM_INVALID_STRUCTURE

4089

i.

Validation includes proper PCR selections and locality selections

40908. Parse pubInfo -> pcrInfoWrite
4091

a. Validate pcrInfoWrite structure on error return TPM_INVALID_STRUCTURE

4092
4093

i.

Validation includes proper PCR selections and locality selections

b. If pcrInfoWrite -> localityAtRelease disallows some localities

4094

i.

4095

c. Else

4096

i.

1011
1012

Set writeLocalities to TRUE
Set writeLocalities to FALSE

214

Level 2 Revision 116 28 February 2011
TCG Published

1013TPM Main Part 3 Commands

TCG © Copyright

1014Specification Version 1.2

40979. Validate that the attributes are consistent
4098
4099

a. The TPM SHALL ignore the bReadSTClear, bWriteSTClear and bWriteDefine
attributes during the execution of this command

4100
4101

b. If TPM_NV_PER_OWNERWRITE is TRUE and TPM_NV_PER_AUTHWRITE is TRUE
return TPM_AUTH_CONFLICT

4102
4103

c. If TPM_NV_PER_OWNERREAD is TRUE and TPM_NV_PER_AUTHREAD is TRUE
return TPM_AUTH_CONFLICT

4104
4105
4106

d. If
TPM_NV_PER_OWNERWRITE
and
TPM_NV_PER_AUTHWRITE
and
TPM_NV_PER_WRITEDEFINE and TPM_NV_PER_PPWRITE and writeLocalities are all
FALSE

4107
4108

i.

Return TPM_PER_NOWRITE

e. Validate pubInfo -> nvIndex

4109
4110
4111
4112
4113

i. Make sure that the index is applicable for this TPM. Return TPM_BADINDEX
on error. A valid index is platform and context sensitive. That is, attempting to
validate an index may be successful in one configuration and invalid in another
configuration. The individual index values MUST indicate if there are any
restrictions on the use of the index.

4114

ii. TPM_NV_INDEX_DIR is always an invalid defined index.

4115

f. If dataSize is 0 return TPM_BAD_PARAM_SIZE

411610.Create D1 a TPM_NV_DATA_SENSITIVE structure
4117

a. Set D1 -> pubInfo to pubInfo

4118

b. Set D1 -> authValue to A1

4119

c. Set D1 -> pubInfo -> bReadSTClear to FALSE

4120

d. Set D1 -> pubInfo -> bWriteSTClear to FALSE

4121

e. Set D1 -> pubInfo -> bWriteDefine to FALSE

412211.Validate that sufficient NV is available to store D1 and pubInfo -> dataSize bytes of data
4123

a. Return TPM_NOSPACE if pubInfo -> dataSize is not available in the TPM

412412.If pubInfo -> nvIndex is not TPM_NV_INDEX_TRIAL
4125

a. Reserve NV space for pubInfo -> dataSize

4126

b. Set all bytes in the newly defined area to 0xFF

4127

c. If NV1_INCREMENTED is TRUE

4128

i.

Set TPM_PERMANENT_DATA -> noOwnerNVWrite to NV1

412913.Ignore continueAuthSession on input and set to FALSE on output
413014.Return TPM_SUCCESS

1015Level 2 Revision 116 28 February 2011
1016

215
TCG Published

1017Copyright © TCG
1018
1019

413120.2

TPM Main Part 3 Commands
Specification Version 1.2

TPM_NV_WriteValue

4132Start of informative comment:
4133This command writes the value to a defined area. The write can be TPM Owner authorized
4134or unauthorized and protected by other attributes and will work when no TPM Owner is
4135present.
4136The action setting bGlobalLock to TRUE is intentionally before the action checking the
4137owner authorization. This allows code (e.g., a BIOS) to lock NVRAM without knowing the
4138owner authorization.
4139The DIR (TPM_NV_INDEX_DIR) has the attributes TPM_NV_PER_OWNERWRITE and
4140TPM_NV_WRITEALL.
4141Certain platform manufacturers or software might require specific error handling in Action
414220.2.
4143Owner authorization is not required when nvLocked is FALSE. If the host does send owner
4144authorization, Action 20.2 indicates that it should be correct, since some TPM
4145implementations may validate it.
4146End of informative comment.
4147Incoming Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of input bytes including paramSize and tag

3

4

1S

4

TPM_COMMAND_CODE

ordinal

Ordinal, TPM_ORD_NV_WriteValue

4

4

2S

4

TPM_NV_INDEX

nvIndex

The index of the area to set

5

4

3S

4

UINT32

offset

The offset into the NV Area

6

4

4S

4

UINT32

dataSize

The size of the data parameter

7

<>

5S

<>

BYTE[]

data

The data to set the area to

8

4

TPM_AUTHHANDLE

authHandle

The authorization session handle used for TPM Owner

#

SZ

1

#

SZ

2H1

20

TPM_NONCE

authLastNonceEven

Even nonce previously generated by TPM to cover inputs

9

20

3H1

20

TPM_NONCE

authNonceOdd

Nonce generated by caller

10

1

4H1

1

BOOL

continueAuthSession

The continue use flag for the authorization session handle

11

20

TPM_AUTHDATA

ownerAuth

The authorization session digest HMAC key: ownerAuth

Type

Name

Description

4148Outgoing Operands and Sizes
PARAM

HMAC

#

SZ

#

SZ

1

2

TPM_TAG

tag

TPM_TAG_RSP_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

4

TPM_RESULT

returnCode

The return code of the operation.

2S

1020
1021

1S

4

TPM_COMMAND_CODE

ordinal

ordinal, TPM_ORD_NV_WriteValue

216

Level 2 Revision 116 28 February 2011
TCG Published

1022TPM Main Part 3 Commands

TCG © Copyright

1023Specification Version 1.2
4

20

1

6

20

TPM_NONCE

nonceEven

Even nonce newly generated by TPM to cover outputs

3H1
5

2H1

20

TPM_NONCE

authNonceOdd

Nonce generated by caller

4H1

1

BOOL

continueAuthSession

Continue use flag, TRUE if handle is still active

TPM_AUTHDATA

ownerAuth

The authorization session digest HMAC key: ownerAuth

20

4149Description
4150For TPM_NV_INDEX_DIR, the ordinal MUST NOT set an error code for the “if dataSize = 0”
4151action. However, the flags set in this case are not applicable to the DIR.
4152Actions
41531. If TPM_PERMANENT_FLAGS -> nvLocked is FALSE then all authorization checks except
4154
for the max NV writes are ignored
4155
4156
4157

a. Ignored
checks
include
physical
presence,
owner
authorization,
TPM_NV_PER_OWNERWRITE, PCR, bWriteDefine, bGlobalLock, bWriteSTClear, locality,
disabled and deactivated.

4158

b. TPM_NV_PER_AUTHWRITE is not ignored.

4159

c. If ownerAuth is present, the TPM MAY check the authorization HMAC.

41602. Locate and set D1 to the TPM_NV_DATA_AREA that corresponds to nvIndex, return
4161
TPM_BADINDEX on error
4162

a. If nvIndex = TPM_NV_INDEX_DIR, set D1 to TPM_PERMANENT_DATA -> authDir[0]

41633. If TPM_PERMANENT_FLAGS -> nvLocked is TRUE
4164

a. If D1 -> permission -> TPM_NV_PER_OWNERWRITE is TRUE

4165

i.

4166

ii. If TPM_STCLEAR_FLAGS -> deactivated is TRUE, return TPM_DEACTIVATED

4167

If TPM_PERMANENT_FLAGS -> disable is TRUE, return TPM_DISABLED

b. If D1 -> permission -> TPM_NV_PER_OWNERWRITE is FALSE

4168
4169

i. If TPM_PERMANENT_FLAGS -> disable is TRUE, the TPM MAY return
TPM_DISABLED

4170
4171

ii. If TPM_STCLEAR_FLAGS -> deactivated is TRUE, the TPM MAY return
TPM_DEACTIVATED

41724. If tag = TPM_TAG_RQU_AUTH1_COMMAND then
4173
4174

a. If D1 -> permission
TPM_AUTH_CONFLICT

4175
4176
4177

i.

->

TPM_NV_PER_OWNERWRITE

is

FALSE

return

This check is ignored if nvIndex is TPM_NV_INDEX0.

b. Validate command and parameters using ownerAuth HMAC with TPM Owner
authentication as the secret, return TPM_AUTHFAIL on error

41785. Else
4179
4180
4181

a. If D1 -> permission
TPM_AUTH_CONFLICT
i.

->

TPM_NV_PER_OWNERWRITE

This check is ignored if nvIndex is TPM_NV_INDEX0.

1024Level 2 Revision 116 28 February 2011
1025

217
TCG Published

is

TRUE

return

1026Copyright © TCG
1027
1028

4182

TPM Main Part 3 Commands
Specification Version 1.2

b. If no TPM Owner validate max NV writes without an owner

4183

i.

4184

ii. Increment NV1 by 1

4185

iii. If NV1 > TPM_MAX_NV_WRITE_NOOWNER return TPM_MAXNVWRITES

4186

iv. Set NV1_INCREMENTED to TRUE

Set NV1 to TPM_PERMANENT_DATA -> noOwnerNVWrite

41876. If nvIndex is TPM_NV_INDEX0 then
4188

a. If dataSize is not 0, the TPM MAY return TPM_BADINDEX.

4189

b. Set TPM_STCLEAR_FLAGS -> bGlobalLock to TRUE

4190

c. Return TPM_SUCCESS

41917. If
D1
->
permission
4192
TPM_AUTH_CONFLICT

->

TPM_NV_PER_AUTHWRITE

is

TRUE

return

41938. Check that D1 -> pcrInfoWrite -> localityAtRelease for TPM_STANY_DATA ->
4194
localityModifier is TRUE
4195
4196

a. For example if TPM_STANY_DATA -> localityModifier was 2 then D1 -> pcrInfo ->
localityAtRelease -> TPM_LOC_TWO would have to be TRUE

4197

b. On error return TPM_BAD_LOCALITY

41989. If D1 -> attributes specifies TPM_NV_PER_PPWRITE then validate physical presence is
4199
asserted if not return TPM_BAD_PRESENCE
420010.If D1 -> attributes specifies TPM_NV_PER_WRITEDEFINE
4201

a. If D1 -> bWriteDefine is TRUE return TPM_AREA_LOCKED

420211.If D1 -> attributes specifies TPM_NV_PER_GLOBALLOCK
4203

a. If TPM_STCLEAR_FLAGS -> bGlobalLock is TRUE return TPM_AREA_LOCKED

420412.If D1 -> attributes specifies TPM_NV_PER_WRITE_STCLEAR
4205

a. If D1 ->bWriteSTClear is TRUE return TPM_AREA_LOCKED

420613.If D1 -> pcrInfoWrite -> pcrSelection specifies a selection of TPM_STCLEAR_DATA ->
4207
PCR[]
4208
4209

a. Create P1 a composite hash of the TPM_STCLEAR_DATA -> PCR[] specified by D1 ->
pcrInfoWrite

4210
4211

b. Compare P1 to D1 -> pcrInfoWrite -> digestAtRelease return TPM_WRONGPCRVAL
on mismatch

421214.If dataSize = 0 then
4213

a. Set D1 -> bWriteSTClear to TRUE

4214

b. Set D1 -> bWriteDefine to TRUE

421515.Else
4216

a. Set S1 to offset + dataSize

4217

b. If S1 > D1 -> dataSize return TPM_NOSPACE

1029
1030

218

Level 2 Revision 116 28 February 2011
TCG Published

1031TPM Main Part 3 Commands

TCG © Copyright

1032Specification Version 1.2

4218
4219

c. If D1 -> attributes specifies TPM_NV_PER_WRITEALL
i.

If dataSize != D1 -> dataSize return TPM_NOT_FULLWRITE

4220

d. Write the new value into the NV storage area

4221

e. If NV1_INCREMENTED is TRUE

4222

i.

Set TPM_PERMANENT_DATA -> noOwnerNVWrite to NV1

422316.Set D1 -> bReadSTClear to FALSE
422417.Return TPM_SUCCESS

1033Level 2 Revision 116 28 February 2011
1034

219
TCG Published

1035Copyright © TCG
1036
1037

422520.3

TPM Main Part 3 Commands
Specification Version 1.2

TPM_NV_WriteValueAuth

4226Start of informative comment:
4227This command writes to a previously defined area. The area must require authorization to
4228write. Use this command when authorization other than the owner authorization is to be
4229used. Otherwise, use TPM_NV_WriteValue.
4230The Part 2 ordinal table indicates that TPM_NV_WriteValueAuth requires an owner present.
4231This is normative, although it was a mistake.
4232End of informative comment.
4233Incoming Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

Tag

TPM_TAG_RQU_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of input bytes including paramSize and tag

3

4

1S

4

TPM_COMMAND_CODE

ordinal

Ordinal, TPM_ORD_NV_WriteValueAuth

4

4

2S

4

TPM_NV_INDEX

nvIndex

The index of the area to set

5

4

3S

4

UINT32

offset

The offset into the chunk

6

4

4S

4

UINT32

dataSize

The size of the data area

7

<>

5S

<>

BYTE

data

The data to set the area to

8

4

TPM_AUTHHANDLE

authHandle

The authorization session handle used for NV element authorization

#

SZ

1

#

SZ

2H1

20

TPM_NONCE

authLastNonceEven

Even nonce previously generated by TPM to cover inputs

20

3H1

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

10

1

4H1

1

BOOL

continueAuthSession

The continue use flag for the authorization session handle

11

20

TPM_AUTHDATA

authValue

HMAC key: NV element auth value

Type

Name

Description

9

4234Outgoing Operands and Sizes
PARAM

HMAC

#

SZ

#

SZ

1

2

TPM_TAG

tag

TPM_TAG_RSP_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

5

1

6

TPM_RESULT

returnCode

The return code of the operation.

4

TPM_COMMAND_CODE

ordinal

ordinal, TPM_ORD_NV_WriteValueAuth

2H1

20

TPM_NONCE

nonceEven

Even nonce newly generated by TPM to cover outputs

3H1

20

4

2S
4

1S

20

TPM_NONCE

NonceOdd

Nonce generated by system associated with authHandle

4H1

1

BOOL

continueAuthSession

Continue use flag, TRUE if handle is still active

TPM_AUTHDATA

authValue

HMAC key: NV element auth value

20

4235Actions
42361. Locate and set D1 to the TPM_NV_DATA_AREA that corresponds to nvIndex, return
4237
TPM_BADINDEX on error
1038
1039

220

Level 2 Revision 116 28 February 2011
TCG Published

1040TPM Main Part 3 Commands

TCG © Copyright

1041Specification Version 1.2

42382. If D1 -> attributes does not specify TPM_NV_PER_AUTHWRITE then return
4239
TPM_AUTH_CONFLICT
42403. Validate authValue using D1 -> authValue, return TPM_AUTHFAIL on error
42414. Check that D1 -> pcrInfoWrite -> localityAtRelease for TPM_STANY_DATA ->
4242
localityModifier is TRUE
4243
4244

a. For example if TPM_STANY_DATA -> localityModifier was 2 then D1 -> pcrInfo ->
localityAtRelease -> TPM_LOC_TWO would have to be TRUE

4245

b. On error return TPM_BAD_LOCALITY

42465. If D1 -> attributes specifies TPM_NV_PER_PPWRITE then validate physical presence is
4247
asserted if not return TPM_BAD_PRESENCE
42486. If D1 -> pcrInfoWrite -> pcrSelection specifies a selection of PCR
4249
4250

a. Create P1 a composite hash of the TPM_STCLEAR_DATA -> PCR[] specified by D1 ->
pcrInfoWrite

4251

b. Compare P1 to digestAtRelease return TPM_WRONGPCRVAL on mismatch

42527. If D1 -> attributes specifies TPM_NV_PER_WRITEDEFINE
4253

a. If D1 -> bWriteDefine is TRUE return TPM_AREA_LOCKED

42548. If D1 -> attributes specifies TPM_NV_PER_GLOBALLOCK
4255

a. If TPM_STCLEAR_FLAGS -> bGlobalLock is TRUE return TPM_AREA_LOCKED

42569. If D1 -> attributes specifies TPM_NV_PER_WRITE_STCLEAR
4257

a. If D1 -> bWriteSTClear is TRUE return TPM_AREA_LOCKED

425810.If dataSize = 0 then
4259

a. Set D1 -> bWriteSTClear to TRUE

4260

b. Set D1 -> bWriteDefine to TRUE

426111.Else
4262

a. Set S1 to offset + dataSize

4263

b. If S1 > D1 -> dataSize return TPM_NOSPACE

4264

c. If D1 -> attributes specifies TPM_NV_PER_WRITEALL

4265
4266

i.

If dataSize != D1 -> dataSize return TPM_NOT_FULLWRITE

d. Write the new value into the NV storage area

426712.Set D1 -> bReadSTClear to FALSE
426813.Return TPM_SUCCESS

1042Level 2 Revision 116 28 February 2011
1043

221
TCG Published

1044Copyright © TCG
1045
1046

426920.4

TPM Main Part 3 Commands
Specification Version 1.2

TPM_NV_ReadValue

4270Start of informative comment:
4271Read a value from the NV store. This command uses optional owner authentication.
4272Action 1 indicates that if the NV area is not locked then reading of the NV area continues
4273without ANY authorization. This is intentional, and allows a platform manufacturer to set
4274the NV areas, read them back, and then lock them all without having to install a TPM
4275owner.
4276Certain platform manufacturers or software might require specific error handling in Action
427720.4.
4278Owner authorization is not required when nvLocked is FALSE. If the host does send owner
4279authorization, Action 20.4 indicates that it should be correct, since some TPM
4280implementations may validate it.
4281End of informative comment.
4282Incoming Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of input bytes including paramSize and tag

3

4

1S

4

TPM_COMMAND_CODE

ordinal

Ordinal, TPM_ORD_NV_ReadValue

4

4

2S

4

TPM_NV_INDEX

nvIndex

The index of the area to set

5

4

3S

4

UINT32

offset

The offset into the area

6

4

4S

4

UINT32

dataSize

The size of the data area

7

4

TPM_AUTHHANDLE

authHandle

The authorization session handle used for TPM Owner authorization

#

SZ

1

#

SZ

2H1

20

TPM_NONCE

authLastNonceEven

Even nonce previously generated by TPM to cover inputs

8

20

3H1

20

TPM_NONCE

authNonceOdd

Nonce generated by caller

9

1

4H1

1

BOOL

continueAuthSession

The continue use flag for the authorization session handle

10

20

TPM_AUTHDATA

ownerAuth

HMAC key: ownerAuth

Type

Name

Description

4283Outgoing Operands and Sizes
PARAM

HMAC

#

SZ

#

SZ

1

2

TPM_TAG

tag

TPM_TAG_RSP_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

TPM_RESULT

returnCode

The return code of the operation.

1S
2S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_NV_ReadValue

4

3S

4

UINT32

dataSize

The size of the data area

5

<>

4S

<>

BYTE[]

data

The data to set the area to

6

20

2H1

20

TPM_NONCE

nonceEven

Even nonce newly generated by TPM to cover outputs

3H1

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

4H1

1

BOOL

continueAuthSession

Continue use flag, TRUE if handle is still active

TPM_AUTHDATA

ownerAuth

HMAC key: ownerAuth

20

4284Actions
42851. If TPM_PERMANENT_FLAGS -> nvLocked is FALSE then all authorization checks are
4286
ignored.
4287
4288

a. Ignored checks include physical presence, owner authorization, PCR, bReadSTClear,
locality, TPM_NV_PER_OWNERREAD, disabled and deactivated.

4289

b. TPM_NV_PER_AUTHREAD is not ignored.

4290

c. If ownerAuth is present, the TPM MAY check the authorization HMAC.

42912. Set D1 a TPM_NV_DATA_AREA structure to the area pointed to by nvIndex, if not found
4292
return TPM_BADINDEX
4293

a. If nvIndex = TPM_NV_INDEX_DIR, set D1 to TPM_PERMANENT_DATA -> authDir[0]

42943. If TPM_PERMANENT_FLAGS -> nvLocked is TRUE
4295

a. If D1 -> permission -> TPM_NV_PER_OWNERREAD is TRUE

4296

i.

4297

ii. If TPM_STCLEAR_FLAGS -> deactivated is TRUE, return TPM_DEACTIVATED

4298

If TPM_PERMANENT_FLAGS -> disable is TRUE, return TPM_DISABLED

b. If D1 -> permission -> TPM_NV_PER_OWNERREAD is FALSE

4299
4300

i. If TPM_PERMANENT_FLAGS -> disable is TRUE, the TPM MAY return
TPM_DISABLED

4301
4302

ii. If TPM_STCLEAR_FLAGS -> deactivated is TRUE, the TPM MAY return
TPM_DEACTIVATED

43034. If tag = TPM_TAG_RQU_AUTH1_COMMAND then
4304

a. If D1 -> TPM_NV_PER_OWNERREAD is FALSE return TPM_AUTH_CONFLICT

4305
4306

b. Validate command and parameters using TPM Owners authentication on error return
TPM_AUTHFAIL

43075. Else
4308

a. If D1 -> TPM_NV_PER_AUTHREAD is TRUE return TPM_AUTH_CONFLICT

4309

b. If D1 -> TPM_NV_PER_OWNERREAD is TRUE return TPM_AUTH_CONFLICT

43106. Check that D1 -> pcrInfoRead -> localityAtRelease for TPM_STANY_DATA ->
4311
localityModifier is TRUE
4312
4313

a. For example if TPM_STANY_DATA -> localityModifier was 2 then D1 -> pcrInfo ->
localityAtRelease -> TPM_LOC_TWO would have to be TRUE

4314

b. On error return TPM_BAD_LOCALITY

43157. If D1 -> attributes specifies TPM_NV_PER_PPREAD then validate physical presence is
4316
asserted if not return TPM_BAD_PRESENCE
43178. If D1 -> TPM_NV_PER_READ_STCLEAR then
1051Level 2 Revision 116 28 February 2011
1052

223
TCG Published

1053Copyright © TCG
1054
1055

4318

TPM Main Part 3 Commands
Specification Version 1.2

a. If D1 -> bReadSTClear is TRUE return TPM_DISABLED_CMD

43199. If D1 -> pcrInfoRead -> pcrSelection specifies a selection of PCR
4320
4321

a. Create P1 a composite hash of the TPM_STCLEAR_DATA -> PCR[] specified by D1 ->
pcrInfoRead

4322
4323

b. Compare P1 to D1 -> pcrInfoRead -> digestAtRelease return TPM_WRONGPCRVAL on
mismatch

432410.If dataSize is 0 then
4325

a. Set D1 -> bReadSTClear to TRUE

4326

b. Set data to NULL (output parameter dataSize to 0)

432711.Else
4328

a. Set S1 to offset + dataSize

4329

b. If S1 > D1 -> dataSize return TPM_NOSPACE

4330

c. Set data to area pointed to by offset

4331

i.

This includes partial reads of TPM_NV_INDEX_DIR.

433212.Return TPM_SUCCESS

1056
1057

224

Level 2 Revision 116 28 February 2011
TCG Published

1058TPM Main Part 3 Commands

TCG © Copyright

1059Specification Version 1.2

433320.5

TPM_NV_ReadValueAuth

4334Start of informative comment:
4335This command requires that the read be authorized by a value set with the blob.
4336The Part 2 ordinal table indicates that TPM_NV_ReadValueAuth requires an owner present.
4337This is normative, although it was a mistake.
4338End of informative comment.
4339Incoming Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of input bytes including paramSize and tag

3

4

1S

4

TPM_COMMAND_CODE

ordinal

Ordinal, TPM_ORD_NV_ReadValueAuth

4

4

2S

4

TPM_NV_INDEX

nvIndex

The index of the area to set

5

4

3S

4

UNIT32

offset

The offset from the data area

6

4

5S

4

UINT32

dataSize

The size of the data area

7

4

TPM_AUTHHANDLE

authHandle

authThe auth handle for the NV element authorization

#

SZ

1

#

SZ

2H1

20

TPM_NONCE

authLastNonceEven

Even nonce previously generated by TPM to cover inputs

8

20

3H1

20

TPM_NONCE

authNonceOdd

Nonce generated by system associated with authHandle

9

1

4H1

1

BOOL

authContinueSession

The continue use flag for the authorization session handle

10

20

TPM_AUTHDATA

authHmac

HMAC key: nv element authorization

Type

Name

Description

4340Outgoing Operands and Sizes
PARAM

HMAC

#

SZ

#

SZ

1

2

TPM_TAG

tag

TPM_TAG_RSP_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

1S

4

TPM_RESULT

returnCode

The return code of the operation.

2S

4

TPM_COMMAND_CODE

ordinal

ordinal, TPM_ORD_NV_ReadValueAuth

4

4

3S

4

UINT32

dataSize

The size of the data area

5

<>

4S

<>

BYTE[]

data

The data

6

20

2H1

20

TPM_NONCE

authNonceEven

Even nonce newly generated by TPM to cover outputs

3H1

20

TPM_NONCE

authLastNonceOdd

Nonce generated by system associated with authHandle

4H1

1

BOOL

authContinueSession

Continue use flag, TRUE if handle is still active

8

20

TPM_AUTHDATA

authHmacOut

HMAC key: nv element authorization

7

1

8

20

4341Actions
43421. Locate and set D1 to the TPM_NV_DATA_AREA that corresponds to nvIndex, on error
4343
return TPM_BADINDEX
1060Level 2 Revision 116 28 February 2011
1061

225
TCG Published

1062Copyright © TCG
1063
1064

TPM Main Part 3 Commands
Specification Version 1.2

43442. If D1 -> TPM_NV_PER_AUTHREAD is FALSE return TPM_AUTH_CONFLICT
43453. Validate authHmac using D1 -> authValue on error return TPM_AUTHFAIL
43464. If D1 -> attributes specifies TPM_NV_PER_PPREAD then validate physical presence is
4347
asserted if not return TPM_BAD_PRESENCE
43485. Check that D1 -> pcrInfoRead -> localityAtRelease for TPM_STANY_DATA ->
4349
localityModifier is TRUE
4350
4351

a. For example if TPM_STANY_DATA -> localityModifier was 2 then D1 -> pcrInfo ->
localityAtRelease -> TPM_LOC_TWO would have to be TRUE

4352

b. On error return TPM_BAD_LOCALITY

43536. If D1 -> pcrInfoRead -> pcrSelection specifies a selection of PCR
4354
4355

a. Create P1 a composite hash of the TPM_STCLEAR_DATA -> PCR[] specified by D1 ->
pcrInfoRead

4356
4357

b. Compare P1 to D1 -> pcrInfoRead -> digestAtRelease return TPM_WRONGPCRVAL on
mismatch

43587. If D1 specifies TPM_NV_PER_READ_STCLEAR then
4359

a. If D1 -> bReadSTClear is TRUE return TPM_DISABLED_CMD

43608. If dataSize is 0 then
4361

a. Set D1 -> bReadSTClear to TRUE

4362

b. Set data to all zeros

43639. Else
4364

a. Set S1 to offset + dataSize

4365

b. If S1 > D1 -> dataSize return TPM_NOSPACE

4366

c. Set data to area pointed to by offset

436710.Return TPM_SUCCESS

1065
1066

226

Level 2 Revision 116 28 February 2011
TCG Published

1067TPM Main Part 3 Commands

TCG © Copyright

1068Specification Version 1.2

436821.
Session Management
4369Start of informative comment:
4370Three TPM_RT_CONTEXT session resources located in TPM_STANY_DATA work together to
4371control session save and load: contextNonceSession, contextCount, and contextList[].
4372All three MUST initialized at TPM_Startup(ST_CLEAR) and TPM_Startup(ST_DEACTIVATED)
4373and MAY be initialized at TPM_Startup(ST_STATE). Initializing invalidates all saved
4374sessions. They MAY be restored by TPM_Startup(ST_STATE). This case would allow saved
4375sessions to be loaded.
The actual ST_STATE operation is reported by the
4376TPM_RT_CONTEXT startup effect.
4377TPM_SaveContext creates a contextBlob containing an encrypted contextNonceSession. The
4378nonce is checked by TPM_LoadContext. So initializing contextNonceSession invalidates all
4379saved contexts. The nonce is large and protected, making a replay infeasible.
4380The contextBlob also contains a public but protected contextCount. The count increments
4381for each saved contextBlob. The TPM also saves contextCount in contextList[]. The TPM
4382validates contextBlob against the contextList[] during TPM_LoadContext. Since the
4383contextList[] is finite, it limits the number of valid saved sessions. Since the contextCount
4384cannot be allowed to wrap, it limits the total number of saved sessions.
4385After a contextBlob is loaded, its contextCount entry is removed from contextList[]. This
4386releases space in the context list for future entries. It also invalidates the contextBlob. So a
4387saved contextBlob can be loaded only once.
4388TPM_FlushSpecific can also specify a contextCount to be removed from the contextList[],
4389allowing invalidation of an individual contextBlob. This is different from TPM_FlushSpecific
4390specifying a session handle, which invalidates a loaded session, not a saved contextBlob.
4391End of informative comment.
4392
439321.1

TPM_KeyControlOwner

4394Start of informative comment:
4395This command controls some attributes of keys that are stored within the TPM key cache.
4396OwnerEvict: If this bit is set to true, this key remains in the TPM non-volatile storage
4397through all TPM_Startup events. The only way to evict this key is for the TPM Owner to
4398execute this command again, setting the owner control bit to false and then executing
4399TPM_FlushSpecific.
4400The key handle does not reference an authorized entity and is not validated.
4401The check for two remaining key slots ensures that users can load the two keys required to
4402execute many commands. Since only the owner can flush owner evict keys, non-owner
4403commands could be blocked if this test was not performed.
4404End of informative comment.
4405Incoming Parameters and Sizes
PARAM

HMAC

Type

1069Level 2 Revision 116 28 February 2011
1070

Name

227
TCG Published

Description

1071Copyright © TCG
1072
1073
#

SZ

1

2

2

4

3

4

4

4

5

<>

2S

6

4

7

1

8

4

9

#

TPM Main Part 3 Commands
Specification Version 1.2

SZ
TPM_TAG

tag

TPM_TAG_RQU_AUTH1_COMMAND

UINT32

paramSize

Total number of input bytes incl. paramSize and tag

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_KeyControlOwner

TPM_KEY_HANDLE

keyHandle

The handle of a loaded key.

<>

TPM_PUBKEY

pubKey

The public key associated with the loaded key

3S

4

TPM_KEY_CONTROL

bitName

The name of the bit to be modified

4S

1

BOOL

bitValue

The value to set the bit to

TPM_AUTHHANDLE

authHandle

The authorization session handle used for owner authentication.

1S

4

2H1

20

TPM_NONCE

authLastNonceEven

Even nonce previously generated by TPM to cover inputs

10

20

3H1

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

11

1

4H1

1

BOOL

continueAuthSession

The continue use flag for the authorization session handle

12

20

20

TPM_AUTHDATA

ownerAuth

HMAC authorization: key ownerAuth

Type

Name

Description

4406Outgoing Parameters and Sizes
PARAM

HMAC

#

SZ

#

SZ

1

2

TPM_TAG

tag

TPM_TAG_RSP_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

5

1

6

TPM_RESULT

returnCode

The return code of the operation.

4

TPM_COMMAND_CODE

ordinal

Command ordinal:TPM_ORD_KeyControlOwner

2H1

20

TPM_NONCE

nonceEven

Even nonce newly generated by TPM.

3H1

20

4

2S
4

1S

20

TPM_NONCE

nonceOdd

Nonce generated by system

4H1

1

BOOL

continueAuthSession

Continue use flag, TRUE if handle is still active

TPM_AUTHDATA

resAuth

HMAC authorization: key ownerAuth

20

4407Description
44081. Set an internal bit within the key cache that controls some attribute of a loaded key.
4409Actions
44101. Validate the AuthData using the owner authentication value, on error return
4411
TPM_AUTHFAIL
44122. Validate that keyHandle refers to a loaded key, return TPM_INVALID_KEYHANDLE on
4413
error.
44143. Validate that pubKey matches the key held by the TPM pointed to by keyHandle, return
4415
TPM_BAD_PARAMETER on mismatch
4416
4417

a. This check is added so that virtualization of the keyHandle does not result in attacks,
as the keyHandle is not associated with an authorization value

44184. Validate that bitName is valid, return TPM_BAD_MODE on error.
44195. If bitName == TPM_KEY_CONTROL_OWNER_EVICT
1074
1075

228

Level 2 Revision 116 28 February 2011
TCG Published

1076TPM Main Part 3 Commands

TCG © Copyright

1077Specification Version 1.2

4420

a. If bitValue == TRUE

4421
4422
4423

i. Verify that after this operation at least two key slots will be present within the
TPM that can store any type of key both of which do NOT have the OwnerEvict bit
set, on error return TPM_NOSPACE

4424
4425

ii. Verify that for this key handle, parentPCRStatus is FALSE and isVolatile is
FALSE. Return TPM_BAD_PARAMETER on error.

4426

iii. Set ownerEvict within the internal key storage structure to TRUE.

4427
4428

b. Else if bitValue == FALSE
i.

Set ownerEvict within the internal key storage structure to FALSE.

44296. Return TPM_SUCCESS

1078Level 2 Revision 116 28 February 2011
1079

229
TCG Published

1080Copyright © TCG
1081
1082

443021.2

TPM Main Part 3 Commands
Specification Version 1.2

TPM_SaveContext

4431Start of informative comment:
4432TPM_SaveContext saves a loaded resource outside the TPM. After successful execution of
4433the command, the TPM automatically releases the internal memory for sessions but leaves
4434keys in place.
4435There is no assumption that a saved context blob is stored in a safe, protected area. Since
4436the context blob can be loaded at any time, do not rely on TPM_SaveContext to restrict
4437access to an entity such as a key. If use of the entity should be restricted, means such as
4438authorization secrets or PCR’s should be used.
4439In general, TPM_SaveContext can save a transport session. However, it cannot save an
4440exclusive transport session, because any ordinal other than TPM_ExecuteTransport
4441terminates the exclusive transport session. This action prevents the exclusive transport
4442session from being saved and reloaded while intervening commands are hidden from the
4443transport log.
4444End of informative comment.
4445Incoming Parameters and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_COMMAND

2

4

UINT32

paramSize

Total number of input bytes including paramSize and tag

3

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_SaveContext

4

4

TPM_HANDLE

handle

Handle of the resource being saved.

5

4

2S

4

TPM_RESOURCE_TYPE

resourceType

The type of resource that is being saved

6

16

3S

16

BYTE[16]

label

Label for identification purposes

Type

Name

Description

TPM_TAG

tag

TPM_TAG_RSP_COMMAND

#

SZ

1

#

SZ

1S

4

4446Outgoing Parameters and Sizes
PARAM
#

SZ

1

2

2

4

3

4

HMAC
#

SZ

UINT32

paramSize

Total number of output bytes including paramSize and tag

1S

4

TPM_RESULT

returnCode

The return code of the operation.

2S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_SaveContext

4

4

3S

4

UINT32

contextSize

The actual size of the outgoing context blob

5

<>

4S

<>

TPM_CONTEXT_BLOB

contextBlob

The context blob

4447Description
44481. The caller of the function uses the label field to add additional sequencing, anti-replay or
4449
other items to the blob. The information does not need to be confidential but needs to be
4450
part of the blob integrity.

1083
1084

230

Level 2 Revision 116 28 February 2011
TCG Published

1085TPM Main Part 3 Commands

TCG © Copyright

1086Specification Version 1.2

4451Actions
44521. Map V1 to TPM_STANY_DATA
44532. Validate that handle points to
4454
TPM_INVALID_RESOURCE on error

resource

that

matches

resourceType,

return

44553. Validate that resourceType is a resource from the following list if not return
4456
TPM_INVALID_RESOURCE
4457

a. TPM_RT_KEY

4458

b. TPM_RT_AUTH

4459

c. TPM_RT_TRANS

4460

d. TPM_RT_DAA_TPM

44614. Locate the correct nonce
4462
4463

a. If resourceType is TPM_RT_KEY
i.

4464
4465

If TPM_STCLEAR_DATA -> contextNonceKey is all zeros
(1)
Set TPM_STCLEAR_DATA -> contextNonceKey to the next value from
the TPM RNG

4466

ii. Map N1 to TPM_STCLEAR_DATA -> contextNonceKey

4467
4468

iii. If the key has TPM_KEY_CONTROL_OWNER_EVICT
TPM_OWNER_CONTROL

4469

i.

then

return

b. Else

4470

set

4471
4472

If V1 -> contextNonceSession is all zeros
(1)

Set V1 -> contextNonceSession to the next value from the TPM RNG

ii. Map N1 to V1 -> contextNonceSession

44735. Set K1 to TPM_PERMANENT_DATA -> contextKey
44746. Create R1 by putting the sensitive part of the resource pointed to by handle into a
4475
structure. The structure is a TPM manufacturer option. The TPM MUST ensure that ALL
4476
sensitive information of the resource is included in R1.
44777. Create C1 a TPM_CONTEXT_SENSITIVE structure
4478
4479
4480

a. C1 forms the inner encrypted wrapper for the blob. All saved context blobs MUST
include a TPM_CONTEXT_SENSITIVE structure and the TPM_CONTEXT_SENSITIVE
structure MUST be encrypted.

4481

b. Set C1 -> contextNonce to N1

4482

c. Set C1 -> internalData to R1

44838. Create B1 a TPM_CONTEXT_BLOB
4484

a. Set B1 -> tag to TPM_TAG_CONTEXTBLOB

4485

b. Set B1 -> resourceType to resourceType

4486

c. Set B1 -> handle to handle

4487

d. Set B1 -> integrityDigest to all zeros

1087Level 2 Revision 116 28 February 2011
1088

231
TCG Published

1089Copyright © TCG
1090
1091

TPM Main Part 3 Commands
Specification Version 1.2

4488

e. Set B1 -> label to label

4489
4490
4491

f. Set B1 -> additionalData to information determined by the TPM manufacturer. This
data will help the TPM to reload and reset context. This area MUST NOT hold any data
that is sensitive (symmetric IV are fine, prime factors of an RSA key are not).

4492
4493

i. For OSAP sessions and for DSAP sessions attached to keys, the hash of the
entity MUST be included in additionalData

4494

g. Set B1 -> additionalSize to the size of additionalData

4495

h. Set B1 -> sensitiveSize to the size of C1

4496

i.

Set B1 -> sensitiveData to C1

44979. If resourceType is TPM_RT_KEY
4498

a. Set B1 -> contextCount to 0

449910.Else
4500

a. If V1 -> contextCount > 232-2 then

4501

i.

4502

b. Else

4503

i.

Return with TPM_TOOMANYCONTEXTS
Validate that the TPM can still manage the new count value

4504
4505

(1)
If the distance between the oldest saved context and the contextCount
is too large return TPM_CONTEXT_GAP

4506
4507

ii. Find contextIndex such that V1 -> contextList[contextIndex] equals 0. If not
found exit with TPM_NOCONTEXTSPACE

4508

iii. Increment V1 -> contextCount by 1

4509

iv. Set V1-> contextList[contextIndex] to V1 -> contextCount

4510

v. Set B1 -> contextCount to V1 -> contextCount

4511
4512

c. The TPM MUST invalidate all information regarding the resource except for
information needed for reloading

451311.Calculate B1 -> integrityDigest the HMAC of B1 using TPM_PERMANENT_DATA ->
4514
tpmProof as the secret
451512.Create E1 by encrypting C1 using K1 as the key
4516

a. Set B1 -> sensitiveSize to the size of E1

4517

b. Set B1 -> sensitiveData to E1

451813.Set contextSize to the size of B1
451914.Return B1 in contextBlob

1092
1093

232

Level 2 Revision 116 28 February 2011
TCG Published

1094TPM Main Part 3 Commands

TCG © Copyright

1095Specification Version 1.2

452021.3

TPM_LoadContext

4521Start of informative comment:
4522TPM_LoadContext loads into the TPM a previously saved context. The command returns a
4523handle.
4524End of informative comment.
4525Incoming Parameters and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_COMMAND

2

4

UINT32

paramSize

Total number of input bytes including paramSize and tag

3

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_LoadContext

4

4

TPM_HANDLE

entityHandle

The handle the TPM MUST use to locate the entity tied to the OSAP/DSAP
session

5

1

2S

1

BOOL

keepHandle

Indication if the handle MUST be preserved

6

4

3S

4

UINT32

contextSize

The size of the following context blob.

7

<>

4S

<>

TPM_CONTEXT_BLOB

contextBlob

The context blob

Type

Name

Description

#

SZ

1

#

1S

SZ

4

4526Outgoing Parameters and Sizes
PARAM

HMAC

#

SZ

#

SZ

1

2

TPM_TAG

tag

TPM_TAG_RSP_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

4

4

TPM_RESULT

returnCode

The return code of the operation.

2S
4

1S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_LoadContext

TPM_HANDLE

handle

The handle assigned to the resource after it has been successfully loaded.

4527Actions
45281. Map contextBlob to B1, a TPM_CONTEXT_BLOB structure
45292. Map V1 to TPM_STANY_DATA
45303. Create M1 by decrypting B1 -> sensitiveData using TPM_PERMANENT_DATA ->
4531
contextKey
45324. Create C1 and R1 by splitting M1 into a TPM_CONTEXT_SENSITIVE structure and
4533
internal resource data
45345. Check contextNonce
4535
4536
4537

a. If B1 -> resourceType is NOT TPM_RT_KEY
i. If C1 -> contextNonce does not equal V1 -> contextNonceSession return
TPM_BADCONTEXT

1096Level 2 Revision 116 28 February 2011
1097

233
TCG Published

1098Copyright © TCG
1099
1100

TPM Main Part 3 Commands
Specification Version 1.2

4538
4539
4540

ii. Validate that the resource pointed to by the context is loaded (i.e. for OSAP the
key referenced is loaded and DSAP connected to the key) return
TPM_RESOURCEMISSING

4541
4542

(1)
For OSAP sessions and for DSAP sessions attached to keys, the TPM
MUST validate that the hash of the entity matches the entity held by the TPM

4543
4544
4545

(2)
For OSAP and DSAP sessions referring to a key, verify that entityHandle
identifies the key linked to this OSAP/DSAP session, if not return
TPM_BAD_HANDLE.

4546

b. Else

4547
4548

i. If C1 -> internalData -> parentPCRStatus is FALSE and C1 -> internalData ->
isVolatile is FALSE

4549

(1)

4550

Ignore C1 -> contextNonce

ii. else

4551
4552

(1)
If C1 -> contextNonce does not equal TPM_STCLEAR_DATA ->
contextNonceKey return TPM_BADCONTEXT

45536. Validate the structure
4554

a. Set H1 to B1 -> integrityDigest

4555

b. Set B1 -> integrityDigest to all zeros

4556

c. Copy M1 to B1 -> sensitiveData

4557
4558

d. Create H2 the HMAC of B1 using TPM_PERMANENT_DATA -> tpmProof as the HMAC
key

4559

e. If H2 does not equal H1 return TPM_BADCONTEXT

45607. If keepHandle is TRUE
4561

a. Set handle to B1 -> handle

4562

b. If the TPM is unable to restore the handle the TPM MUST return TPM_BAD_HANDLE

45638. Else
4564
4565

a. The TPM SHOULD attempt to restore the handle but if not possible it MAY set the
handle to any valid for B1 -> resourceType

45669. If B1 -> resourceType is NOT TPM_RT_KEY
4567
4568

a. Find contextIndex such that V1 -> contextList[contextIndex] equals B1 ->
TPM_CONTEXT_BLOB -> contextCount

4569

b. If not found then return TPM_BADCONTEXT

4570

c. Set V1 -> contextList[contextIndex] to 0

457110.Process B1 to return the resource back into TPM use

1101
1102

234

Level 2 Revision 116 28 February 2011
TCG Published

1103TPM Main Part 3 Commands

TCG © Copyright

1104Specification Version 1.2

457222.
Eviction
4573Start of informative comment:
4574The TPM has numerous resources held inside of the TPM that may need eviction. The need
4575for eviction occurs when the number or resources in use by the TPM exceed the available
4576space. For resources that are hard to reload (i.e. keys tied to PCR values) the outside entity
4577should first perform a context save before evicting items.
4578In version 1.1 there were separate commands to evict separate resource types. This new
4579command set uses the resource types defined for context saving and creates a generic
4580command that will evict all resource types.
4581End of informative comment.
4582The TPM MUST NOT flush the EK or SRK using this command.
4583Version 1.2 deprecates the following commands:
4584● TPM_Terminate_Handle
4585● TPM_EvictKey
4586● TPM_Reset

1105Level 2 Revision 116 28 February 2011
1106

235
TCG Published

1107Copyright © TCG
1108
1109

458722.1

TPM Main Part 3 Commands
Specification Version 1.2

TPM_FlushSpecific

4588Start of informative comment:
4589TPM_FlushSpecific flushes from the TPM a specific handle.
4590End of informative comment.
4591Incoming Parameters and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_COMMAND

2

4

UINT32

paramSize

Total number of input bytes including paramSize and tag

3

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_FlushSpecific

4

4

TPM_HANDLE

handle

The handle of the item to flush

5

4

TPM_RESOURCE_TYPE

resourceType

The type of resource that is being flushed

Type

Name

Description

#

SZ

1

#

1S

2S

SZ

4

4

4592Outgoing Parameters and Sizes
PARAM

HMAC

#

#

SZ

SZ

1

2

TPM_TAG

tag

TPM_TAG_RSP_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

1S

4

TPM_RESULT

returnCode

The return code of the operation

2S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_FlushSpecific

4593Description
4594TPM_FlushSpecific releases the resources associated with the given handle.
4595Actions
45961. If resourceType is TPM_RT_CONTEXT
4597
4598
4599

a. The handle for a context is not a handle but the "context count" value. The TPM uses
the "context count" value to locate the proper contextList entry and sets R1 to the
contextList entry

46002. Else if resourceType is TPM_RT_KEY
4601

a. Set R1 to the key pointed to by handle

4602

b. If R1 -> ownerEvict is TRUE return TPM_KEY_OWNER_CONTROL

46033. Else if resourceType is TPM_RT_AUTH
4604

a. Set R1 to the authorization session pointed to by handle

46054. Else if resourceType is TPM_RT_TRANS
4606

a. Set R1 to the transport session pointed to by handle

46075. Else if resourceType is TPM_RT_DAA_TPM
1110
1111

236

Level 2 Revision 116 28 February 2011
TCG Published

1112TPM Main Part 3 Commands

TCG © Copyright

1113Specification Version 1.2

4608

a. Set R1 to the DAA session pointed to by handle

46096. Else return TPM_INVALID_RESOURCE
46107. Validate that R1 determined by resourceType and handle points to a valid allocated
4611
resource. Return TPM_BAD_PARAMETER on error.
46128. Invalidate R1 and all internal resources allocated to R1
4613

a. Resources include authorization sessions

1114Level 2 Revision 116 28 February 2011
1115

237
TCG Published

1116Copyright © TCG
1117
1118

TPM Main Part 3 Commands
Specification Version 1.2

461423.
Timing Ticks
4615Start of informative comment:
4616The TPM timing ticks are always available for use. The association of timing ticks to actual
4617time is a protocol that occurs outside of the TPM. See the design document for details.
4618The setting of the clock type variable is a one time operation that allows the TPM to be
4619configured to the type of platform that is installed on.
4620The ability for the TPM to continue to increment the timer ticks across power cycles of the
4621platform is a TPM and platform manufacturer decision.
4622End of informative comment.
462323.1

TPM_GetTicks

4624Start of informative comment:
4625This command returns the current tick count of the TPM.
4626End of informative comment.
4627Incoming Parameters and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_COMMAND

2

4

UINT32

paramSize

Total number of input bytes including paramSize and tag

3

4

TPM_COMMAND_CODE

ordinal

Ordinal: TPM_ORD_GetTicks

Type

Name

Description

#

SZ

1

#

SZ

1S

4

4628Outgoing Parameters and Sizes
PARAM

HMAC

#

SZ

#

SZ

1

2

TPM_TAG

tag

TPM_TAG_RSP_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

32

4

TPM_RESULT

returnCode

The return code of the operation.

2S
4

1S

4

TPM_COMMAND_CODE

ordinal

Ordinal: TPM_ORD_GetTicks

3S

32

TPM_CURRENT_TICKS

currentTime

The current time held in the TPM

4629Description
4630This command returns the current time held in the TPM. It is the responsibility of the
4631external system to maintain any relation between this time and a UTC value or local real
4632time value.
4633Actions
46341. Set T1 to the internal TPM_CURRENT_TICKS structure
46352. Return T1 as currentTime.
1119
1120

238

Level 2 Revision 116 28 February 2011
TCG Published

1121TPM Main Part 3 Commands

TCG © Copyright

1122Specification Version 1.2

463623.2

TPM_TickStampBlob

4637Start of informative comment:
4638This command applies a time stamp to the passed blob. The TPM makes no representation
4639regarding the blob merely that the blob was present at the TPM at the time indicated.
4640End of informative comment.
4641Incoming Parameters and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of input bytes including paramSize and tag

3

4

TPM_COMMAND_CODE

ordinal

Ordinal, fixed value of TPM_ORD_TickStampBlob

4

4

TPM_KEY_HANDLE

keyHandle

The keyHandle identifier of a loaded key that can perform digital
signatures.

5

20

2S

20

TPM_NONCE

antiReplay

Anti replay value added to signature

6

20

3S

20

TPM_DIGEST

digestToStamp

The digest to perform the tick stamp on

7

4

TPM_AUTHHANDLE

authHandle

The authorization session handle used for keyHandle authorization

#

SZ

1

#

1S

SZ

4

2H1

20

TPM_NONCE

authLastNonceEven

Even nonce previously generated by TPM to cover inputs

8

20

3H1

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

9

1

4H1

1

BOOL

continueAuthSession

The continue use flag for the authorization session handle

10

20

TPM_AUTHDATA

privAuth

The authorization session digest that authorizes the use of keyHandle.
HMAC key: key.usageAuth

1123Level 2 Revision 116 28 February 2011
1124

239
TCG Published

1125Copyright © TCG
1126
1127

TPM Main Part 3 Commands
Specification Version 1.2

4642Outgoing Parameters and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RSP_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

#

SZ

1

#

SZ

1S

4

TPM_RESULT

returnCode

The return code of the operation.

2S

4

TPM_COMMAND_CODE

ordinal

Ordinal, fixed value of TPM_ORD_TickStampBlob

4

32

3S

32

TPM_CURRENT_TICKS

currentTicks

The current time according to the TPM

5

4

4S

4

UINT32

sigSize

The length of the returned digital signature

6

<>

5S

<>

BYTE[ ]

sig

The resulting digital signature.

7

20

2H1

20

TPM_NONCE

nonceEven

Even nonce newly generated by TPM to cover outputs

3H1

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

4H1

1

BOOL

continueAuthSession

Continue use flag, TRUE if handle is still active

TPM_AUTHDATA

resAuth

The authorization session digest for the returned parameters. HMAC key:
key.usageAuth

8

1

9

20

4643Description
4644The function performs a digital signature on the hash of digestToStamp and the current tick
4645count.
4646It is the responsibility of the external system to maintain any relation between tick count
4647and a UTC value or local real time value.
4648Actions
46491. The TPM validates the AuthData to use the key pointed to by keyHandle.
46502. Validate that keyHandle -> keyUsage is TPM_KEY_SIGNING, TPM_KEY_IDENTITY or
4651
TPM_KEY_LEGACY, if not return the error code TPM_INVALID_KEYUSAGE.
46523. Validate that keyHandle -> sigScheme is TPM_SS_RSASSAPKCS1v15_SHA1 or
4653
TPM_SS_RSASSAPKCS1v15_INFO, if not return TPM_INAPPROPRIATE_SIG.
46544. If TPM_STCLEAR_DATA -> currentTicks is not properly initialized
4655

a. Initialize the TPM_STCLEAR_DATA -> currentTicks

46565. Create T1, a TPM_CURRENT_TICKS structure.
46576. Create H1 a TPM_SIGN_INFO structure and set the structure defaults
4658

a. Set H1 -> fixed to “TSTP”

4659

b. Set H1 -> replay to antiReplay

4660

c. Create H2 the concatenation of digestToStamp || T1

4661

d. Set H1 -> dataLen to the length of H2

4662

e. Set H1 -> data to H2

1128
1129

240

Level 2 Revision 116 28 February 2011
TCG Published

1130TPM Main Part 3 Commands

TCG © Copyright

1131Specification Version 1.2

46637. The TPM computes the signature, sig, using the key referenced by keyHandle, using
4664
SHA-1 of H1 as the information to be signed
46658. The TPM returns T1 as currentTicks parameter

1132Level 2 Revision 116 28 February 2011
1133

241
TCG Published

1134Copyright © TCG
1135
1136

466624.
4667

TPM Main Part 3 Commands
Specification Version 1.2

Transport Sessions

4668See Part 1 for rationale and security issues.
466924.1

TPM_EstablishTransport

4670Start of informative comment:
4671This establishes the transport session. Depending on the attributes specified for the session
4672this may establish shared secrets, encryption keys, and session logs. The session will be in
4673use for by the TPM_ExecuteTransport command.
4674The only restriction on what can happen inside of a transport session is that there is no
4675“nesting” of sessions. It is permissible to perform operations that delete internal state and
4676make the TPM inoperable.
4677End of informative comment.
4678Incoming Parameters and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of input bytes including paramSize and tag

3

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_EstablishTransport

4

4

TPM_KEY_HANDLE

encHandle

The handle to the key that encrypted the blob

5

<>

2S

<>

TPM_TRANSPORT_PUBLIC

transPublic

The public information describing the transport session

6

4

3S

4

UINT32

secretSize

The size of the secret Area

7

<>

4S

<>

BYTE[]

secret

The encrypted secret area

8

4

TPM_AUTHHANDLE

authHandle

The authorization session handle used for keyHandle authorization

#

SZ

1

#

1S

SZ

4

2H1

20

TPM_NONCE

authLastNonceEven

Even nonce previously generated by TPM to cover inputs

9

20

3H1

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

10

1

4H1

1

BOOL

continueAuthSession

The continue use flag for the authorization session handle

11

20

TPM_AUTHDATA

keyAuth

Authorization. HMAC key: encKey.usageAuth

4679

1137
1138

242

Level 2 Revision 116 28 February 2011
TCG Published

1139TPM Main Part 3 Commands

TCG © Copyright

1140Specification Version 1.2

4680Outgoing Parameters and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RSP_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

#

SZ

1

#

SZ

1S

4

TPM_RESULT

returnCode

The return code of the operation.

2S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_EstablishTransport

TPM_TRANSHANDLE

transHandle

The handle for the transport session

4

4

5

4

3S

4

TPM_MODIFIER_INDICATOR

locality

The locality that called this command

6

32

4S

32

TPM_CURRENT_TICKS

currentTicks

The current tick count

7

20

5S

20

TPM_NONCE

transNonceEven

The even nonce in use for subsequent execute transport

8

20

2H1

20

TPM_NONCE

nonceEven

Even nonce newly generated by TPM to cover outputs

3H1

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

4H1

1

BOOL

continueAuthSession

Continue use flag, TRUE if handle is still active

TPM_AUTHDATA

resAuth

Authorization. HMAC key: key.usageAuth

9

1

10

20

4681Description
4682This command establishes the transport sessions shared secret. The encryption of the
4683shared secret uses the public key of the key loaded in encKey.
4684Actions
46851. If encHandle is TPM_KH_TRANSPORT then
4686

a. If tag is NOT TPM_TAG_RQU_COMMAND return TPM_BADTAG

4687
4688

b. If transPublic -> transAttributes specifies TPM_TRANSPORT_ENCRYPT return
TPM_BAD_SCHEME

4689

c. If secretSize is not 20 return TPM_BAD_PARAM_SIZE

4690

d. Set A1 to secret

46912. Else
4692
4693

a. encHandle -> keyUsage MUST be TPM_KEY_STORAGE or TPM_KEY_LEGACY return
TPM_INVALID_KEYUSAGE on error

4694
4695

b. If encHandle -> authDataUsage does not equal TPM_AUTH_NEVER and tag is NOT
TPM_TAG_RQU_AUTH1_COMMAND return TPM_AUTHFAIL

4696
4697

c. Using encHandle -> usageAuth validate the AuthData to use the key and the
parameters to the command

4698
4699

d. Create K1 a TPM_TRANSPORT_AUTH structure by decrypting secret using the key
pointed to by encHandle

4700

e. Validate K1 for tag

4701

f. Set A1 to K1 -> authData

1141Level 2 Revision 116 28 February 2011
1142

243
TCG Published

1143Copyright © TCG
1144
1145

TPM Main Part 3 Commands
Specification Version 1.2

47023. If transPublic -> transAttributes has TPM_TRANSPORT_ENCRYPT
4703
4704

a. If TPM_PERMANENT_FLAGS -> FIPS is true and transPublic -> algId is equal to
TPM_ALG_MGF1 return TPM_INAPPROPRIATE_ENC

4705
4706

b. Check
if
the
transPublic
TPM_BAD_KEY_PROPERTY

4707
4708

c. If transPublic -> algid is TPM_ALG_AESXXX, check that transPublic -> encScheme is
supported, if not return TPM_INAPPROPRIATE_ENC

4709

d. Perform any initializations necessary for the algorithm

->

algId

is

supported,

if

not

return

47104. Generate transNonceEven from the TPM RNG
47115. Create T1 a TPM_TRANSPORT_INTERNAL structure
4712
4713

a. Ensure that the TPM has sufficient internal space to allocate the transport session,
return TPM_RESOURCES on error

4714

b. Assign a T1 -> transHandle value. This value is assigned by the TPM

4715

c. Set T1 -> transDigest to all zeros

4716

d. Set T1 -> transPublic to transPublic

4717

e. Set T1-> transNonceEven to transNonceEven

4718

f. Set T1 -> authData to A1

47196. If TPM_STANY_DATA -> currentTicks is not properly initialized
4720

a. Initialize the TPM_STANY_DATA -> currentTicks

47217. Set currentTicks to TPM_STANY_DATA -> currentTicks
47228. If T1 -> transPublic -> transAttributes has TPM_TRANSPORT_LOG set then
4723

a. Create L1 a TPM_TRANSPORT_LOG_IN structure

4724

i.

4725

ii. Set L1 -> pubKeyHash to all zeros

4726

iii. Set T1 -> transDigest to SHA-1 (T1 -> transDigest || L1)

4727

Set L1 -> parameters to SHA-1 (ordinal || transPublic || secretSize || secret)

b. Create L2 a TPM_TRANSPORT_LOG_OUT structure

4728
4729

i. Set L2 -> parameters to SHA-1 (returnCode || ordinal || locality ||
currentTicks || transNonceEven)

4730

ii. Set L2 -> locality to the locality of this command

4731
4732

iii. Set L2 -> currentTicks to currentTicks, this MUST be the same value that is
returned in the currentTicks parameter

4733

iv. Set T1 -> transDigest to SHA-1 (T1 -> transDigest || L2)

47349. If T1 -> transPublic -> transAttributes has TPM_TRANSPORT_EXCLUSIVE then set
4735
TPM_STANY_FLAGS -> transportExclusive to TRUE
4736
4737
4738
1146
1147

a. Execution
of
any
command
other
than
TPM_ExecuteTransport
or
TPM_ReleaseTransportSigned targeting this transport session will cause the abnormal
invalidation of this transport session transHandle
244

Level 2 Revision 116 28 February 2011
TCG Published

1148TPM Main Part 3 Commands

TCG © Copyright

1149Specification Version 1.2

4739
4740

b. The TPM gives no indication, other than invalidation of transHandle, that the session
is terminated

474110.Return T1 -> transHandle as transHandle

1150Level 2 Revision 116 28 February 2011
1151

245
TCG Published

1152Copyright © TCG
1153
1154

474224.2

TPM Main Part 3 Commands
Specification Version 1.2

TPM_ExecuteTransport

4743Start of informative comment:
4744Delivers a wrapped TPM command to the TPM where the TPM unwraps the command and
4745then executes the command.
4746TPM_ExecuteTransport uses the same rolling nonce paradigm as other authorized TPM
4747commands. The even nonces start in TPM_EstablishTransport and change on each
4748invocation of TPM_ExecuteTransport.
4749The only restriction on what can happen inside of a transport session is that there is no
4750“nesting” of sessions. It is permissible to perform operations that delete internal state and
4751make the TPM inoperable.
4752Because, in general, key handles are not logged, a digest of the corresponding public key is
4753logged. In cases where the key handle is logged (e.g. TPM_OwnerReadInternalPub), the
4754public key is also logged.
4755The wrapped command is audited twice – once according to the actions of
4756TPM_ExecuteTransport and once within the wrapped command itself according to the
4757special rules for auditing a command wrapped in an encrypted transport session.
4758The method of incrementing the symmetric key counter value is different from that used by
4759some standard crypto libraries (e.g. openSSL, Java JCE) that increment the entire counter
4760value. TPM users should be aware of this to avoid errors when the counter wraps.
4761End of informative comment.
4762Incoming Parameters and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of input bytes including paramSize and tag

3

4

1S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_ExecuteTransport

4

4

2S

4

UINT32

wrappedCmdSize

Size of the wrapped command

5

<>

3S

<>

BYTE[]

wrappedCmd

The wrapped command

6

4

TPM_TRANSHANDLE

transHandle

The transport session handle

#

SZ

1

#

SZ

2H1

20

TPM_NONCE

transLastNonceEven

Even nonce previously generated by TPM

7

20

3H1

20

TPM_NONCE

transNonceOdd

Nonce generated by caller

8

1

4H1

1

BOOL

continueTransSession

The continue use flag for the authorization session handle

9

20

TPM_AUTHDATA

transAuth

HMAC for transHandle key: transHandle -> authData

4763

1155
1156

246

Level 2 Revision 116 28 February 2011
TCG Published

1157TPM Main Part 3 Commands

TCG © Copyright

1158Specification Version 1.2

4764Outgoing Parameters and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RSP_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

#

SZ

1

#

SZ

1S

4

TPM_RESULT

returnCode

The return code of the ExecuteTransport command. This does not reflect
the status of wrapped command.

2S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_ExecuteTransport

4

8

3S

8

UINT64

currentTicks

The current ticks when the command was executed

5

4

4S

4

TPM_MODIFIER_INDICATOR

locality

The locality that called this command

6

4

5S

4

UINT32

wrappedRspSize

Size of the wrapped response

7

<>

6S

<>

BYTE[]

wrappedRsp

The wrapped response

8

20

2H1

20

TPM_NONCE

transNonceEven

Even nonce newly generated by TPM

3H1

20

TPM_NONCE

transNonceOdd

Nonce generated by caller

4H1

1

BOOL

continueTransSession

The continue use flag for the session

TPM_AUTHDATA

transAuth

HMAC for transHandle key: transHandle -> authData

9

1

10

20

4765Description
47661. This command executes a TPM command using the transport session.
47672.
4768
4769
4770

Prior to execution of the wrapped command (action 11 below) failure of the transport
session MUST have no effect on the resources referenced by the wrapped command. The
exception is when the TPM goes into failure mode and return FAILED_SELFTEST for all
subsequent commands.

47713.
4772
4773
4774
4775
4776

After execution of the wrapped command, failure of the transport session MAY NOT
affect wrapped command resources. That is, the TPM is not required to clean up the
effects of the wrapped command. Sessions and keys MAY remain loaded. It is
understood that the transport session will be returning an error code and not reporting
any session nonces. Therefore, wrapped sessions are no longer useful to the caller. It is
the responsibility of the caller to clean up the result of the wrapped command.

47774. Execution of the wrapped command (action 11) SHOULD have no effect on the transport
4778
session.
4779
4780

a. The wrapped command SHALL use no resources of the transport session, this
includes authorization sessions

4781
4782

b. If the wrapped command execution returns an error (action 11 below) then the
sessions for TPM_ExecuteTransport still operate properly.

4783
4784

c. The exception to this is when the wrapped command causes the TPM to go into
failure mode and return TPM_FAILSELFTEST for all subsequent commands

47855. Field layout
4786

a. Notation

4787i. et indicates the outer TPM_ExecuteTransport command and response
1159Level 2 Revision 116 28 February 2011
1160

247
TCG Published

1161Copyright © TCG
1162
1163

4788ii. w indicates the inner
4789
TPM_ExecuteTransport.

TPM Main Part 3 Commands
Specification Version 1.2

command

and

response

that

is

wrapped

by

the

4790iii. (o) indicates optional parameters that may or may not be present in the wrapped
4791
command.
4792

b. Command representation

4793

c. ******************************************************************************

4794

d. TAGet | LENet | ORDet | wrappedCmdSize | wrappedCmd | AUTHet

4795

e. ******************************************************************************

4796

f. wrappedCmd looks like the following

4797

g. ****************************************************************************************

4798

h. TAGw | LENw | ORDw | HANDLESw(o) | DATAw | AUTH1w (o) | AUTH2w (o)

4799

i.

4800

j.

| LEN1 |

4801

k.

| E1

| (encrypted)

4802

l.

| C1

| (decrypted)

4803

m. Response representation

4804

n. *******************************************************************************

4805

o. TAGet | LENet | RCet | … | wrappedRspSize | wrappedRsp | AUTHet

4806

p. *******************************************************************************

4807

q. wrappedRsp looks like the following

4808

r. *************************************************************************************

4809

s. TAGw | LENw | RCw | HANDLESw(o) | DATAw | AUTH1w (o) | AUTH2w (o)

4810

t. *************************************************************************************

4811

u.

4812

v. | -------------------------- C2 -------------------------------------------------- |

4813

w.

| S2

| (decrypted)

4814

x.

| E2

| (encrypted)

4815

y. The only command and response parameter that is possibly encrypted is DATAw.

****************************************************************************************

| LEN2 |

48166. Additional DATAw comments
4817

a. For TPM_FlushSpecific and TPM_SaveContext

4818

i.

4819
4820

(1) It is understood that encrypting the resourceType prevents a determination of
the handle type.

4821

ii. If the resourceType is TPM_RT_KEY, then the public key MUST be logged.

4822
1164
1165

The DATAw part of these commands does not include the handle.

b. For TPM_DAA_Join and TPM_DAA_Sign
248

Level 2 Revision 116 28 February 2011
TCG Published

1166TPM Main Part 3 Commands

TCG © Copyright

1167Specification Version 1.2

4823
4824
4825

i. The DATAw part of these commands does not include the input handle. The
output handle from stage 0 is included in DATAW.
c. For TPM_LoadKey2

4826
4827
4828

i. The outgoing handle is not part of the outgoing DATAw and is not encrypted or
logged by the outgoing transport.
d. For TPM_LoadKey

4829
4830
4831

i. The outgoing handle is part of the outgoing DATAw and is encrypted and
logged.
e. For TPM_LoadContext

4832
4833

i. The outgoing handle is not part of the outgoing DATAw and is not encrypted or
logged by the outgoing transport.

4834
4835

(1) It is understood that encrypting the contextBlob prevents a determination of
the handle type.

4836
4837

f. For TPM_OIAP and TPM_OSAP,
or logged.

4838
4839
4840
4841

i. For TPM_OSAP, the public key MUST NOT be logged. During a logged
transport session, when a wrapped command uses the key, the public key
referenced by the key handle will be logged in the transport. Thus, the audit trail
is established for any key usage at that time.

4842

g. For TPM_DSAP

4843

i.

4844

ii. For output no parameters are encrypted or logged.

no input or output parameters are encrypted

For input, only entityValue is encrypted and logged.

48457.
4846
4847
4848
4849
4850

TPM_ExecuteTransport returns an implementation defined result when the wrapped
command would cause termination of the transport session. Implementation defined
possibilities include but are not limited to: the wrapped command may execute,
completely, partially, or not at all, the transport session may or may not be terminated,
continueTransSession may not be processed or returned correctly, and an error may or
may not be returned. The wrapped commands include:

4851

a. TPM_FlushSpecific, TPM_SaveContext targeting the transport session

4852

b. TPM_OwnerClear, TPM_ForceClear, TPM_RevokeTrust

4853Actions
48541. Using transHandle locate the TPM_TRANSPORT_INTERNAL structure T1
48552. Parse wrappedCmd
4856

a. Set TAGw, LENw, and ORDw to the parameters from wrappedCmd

4857

b. Set E1 to DATAw

4858
4859
4860

i. This pointer is ordinal dependent and requires the execute transport
command to parse wrappedCmd
c. Set LEN1 to the length of DATAw

1168Level 2 Revision 116 28 February 2011
1169

249
TCG Published

1170Copyright © TCG
1171
1172

4861

i.

TPM Main Part 3 Commands
Specification Version 1.2

DATAw always ends at the start of AUTH1w if AUTH1w is present

48623. If LEN1 is less than 0, or if ORDw is unknown, unimplemented, or cannot be determined
4863

a. Return TPM_BAD_PARAMETER

48644. If T1 -> transPublic -> transAttributes has TPM_TRANSPORT_ENCRYPT set then
4865

a. If T1 -> transPublic -> algId is TPM_ALG_MGF1

4866
4867
4868

i. Using the MGF1 function, create string G1 of length LEN1. The inputs to the
MGF1 are transLastNonceEven, transNonceOdd, “in”, and T1 -> authData. These
four values concatenated together form the Z value that is the seed for the MGF1.

4869

ii. Create C1 by performing an XOR of G1 and wrappedCmd starting at E1.

4870

b. If the encryption algorithm requires an IV or CTR, calculate the IV or CTR value

4871
4872
4873
4874
4875
4876

i. Using the MGF1 function, create string IV1 or CTR1 with a length set by the
block size of the encryption algorithm. The inputs to the MGF1 are
transLastNonceEven, transNonceOdd, and “in”. These three values concatenated
together form the Z value that is the seed for the MGF1. Note that any
terminating characters within the string “in” are ignored, so a total of 42 bytes are
hashed.

4877

ii. The symmetric key is taken from the first bytes of T1 -> authData.

4878

iii. Decrypt DATAw and replace the DATAw area of E1 creating C1

4879

c. TPM_OSAP, TPM_OIAP have no parameters encrypted

4880

d. TPM_DSAP has special rules for parameter encryption

48815. Else
4882

a. Set C1 to the DATAw area E1 of wrappedCmd

48836. Create H1 the SHA-1 of (ORDw || C1).
4884

a. C1 MUST point at the decrypted DATAw area of E1

4885
4886

b. The TPM MAY use this calculation for both execute transport authorization,
authorization of the wrapped command and transport log creation

48877. Validate the incoming transport session authorization
4888

a. Set inParamDigest to SHA-1 (ORDet || wrappedCmdSize || H1)

4889
4890

b. Calculate the HMAC of (inParamDigest || transLastNonceEven || transNonceOdd ||
continueTransSession) using T1 -> authData as the HMAC key

4891

c. Validate transAuth, on errors return TPM_AUTHFAIL

48928. If TPM_ExecuteTransport requires auditing
4893
4894

a. Create TPM_AUDIT_EVENT_IN using H1 as the input parameter digest and update
auditDigest

4895

b. On any error return TPM_AUDITFAIL_UNSUCCESSFUL

48969. If ORDw is from the list of following commands return TPM_NO_WRAP_TRANSPORT
4897
1173
1174

a. TPM_EstablishTransport
250

Level 2 Revision 116 28 February 2011
TCG Published

1175TPM Main Part 3 Commands

TCG © Copyright

1176Specification Version 1.2

4898

b. TPM_ExecuteTransport

4899

c. TPM_ReleaseTransportSigned

490010.If T1 -> transPublic -> transAttributes has TPM_TRANSPORT_LOG set then
4901

a. Create L2 a TPM_TRANSPORT_LOG_IN structure

4902

b. Set L2 -> parameters to H1

4903

c. If ORDw is a command with no key handles

4904
4905

i.

Set L2 -> pubKeyHash to all zeros

d. If ORDw is a command with one key handle

4906
4907

i. Create K2 the hash of the TPM_STORE_PUBKEY structure of the key pointed
to by the key handle.

4908

ii. Set L2 -> pubKeyHash to SHA-1 (K2)

4909

e. If ORDw is a command with two key handles

4910
4911

i. Create K2 the hash of the TPM_STORE_PUBKEY structure of the key pointed
to by the first key handle.

4912
4913

ii. Create K3 the hash of the TPM_STORE_PUBKEY structure of the key pointed
to by the second key handle.

4914

iii. Set L2 -> pubKeyHash to SHA-1 (K2 || K3)

4915

f. Set T1 -> transDigest to the SHA-1 (T1 -> transDigest || L2)

4916
4917

g. If ORDw is a command with key handles, and the key is not loaded, return
TPM_INVALID_KEYHANDLE.

491811.Send the wrapped command to the normal TPM command parser, the output is C2 and
4919
the return code is RCw
4920
4921

a. If ORDw is a command that is audited then the TPM MUST perform the input and
output audit of the command as part of this action.

4922
4923

b. The TPM MAY use H1 as the data value in the authorization and audit calculations
during the execution of C1

492412.Set CT1 to TPM_STANY_DATA -> currentTicks -> currentTicks and return CT1 in the
4925
currentTicks output parameter
492613.Calculate S2 the pointer to the DATAw area of C2
4927

a. Calculate LEN2 the length of S2 according to the same rules that calculated LEN1

492814.Create H2 the SHA-1 of (RCw || ORDw || S2)
4929
4930

a. The TPM MAY use this calculation for execute transport authorization and transport
log out creation

493115.Calculate the outgoing transport session authorization
4932

a. Create the new transNonceEven for the output of the command

4933
4934

b. Set outParamDigest to SHA-1 (RCet || ORDet || TPM_STANY_DATA -> currentTicks
-> currentTicks || locality || wrappedRspSize || H2)

1177Level 2 Revision 116 28 February 2011
1178

251
TCG Published

1179Copyright © TCG
1180
1181

4935
4936

TPM Main Part 3 Commands
Specification Version 1.2

c. Calculate transAuth, the HMAC of (outParamDigest || transNonceEven ||
transNonceOdd || continueTransSession) using T1 -> authData as the HMAC key

493716.If T1 -> transPublic -> transAttributes has TPM_TRANSPORT_LOG set then
4938

a. Create L3 a TPM_TRANSPORT_LOG_OUT structure

4939

b. Set L3 -> parameters to H2

4940

c. Set L3 -> currentTicks to TPM_STANY_DATA -> currentTicks

4941

d. Set L3 -> locality to TPM_STANY_DATA -> localityModifier

4942

e. Set T1 -> transDigest to the SHA-1 (T1 -> transDigest || L3)

494317.If T1 -> transPublic -> transAttributes has TPM_TRANSPORT_ENCRYPT set then
4944

a. If T1 -> transPublic -> algId is TPM_ALG_MGF1

4945
4946
4947

i. Using the MGF1 function, create string G2 of length LEN2. The inputs to the
MGF1 are transNonceEven, transNonceOdd, “out”, and T1 -> authData. These
four values concatenated together form the Z value that is the seed for the MGF1.

4948

ii. Create E2 by performing an XOR of G2 and C2 starting at S2.

4949

b. Else

4950
4951
4952

i. Create IV2 or CTR2 using the same algorithm as IV1 or CTR1 with the input
values transNonceEven, transNonceOdd, and “out”. Note that any terminating
characters within the string “out” are ignored, so a total of 43 bytes are hashed.

4953

ii. The symmetric key is taken from the first bytes of T1 -> authData

4954

iii. Create E2 by encrypting C2 starting at S2

495518.Else
4956

a. Set E2 to the DATAw area S2 of wrappedRsp

495719.If continueTransSession is FALSE
4958

a. Invalidate all session data related to transHandle

495920.If TPM_ExecuteTranport requires auditing
4960
4961

a. Create TPM_AUDIT_EVENT_OUT using H2 for the parameters and update the
auditDigest

4962
4963

b. On
any
errors
return
TPM_AUDITFAIL_SUCCESSFUL
TPM_AUDITFAIL_UNSUCCESSFUL depending on RCw

496421.Return C2 but with S2 replaced by E2 in the wrappedRsp parameter

1182
1183

252

Level 2 Revision 116 28 February 2011
TCG Published

or

1184TPM Main Part 3 Commands

TCG © Copyright

1185Specification Version 1.2

496524.3

TPM_ReleaseTransportSigned

4966Start of informative comment:
4967This command completes the transport session. If logging for this session is turned on, then
4968this command returns a digital signature of the hash of all operations performed during the
4969session.
4970This command serves no purpose if logging is turned off, and results in an error if
4971attempted.
4972This command uses two authorization sessions, the key that will sign the log and the
4973authorization from the session. Having the session authorization proves that the requestor
4974that is signing the log is the owner of the session. If this restriction is not put in then an
4975attacker can close the log and sign using their own key.
4976The hash of the session log includes the information associated with the input phase of
4977execution of the TPM_ReleaseTransportSigned command. It cannot include the output
4978phase information.
4979End of informative comment.
4980Incoming Parameters and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_AUTH2_COMMAND

4

UINT32

paramSize

Total number of input bytes including paramSize and tag

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_ReleaseTransportSigned

TPM_KEY_HANDLE

keyHandle

Handle of a loaded key that will perform the signing

TPM_NONCE

antiReplay

Value provided by caller for anti-replay protection

TPM_AUTHHANDLE

authHandle

The authorization session to use key

#

SZ

1
2
3

4

4

4

5

20

6

#

4

1S

2S

SZ

4

20

2H1

20

TPM_NONCE

authLastNonceEven

Even nonce previously generated by TPM to cover inputs

7

20

3H1

20

TPM_NONCE

authNonceOdd

Nonce generated by system associated with authHandle

8

1

4H1

1

BOOL

continueAuthSession

The continue use flag for the authorization session handle

9

20

TPM_AUTHDATA

keyAuth

The authorization session digest that authorizes the use of key. HMAC
key: key -> usageAuth

10

4

TPM_TRANSHANDLE

transHandle

The transport session handle

2H2

20

TPM_NONCE

transLastNonceEven

Even nonce in use by execute Transport

11

20

3H2

20

TPM_NONCE

transNonceOdd

Nonce supplied by caller for transport session

12

1

4H2

1

BOOL

continueTransSession

The continue use flag for the authorization session handle

13

20

TPM_AUTHDATA

transAuth

HMAC for transport session key: transHandle -> authData

1186Level 2 Revision 116 28 February 2011
1187

253
TCG Published

1188Copyright © TCG
1189
1190

TPM Main Part 3 Commands
Specification Version 1.2

4981Outgoing Parameters and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RSP_AUTH2_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

#

SZ

1

#

SZ

1S

4

TPM_RESULT

returnCode

The return code of the operation.

2S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_ReleaseTransportSigned

4

4

3S

4

TPM_MODIFIER_INDICATOR

locality

The locality that called this command

5

32

4S

32

TPM_CURRENT_TICKS

currentTicks

The current ticks when the command executed

6

4

5S

4

UINT32

signSize

The size of the signature area

7

<>

6S

<>

BYTE[]

signature

The signature of the digest

8

20

2H1

20

TPM_NONCE

authNonceEven

Even nonce newly generated by TPM

3H1

20

TPM_NONCE

authNonceOdd

Nonce generated by caller

4H1

1

BOOL

continueAuthSession

The continue use flag for the session

TPM_AUTHDATA

keyAuth

HMAC: key -> usageAuth

9

1

10

20

11

20

1

13

20

TPM_NONCE

transNonceEven

Even nonce newly generated by TPM

3H2
12

2H2

20

TPM_NONCE

transNonceOdd

Nonce generated by caller

4H2

1

BOOL

continueTransSession

The continue use flag for the session

TPM_AUTHDATA

transAuth

HMAC: transHandle -> authData

20

4982Description
4983This command releases a transport session and signs the transport log
4984Actions
49851. Using transHandle locate the TPM_TRANSPORT_INTERNAL structure T1
49862. Validate that keyHandle -> sigScheme is TPM_SS_RSASSAPKCS1v15_SHA1 or
4987
TPM_SS_RSASSAPKCS1v15_INFO, if not return TPM_INAPPROPRIATE_SIG.
49883. Validate that keyHandle
4989
TPM_INVALID_KEYUSAGE

->

keyUsage

is

TPM_KEY_SIGNING,

if

not

return

49904. Using key -> authData validate the command and parameters, on error return
4991
TPM_AUTHFAIL
49925. Using transHandle -> authData validate the command and parameters, on error return
4993
TPM_AUTH2FAIL
49946. If T1 -> transAttributes has TPM_TRANSPORT_LOG set then
4995

a. Create A1 a TPM_TRANSPORT_LOG_OUT structure

4996

b. Set A1 –> parameters to the SHA-1 (ordinal || antiReplay)

4997

c. Set A1 -> currentTicks to TPM_STANY_DATA -> currentTicks

4998

d. Set A1 -> locality to the locality modifier for this command

1191
1192

254

Level 2 Revision 116 28 February 2011
TCG Published

1193TPM Main Part 3 Commands

TCG © Copyright

1194Specification Version 1.2

4999

e. Set T1 -> transDigest to SHA-1 (T1 -> transDigest || A1)

50007. Else
5001

a. Return TPM_BAD_MODE

50028. Create H1 a TPM_SIGN_INFO structure and set the structure defaults
5003

a. Set H1 -> fixed to “TRAN”

5004

b. Set H1 -> replay to antiReplay

5005

c. Set H1 -> data to T1 -> transDigest

5006

d. Sign SHA-1 hash of H1 using the key pointed to by keyHandle

50079. Invalidate all session data related to T1
500810.Set continueTransSession to FALSE
500911.Return TPM_SUCCESS

1195Level 2 Revision 116 28 February 2011
1196

255
TCG Published

1197Copyright © TCG
1198
1199

501025.

TPM Main Part 3 Commands
Specification Version 1.2

Monotonic Counter

501125.1

TPM_CreateCounter

5012Start of informative comment:
5013This command creates the counter but does not select the counter. Counter creation
5014assigns an AuthData value to the counter and sets the counters original start value. The
5015original start value is the current internal base value plus one. Setting the new counter to
5016the internal base avoids attacks on the system that are attempting to use old counter
5017values.
5018End of informative comment.
5019Incoming Parameters and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of input bytes incl. paramSize and tag

3

4

1S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_CreateCounter

4

20

2S

20

TPM_ENCAUTH

encAuth

The encrypted auth data for the new counter

5

4

3s

4

BYTE

label

Label to associate with counter

7

4

TPM_AUTHHANDLE

authHandle

The authorization session handle used for owner authentication.

#

SZ

1

#

SZ

2H1

20

TPM_NONCE

authLastNonceEven

Even nonce previously generated by TPM to cover inputs

8

20

3H1

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

9

1

4H1

1

BOOL

continueAuthSession

Ignored

10

20

20

TPM_AUTHDATA

ownerAuth

Authorization ownerAuth.

Type

Name

Description

5020Outgoing Parameters and Sizes
PARAM

HMAC

#

SZ

#

SZ

1

2

TPM_TAG

tag

TPM_TAG_RSP_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

1S

4

TPM_RESULT

returnCode

The return code of the operation.

2S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_CreateCounter

4

4

3s

4

TPM_COUNT_ID

countID

The handle for the counter

5

10

4S

10

TPM_COUNTER_VALUE

counterValue

The starting counter value

6

20

2H1

20

TPM_NONCE

nonceEven

Even nonce newly generated by TPM to cover outputs

3H1

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

4H1

1

BOOL

continueAuthSession

Fixed value of FALSE

20

TPM_AUTHDATA

resAuth

Authorization. HMAC key: ownerAuth.

7

1

8

20

5021Description
1200
1201

256

Level 2 Revision 116 28 February 2011
TCG Published

1202TPM Main Part 3 Commands

TCG © Copyright

1203Specification Version 1.2

5022This command creates a new monotonic counter. The TPM MUST support a minimum of 4
5023concurrent counters.
5024Actions
5025The TPM SHALL do the following:
50261. Using the authHandle field, validate the owner’s AuthData to execute the command and
5027
all of the incoming parameters. The authorization session MUST be OSAP or DSAP
50282. Ignore continueAuthSession on input and set continueAuthSession to FALSE on output
50293. Create a1 by decrypting encAuth according to the ADIP indicated by authHandle.
50304. Validate that there is sufficient internal space in the TPM to create a new counter. If
5031
there is insufficient space, the command returns an error.
5032
5033

a. The TPM MUST provide storage for a1, TPM_COUNTER_VALUE, countID, and any
other internal data the TPM needs to associate with the counter

50345. Increment the max counter value
50356. Set the counter to the max counter value
50367. Set the counter label to label
50378. Create a countID

1204Level 2 Revision 116 28 February 2011
1205

257
TCG Published

1206Copyright © TCG
1207
1208

503825.2

TPM Main Part 3 Commands
Specification Version 1.2

TPM_IncrementCounter

5039Start of informative comment:
5040This authorized command increments the indicated counter by one. Once a counter has
5041been incremented then all subsequent increments must be for the same handle until a
5042successful TPM_Startup(ST_CLEAR) is executed.
5043The order for checking validation of the command parameters when no counter is active,
5044keeps an attacker from creating a denial-of-service attack.
5045End of informative comment.
5046Incoming Parameters and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of input bytes including paramSize and tag

3

4

1S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_IncrementCounter

4

4

2s

4

TPM_COUNT_ID

countID

The handle of a valid counter

5

4

TPM_AUTHHANDLE

authHandle

The authorization session handle used for counter authorization

#

SZ

1

#

SZ

2H1

20

TPM_NONCE

authLastNonceEven

Even nonce previously generated by TPM to cover inputs

6

20

3H1

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

7

1

4H1

1

BOOL

continueAuthSession

The continue use flag for the authorization session handle

8

20

TPM_AUTHDATA

counterAuth

The authorization session digest that authorizes the use of countID.
HMAC key: countID -> authData

Type

Name

Description

5047Outgoing Parameters and Sizes
PARAM

HMAC

#

SZ

#

SZ

1

2

TPM_TAG

tag

TPM_TAG_RSP_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

1S

4

TPM_RESULT

returnCode

The return code of the operation.

2S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_IncrementCounter

5

10

3S

10

TPM_COUNTER_VALUE

count

The counter value

6

20

2H1

20

TPM_NONCE

nonceEven

Even nonce newly generated by TPM to cover outputs

3H1

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

4H1

1

BOOL

continueAuthSession

Continue use flag, TRUE if handle is still active

TPM_AUTHDATA

resAuth

The authorization session digest for the returned parameters. HMAC key:
countID -> authData

7

1

8

20

5048Description
5049This function increments the counter by 1.
5050The TPM MAY implement increment throttling to avoid burn problems
1209
1210

258

Level 2 Revision 116 28 February 2011
TCG Published

1211TPM Main Part 3 Commands

TCG © Copyright

1212Specification Version 1.2

5051Actions
50521. If TPM_STCLEAR_DATA -> countID is 0
5053

a. Validate that countID is a valid counter, return TPM_BAD_COUNTER on mismatch

5054

b. Validate the command parameters using counterAuth

5055

c. Set TPM_STCLEAR_DATA -> countID to countID

50562. else
5057
5058
5059

a. If TPM_STCLEAR_DATA -> countID does not equal countID
i.

Return TPM_BAD_COUNTER

b. Validate the command parameters using counterAuth

50603. Increments the counter by 1
50614. Return new count value in count

1213Level 2 Revision 116 28 February 2011
1214

259
TCG Published

1215Copyright © TCG
1216
1217

506225.3

TPM Main Part 3 Commands
Specification Version 1.2

TPM_ReadCounter

5063Start of informative comment:
5064Reading the counter provides the caller with the current number in the sequence.
5065End of informative comment.
5066Incoming Parameters and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_COMMAND

2

4

UINT32

paramSize

Total number of input bytes incl. paramSize and tag

3

4

1S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_ReadCounter

4

4

2S

4

TPM_COUNT_ID

countID

ID value of the counter

Type

Name

Description

#

SZ

1

#

SZ

5067Outgoing Parameters and Sizes
PARAM

HMAC

#

SZ

#

SZ

1

2

TPM_TAG

tag

TPM_TAG_RSP_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

10

4

TPM_RESULT

returnCode

The return code of the operation.

2S
4

1S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_ReadCounter

3S

10

TPM_COUNTER_VALUE

count

The counter value

5068Description
5069This returns the current value for the counter indicated. The counter MAY be any valid
5070counter.
5071Actions
50721. Validate that countID points to a valid counter. Return TPM_BAD_COUNTER on error.
50732. Return count

1218
1219

260

Level 2 Revision 116 28 February 2011
TCG Published

1220TPM Main Part 3 Commands

TCG © Copyright

1221Specification Version 1.2

507425.4

TPM_ReleaseCounter

5075Start of informative comment:
5076This command releases a counter such that no reads or increments of the indicated counter
5077will succeed.
5078End of informative comment.
5079Incoming Parameters and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of input bytes including paramSize and tag

3

4

1S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_ReleaseCounter

4

4

2s

4

TPM_COUNT_ID

countID

ID value of the counter

5

4

TPM_AUTHHANDLE

authHandle

The authorization session handle used for countID authorization

#

SZ

1

#

SZ

2H1

20

TPM_NONCE

authLastNonceEven

Even nonce previously generated by TPM to cover inputs

6

20

3H1

20

TPM_NONCE

nonceOdd

Nonce associated with countID

7

1

4H1

1

BOOL

continueAuthSession

The continue use flag for the authorization session handle

8

20

TPM_AUTHDATA

counterAuth

The authorization session digest that authorizes the use of countID.
HMAC key: countID -> authData

Type

Name

Description

5080Outgoing Parameters and Sizes
PARAM

HMAC

#

SZ

#

SZ

1

2

TPM_TAG

tag

TPM_TAG_RSP_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

5

1

6

TPM_RESULT

returnCode

The return code of the operation.

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_ReleaseCounter

2H1

20

TPM_NONCE

nonceEven

Even nonce newly generated by TPM to cover outputs

3H1

20

4

2S
4

1S

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

4H1

1

BOOL

continueAuthSession

Continue use flag, TRUE if handle is still active

TPM_AUTHDATA

resAuth

The authorization session digest for the returned parameters. HMAC key:
countID -> authData

20

5081Actions
5082The TPM uses countID to locate a valid counter.
50831. Authenticate the command and the parameters using the AuthData pointed to by
5084
countID. Return TPM_AUTHFAIL on error
50852. The TPM invalidates all internal information regarding the counter. This includes
5086
releasing countID such that any subsequent attempts to use countID will fail.
50873. The TPM invalidates sessions
1222Level 2 Revision 116 28 February 2011
1223

261
TCG Published

1224Copyright © TCG
1225
1226

TPM Main Part 3 Commands
Specification Version 1.2

5088

a. MUST invalidate all OSAP sessions associated with the counter

5089

b. MAY invalidate any other session

50904. If TPM_STCLEAR_DATA -> countID equals countID,
5091

1227
1228

a. Set TPM_STCLEAR_DATA -> countID to an illegal value (not the zero value)

262

Level 2 Revision 116 28 February 2011
TCG Published

1229TPM Main Part 3 Commands

TCG © Copyright

1230Specification Version 1.2

509225.5

TPM_ReleaseCounterOwner

5093Start of informative comment:
5094This command releases a counter such that no reads or increments of the indicated counter
5095will succeed.
5096End of informative comment.
5097Incoming Parameters and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of input bytes including paramSize and tag

3

4

1S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_ReleaseCounterOwner

4

4

2s

4

TPM_COUNT_ID

countID

ID value of the counter

5

4

TPM_AUTHHANDLE

authHandle

The authorization session handle used for owner authentication

#

SZ

1

#

SZ

2H1

20

TPM_NONCE

authLastNonceEven

Even nonce previously generated by TPM to cover inputs

6

20

3H1

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

7

1

4H1

1

BOOL

continueAuthSession

The continue use flag for the authorization session handle

8

20

TPM_AUTHDATA

ownerAuth

The authorization session digest that authorizes the inputs. HMAC key:
ownerAuth

Type

Name

Description

5098Outgoing Parameters and Sizes
PARAM

HMAC

#

SZ

#

SZ

1

2

TPM_TAG

tag

TPM_TAG_RSP_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

5

1

6

TPM_RESULT

returnCode

The return code of the operation.

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_ReleaseCounterOwner

2H1

20

TPM_NONCE

nonceEven

Even nonce newly generated by TPM to cover outputs

3H1

20

4

2S
4

1S

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

4H1

1

BOOL

continueAuthSession

Continue use flag, TRUE if handle is still active

TPM_AUTHDATA

resAuth

The authorization session digest for the returned parameters. HMAC key:
ownerAuth

20

5099Description
5100This invalidates all information regarding a counter.
5101Actions
51021. Validate that ownerAuth properly authorizes the command and parameters
51032. The TPM uses countID to locate a valid counter. Return TPM_BAD_COUNTER if not
5104
found.
1231Level 2 Revision 116 28 February 2011
1232

263
TCG Published

1233Copyright © TCG
1234
1235

TPM Main Part 3 Commands
Specification Version 1.2

51053. The TPM invalidates all internal information regarding the counter. This includes
5106
releasing countID such that any subsequent attempts to use countID will fail.
51074. The TPM invalidates sessions
5108

a. MUST invalidate all OSAP sessions associated with the counter

5109

b. MAY invalidate any other session

51105. If TPM_STCLEAR_DATA -> countID equals countID,
5111

1236
1237

a. Set TPM_STCLEAR_DATA -> countID to an illegal value (not the zero value)

264

Level 2 Revision 116 28 February 2011
TCG Published

1238TPM Main Part 3 Commands

TCG © Copyright

1239Specification Version 1.2

511226.

DAA commands

511326.1

TPM_DAA_Join

5114Start of informative comment:
5115TPM_DAA_Join is the process that establishes the DAA parameters in the TPM for a specific
5116DAA issuing authority.
5117outputSize and outputData are always included in the outParamDigest. This includes stage
51180, where the outputData contains the DAA session handle.
5119 End of informative comment.
5120Incoming Parameters and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of input bytes incl. paramSize and tag

3

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_DAA_Join.

4

4

TPM_HANDLE

handle

Session handle

5

1

2S

1

BYTE

stage

Processing stage of join

6

4

3S

4

UINT32

inputSize0

Size of inputData0 for this stage of JOIN

7

<>

4S

<>

BYTE[]

inputData0

Data to be used by this capability

8

4

5S

4

UINT32

inputSize1

Size of inputData1 for this stage of JOIN

9

<>

6S

<>

BYTE[]

inputData1

Data to be used by this capability

10

4

TPM_AUTHHANDLE

authHandle

The authorization session handle used for owner authentication

#

SZ

1

#

1S

SZ

4

2 H1

20

TPM_NONCE

authLastNonceEven

Even nonce previously generated by TPM to cover inputs

11

20

3 H1

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

12

1

4 H1

1

BOOL

continueAuthSession

Continue use flag, TRUE if handle is still active

13

20

20

TPM_AUTHDATA

ownerAuth

The authorization session digest for inputs and owner. HMAC key:
ownerAuth.

1240Level 2 Revision 116 28 February 2011
1241

265
TCG Published

1242Copyright © TCG
1243
1244

TPM Main Part 3 Commands
Specification Version 1.2

5121Outgoing Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RSP_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of output bytes incl. paramSize and tag

3

4

#

SZ

1

#

SZ

1S

4

TPM_RESULT

returnCode

The return code of the operation

2S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_DAA_Join.

4

4

3S

4

UINT32

outputSize

Size of outputData

5

<>

4S

<>

BYTE[]

outputData

Data produced by this capability

6

20

2 H1

20

TPM_NONCE

nonceEven

Even nonce newly generated by TPM to cover outputs

3 H1

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

4 H1

1

BOOL

continueAuthSession

Continue use flag, TRUE if handle is still active

20

TPM_AUTHDATA

resAuth

Authorization HMAC key: ownerAuth.

7
8

1245
1246

1
20

266

Level 2 Revision 116 28 February 2011
TCG Published

1247TPM Main Part 3 Commands

TCG © Copyright

1248Specification Version 1.2

5122Description
5123This table summaries the input, output and saved data that is associated with each stage of
5124processing.
Stage
0

Input Data0

Input Data1

Operation

Output Data

Scratchpad

DAA_count

NULL

initialise

Session Handle

NULL

(used as # repetitions of stage 1)
1

n0

signatureValue

rekeying

NULL

n0

2

DAA_issuerSettings

signatureValue

issuer settings

NULL

NULL

3

DAA_count

NULL

DAA_join_uo,

NULL

NULL

DAA_join_u1
4

DAA_generic_R0

DAA_generic_n

P1=R0^f0 mod n

NULL

P1

5

DAA_generic_R1

DAA_generic_n

P2 = P1*(R1^f1) mod n

NULL

P2

6

DAA_generic_S0

DAA_generic_n

P3 = P2*(S0^u0) mod n

NULL

P3

7

DAA_generic_S1

DAA_generic_n

U = P3*(S1^u1) mod n

U

NULL

8

NE

NULL

U2

U2

NULL

9

DAA_generic_R0

DAA_generic_n

P1=R0^r0 mod n

NULL

P1

10

DAA_generic_R1

DAA_generic_n

P2 = P1*(R1^r1) mod n

NULL

P2

11

DAA_generic_S0

DAA_generic_n

P3 = P2*(S0^r2) mod n

NULL

P3

12

DAA_generic_S1

DAA_generic_n

P4 = P3*(S1^r3) mod n

P4

NULL

13

DAA_generic_gamma

w

w1 = w^q mod gamma

NULL

w

14

DAA_generic_gamma

NULL

E = w^f mod gamma

E

w

15

DAA_generic_gamma

NULL

r = r0 + (2^power0)*r1 mod q,

E1

NULL

E1 = w^r mod gamma
16

c1

NULL

c = hash(c1 || NT)

nt

NULL

17

NULL

NULL

s0 = r0 + c*f0

s0

NULL

18

NULL

NULL

s1 = r1 + c*f1

s1

NULL

19

NULL

NULL

s2 = r2 + c*u0

s2

NULL

c

s12

mod 2^power1
20

NULL

NULL

s12 = r2 + c*u0
>> power1

21

NULL

NULL

s3 = r3 + c*u1 + s12

s3

NULL

22

u2

NULL

v0 = u2 + u0 mod 2^power1

enc(v0)

v10

v10 = u2 + u0 >> power1
23

u3

NULL

V1 = u3 + u1 + v10

enc(v1)

NULL

24

NULL

NULL

enc(DAA_tpmSpecific)

enc(DAA_tpmSpecific)

NULL

5125

1249Level 2 Revision 116 28 February 2011
1250

267
TCG Published

1251Copyright © TCG
1252
1253

TPM Main Part 3 Commands
Specification Version 1.2

5126Actions
5127A Trusted Platform Module that receives a valid TPM_DAA_Join command SHALL:
51281. Use ownerAuth to verify that the Owner authorized all TPM_DAA_Join input parameters.
51292. Any error return results in the TPM invalidating all resources associated with the join
51303. Constant values of 0 or 1 are 1 byte integers, stages affected are
5131

a. 4(j), 5(j), 14(f), 17(e)

51324. Representation of the strings “r0” to “r4” are 2-byte ASCII encodings, stages affected are
5133

a. 9(i), 10(h), 11(h), 12(h), 15(f),15(g), 17(d), 18(d), 19(d), 20(d), 21(d)

5134Start of informative comment:
51355. Variable DAA_Count
5136
5137
5138

a. In stage 0, DAA_Count denotes the length of the RSA key chain, which certifies the
main DAA public key and which will be loaded in stage 1. It also denotes the number of
times stage 1 is executed.

5139
5140
5141

b. In stage 3 the variable DAA_count denotes the actual DAA counter. It allows a DAA
issuer to keep track of the number of times it has issued 'different' DAA credentials to
the same platform. (The counter does not need to be equal to the actual number.)

5142End of informative comment.
5143Stages
51440. If stage==0
5145

c. Determine that sufficient resources are available to perform a TPM_DAA_Join.

5146
5147
5148

i. The TPM MUST support sufficient resources to perform one (1)
TPM_DAA_Join/
TPM_DAA_Sign.
The
TPM
MAY
support
additional
TPM_DAA_Join/ TPM_DAA_Sign sessions.

5149
5150

ii. The TPM may share internal resources between the DAA operations and other
variable resource requirements:

5151
5152
5153

iii.
If there are insufficient resources within the stored key pool (and one or
more keys need to be removed to permit the DAA operation to execute) return
TPM_NOSPACE

5154
5155
5156

iv.
If there are insufficient resources within the stored session pool (and
one or more authorization or transport sessions need to be removed to permit
the DAA operation to execute), return TPM_RESOURCES.

5157

d. Set all fields in DAA_issuerSettings = NULL

5158

e. set all fields in DAA_tpmSpecific = NULL

5159

f. set all fields in DAA_session = NULL

5160

g. Set all fields in DAA_joinSession = NULL

5161
5162

h. Verify that sizeOf(inputData0) == sizeOf(DAA_tpmSpecific -> DAA_count) and return
error TPM_DAA_INPUT_DATA0 on mismatch

1254
1255

268

Level 2 Revision 116 28 February 2011
TCG Published

1256TPM Main Part 3 Commands

TCG © Copyright

1257Specification Version 1.2

5163

i.

Verify that inputData0 > 0, and return error TPM_DAA_INPUT_DATA0 on mismatch

5164

j.

Set DAA_tpmSpecific -> DAA_count = inputData0

5165
5166

k. set
DAA_session
DAA_joinSession)

5167

l.

5168

m. Assign session handle for TPM_DAA_Join

5169

n. set outputData = new session handle

5170
5171

->

DAA_digestContext

=

SHA-1(DAA_tpmSpecific

||

set DAA_session -> DAA_stage = 1

i.

The handle in outputData is included the output HMAC.

o. return TPM_SUCCESS

51726. If stage==1
5173
5174

a. Verify that DAA_session ->DAA_stage==1. Return TPM_DAA_STAGE and flush handle
on mismatch

5175
5176

b. Verify that DAA_session -> DAA_digestContext == SHA-1(DAA_tpmSpecific ||
DAA_joinSession) and return TPM_DAA_TPM_SETTINGS on mismatch

5177
5178

c. Verify that sizeOf(inputData0) == DAA_SIZE_issuerModulus and return error
TPM_DAA_INPUT_DATA0 on mismatch

5179

d. If DAA_session -> DAA_scratch == NULL:

5180

i.

5181

ii. set DAA_joinSession -> DAA_digest_n0 = SHA-1(DAA_session -> DAA_scratch)

5182
5183

iii. set DAA_tpmSpecific -> DAA_rekey = SHA-1(tpmDAASeed || DAA_joinSession
-> DAA_digest_n0)

5184

Set DAA_session -> DAA_scratch = inputData0

e. Else (If DAA_session -> DAA_scratch != NULL):

5185

i.

5186
5187

ii. Verify that sizeOf(inputData1) == DAA_SIZE_issuerModulus and return error
TPM_DAA_INPUT_DATA1 on mismatch

5188

iii. Set signatureValue = inputData1

5189
5190
5191
5192

iv. Use the RSA key == [DAA_session -> DAA_scratch] to verify that
signatureValue
is
a
signature
on
signedData
using
TPM_SS_RSASSAPKCS1v15_SHA1 (RSA PKCS1.5 with SHA-1), and return error
TPM_DAA_ISSUER_VALIDITY on mismatch

5193

v. Set DAA_session -> DAA_scratch = signedData

Set signedData = inputData0

5194

f. Decrement DAA_tpmSpecific -> DAA_count by 1 (unity)

5195

g. If DAA_tpmSpecific -> DAA_count == 0:

5196

i.

increment DAA_session -> DAA_stage by 1

5197
5198

h. set
DAA_session
DAA_joinSession)

5199

i.

->

DAA_digestContext

set outputData = NULL

1258Level 2 Revision 116 28 February 2011
1259

269
TCG Published

=

SHA-1(DAA_tpmSpecific

||

1260Copyright © TCG
1261
1262

5200

j.

TPM Main Part 3 Commands
Specification Version 1.2

return TPM_SUCCESS

52017. If stage==2
5202
5203

a. Verify that DAA_session ->DAA_stage==2. Return TPM_DAA_STAGE and flush handle
on mismatch

5204
5205

b. Verify that DAA_session -> DAA_digestContext == SHA-1(DAA_tpmSpecific ||
DAA_joinSession) and return error TPM_DAA_TPM_SETTINGS on mismatch

5206
5207

c. Verify that sizeOf(inputData0) == sizeOf(TPM_DAA_ISSUER) and return error
TPM_DAA_INPUT_DATA0 on mismatch

5208
5209

d. Set DAA_issuerSettings = inputData0. Verify that all fields in DAA_issuerSettings are
present and return error TPM_DAA_INPUT_DATA0 if not.

5210
5211

e. Verify that sizeOf(inputData1) == DAA_SIZE_issuerModulus and return error
TPM_DAA_INPUT_DATA1 on mismatch

5212

f. Set signatureValue = inputData1

5213

g. Set signedData = (DAA_joinSession -> DAA_digest_n0 ||DAA_issuerSettings)

5214
5215
5216

h. Use the RSA key [DAA_session -> DAA_scratch] to verify that signatureValue is a
signature on signedData using TPM_SS_RSASSAPKCS1v15_SHA1 (RSA PKCS1.5 with
SHA-1),, and return error TPM_DAA_ISSUER_VALIDITY on mismatch

5217

i.

5218
5219

j. set
DAA_session
DAA_joinSession)

5220

k. Set DAA_session -> DAA_scratch = NULL

5221

l.

5222

m. return TPM_SUCCESS

Set DAA_tpmSpecific -> DAA_digestIssuer == SHA-1(DAA_issuerSettings)
->

DAA_digestContext

=

SHA-1(DAA_tpmSpecific

||

increment DAA_session -> DAA_stage by 1

52238. If stage==3
5224
5225

a. Verify that DAA_session ->DAA_stage==3. Return TPM_DAA_STAGE and flush handle
on mismatch

5226
5227

b. Verify that DAA_tpmSpecific -> DAA_digestIssuer == SHA-1(DAA_issuerSettings) and
return error TPM_DAA_ISSUER_SETTINGS on mismatch

5228
5229

c. Verify that DAA_session -> DAA_digestContext == SHA-1(DAA_tpmSpecific ||
DAA_joinSession) and return error TPM_DAA_TPM_SETTINGS on mismatch

5230
5231

d. Verify that sizeOf(inputData0) == sizeOf(DAA_tpmSpecific -> DAA_count) and return
error TPM_DAA_INPUT_DATA0 on mismatch

5232

e. Set DAA_tpmSpecific -> DAA_count = inputData0

5233

f. Obtain random data from the RNG and store it as DAA_joinSession -> DAA_join_u0

5234

g. Obtain random data from the RNG and store it as DAA_joinSession -> DAA_join_u1

5235

h. set outputData = NULL

5236

i.

1263
1264

increment DAA_session -> DAA_stage by 1

270

Level 2 Revision 116 28 February 2011
TCG Published

1265TPM Main Part 3 Commands

TCG © Copyright

1266Specification Version 1.2

5237
5238

j. set
DAA_session
DAA_joinSession)

5239

k. return TPM_SUCCESS

->

DAA_digestContext

=

SHA-1(DAA_tpmSpecific

||

52409. If stage==4,
5241
5242

a. Verify that DAA_session ->DAA_stage==4. Return TPM_DAA_STAGE and flush handle
on mismatch

5243
5244

b. Verify that DAA_tpmSpecific -> DAA_digestIssuer == SHA-1(DAA_issuerSettings) and
return error TPM_DAA_ISSUER_SETTINGS on mismatch

5245
5246

c. Verify that DAA_session -> DAA_digestContext == SHA-1(DAA_tpmSpecific ||
DAA_joinSession) and return error TPM_DAA_TPM_SETTINGS on mismatch

5247

d. Set DAA_generic_R0 = inputData0

5248
5249

e. Verify that SHA-1(DAA_generic_R0) == DAA_issuerSettings -> DAA_digest_R0 and
return error TPM_DAA_INPUT_DATA0 on mismatch

5250

f. Set DAA_generic_n = inputData1

5251
5252

g. Verify that SHA-1(DAA_generic_n) == DAA_issuerSettings -> DAA_digest_n and
return error TPM_DAA_INPUT_DATA1 on mismatch

5253

h. Set X = DAA_generic_R0

5254

i.

5255
5256
5257

j. Set f = SHA-1(DAA_tpmSpecific -> DAA_rekey || DAA_tpmSpecific -> DAA_count ||
0 ) || SHA-1(DAA_tpmSpecific -> DAA_rekey || DAA_tpmSpecific -> DAA_count || 1 )
mod DAA_issuerSettings -> DAA_generic_q

5258

k. Set f0 = f mod 2^DAA_power0 (erase all but the lowest DAA_power0 bits of f)

5259

l.

5260

m. set outputData = NULL

5261

n. increment DAA_session -> DAA_stage by 1

5262

o. return TPM_SUCCESS

Set n = DAA_generic_n

Set DAA_session -> DAA_scratch = (X^f0) mod n

526310.If stage==5
5264
5265

a. Verify that DAA_session ->DAA_stage==5. Return TPM_DAA_STAGE and flush handle
on mismatch

5266
5267

b. Verify that DAA_tpmSpecific -> DAA_digestIssuer == SHA-1(DAA_issuerSettings) and
return error TPM_DAA_ISSUER_SETTINGS on mismatch

5268
5269

c. Verify that DAA_session -> DAA_digestContext == SHA-1(DAA_tpmSpecific ||
DAA_joinSession) and return error TPM_DAA_TPM_SETTINGS on mismatch

5270

d. Set DAA_generic_R1 = inputData0

5271
5272

e. Verify that SHA-1(DAA_generic_R1) == DAA_issuerSettings -> DAA_digest_R1 and
return error TPM_DAA_INPUT_DATA0 on mismatch

5273

f. Set DAA_generic_n = inputData1

1267Level 2 Revision 116 28 February 2011
1268

271
TCG Published

1269Copyright © TCG
1270
1271

TPM Main Part 3 Commands
Specification Version 1.2

5274
5275

g. Verify that SHA-1(DAA_generic_n) == DAA_issuerSettings -> DAA_digest_n and
return error TPM_DAA_INPUT_DATA1 on mismatch

5276

h. Set X = DAA_generic_R1

5277

i.

5278
5279
5280

j. Set f = SHA-1(DAA_tpmSpecific -> DAA_rekey || DAA_tpmSpecific -> DAA_count ||
0 ) || SHA-1(DAA_tpmSpecific -> DAA_rekey || DAA_tpmSpecific -> DAA_count || 1 )
mod DAA_issuerSettings -> DAA_generic_q.

5281
5282

k. Shift f right by DAA_power0 bits (discard the lowest DAA_power0 bits) and label the
result f1

5283

l.

5284

m. Set DAA_session -> DAA_scratch = Z*(X^f1) mod n

5285

n. set outputData = NULL

5286

o. increment DAA_session -> DAA_stage by 1

5287

p. return TPM_SUCCESS

Set n = DAA_generic_n

Set Z = DAA_session -> DAA_scratch

528811.If stage==6
5289
5290

a. Verify that DAA_session ->DAA_stage==6. Return TPM_DAA_STAGE and flush handle
on mismatch

5291
5292

b. Verify that DAA_tpmSpecific -> DAA_digestIssuer == SHA-1(DAA_issuerSettings) and
return error TPM_DAA_ISSUER_SETTINGS on mismatch

5293
5294

c. Verify that DAA_session -> DAA_digestContext == SHA-1(DAA_tpmSpecific ||
DAA_joinSession) and return error TPM_DAA_TPM_SETTINGS on mismatch

5295

d. Set DAA_generic_S0 = inputData0

5296
5297

e. Verify that SHA-1(DAA_generic_S0) == DAA_issuerSettings -> DAA_digest_S0 and
return error TPM_DAA_INPUT_DATA0 on mismatch

5298

f. Set DAA_generic_n = inputData1

5299
5300

g. Verify that SHA-1(DAA_generic_n) == DAA_issuerSettings -> DAA_digest_n and
return error TPM_DAA_INPUT_DATA1 on mismatch

5301

h. Set X = DAA_generic_S0

5302

i.

Set n = DAA_generic_n

5303

j.

Set Z = DAA_session -> DAA_scratch

5304

k. Set Y = DAA_joinSession -> DAA_join_u0

5305

l.

5306

m. set outputData = NULL

5307

n. increment DAA_session -> DAA_stage by 1

5308

o. return TPM_SUCCESS

Set DAA_session -> DAA_scratch = Z*(X^Y) mod n

530912.If stage==7

1272
1273

272

Level 2 Revision 116 28 February 2011
TCG Published

1274TPM Main Part 3 Commands

TCG © Copyright

1275Specification Version 1.2

5310
5311

a. Verify that DAA_session ->DAA_stage==7. Return TPM_DAA_STAGE and flush handle
on mismatch

5312
5313

b. Verify that DAA_tpmSpecific -> DAA_digestIssuer == SHA-1(DAA_issuerSettings) and
return error TPM_DAA_ISSUER_SETTINGS on mismatch

5314
5315

c. Verify that DAA_session -> DAA_digestContext == SHA-1(DAA_tpmSpecific ||
DAA_joinSession) and return error TPM_DAA_TPM_SETTINGS on mismatch

5316

d. Set DAA_generic_S1 = inputData0

5317
5318

e. Verify that SHA-1(DAA_generic_S1) == DAA_issuerSettings -> DAA_digest_S1 and
return error TPM_DAA_INPUT_DATA0 on mismatch

5319

f. Set DAA_generic_n = inputData1

5320
5321

g. Verify that SHA-1(DAA_generic_n) == DAA_issuerSettings -> DAA_digest_n and
return error TPM_DAA_INPUT_DATA1 on mismatch

5322

h. Set X = DAA_generic_S1

5323

i.

Set n = DAA_generic_n

5324

j.

Set Y = DAA_joinSession -> DAA_join_u1

5325

k. Set Z = DAA_session -> DAA_scratch

5326

l.

5327
5328

m. Set DAA_session -> DAA_digest to the SHA-1 (DAA_session -> DAA_scratch ||
DAA_tpmSpecific -> DAA_count || DAA_joinSession -> DAA_digest_n0)

5329

n. set outputData = DAA_session -> DAA_scratch

5330

o. set DAA_session -> DAA_scratch = NULL

5331

p. increment DAA_session -> DAA_stage by 1

5332

q. return TPM_SUCCESS

Set DAA_session -> DAA_scratch = Z*(X^Y) mod n

533313.If stage==8
5334
5335

a. Verify that DAA_session ->DAA_stage==8. Return TPM_DAA_STAGE and flush handle
on mismatch

5336
5337

b. Verify that DAA_tpmSpecific -> DAA_digestIssuer == SHA-1(DAA_issuerSettings) and
return error TPM_DAA_ISSUER_SETTINGS on mismatch

5338
5339

c. Verify that DAA_session -> DAA_digestContext == SHA-1(DAA_tpmSpecific ||
DAA_joinSession) and return error TPM_DAA_TPM_SETTINGS on mismatch

5340
5341

d. Verify inputSize0 == DAA_SIZE_NE and return error TPM_DAA_INPUT_DATA0 on
mismatch

5342

e. Set NE = decrypt(inputData0, privEK)

5343

f. set outputData = SHA-1(DAA_session -> DAA_digest || NE)

5344

g. set DAA_session -> DAA_digest = NULL

5345

h. increment DAA_session -> DAA_stage by 1

5346

i.

return TPM_SUCCESS

1276Level 2 Revision 116 28 February 2011
1277

273
TCG Published

1278Copyright © TCG
1279
1280

TPM Main Part 3 Commands
Specification Version 1.2

534714.If stage==9
5348
5349

a. Verify that DAA_session ->DAA_stage==9. Return TPM_DAA_STAGE and flush handle
on mismatch

5350
5351

b. Verify that DAA_tpmSpecific -> DAA_digestIssuer == SHA-1(DAA_issuerSettings) and
return error TPM_DAA_ISSUER_SETTINGS on mismatch

5352
5353

c. Verify that DAA_session -> DAA_digestContext == SHA-1(DAA_tpmSpecific ||
DAA_joinSession) and return error TPM_DAA_TPM_SETTINGS on mismatch

5354

d. Set DAA_generic_R0 = inputData0

5355
5356

e. Verify that SHA-1(DAA_generic_R0) == DAA_issuerSettings -> DAA_digest_R0 and
return error TPM_DAA_INPUT_DATA0 on mismatch

5357

f. Set DAA_generic_n = inputData1

5358
5359

g. Verify that SHA-1(DAA_generic_n) == DAA_issuerSettings -> DAA_digest_n and
return error TPM_DAA_INPUT_DATA1 on mismatch

5360

h. Obtain random data from the RNG and store it as DAA_session -> DAA_contextSeed

5361
5362

i. Obtain DAA_SIZE_r0 bytes using the MGF1 function and label them Y.
DAA_session -> DAA_contextSeed is the Z seed.

5363

j.

5364

k. Set n = DAA_generic_n

5365

l.

5366

m. set outputData = NULL

5367

n. increment DAA_session -> DAA_stage by 1

5368

o. return TPM_SUCCESS

“r0” ||

Set X = DAA_generic_R0
Set DAA_session -> DAA_scratch = (X^Y) mod n

536915.If stage==10
5370
5371

a. Verify that DAA_session ->DAA_stage==10. Return TPM_DAA_STAGE and flush
handle on mismatch h

5372
5373

b. Verify that DAA_tpmSpecific -> DAA_digestIssuer == SHA-1(DAA_issuerSettings) and
return error TPM_DAA_ISSUER_SETTINGS on mismatch

5374
5375

c. Verify that DAA_session -> DAA_digestContext == SHA-1(DAA_tpmSpecific ||
DAA_joinSession) and return error TPM_DAA_TPM_SETTINGS on mismatch

5376

d. Set DAA_generic_R1 = inputData0

5377
5378

e. Verify that SHA-1(DAA_generic_R1) == DAA_issuerSettings -> DAA_digest_R1 and
return error TPM_DAA_INPUT_DATA0 on mismatch

5379

f. Set DAA_generic_n = inputData1

5380
5381

g. Verify that SHA-1(DAA_generic_n) == DAA_issuerSettings -> DAA_digest_n and
return error TPM_DAA_INPUT_DATA1 on mismatch

5382
5383

h. Obtain DAA_SIZE_r1 bytes using the MGF1 function and label them Y. “r1” ||
DAA_session -> DAA_contextSeed is the Z seed.

5384

i.

1281
1282

Set X = DAA_generic_R1

274

Level 2 Revision 116 28 February 2011
TCG Published

1283TPM Main Part 3 Commands

TCG © Copyright

1284Specification Version 1.2

5385

j.

5386

k. Set Z = DAA_session -> DAA_scratch

5387

l.

5388

m. set outputData = NULL

5389

n. increment DAA_session -> DAA_stage by 1

5390

o. return TPM_SUCCESS

Set n = DAA_generic_n
Set DAA_session -> DAA_scratch = Z*(X^Y) mod n

539116.If stage==11
5392
5393

a. Verify that DAA_session ->DAA_stage==11. Return TPM_DAA_STAGE and flush
handle on mismatch

5394
5395

b. Verify that DAA_tpmSpecific -> DAA_digestIssuer == SHA-1(DAA_issuerSettings) and
return error TPM_DAA_ISSUER_SETTINGS on mismatch

5396
5397

c. Verify that DAA_session -> DAA_digestContext == SHA-1(DAA_tpmSpecific ||
DAA_joinSession) and return error TPM_DAA_TPM_SETTINGS on mismatch

5398

d. Set DAA_generic_S0 = inputData0

5399
5400

e. Verify that SHA-1(DAA_generic_S0) == DAA_issuerSettings -> DAA_digest_S0 and
return error TPM_DAA_INPUT_DATA0 on mismatch

5401

f. Set DAA_generic_n = inputData1

5402
5403

g. Verify that SHA-1(DAA_generic_n) == DAA_issuerSettings -> DAA_digest_n and
return error TPM_DAA_INPUT_DATA1 on mismatch

5404
5405

h. Obtain DAA_SIZE_r2 bytes using the MGF1 function and label them Y.
DAA_session -> DAA_contextSeed is the Z seed.

5406

i.

Set X = DAA_generic_S0

5407

j.

Set n = DAA_generic_n

5408

k. Set Z = DAA_session -> DAA_scratch

5409

l.

5410

m. set outputData = NULL

5411

n. increment DAA_session -> DAA_stage by 1

5412

o. return TPM_SUCCESS

“r2” ||

Set DAA_session -> DAA_scratch = Z*(X^Y) mod n

541317.If stage==12
5414
5415

a. Verify that DAA_session ->DAA_stage==12. Return TPM_DAA_STAGE and flush
handle on mismatch

5416
5417

b. Verify that DAA_tpmSpecific -> DAA_digestIssuer == SHA-1(DAA_issuerSettings ) and
return error TPM_DAA_ISSUER_SETTINGS on mismatch

5418
5419

c. Verify that DAA_session -> DAA_digestContext == SHA-1(DAA_tpmSpecific ||
DAA_joinSession) and return error TPM_DAA_TPM_SETTINGS on mismatch

5420

d. Set DAA_generic_S1 = inputData0

1285Level 2 Revision 116 28 February 2011
1286

275
TCG Published

1287Copyright © TCG
1288
1289

TPM Main Part 3 Commands
Specification Version 1.2

5421
5422

e. Verify that SHA-1(DAA_generic_S1) == DAA_issuerSettings -> DAA_digest_S1 and
return error TPM_DAA_INPUT_DATA0 on mismatch

5423

f. Set DAA_generic_n = inputData1

5424
5425

g. Verify that SHA-1(DAA_generic_n) == DAA_issuerSettings -> DAA_digest_n and
return error TPM_DAA_INPUT_DATA1 on mismatch

5426
5427

h. Obtain DAA_SIZE_r3 bytes using the MGF1 function and label them Y.
DAA_session -> DAA_contextSeed is the Z seed.

5428

i.

Set X = DAA_generic_S1

5429

j.

Set n = DAA_generic_n

5430

k. Set Z = DAA_session -> DAA_scratch

5431

l.

5432

m. set outputData = DAA_session -> DAA_scratch

5433

n. Set DAA_session -> DAA_scratch = NULL

5434

o. increment DAA_session -> DAA_stage by 1

5435

p. return TPM_SUCCESS

“r3” ||

Set DAA_session -> DAA_scratch = Z*(X^Y) mod n

543618.If stage==13
5437
5438

a. Verify that DAA_session->DAA_stage==13. Return TPM_DAA_STAGE and flush
handle on mismatch

5439
5440

b. Verify that DAA_tpmSpecific -> DAA_digestIssuer == SHA-1(DAA_issuerSettings) and
return error TPM_DAA_ISSUER_SETTINGS on mismatch

5441
5442

c. Verify that DAA_session -> DAA_digestContext == SHA-1(DAA_tpmSpecific ||
DAA_joinSession) and return error TPM_DAA_TPM_SETTINGS on mismatch

5443

d. Set DAA_generic_gamma = inputData0

5444
5445

e. Verify
that
SHA-1(DAA_generic_gamma)
==
DAA_issuerSettings
DAA_digest_gamma and return error TPM_DAA_INPUT_DATA0 on mismatch

5446
5447

f. Verify that inputSize1 == DAA_SIZE_w and return error TPM_DAA_INPUT_DATA1 on
mismatch

5448

g. Set w = inputData1

5449

h. Set w1 = w^( DAA_issuerSettings -> DAA_generic_q) mod (DAA_generic_gamma)

5450

i.

If w1 != 1 (unity), return error TPM_DAA_WRONG_W

5451

j.

Set DAA_session -> DAA_scratch = w

5452

k. set outputData = NULL

5453

l.

5454

m. return TPM_SUCCESS.

->

increment DAA_session -> DAA_stage by 1

545519.If stage==14
5456
5457
1290
1291

a. Verify that DAA_session ->DAA_stage==14. Return TPM_DAA_STAGE and flush
handle on mismatch
276

Level 2 Revision 116 28 February 2011
TCG Published

1292TPM Main Part 3 Commands

TCG © Copyright

1293Specification Version 1.2

5458
5459

b. Verify that DAA_tpmSpecific -> DAA_digestIssuer == SHA-1(DAA_issuerSettings ) and
return error TPM_DAA_ISSUER_SETTINGS on mismatch

5460
5461

c. Verify that DAA_session -> DAA_digestContext == SHA-1(DAA_tpmSpecific ||
DAA_joinSession) and return error TPM_DAA_TPM_SETTINGS on mismatch

5462

d. Set DAA_generic_gamma = inputData0

5463
5464

e. Verify
that
SHA-1(DAA_generic_gamma)
==
DAA_issuerSettings
DAA_digest_gamma and return error TPM_DAA_INPUT_DATA0 on mismatch

5465
5466
5467

f. Set f = SHA-1(DAA_tpmSpecific -> DAA_rekey || DAA_tpmSpecific -> DAA_count ||
0 ) || SHA-1(DAA_tpmSpecific -> DAA_rekey || DAA_tpmSpecific -> DAA_count || 1 )
mod DAA_issuerSettings -> DAA_generic_q.

5468

g. Set E = ((DAA_session -> DAA_scratch)^f) mod (DAA_generic_gamma).

5469

h. Set outputData = E

5470

i.

increment DAA_session -> DAA_stage by 1

5471

j.

return TPM_SUCCESS.

->

547220.If stage==15
5473
5474

a. Verify that DAA_session ->DAA_stage==15. Return TPM_DAA_STAGE and flush
handle on mismatch

5475
5476

b. Verify that DAA_tpmSpecific -> DAA_digestIssuer == SHA-1(DAA_issuerSettings) and
return error TPM_DAA_ISSUER_SETTINGS on mismatch

5477
5478

c. Verify that DAA_session -> DAA_digestContext == SHA-1(DAA_tpmSpecific ||
DAA_joinSession) and return error TPM_DAA_TPM_SETTINGS on mismatch

5479

d. Set DAA_generic_gamma = inputData0

5480
5481

e. Verify
that
SHA-1(DAA_generic_gamma)
==
DAA_issuerSettings
DAA_digest_gamma and return error TPM_DAA_INPUT_DATA0 on mismatch

5482
5483

f. Obtain DAA_SIZE_r0 bytes using the MGF1 function and label them r0.
DAA_session -> DAA_contextSeed is the Z seed.

“r0” ||

5484
5485

g. Obtain DAA_SIZE_r1 bytes using the MGF1 function and label them r1.
DAA_session -> DAA_contextSeed is the Z seed.

“r1” ||

5486

h. set r = r0 + 2^DAA_power0 * r1 mod (DAA_issuerSettings -> DAA_generic_q).

5487

i.

set E1 = ((DAA_session -> DAA_scratch)^r) mod (DAA_generic_gamma).

5488

j.

Set DAA_session -> DAA_scratch = NULL

5489

k. Set outputData = E1

5490

l.

5491

m. return TPM_SUCCESS.

->

increment DAA_session -> DAA_stage by 1

549221.If stage==16
5493
5494

a. Verify that DAA_session ->DAA_stage==16. Return TPM_DAA_STAGE and flush
handle on mismatch

1294Level 2 Revision 116 28 February 2011
1295

277
TCG Published

1296Copyright © TCG
1297
1298

TPM Main Part 3 Commands
Specification Version 1.2

5495
5496

b. Verify that DAA_tpmSpecific -> DAA_digestIssuer == SHA-1(DAA_issuerSettings) and
return error TPM_DAA_ISSUER_SETTINGS on mismatch

5497
5498

c. Verify that DAA_session -> DAA_digestContext == SHA-1(DAA_tpmSpecific ||
DAA_joinSession) and return error TPM_DAA_TPM_SETTINGS on mismatch

5499
5500

d. Verify
that
inputSize0
==
TPM_DAA_INPUT_DATA0 on mismatch

5501

e. Set DAA_session -> DAA_digest = inputData0

5502

f. Obtain DAA_SIZE_NT bytes from the RNG and label them NT

5503

g. Set DAA_session -> DAA_digest to the SHA-1 ( DAA_session -> DAA_digest || NT )

5504

h. Set outputData = NT

5505

i.

increment DAA_session -> DAA_stage by 1

5506

j.

return TPM_SUCCESS.

sizeOf(TPM_DIGEST)

and

return

error

550722.If stage==17
5508
5509

a. Verify that DAA_session ->DAA_stage==17. Return TPM_DAA_STAGE and flush
handle on mismatch

5510
5511

b. Verify that DAA_tpmSpecific -> DAA_digestIssuer == SHA-1(DAA_issuerSettings) and
return error TPM_DAA_ISSUER_SETTINGS on mismatch

5512
5513

c. Verify that DAA_session -> DAA_digestContext == SHA-1(DAA_tpmSpecific ||
DAA_joinSession) and return error TPM_DAA_TPM_SETTINGS on mismatch

5514
5515

d. Obtain DAA_SIZE_r0 bytes using the MGF1 function and label them r0.
DAA_session -> DAA_contextSeed is the Z seed.

5516
5517
5518

e. Set f = SHA-1(DAA_tpmSpecific -> DAA_rekey || DAA_tpmSpecific -> DAA_count ||
0 ) || SHA-1(DAA_tpmSpecific -> DAA_rekey || DAA_tpmSpecific -> DAA_count || 1 )
mod DAA_issuerSettings -> DAA_generic_q.

5519

f. Set f0 = f mod 2^DAA_power0 (erase all but the lowest DAA_power0 bits of f)

5520
5521

g. Set s0 = r0 + (DAA_session -> DAA_digest) * f0 in Z. Compute over the integers. The
computation is not reduced with a modulus.

5522

h. set outputData = s0

5523

i.

increment DAA_session -> DAA_stage by 1

5524

j.

return TPM_SUCCESS

“r0” ||

552523.If stage==18
5526
5527

a. Verify that DAA_session ->DAA_stage==18. Return TPM_DAA_STAGE and flush
handle on mismatch

5528
5529

b. Verify that DAA_tpmSpecific -> DAA_digestIssuer == SHA-1(DAA_issuerSettings) and
return error TPM_DAA_ISSUER_SETTINGS on mismatch

5530
5531

c. Verify that DAA_session -> DAA_digestContext == SHA-1(DAA_tpmSpecific ||
DAA_joinSession) and return error TPM_DAA_TPM_SETTINGS on mismatch

1299
1300

278

Level 2 Revision 116 28 February 2011
TCG Published

1301TPM Main Part 3 Commands

TCG © Copyright

1302Specification Version 1.2

5532
5533

d. Obtain DAA_SIZE_r1 bytes using the MGF1 function and label them r1. “r1” ||
DAA_session -> DAA_contextSeed is the Z seed.

5534
5535
5536

e. Set f = SHA-1(DAA_tpmSpecific -> DAA_rekey || DAA_tpmSpecific -> DAA_count ||
0 ) || SHA-1(DAA_tpmSpecific -> DAA_rekey || DAA_tpmSpecific -> DAA_count || 1 )
mod DAA_issuerSettings -> DAA_generic_q.

5537
5538

f. Shift f right by DAA_power0 bits (discard the lowest DAA_power0 bits) and label the
result f1

5539
5540

g. Set s1 = r1 + (DAA_session -> DAA_digest)* f1 in Z. Compute over the integers. The
computation is not reduced with a modulus.

5541

h. set outputData = s1

5542

i.

increment DAA_session -> DAA_stage by 1

5543

j.

return TPM_SUCCESS

554424.If stage==19
5545
5546

a. Verify that DAA_session ->DAA_stage==19. Return TPM_DAA_STAGE and flush
handle on mismatch

5547
5548

b. Verify that DAA_tpmSpecific -> DAA_digestIssuer == SHA-1(DAA_issuerSettings) and
return error TPM_DAA_ISSUER_SETTINGS on mismatch

5549
5550

c. Verify that DAA_session -> DAA_digestContext == SHA-1(DAA_tpmSpecific ||
DAA_joinSession) and return error TPM_DAA_TPM_SETTINGS on mismatch

5551
5552

d. Obtain DAA_SIZE_r2 bytes using the MGF1 function and label them r2.
DAA_session -> DAA_contextSeed is the Z seed.

5553
5554

e. Set s2 = r2 + (DAA_session -> DAA_digest)*( DAA_joinSession -> DAA_join_u0) mod
2^DAA_power1 (Erase all but the lowest DAA_power1 bits of s2)

5555

f. set outputData = s2

5556

g. increment DAA_session -> DAA_stage by 1

5557

h. return TPM_SUCCESS

“r2” ||

555825.If stage==20
5559
5560

a. Verify that DAA_session ->DAA_stage==20. Return TPM_DAA_STAGE and flush
handle on mismatch

5561
5562

b. Verify that DAA_tpmSpecific -> DAA_digestIssuer == SHA-1(DAA_issuerSettings) and
return error TPM_DAA_ISSUER_SETTINGS on mismatch

5563
5564

c. Verify that DAA_session -> DAA_digestContext == SHA-1(DAA_tpmSpecific ||
DAA_joinSession) and return error TPM_DAA_TPM_SETTINGS on mismatch

5565
5566

d. Obtain DAA_SIZE_r2 bytes using the MGF1 function and label them r2.
DAA_session -> DAA_contextSeed is the Z seed.

5567

e. Set s12 = r2 + (DAA_session -> DAA_digest)*( DAA_joinSession -> DAA_join_u0)

5568

f. Shift s12 right by DAA_power1 bit (discard the lowest DAA_power1 bits).

5569

g. Set DAA_session -> DAA_scratch = s12

1303Level 2 Revision 116 28 February 2011
1304

279
TCG Published

“r2” ||

1305Copyright © TCG
1306
1307

TPM Main Part 3 Commands
Specification Version 1.2

5570

h. Set outputData = DAA_session -> DAA_digest

5571

i.

increment DAA_session -> DAA_stage by 1

5572

j.

return TPM_SUCCESS

557326.If stage==21
5574
5575

a. Verify that DAA_session ->DAA_stage==21. Return TPM_DAA_STAGE and flush
handle on mismatch

5576
5577

b. Verify that DAA_tpmSpecific -> DAA_digestIssuer == SHA-1(DAA_issuerSettings) and
return error TPM_DAA_ISSUER_SETTINGS on mismatch

5578
5579

c. Verify that DAA_session -> DAA_digestContext == SHA-1(DAA_tpmSpecific ||
DAA_joinSession) and return error TPM_DAA_TPM_SETTINGS on mismatch

5580
5581

d. Obtain DAA_SIZE_r3 bytes using the MGF1 function and label them r3.
DAA_session -> DAA_contextSeed is the Z seed.

5582
5583

e. Set s3 = r3 + (DAA_session -> DAA_digest)*( DAA_joinSession -> DAA_join_u1) +
(DAA_session -> DAA_scratch).

5584

f. Set DAA_session -> DAA_scratch = NULL

5585

g. set outputData = s3

5586

h. increment DAA_session -> DAA_stage by 1

5587

i.

“r3” ||

return TPM_SUCCESS

558827.If stage==22
5589
5590

a. Verify that DAA_session ->DAA_stage==22. Return TPM_DAA_STAGE and flush
handle on mismatch

5591
5592

b. Verify that DAA_tpmSpecific -> DAA_digestIssuer == SHA-1(DAA_issuerSettings) and
return error TPM_DAA_ISSUER_SETTINGS on mismatch

5593
5594

c. Verify that DAA_session -> DAA_digestContext == SHA-1(DAA_tpmSpecific ||
DAA_joinSession) and return error TPM_DAA_TPM_SETTINGS on mismatch

5595
5596

d. Verify inputSize0 == DAA_SIZE_v0 and return error TPM_DAA_INPUT_DATA0 on
mismatch

5597

e. Set u2 = inputData0

5598
5599

f. Set v0 = u2 + (DAA_joinSession -> DAA_join_u0) mod 2^DAA_power1 (Erase all but
the lowest DAA_power1 bits of v0).

5600

g. Set DAA_tpmSpecific -> DAA_digest_v0 = SHA-1(v0)

5601
5602

h. Set v10 = u2 + (DAA_joinSession -> DAA_join_u0) in Z. Compute over the integers.
The computation is not reduced with a modulus.

5603

i.

Shift v10 right by DAA_power1 bits (erase the lowest DAA_power1 bits).

5604

j.

Set DAA_session ->DAA_scratch = v10

5605

k. Set outputData

5606
5607
1308
1309

i. Fill in TPM_DAA_BLOB with a type of TPM_RT_DAA_V0 and encrypt the v0
parameters using TPM_PERMANENT_DATA -> daaBlobKey
280

Level 2 Revision 116 28 February 2011
TCG Published

1310TPM Main Part 3 Commands

TCG © Copyright

1311Specification Version 1.2

5608

ii. set outputData to the encrypted TPM_DAA_BLOB

5609

l.

5610
5611

m. set
DAA_session
DAA_joinSession)

5612

n. return TPM_SUCCESS

increment DAA_session -> DAA_stage by 1
->

DAA_digestContext

=

SHA-1(DAA_tpmSpecific

||

561328.If stage==23
5614
5615

a. Verify that DAA_session ->DAA_stage==23. Return TPM_DAA_STAGE and flush
handle on mismatch

5616
5617

b. Verify that DAA_tpmSpecific -> DAA_digestIssuer == SHA-1(DAA_issuerSettings) and
return error TPM_DAA_ISSUER_SETTINGS on mismatch

5618
5619

c. Verify that DAA_session -> DAA_digestContext == SHA-1(DAA_tpmSpecific ||
DAA_joinSession) and return error TPM_DAA_TPM_SETTINGS on mismatch

5620
5621

d. Verify inputSize0 == DAA_SIZE_v1 and return error TPM_DAA_INPUT_DATA0 on
mismatch

5622

e. Set u3 = inputData0

5623

f. Set v1 = u3 + DAA_joinSession -> DAA_join_u1 + DAA_session ->DAA_scratch

5624

g. Set DAA_tpmSpecific -> DAA_digest_v1 = SHA-1(v1)

5625

h. Set outputData

5626
5627

i. Fill in TPM_DAA_BLOB with a type of TPM_RT_DAA_V1 and encrypt the v1
parameters using TPM_PERMANENT_DATA -> daaBlobKey

5628

ii. set outputData to the encrypted TPM_DAA_BLOB

5629

i.

Set DAA_session ->DAA_scratch = NULL

5630

j.

increment DAA_session -> DAA_stage by 1

5631
5632

k. set
DAA_session
DAA_joinSession)

5633

l.

->

DAA_digestContext

=

SHA-1(DAA_tpmSpecific

||

return TPM_SUCCESS

563429.If stage==24
5635
5636

a. Verify that DAA_session ->DAA_stage==24. Return TPM_DAA_STAGE and flush
handle on mismatch

5637
5638

b. Verify that DAA_tpmSpecific -> DAA_digestIssuer == SHA-1(DAA_issuerSettings) and
return error TPM_DAA_ISSUER_SETTINGS on mismatch

5639
5640

c. Verify that DAA_session -> DAA_digestContext == SHA-1(DAA_tpmSpecific ||
DAA_joinSession) and return error TPM_DAA_TPM_SETTINGS on mismatch

5641
5642

d. set outputData
daaBlobKey

5643
5644

e. Terminate the DAA session and all resources associated with the DAA join session
handle.

5645

f. return TPM_SUCCESS

=

enc(DAA_tpmSpecific)

1312Level 2 Revision 116 28 February 2011
1313

281
TCG Published

using

TPM_PERMANENT_DATA

->

1314Copyright © TCG
1315
1316

TPM Main Part 3 Commands
Specification Version 1.2

564630.If stage > 24, return error: TPM_DAA_STAGE

1317
1318

282

Level 2 Revision 116 28 February 2011
TCG Published

1319TPM Main Part 3 Commands

TCG © Copyright

1320Specification Version 1.2

564726.2

TPM_DAA_Sign

5648Start of informative comment:
5649outputSize and outputData are always included in the outParamDigest. This includes stage
56500, where the outputData contains the DAA session handle.
5651 End of informative comment.
5652TPM protected capability; user must provide authorizations from the TPM Owner.
5653Incoming Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

Tag

TPM_TAG_RQU_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of input bytes incl. paramSize and tag

3

4

TPM_COMMAND_CODE

Ordinal

Command ordinal: TPM_ORD_DAA_Sign

4

4

TPM_HANDLE

handle

Handle to the sign session

5

1

2S

1

BYTE

stage

Stage of the sign process

6

4

3S

4

UINT32

inputSize0

Size of inputData0 for this stage of DAA_Sign

7

<>

4S

<>

BYTE[]

inputData0

Data to be used by this capability

8

4

5S

4

UINT32

inputSize1

Size of inputData1 for this stage of DAA_Sign

9

<>

6S

<>

BYTE[]

inputData1

Data to be used by this capability

10

4

TPM_AUTHHANDLE

authHandle

The authorization session handle used for owner authentication

#

SZ

1

#

SZ

1S

4

2 H1

20

TPM_NONCE

authLastNonceEven

Even nonce previously generated by TPM to cover inputs

11

20

3 H1

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

12

1

4 H1

1

BOOL

continueAuthSession

Continue use flag, TRUE if handle is still active

13

20

20

TPM_AUTHDATA

ownerAuth

The authorization session digest for inputs and owner. HMAC key:
ownerAuth.

5654Outgoing Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RSP_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of output bytes incl. paramSize and tag

3

4

#

SZ

1

#

SZ

1S

4

TPM_RESULT

returnCode

The return code of the operation

2S

4

TPM_COMMAND_CODE

ordinal

Command ordinal:TPM_ORD_DAA_Sign

4

4

3S

4

UINT32

outputSize

Size of outputData

5

<>

4S

<>

BYTE[]

outputData

Data produced by this capability

6

20

2 H1

20

TPM_NONCE

nonceEven

Even nonce newly generated by TPM to cover outputs

3 H1

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

4 H1

1

BOOL

continueAuthSession

Continue use flag, TRUE if handle is still active

20

TPM_AUTHDATA

resAuth

The authorization session digest for the returned parameters. HMAC key:
ownerAuth.

7

1

8

20

1321Level 2 Revision 116 28 February 2011
1322

283
TCG Published

1323Copyright © TCG
1324
1325

TPM Main Part 3 Commands
Specification Version 1.2

5655Description
5656This table summaries the input, output and saved data that is associated with each stage of
5657processing.
Stage

Input Data0

Input Data1

Operation

Output Data

Scratchpad

0

DAA_issuerSettings

NULL

initialise

handle

NULL

1

enc(DAA_tpmSpecific)

NULL

initialise

NULL

NULL

2

DAA_generic_R0

DAA_generic_n

P1=R0^r0 mod n

NULL

P1

3

DAA_generic_R1

DAA_generic_n

P2 = P1*(R1^r1) mod n

NULL

P2

4

DAA_generic_S0

DAA_generic_n

P3 = P2*(S0^r2) mod n

NULL

P3

5

DAA_generic_S1

DAA_generic_n

T = P3*(S1^r4) mod n

T

NULL

6

DAA_generic_gamma

w

w1 = w^q mod gamma

NULL

w

7

DAA_generic_gamma

NULL

E = w^f mod gamma

E

w

8

DAA_generic_gamma

NULL

r = r0 + (2^power0)*r1
mod q,

E1

NULL

E1 = w^r mod gamma
9

c1

NULL

c = hash(c1 || NT)

NT

NULL

10

b (selector)

m or handle to AIK

c = hash(c || 1 || m)

c

NULL

or
c = hash(c || 0 || AIKmodulus)
11

NULL

NULL

s0 = r0 + c*f0

s0

NULL

12

NULL

NULL

s1 = r1 + c*f1

s1

NULL

13

enc(v0)

NULL

s2 = r2 + c*v0

s2

NULL

NULL

s12

s3

NULL

mod 2^power1
14

enc(v0)

NULL

s12 = r2 + c*v0
>> power1

15

enc(v1)

NULL

s3 = r4 + c*v1 + s12

5658
5659When a TPM receives an Owner authorized command to input enc(DAA_tpmSpecific) or
5660enc(v0) or enc(v1), the TPM MUST verify that the TPM created the data and that neither the
5661data nor the TPM's daaProof has been changed since the data was created. Loading one of
5662these wrapped blobs does not require authorization, since correct blobs were created by the
5663TPM under Owner authorization, and unwrapped blobs cannot be used without Owner
5664authorisation. The TPM MUST NOT restrict the number of times that the contents of
5665enc(DAA_tpmSpecific) or enc(v0) or enc(v1) can be used by the same combination of TPM
5666and daaProof that created them.
5667Actions
5668A Trusted Platform Module that receives a valid TPM_DAA_Sign command SHALL:
56691. Use ownerAuth to verify that the Owner authorized all TPM_DAA_Sign input parameters.
56702. Any error results in the TPM invalidating all resources associated with the command
56713. Constant values of 0 or 1 are 1 byte integers, stages affected are
5672
1326
1327

a. 7(f), 11(e), 12(e)
284

Level 2 Revision 116 28 February 2011
TCG Published

1328TPM Main Part 3 Commands

TCG © Copyright

1329Specification Version 1.2

56734. Representation of the strings “r0” to “r4” are 2-byte ASCII encodings, stages affected are
5674

a. 2(h), 3(h), 4(h), 5(h), 12(d), 13(f), 14(f), 15(f)

5675Stages
56760. If stage==0
5677

b. Determine that sufficient resources are available to perform a TPM_DAA_Sign.

5678
5679
5680

i. The TPM MUST support sufficient resources to perform one (1)
TPM_DAA_Join/ TPM_DAA_Sign. The TPM MAY support addition TPM_DAA_Join/
TPM_DAA_Sign sessions.

5681
5682

ii. The TPM may share internal resources between the DAA operations and other
variable resource requirements:

5683
5684
5685

iii. If there are insufficient resources within the stored key pool (and one or more
keys need to be removed to permit the DAA operation to execute) return
TPM_NOSPACE

5686
5687
5688

iv. If there are insufficient resources within the stored session pool (and one or
more authorization or transport sessions need to be removed to permit the DAA
operation to execute), return TPM_RESOURCES.

5689

c. Set DAA_issuerSettings = inputData0

5690
5691

d. Verify that all fields in DAA_issuerSettings
TPM_DAA_INPUT_DATA0 if not.

5692

e. set all fields in DAA_session = NULL

5693

f. Assign new handle for session

5694

g. Set outputData to new handle

5695

i.

are

present

and

return

error

The handle in outputData is included the output HMAC.

5696

h. set DAA_session -> DAA_stage = 1

5697

i.

return TPM_SUCCESS

56985. If stage==1
5699
5700

a. Verify that DAA_session ->DAA_stage==1. Return TPM_DAA_STAGE and flush handle
on mismatch

5701
5702

b. Set DAA_tpmSpecific = unwrap(inputData0) using TPM_PERMANENT_DATA ->
daaBlobKey

5703
5704

c. Verify that DAA_tpmSpecific -> DAA_digestIssuer == SHA-1(DAA_issuerSettings) and
return error TPM_DAA_ISSUER_SETTINGS on mismatch

5705

d. set DAA_session -> DAA_digestContext = SHA-1(DAA_tpmSpecific)

5706

e. set outputData = NULL

5707

f. set DAA_session -> DAA_stage =2

5708

g. return TPM_SUCCESS

57096. If stage==2
1330Level 2 Revision 116 28 February 2011
1331

285
TCG Published

1332Copyright © TCG
1333
1334

TPM Main Part 3 Commands
Specification Version 1.2

5710
5711

a. Verify that DAA_session ->DAA_stage==2. Return TPM_DAA_STAGE and flush handle
on mismatch

5712
5713

b. Verify that DAA_tpmSpecific -> DAA_digestIssuer == SHA-1(DAA_issuerSettings) and
return error TPM_DAA_ISSUER_SETTINGS on mismatch

5714
5715

c. Verify that DAA_session -> DAA_digestContext == SHA-1(DAA_tpmSpecific) and
return error TPM_DAA_TPM_SETTINGS on mismatch

5716

d. Set DAA_generic_R0 = inputData0

5717
5718

e. Verify that SHA-1(DAA_generic_R0) == DAA_issuerSettings -> DAA_digest_R0 and
return error TPM_DAA_INPUT_DATA0 on mismatch

5719

f. Set DAA_generic_n = inputData1

5720
5721

g. Verify that SHA-1(DAA_generic_n) == DAA_issuerSettings -> DAA_digest_n and
return error TPM_DAA_INPUT_DATA1 on mismatch

5722

h. Obtain random data from the RNG and store it as DAA_session -> DAA_contextSeed

5723
5724

i. Obtain DAA_SIZE_r0 bytes using the MGF1 function and label them Y.
DAA_session -> DAA_contextSeed is the Z seed.

5725

j.

5726

k. Set n = DAA_generic_n

5727

l.

5728

m. set outputData = NULL

5729

n. increment DAA_session -> DAA_stage by 1

5730

o. return TPM_SUCCESS

“r0” ||

Set X = DAA_generic_R0
Set DAA_session -> DAA_scratch = (X^Y) mod n

57317. If stage==3
5732
5733

a. Verify that DAA_session ->DAA_stage==3. Return TPM_DAA_STAGE and flush handle
on mismatch

5734
5735

b. Verify that DAA_tpmSpecific -> DAA_digestIssuer == SHA-1(DAA_issuerSettings) and
return error TPM_DAA_ISSUER_SETTINGS on mismatch

5736
5737

c. Verify that DAA_session -> DAA_digestContext == SHA-1(DAA_tpmSpecific) and
return error TPM_DAA_TPM_SETTINGS on mismatch

5738

d. Set DAA_generic_R1 = inputData0

5739
5740

e. Verify that SHA-1(DAA_generic_R1) == DAA_issuerSettings -> DAA_digest_R1 and
return error TPM_DAA_INPUT_DATA0 on mismatch

5741

f. Set DAA_generic_n = inputData1

5742
5743

g. Verify that SHA-1(DAA_generic_n) == DAA_issuerSettings -> DAA_digest_n and
return error TPM_DAA_INPUT_DATA1 on mismatch

5744
5745

h. Obtain DAA_SIZE_r1 bytes using the MGF1 function and label them Y.
DAA_session -> DAA_contextSeed is the Z seed.

5746

i.

Set X = DAA_generic_R1

5747

j.

Set n = DAA_generic_n

1335
1336

286

“r1” ||

Level 2 Revision 116 28 February 2011
TCG Published

1337TPM Main Part 3 Commands

TCG © Copyright

1338Specification Version 1.2

5748

k. Set Z = DAA_session -> DAA_scratch

5749

l.

5750

m. set outputData = NULL

5751

n. increment DAA_session -> DAA_stage by 1

5752

o. return TPM_SUCCESS

Set DAA_session -> DAA_scratch = Z*(X^Y) mod n

57538. If stage==4
5754
5755

a. Verify that DAA_session ->DAA_stage==4. Return TPM_DAA_STAGE and flush handle
on mismatch

5756
5757

b. Verify that DAA_tpmSpecific -> DAA_digestIssuer == SHA-1(DAA_issuerSettings) and
return error TPM_DAA_ISSUER_SETTINGS on mismatch

5758
5759

c. Verify that DAA_session -> DAA_digestContext = SHA-1(DAA_tpmSpecific)
return error TPM_DAA_TPM_SETTINGS on mismatch

5760

d. Set DAA_generic_S0 = inputData0

5761
5762

e. Verify that SHA-1(DAA_generic_S0) == DAA_issuerSettings -> DAA_digest_S0 and
return error TPM_DAA_INPUT_DATA0 on mismatch

5763

f. Set DAA_generic_n = inputData1

5764
5765

g. Verify that SHA-1(DAA_generic_n) == DAA_issuerSettings -> DAA_digest_n and
return error TPM_DAA_INPUT_DATA1 on mismatch

5766
5767

h. Obtain DAA_SIZE_r2 bytes using the MGF1 function and label them Y.
DAA_session -> DAA_contextSeed is the Z seed.

5768

i.

Set X = DAA_generic_S0

5769

j.

Set n = DAA_generic_n

5770

k. Set Z = DAA_session -> DAA_scratch

5771

l.

5772

m. set outputData = NULL

5773

n. increment DAA_session -> DAA_stage by 1

5774

o. return TPM_SUCCESS

and

“r2” ||

Set DAA_session -> DAA_scratch = Z*(X^Y) mod n

57759. If stage==5
5776
5777

a. Verify that DAA_session ->DAA_stage==5. Return TPM_DAA_STAGE and flush handle
on mismatch

5778
5779

b. Verify that DAA_tpmSpecific -> DAA_digestIssuer == SHA-1(DAA_issuerSettings) and
return error TPM_DAA_ISSUER_SETTINGS on mismatch

5780
5781

c. Verify that DAA_session -> DAA_digestContext == SHA-1(DAA_tpmSpecific) and
return error TPM_DAA_TPM_SETTINGS on mismatch

5782

d. Set DAA_generic_S1 = inputData0

5783
5784

e. Verify that SHA-1(DAA_generic_S1) == DAA_issuerSettings -> DAA_digest_S1 and
return error TPM_DAA_INPUT_DATA0 on mismatch

1339Level 2 Revision 116 28 February 2011
1340

287
TCG Published

1341Copyright © TCG
1342
1343

TPM Main Part 3 Commands
Specification Version 1.2

5785

f. Set DAA_generic_n = inputData1

5786
5787

g. Verify that SHA-1(DAA_generic_n) == DAA_issuerSettings -> DAA_digest_n and
return error TPM_DAA_INPUT_DATA1 on mismatch

5788
5789

h. Obtain DAA_SIZE_r4 bytes using the MGF1 function and label them Y.
DAA_session -> DAA_contextSeed is the Z seed.

5790

i.

Set X = DAA_generic_S1

5791

j.

Set n = DAA_generic_n

5792

k. Set Z = DAA_session -> DAA_scratch

5793

l.

5794

m. set outputData = DAA_session -> DAA_scratch

5795

n. set DAA_session -> DAA_scratch = NULL

5796

o. increment DAA_session -> DAA_stage by 1

5797

p. return TPM_SUCCESS

“r4” ||

Set DAA_session -> DAA_scratch = Z*(X^Y) mod n

579810.If stage==6
5799
5800

a. Verify that DAA_session ->DAA_stage==6. Return TPM_DAA_STAGE and flush handle
on mismatch

5801
5802

b. Verify that DAA_tpmSpecific -> DAA_digestIssuer == SHA-1(DAA_issuerSettings) and
return error TPM_DAA_ISSUER_SETTINGS on mismatch

5803
5804

c. Verify that DAA_session -> DAA_digestContext == SHA-1(DAA_tpmSpecific) and
return error TPM_DAA_TPM_SETTINGS on mismatch

5805

d. Set DAA_generic_gammma = inputData0

5806
5807

e. Verify
that
SHA-1(DAA_generic_gamma)
==
DAA_issuerSettings
DAA_digest_gamma and return error TPM_DAA_INPUT_DATA0 on mismatch

5808
5809

f. Verify that inputSize1 == DAA_SIZE_w and return error TPM_DAA_INPUT_DATA1 on
mismatch

5810

g. Set w = inputData1

5811

h. Set w1 = w^( DAA_issuerSettings -> DAA_generic_q) mod (DAA_generic_gamma)

5812

i.

If w1 != 1 (unity), return error TPM_DAA_WRONG_W

5813

j.

Set DAA_session -> DAA_scratch = w

5814

k. set outputData = NULL

5815

l.

5816

m. return TPM_SUCCESS.

->

increment DAA_session -> DAA_stage by 1

581711.If stage==7
5818
5819

a. Verify that DAA_session ->DAA_stage==7. Return TPM_DAA_STAGE and flush handle
on mismatch

5820
5821

b. Verify that DAA_tpmSpecific -> DAA_digestIssuer == SHA-1(DAA_issuerSettings) and
return error TPM_DAA_ISSUER_SETTINGS on mismatch

1344
1345

288

Level 2 Revision 116 28 February 2011
TCG Published

1346TPM Main Part 3 Commands

TCG © Copyright

1347Specification Version 1.2

5822
5823

c. Verify that DAA_session -> DAA_digestContext == SHA-1(DAA_tpmSpecific) and
return error TPM_DAA_TPM_SETTINGS on mismatch

5824

d. Set DAA_generic_gamma = inputData0

5825
5826

e. Verify
that
SHA-1(DAA_generic_gamma)
==
DAA_issuerSettings
DAA_digest_gamma and return error TPM_DAA_INPUT_DATA0 on mismatch

5827
5828
5829

f. Set f = SHA-1(DAA_tpmSpecific -> DAA_rekey || DAA_tpmSpecific -> DAA_count ||
0 ) || SHA-1(DAA_tpmSpecific -> DAA_rekey || DAA_tpmSpecific -> DAA_count || 1 )
mod DAA_issuerSettings -> DAA_generic_q.

5830

g. Set E = ((DAA_session -> DAA_scratch)^f) mod (DAA_generic_gamma).

5831

h. Set outputData = E

5832

i.

increment DAA_session -> DAA_stage by 1

5833

j.

return TPM_SUCCESS.

->

583412.If stage==8
5835
5836

a. Verify that DAA_session ->DAA_stage==8. Return TPM_DAA_STAGE and flush handle
on mismatch

5837
5838

b. Verify that DAA_tpmSpecific -> DAA_digestIssuer == SHA-1(DAA_issuerSettings) and
return error TPM_DAA_ISSUER_SETTINGS on mismatch

5839
5840

c. Verify that DAA_session -> DAA_digestContext == SHA-1(DAA_tpmSpecific) and
return error TPM_DAA_TPM_SETTINGS on mismatch

5841

d. Set DAA_generic_gamma = inputData0

5842
5843

e. Verify
that
SHA-1(DAA_generic_gamma)
==
DAA_issuerSettings
DAA_digest_gamma and return error TPM_DAA_INPUT_DATA0 on mismatch

5844
5845

f. Obtain DAA_SIZE_r0 bytes using the MGF1 function and label them r0.
DAA_session -> DAA_contextSeed is the Z seed.

“r0” ||

5846
5847

g. Obtain DAA_SIZE_r1 bytes using the MGF1 function and label them r1.
DAA_session -> DAA_contextSeed is the Z seed.

“r1” ||

5848

h. set r = r0 + 2^DAA_power0 * r1 mod (DAA_issuerSettings -> DAA_generic_q).

5849

i.

Set E1 = ((DAA_session -> DAA_scratch)^r) mod (DAA_generic_gamma)

5850

j.

Set DAA_session -> DAA_scratch = NULL

5851

k. Set outputData = E1

5852

l.

5853

m. return TPM_SUCCESS.

->

increment DAA_session -> DAA_stage by 1

585413.If stage==9
5855
5856

a. Verify that DAA_session ->DAA_stage==9. Return TPM_DAA_STAGE and flush handle
on mismatch

5857
5858

b. Verify that DAA_tpmSpecific -> DAA_digestIssuer == SHA-1(DAA_issuerSettings) and
return error TPM_DAA_ISSUER_SETTINGS on mismatch

1348Level 2 Revision 116 28 February 2011
1349

289
TCG Published

1350Copyright © TCG
1351
1352

TPM Main Part 3 Commands
Specification Version 1.2

5859
5860

c. Verify that DAA_session -> DAA_digestContext == SHA-1(DAA_tpmSpecific) and
return error TPM_DAA_TPM_SETTINGS on mismatch

5861
5862

d. Verify
that
inputSize0
==
TPM_DAA_INPUT_DATA0 on mismatch

5863

e. Set DAA_session -> DAA_digest = inputData0

5864

f. Obtain DAA_SIZE_NT bytes from the RNG and label them NT

5865

g. Set DAA_session -> DAA_digest to the SHA-1 ( DAA_session -> DAA_digest || NT )

5866

h. Set outputData = NT

5867

i.

increment DAA_session -> DAA_stage by 1

5868

j.

return TPM_SUCCESS.

sizeOf(TPM_DIGEST)

and

return

error

586914.If stage==10
5870
5871

a. Verify that DAA_session ->DAA_stage==10. Return TPM_DAA_STAGE and flush
handle on mismatch

5872
5873

b. Verify that DAA_tpmSpecific -> DAA_digestIssuer == SHA-1(DAA_issuerSettings) and
return error TPM_DAA_ISSUER_SETTINGS on mismatch

5874
5875

c. Verify that DAA_session -> DAA_digestContext == SHA-1(DAA_tpmSpecific) and
return error TPM_DAA_TPM_SETTINGS on mismatch

5876
5877

d. Verify that inputSize0 == sizeOf(BYTE), and return error TPM_DAA_INPUT_DATA0 on
mismatch

5878
5879

e. Set selector = inputData0, verify that selector == 0 or 1, and return error
TPM_DAA_INPUT_DATA0 on mismatch

5880
5881

f. If selector == 1, verify that inputSize1 == sizeOf(TPM_DIGEST), and return error
TPM_DAA_INPUT_DATA1 on mismatch

5882
5883

g. Set DAA_session -> DAA_digest to SHA-1 (DAA_session -> DAA_digest || 1 ||
inputData1)

5884
5885

h. If selector == 0, verify that inputData1 is a handle to a TPM identity key (AIK), and
return error TPM_DAA_INPUT_DATA1 on mismatch

5886
5887

i. Set DAA_session -> DAA_digest to SHA-1 (DAA_session -> DAA_digest || 0 || n2)
where n2 is the modulus of the AIK

5888

j.

5889

k. increment DAA_session -> DAA_stage by 1

5890

l.

Set outputData = DAA_session -> DAA_digest
return TPM_SUCCESS.

589115.If stage==11
5892
5893

a. Verify that DAA_session ->DAA_stage==11. Return TPM_DAA_STAGE and flush
handle on mismatch

5894
5895

b. Verify that DAA_tpmSpecific -> DAA_digestIssuer == SHA-1(DAA_issuerSettings) and
return error TPM_DAA_ISSUER_SETTINGS on mismatch

1353
1354

290

Level 2 Revision 116 28 February 2011
TCG Published

1355TPM Main Part 3 Commands

TCG © Copyright

1356Specification Version 1.2

5896
5897

c. Verify that DAA_session -> DAA_digestContext == SHA-1(DAA_tpmSpecific) and
return error TPM_DAA_TPM_SETTINGS on mismatch

5898
5899

d. Obtain DAA_SIZE_r0 bytes using the MGF1 function and label them r0.
DAA_session -> DAA_contextSeed is the Z seed.

5900
5901
5902

e. Set f = SHA-1(DAA_tpmSpecific -> DAA_rekey || DAA_tpmSpecific -> DAA_count ||
0 ) || SHA-1(DAA_tpmSpecific -> DAA_rekey || DAA_tpmSpecific -> DAA_count || 1 )
mod DAA_issuerSettings -> DAA_generic_q.

5903

f. Set f0 = f mod 2^DAA_power0 (erase all but the lowest DAA_power0 bits of f)

5904

g. Set s0 = r0 + (DAA_session -> DAA_digest)*(f0)

5905

h. set outputData = s0

5906

i.

increment DAA_session -> DAA_stage by 1

5907

j.

return TPM_SUCCESS

“r0” ||

590816.If stage==12
5909
5910

a. Verify that DAA_session ->DAA_stage==12. Return TPM_DAA_STAGE and flush
handle on mismatch

5911
5912

b. Verify that DAA_tpmSpecific -> DAA_digestIssuer == SHA-1(DAA_issuerSettings) and
return error TPM_DAA_ISSUER_SETTINGS on mismatch

5913
5914

c. Verify that DAA_session -> DAA_digestContext == SHA-1(DAA_tpmSpecific) and
return error TPM_DAA_TPM_SETTINGS on mismatch

5915
5916

d. Obtain DAA_SIZE_r1 bytes using the MGF1 function and label them r1.
DAA_session -> DAA_contextSeed is the Z seed.

5917
5918
5919

e. Set f = SHA-1(DAA_tpmSpecific -> DAA_rekey || DAA_tpmSpecific -> DAA_count ||
0 ) || SHA-1(DAA_tpmSpecific -> DAA_rekey || DAA_tpmSpecific -> DAA_count || 1 )
mod DAA_issuerSettings -> DAA_generic_q.

5920
5921

f. Shift f right by DAA_power0 bits (discard the lowest DAA_power0 bits) and label the
result f1

5922

g. Set s1 = r1 + (DAA_session -> DAA_digest)*(f1)

5923

h. set outputData = s1

5924

i.

increment DAA_session -> DAA_stage by 1

5925

j.

return TPM_SUCCESS

“r1” ||

592617.If stage==13
5927
5928

a. Verify that DAA_session ->DAA_stage==13. Return TPM_DAA_STAGE and flush
handle on mismatch

5929
5930

b. Verify that DAA_tpmSpecific -> DAA_digestIssuer == SHA-1(DAA_issuerSettings) and
return error TPM_DAA_ISSUER_SETTINGS on mismatch

5931
5932

c. Verify that DAA_session -> DAA_digestContext == SHA-1(DAA_tpmSpecific) and
return error TPM_DAA_TPM_SETTINGS on mismatch

5933
5934

d. Set DAA_private_v0=
daaBlobKey

unwrap(inputData0)

1357Level 2 Revision 116 28 February 2011
1358

291
TCG Published

using

TPM_PERMANENT_DATA

->

1359Copyright © TCG
1360
1361

TPM Main Part 3 Commands
Specification Version 1.2

5935
5936

e. Verify that SHA-1(DAA_private_v0) == DAA_tpmSpecific -> DAA_digest_v0 and return
error TPM_DAA_INPUT_DATA0 on mismatch

5937
5938

f. Obtain DAA_SIZE_r2 bytes from the MGF1 function and label them r2.
DAA_session -> DAA_contextSeed is the Z seed.

5939
5940

g. Set s2 = r2 + (DAA_session -> DAA_digest)*( DAA_private_v0) mod 2^DAA_power1
(erase all but the lowest DAA_power1 bits of s2)

5941

h. set outputData = s2

5942

i.

increment DAA_session -> DAA_stage by 1

5943

j.

return TPM_SUCCESS

“r2” ||

594418.If stage==14
5945
5946

a. Verify that DAA_session ->DAA_stage==14. Return TPM_DAA_STAGE and flush
handle on mismatch

5947
5948

b. Verify that DAA_tpmSpecific -> DAA_digestIssuer == SHA-1(DAA_issuerSettings) and
return error TPM_DAA_ISSUER_SETTINGS on mismatch

5949
5950

c. Verify that DAA_session -> DAA_digestContext == SHA-1(DAA_tpmSpecific) and
return error TPM_DAA_TPM_SETTINGS on mismatch

5951
5952

d. Set DAA_private_v0=
daaBlobKey

5953
5954

e. Verify that SHA-1(DAA_private_v0) == DAA_tpmSpecific -> DAA_digest_v0 and return
error TPM_DAA_INPUT_DATA0 on mismatch

5955
5956

f. Obtain DAA_SIZE_r2 bytes using the MGF1 function and label them r2.
DAA_session -> DAA_contextSeed is the Z seed.

5957

g. Set s12 = r2 + (DAA_session -> DAA_digest)*(DAA_private_v0).

5958

h. Shift s12 right by DAA_power1 bits (erase the lowest DAA_power1 bits).

5959

i.

Set DAA_session -> DAA_scratch = s12

5960

j.

set outputData = NULL

5961

k. increment DAA_session -> DAA_stage by 1

5962

l.

unwrap(inputData0)

using

TPM_PERMANENT_DATA

->

“r2” ||

return TPM_SUCCESS

596319.If stage==15
5964
5965

a. Verify that DAA_session ->DAA_stage==15. Return TPM_DAA_STAGE and flush
handle on mismatch

5966
5967

b. Verify that DAA_tpmSpecific -> DAA_digestIssuer == SHA-1(DAA_issuerSettings) and
return error TPM_DAA_ISSUER_SETTINGS on mismatch

5968
5969

c. Verify that DAA_session -> DAA_digestContext == SHA-1(DAA_tpmSpecific) and
return error TPM_DAA_TPM_SETTINGS on mismatch

5970
5971

d. Set DAA_private_v1 = unwrap(inputData0) using
daaBlobKey

1362
1363

292

TPM_PERMANENT_DATA

Level 2 Revision 116 28 February 2011
TCG Published

->

1364TPM Main Part 3 Commands

TCG © Copyright

1365Specification Version 1.2

5972
5973

e. Verify that SHA-1(DAA_private_v1) == DAA_tpmSpecific -> DAA_digest_v1 and return
error TPM_DAA_INPUT_DATA0 on mismatch

5974
5975

f. Obtain DAA_SIZE_r4 bytes using the MGF1 function and label them r4.
DAA_session -> DAA_contextSeed is the Z seed.

5976
5977

g. Set s3 = r4 + (DAA_session -> DAA_digest)*(DAA_private_v1) + (DAA_session ->
DAA_scratch).

5978

h. Set DAA_session -> DAA_scratch = NULL

5979

i.

5980
5981

j. Terminate the DAA session and all resources associated with the DAA sign session
handle.

5982

k. return TPM_SUCCESS

“r4” ||

set outputData = s3

598320.If stage > 15, return error: TPM_DAA_STAGE

1366Level 2 Revision 116 28 February 2011
1367

293
TCG Published

1368Copyright © TCG
1369
1370

598427.
Deprecated
5985Start of informative comment:

TPM Main Part 3 Commands
Specification Version 1.2

commands

5986This section covers the commands that were in version 1.1 but now have new functionality
5987in other functions. The deprecated commands are still available in 1.2 but all new software
5988should use the new functionality.
5989There is no requirement that the deprecated commands work with new structures.
5990End of informative comment.
59911. Commands deprecated in version 1.2 MUST work with version 1.1 structures
59922. Commands deprecated in version 1.2 MAY work with version 1.2 structures

1371
1372

294

Level 2 Revision 116 28 February 2011
TCG Published

1373TPM Main Part 3 Commands

TCG © Copyright

1374Specification Version 1.2

599327.1

Key commands

5994Start of informative comment:
5995The key commands are deprecated as the new way to handle keys is to use the standard
5996context commands. So TPM_EvictKey is now handled by TPM_FlushSpecific,
5997TPM_Terminate_Handle by TPM_FlushSpecific.
5998End of informative comment.
599927.1.1

TPM_EvictKey

6000Incoming Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_COMMAND

2

4

UINT32

paramSize

Total number of input bytes including paramSize and tag

3

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_EvictKey

4

4

TPM_KEY_HANDLE

evictHandle

The handle of the key to be evicted.

Type

Name

Description

#

SZ

1

#

1S

SZ

4

6001Outgoing Operands and Sizes
PARAM

HMAC

#

SZ

#

SZ

1

2

TPM_TAG

tag

TPM_TAG_RSP_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

1S

4

TPM_RESULT

returnCode

The return code of the operation.

2S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_EvictKey

6002Actions
6003The TPM will invalidate the key stored in the specified handle and return the space to the
6004available internal pool for subsequent query by TPM_GetCapability and usage by
6005TPM_LoadKey. If the specified key handle does not correspond to a valid key, an error will
6006be returned.
6007New 1.2 functionality
6008The command must check the status of the ownerEvict flag for the key and if the flag is
6009TRUE return TPM_KEY_CONTROL_OWNER

1375Level 2 Revision 116 28 February 2011
1376

295
TCG Published

1377Copyright © TCG
1378
1379

601027.1.2

TPM Main Part 3 Commands
Specification Version 1.2

TPM_Terminate_Handle

6011Start of informative comment:
6012This allows the TPM manager to clear out information in a session handle.
6013The TPM may maintain the authorization session even though a key attached to it has been
6014unloaded or the authorization session itself has been unloaded in some way. When a
6015command is executed that requires this session, it is the responsibility of the external
6016software to load both the entity and the authorization session information prior to
6017command execution.
6018End of informative comment.
6019Incoming Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_COMMAND

2

4

UINT32

paramSize

Total number of input bytes including paramSize and tag

3

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_Terminate_Handle.

4

4

TPM_AUTHHANDLE

handle

The handle to terminate

Type

Name

Description

#

SZ

1

#

SZ

1S

4

6020Outgoing Operands and Sizes
PARAM

HMAC

#

SZ

#

SZ

1

2

TPM_TAG

tag

TPM_TAG_RSP_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

1S

4

TPM_RESULT

returnCode

The return code of the operation.

2S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_Terminate_Handle.

6021Description
6022The TPM SHALL terminate the session and destroy all data associated with the session
6023indicated.
6024Actions
6025A TPM SHALL unilaterally perform the actions of TPM_Terminate_Handle upon detection of
6026the following events:
60271. Completion of a received command whose authorization “continueUse” flag is FALSE.
60282. Completion of a received command when a shared secret derived from the authorization
6029
session was exclusive-or’ed with data (to provide confidentiality for that data). This
6030
occurs during execution of a TPM_ChangeAuth command, for example.
60313. When the associated entity is destroyed (in the case of TPM Owner or SRK, for example)
60324. Upon execution of TPM_Init

1380
1381

296

Level 2 Revision 116 28 February 2011
TCG Published

1382TPM Main Part 3 Commands

TCG © Copyright

1383Specification Version 1.2

60335. When the command returns an error. This is due to the fact that when returning an
6034
error the TPM does not send back nonceEven. There is no way to maintain the rolling
6035
nonces, hence the TPM MUST terminate the authorization session.
60366. Failure of an authorization check belonging to that authorization session.

1384Level 2 Revision 116 28 February 2011
1385

297
TCG Published

1386Copyright © TCG
1387
1388

603727.2

TPM Main Part 3 Commands
Specification Version 1.2

Context management

6038Start of informative comment:
6039The 1.1 context commands were written for specific resource types. The 1.2 commands are
6040generic for all resource types. So the Savexxx commands are replaced by TPM_SaveContext
6041and the LoadXXX commands by TPM_LoadContext.
6042End of informative comment.
604327.2.1

TPM_SaveKeyContext

6044Start of informative comment:
6045TPM_SaveKeyContext saves a loaded key outside the TPM. After creation of the key context
6046blob the TPM automatically releases the internal memory used by that key. The format of
6047the key context blob is specific to a TPM.
6048End of informative comment.
6049Incoming Operands and Sizes
PARAM
#

SZ

1

4

4

4

1S

4

Description

TPM_TAG

tag

TPM_TAG_RQU_COMMAND

UINT32

paramSize

Total number of input bytes including paramSize and tag

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_SaveKeyContext

TPM_KEY_HANDLE

SZ

Name

4

3

#

Type

2

2

HMAC

keyHandle

The key which will be kept outside the TPM

Type

Name

Description

6050Outgoing Operands and Sizes
PARAM

HMAC

#

SZ

#

SZ

1

2

TPM_TAG

tag

TPM_TAG_RSP_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

1S

4

TPM_RESULT

returnCode

The return code of the operation.

2S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_SaveKeyContext

4

4

3S

4

UINT32

keyContextSize

The actual size of the outgoing key context blob. If the command fails the value
will be 0

5

<>

4S

<>

BYTE[]

keyContextBlob

The key context blob.

6051Description
60521. This command allows saving a loaded key outside the TPM. After creation of the
6053
keyContextBlob, the TPM automatically releases the internal memory used by that key.
6054
The format of the key context blob is specific to a TPM.
60552.
6056
6057
6058
1389
1390

A TPM protected capability belonging to the TPM that created a key context blob MUST
be the only entity that can interpret the contents of that blob. If a cryptographic
technique is used for this purpose, the level of security provided by that technique
SHALL be at least as secure as a 2048 bit RSA algorithm. Any secrets (such as keys)
298

Level 2 Revision 116 28 February 2011
TCG Published

1391TPM Main Part 3 Commands

TCG © Copyright

1392Specification Version 1.2

6059
6060
6061

used in such a cryptographic technique MUST be generated using the TPM’s random
number generator. Any symmetric key MUST be used within the power-on session
during which it was created, only.

60623. A key context blob SHALL enable verification of the integrity of the contents of the blob
6063
by a TPM protected capability.
60644. A key context blob SHALL enable verification of the session validity of the contents of the
6065
blob by a TPM protected capability. The method SHALL ensure that all key context blobs
6066
are rendered invalid if power to the TPM is interrupted.

1393Level 2 Revision 116 28 February 2011
1394

299
TCG Published

1395Copyright © TCG
1396
1397

TPM Main Part 3 Commands
Specification Version 1.2

6067
606827.2.2

TPM_LoadKeyContext

6069Start of informative comment:
6070TPM_LoadKeyContext loads a key context blob into the TPM previously retrieved by a
6071TPM_SaveKeyContext call. After successful completion the handle returned by this
6072command can be used to access the key.
6073End of informative comment.
6074Incoming Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_COMMAND

2

4

UINT32

paramSize

Total number of input bytes including paramSize and tag

3

4

1S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_LoadKeyContext

4

4

2S

4

UINT32

keyContextSize

The size of the following key context blob.

5

<>

3S

<>

BYTE[]

keyContextBlob

The key context blob.

Type

Name

Description

#

SZ

1

#

SZ

6075Outgoing Operands and Sizes
PARAM

HMAC

#

SZ

#

SZ

1

2

TPM_TAG

tag

TPM_TAG_RSP_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

4

TPM_RESULT

returnCode

The return code of the operation.

2S
4

1S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_LoadKeyContext

TPM_KEY_HANDLE

keyHandle

The handle assigned to the key after it has been successfully loaded.

4

6076Description
60771. This command allows loading a key context blob into the TPM previously retrieved by a
6078
TPM_SaveKeyContext call. After successful completion the handle returned by this
6079
command can be used to access the key.
60802. The contents of a key context blob SHALL be discarded unless the contents have passed
6081
an integrity test. This test SHALL (statistically) prove that the contents of the blob are
6082
the same as when the blob was created.
60833. The contents of a key context blob SHALL be discarded unless the contents have passed
6084
a session validity test. This test SHALL (statistically) prove that the blob was created by
6085
this TPM during this power-on session.

1398
1399

300

Level 2 Revision 116 28 February 2011
TCG Published

1400TPM Main Part 3 Commands

TCG © Copyright

1401Specification Version 1.2

6086
608727.2.3

TPM_SaveAuthContext

6088Start of informative comment:
6089TPM_SaveAuthContext saves a loaded authorization session outside the TPM. After creation
6090of the authorization context blob, the TPM automatically releases the internal memory used
6091by that session. The format of the authorization context blob is specific to a TPM.
6092End of informative comment.
6093Incoming Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_COMMAND

2

4

UINT32

paramSize

Total number of input bytes including paramSize and tag

3

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_SaveAuthContext

4

4

TPM_AUTHHANDLE

authHandle

Authorization session which will be kept outside the TPM

Type

Name

Description

#

SZ

1

#

SZ

1S

4

6094Outgoing Operands and Sizes
PARAM

HMAC

#

SZ

#

SZ

1

2

TPM_TAG

tag

TPM_TAG_RSP_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

1S

4

TPM_RESULT

returnCode

The return code of the operation.

2S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_SaveAuthContext

4

4

3S

4

UINT32

authContextSize

The actual size of the outgoing authorization context blob. If the command fails
the value will be 0.

5

<>

4S

4

BYTE[]

authContextBlob

The authorization context blob.

6095Description
6096This command allows saving a loaded authorization session outside the TPM. After creation
6097of the authContextBlob, the TPM automatically releases the internal memory used by that
6098session. The format of the authorization context blob is specific to a TPM.
6099A TPM protected capability belonging to the TPM that created an authorization context blob
6100MUST be the only entity that can interpret the contents of that blob. If a cryptographic
6101technique is used for this purpose, the level of security provided by that technique SHALL
6102be at least as secure as a 2048 bit RSA algorithm. Any secrets (such as keys) used in such a
6103cryptographic technique MUST be generated using the TPM’s random number generator.
6104Any symmetric key MUST be used within the power-on session during which it was created,
6105only.
6106An authorization context blob SHALL enable verification of the integrity of the contents of
6107the blob by a TPM protected capability.

1402Level 2 Revision 116 28 February 2011
1403

301
TCG Published

1404Copyright © TCG
1405
1406

TPM Main Part 3 Commands
Specification Version 1.2

6108An authorization context blob SHALL enable verification of the session validity of the
6109contents of the blob by a TPM protected capability. The method SHALL ensure that all
6110authorization context blobs are rendered invalid if power to the TPM is interrupted.
611127.2.4

TPM_LoadAuthContext

6112Start of informative comment:
6113TPM_LoadAuthContext loads an authorization context blob into the TPM previously
6114retrieved by a TPM_SaveAuthContext call. After successful completion, the handle returned
6115by this command can be used to access the authorization session.
6116End of informative comment.
6117Incoming Operands and Sizes
PARAM

HMAC

Name

Description

TPM_TAG

tag

TPM_TAG_RQU_COMMAND

UINT32

#

Type

paramSize

Total number of input bytes including paramSize and tag

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_LoadAuthContext

4

UINT32

authContextSize

The size of the following authorization context blob.

<>

BYTE[]

authContextBlob

The authorization context blob.

Type

Name

Description

#

SZ

SZ

1

2

2

4

3

4

1S

4

4

4

2S

5

<>

3S

6118Outgoing Operands and Sizes
PARAM

HMAC

#

SZ

#

SZ

1

2

TPM_TAG

tag

TPM_TAG_RSP_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

4

TPM_RESULT

returnCode

The return code of the operation.

2S
4

1S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_LoadAuthContext

TPM_KEY_HANDLE

authHandle

The handle assigned to the authorization session after it has been successfully
loaded.

4

6119Description
6120This command allows loading an authorization context blob into the TPM previously
6121retrieved by a TPM_SaveAuthContext call. After successful completion, the handle returned
6122by this command can be used to access the authorization session.
6123The contents of an authorization context blob SHALL be discarded unless the contents have
6124passed an integrity test. This test SHALL (statistically) prove that the contents of the blob
6125are the same as when the blob was created.
6126The contents of an authorization context blob SHALL be discarded unless the contents have
6127passed a session validity test. This test SHALL (statistically) prove that the blob was created
6128by this TPM during this power-on session.
6129For an OSAP authorization context blob referring to a key, verify that the key linked to this
6130session is resident in the TPM.
1407
1408

302

Level 2 Revision 116 28 February 2011
TCG Published

1409TPM Main Part 3 Commands

TCG © Copyright

1410Specification Version 1.2

6131

1411Level 2 Revision 116 28 February 2011
1412

303
TCG Published

1413Copyright © TCG
1414
1415

613227.3

TPM Main Part 3 Commands
Specification Version 1.2

DIR commands

6133Start of informative comment:
6134The DIR commands are replaced by the NV storage commands.
6135The DIR [0] in 1.1 is now TPM_PERMANENT_DATA -> authDIR[0] and is always available for
6136the TPM to use. It is accessed by DIR commands using dirIndex 0 and by NV commands
6137using nvIndex TPM_NV_INDEX_DIR.
6138If the TPM vendor supports additional DIR registers, the TPM vendor may return errors or
6139provide vendor specific mappings for those DIR registers to NV storage locations.
6140End of informative comment.
61411. A dirIndex value of 0 MUST corresponds to an NV storage nvIndex value
6142
TPM_NV_INDEX_DIR.
61432. The TPM vendor MAY return errors or MAY provide vendor specific mappings for DIR
6144
dirIndex values greater than 0 to NV storage locations.

1416
1417

304

Level 2 Revision 116 28 February 2011
TCG Published

1418TPM Main Part 3 Commands

TCG © Copyright

1419Specification Version 1.2

614527.3.1

TPM_DirWriteAuth

6146Start of informative comment:
6147The TPM_DirWriteAuth operation provides write access to the Data Integrity Registers. DIRs
6148are non-volatile memory registers held in a TPM-shielded location. Owner authentication is
6149required to authorize this action.
6150Access is also provided through the NV commands with nvIndex TPM_NV_INDEX_DIR.
6151Owner authorization is not required when nvLocked is FALSE.
6152Version 1.2 requires only one DIR. If the DIR named does not exist, the TPM_DirWriteAuth
6153operation returns TPM_BADINDEX.
6154End of informative comment.
6155Incoming Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of input bytes including paramSize and tag

3

4

1S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_DirWriteAuth.

4

4

2S

4

TPM_DIRINDEX

dirIndex

Index of the DIR

5

20

3S

20

TPM_DIRVALUE

newContents

New value to be stored in named DIR

6

4

TPM_AUTHHANDLE

authHandle

The authorization session handle used for command.

2H1

20

TPM_NONCE

authLastNonceEven

Even nonce previously generated by TPM to cover inputs

7

20

3H1

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

8

1

4H1

1

BOOL

continueAuthSession

The continue use flag for the authorization session handle

9

20

TPM_AUTHDATA

ownerAuth

The authorization session digest for inputs. HMAC key: ownerAuth.

Type

Name

Description

#

SZ

1

#

SZ

6156Outgoing Operands and Sizes
PARAM

HMAC

#

SZ

#

SZ

1

2

TPM_TAG

tag

TPM_TAG_RSP_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

5

1

6

TPM_RESULT

returnCode

The return code of the operation.

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_DirWriteAuth

2H1

20

TPM_NONCE

nonceEven

Even nonce newly generated by TPM to cover outputs

3H1

20

4

2S
4

1S

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

4H1

1

BOOL

continueAuthSession

Continue use flag, TRUE if handle is still active

TPM_AUTHDATA

resAuth

The authorization session digest for the returned parameters. HMAC key:
ownerAuth.

20

6157Actions

1420Level 2 Revision 116 28 February 2011
1421

305
TCG Published

1422Copyright © TCG
1423
1424

TPM Main Part 3 Commands
Specification Version 1.2

61581. Validate that authHandle contains a TPM Owner AuthData to execute the
6159
TPM_DirWriteAuth command
61602. Validate that dirIndex points to a valid DIR on this TPM
61613. Write newContents into the DIR pointed to by dirIndex

1425
1426

306

Level 2 Revision 116 28 February 2011
TCG Published

1427TPM Main Part 3 Commands

TCG © Copyright

1428Specification Version 1.2

6162
616327.3.2

TPM_DirRead

6164Start of informative comment:
6165The TPM_DirRead operation provides read access to the DIRs. No authentication is required
6166to perform this action because typically no cryptographically useful AuthData is available
6167early in boot. TSS implementers may choose to provide other means of authorizing this
6168action. Version 1.2 requires only one DIR. If the DIR named does not exist, the
6169TPM_DirRead operation returns TPM_BADINDEX.
6170End of informative comment.
6171Incoming Operands and Sizes
PARAM

HMAC
#

SZ

1

2

2

4

3

4

1S

4

4

4

2S

4

Name

Description

TPM_TAG

tag

TPM_TAG_RQU_COMMAND

UINT32

SZ

Type

#

paramSize

Total number of input bytes including paramSize and tag

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_DirRead.

TPM_DIRINDEX

dirIndex

Index of the DIR to be read

Type

Name

Description

6172Outgoing Operands and Sizes
PARAM

HMAC

#

SZ

#

SZ

1

2

TPM_TAG

tag

TPM_TAG_RSP_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

20

4

TPM_RESULT

returnCode

The return code of the operation.

2S
4

1S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_DirRead.

3S

20

TPM_DIRVALUE

dirContents

The current contents of the named DIR

6173Actions
61741. Validate that dirIndex points to a valid DIR on this TPM
61752. Return the contents of the DIR in dirContents

1429Level 2 Revision 116 28 February 2011
1430

307
TCG Published

1431Copyright © TCG
1432
1433

617627.4

TPM Main Part 3 Commands
Specification Version 1.2

Change Auth

6177Start of informative comment:
6178The change auth commands can be duplicated by creating a transport session with
6179confidentiality and issuing the changeAuth command.
6180End of informative comment.

1434
1435

308

Level 2 Revision 116 28 February 2011
TCG Published

1436TPM Main Part 3 Commands

TCG © Copyright

1437Specification Version 1.2

6181
618227.4.1

TPM_ChangeAuthAsymStart

6183Start of informative comment:
6184The TPM_ChangeAuthAsymStart starts the process of changing AuthData for an entity. It
6185sets up an OIAP session that must be retained for use by its twin
6186TPM_ChangeAuthAsymFinish command.
6187TPM_ChangeAuthAsymStart creates a temporary asymmetric public key “tempkey” to
6188provide confidentiality for new AuthData to be sent to the TPM. TPM_ChangeAuthAsymStart
6189certifies that tempkey was generated by a genuine TPM, by generating a certifyInfo
6190structure that is signed by a TPM identity. The owner of that TPM identity must cooperate
6191to produce this command, because TPM_ChangeAuthAsymStart requires authorization to
6192use that identity.
6193It is envisaged that tempkey and certifyInfo are given to the owner of the entity whose
6194authorization
is
to
be
changed.
That
owner
uses
certifyInfo
and
a
6195TPM_IDENTITY_CREDENTIAL to verify that tempkey was generated by a genuine TPM. This
6196is done by verifying the TPM_IDENTITY_CREDENTIAL using the public key of a CA,
6197verifying the signature on the certifyInfo structure with the public key of the identity in
6198TPM_IDENTITY_CREDENTIAL, and verifying tempkey by comparing its digest with the value
6199inside certifyInfo. The owner uses tempkey to encrypt the desired new AuthData and inserts
6200that encrypted data in a TPM_ChangeAuthAsymFinish command, in the knowledge that
6201only a TPM with a specific identity can interpret the new AuthData.
6202End of informative comment.
6203Incoming Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of input bytes including paramSize and tag

3

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_ChangeAuthAsymStart.

4

4

TPM_KEY_HANDLE

idHandle

The keyHandle identifier of a loaded identity ID key

5

20

2s

20

TPM_NONCE

antiReplay

The nonce to be inserted into the certifyInfo structure

6

<>

3S

<>

TPM_KEY_PARMS

tempKey

Structure contains all parameters of ephemeral key.

7

4

TPM_AUTHHANDLE

authHandle

The authorization session handle used for idHandle authorization.

#

SZ

1

#

1S

SZ

4

2H1

20

TPM_NONCE

authLastNonceEven

Even nonce previously generated by TPM to cover inputs

8

20

3H1

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

9

1

4H1

1

BOOL

continueAuthSession

The continue use flag for the authorization session handle

10

20

TPM_AUTHDATA

idAuth

Authorization. HMAC key: idKey.usageAuth.

1438Level 2 Revision 116 28 February 2011
1439

309
TCG Published

1440Copyright © TCG
1441
1442

TPM Main Part 3 Commands
Specification Version 1.2

6204Outgoing Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RSP_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

#

SZ

1

#

SZ

1S

4

TPM_RESULT

returnCode

The return code of the operation.

2S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_ChangeAuthAsymStart

7

95

3S

95

TPM_CERTIFY_INFO

certifyInfo

The certifyInfo structure that is to be signed.

8

4

4S

4

UINT32

sigSize

The used size of the output area for the signature

9

<>

5S

<>

BYTE[ ]

sig

The signature of the certifyInfo parameter.

10

4

6s

4

TPM_KEY_HANDLE

ephHandle

The keyHandle identifier to be used by ChangeAuthAsymFinish for the
ephemeral key

11

<>

7S

<>

TPM_KEY

tempKey

Structure containing all parameters and public part of ephemeral key. TPM_KEY.encSize is set to 0.

12

20

2H1

20

TPM_NONCE

nonceEven

Even nonce newly generated by TPM to cover outputs

3H1

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

4H1

1

BOOL

continueAuthSession

Continue use flag, TRUE if handle is still active

TPM_AUTHDATA

resAuth

Authorization. HMAC key: idKey.usageAuth.

13

1

14

20

6205Actions
62061. The TPM SHALL verify the AuthData to use the TPM identity key held in idHandle. The
6207
TPM MUST verify that the key is a TPM identity key.
62082. The TPM SHALL validate the algorithm parameters for the key to create from the
6209
tempKey parameter.
62103. Recommended key type is RSA
62114. Minimum RSA key size MUST is 512 bits, recommended RSA key size is 1024
62125. For other key types the minimum key size strength MUST be comparable to RSA 512
62136. If the TPM is not designed to create a key of the requested type, return the error code
6214
TPM_BAD_KEY_PROPERTY
62157. The TPM SHALL create a new key (k1) in accordance with the algorithm parameter. The
6216
newly created key is pointed to by ephHandle.
62178. The TPM SHALL fill in all fields in tempKey using k1 for the information. The TPM_KEY
6218
-> encSize MUST be 0.
62199. The TPM SHALL fill in certifyInfo using k1 for the information. The certifyInfo -> data
6220
field is supplied by the antiReplay.
622110.The TPM then signs the certifyInfo parameter using the key pointed to by idHandle. The
6222
resulting signed blob is returned in sig parameter

1443
1444

310

Level 2 Revision 116 28 February 2011
TCG Published

1445TPM Main Part 3 Commands

TCG © Copyright

1446Specification Version 1.2

6223Field Descriptions for certifyInfo parameter
Type

Name

Description

TPM_VERSION

Version

TPM version structure; Part 2 TPM_VERSION

keyFlags

Redirection

This SHALL be set to FALSE

Migratable

This SHALL be set to FALSE

Volatile

This SHALL be set to TRUE

TPM_AUTH_DATA_USAGE

authDataUsage

This SHALL be set to TPM_AUTH_NEVER

TPM_KEY_USAGE

KeyUsage

This SHALL be set to TPM_KEY_AUTHCHANGE

UINT32

PCRInfoSize

This SHALL be set to 0

TPM_DIGEST

pubDigest

This SHALL be the hash of the public key being certified.

TPM_NONCE

Data

This SHALL be set to antiReplay

TPM_KEY_PARMS

info

This specifies the type of key and its parameters.

BOOL

parentPCRStatus

This SHALL be set to FALSE.

1447Level 2 Revision 116 28 February 2011
1448

311
TCG Published

1449Copyright © TCG
1450
1451

TPM Main Part 3 Commands
Specification Version 1.2

6224
622527.4.2

TPM_ChangeAuthAsymFinish

6226Start of informative comment:
6227The TPM_ChangeAuthAsymFinish command allows the owner of an entity to change the
6228AuthData for the entity.
6229The command requires the cooperation of the owner of the parent of the entity, since
6230AuthData must be provided to use that parent entity. The command requires knowledge of
6231the existing AuthData information and passes the new AuthData information. The
6232newAuthLink parameter proves knowledge of existing AuthData information and new
6233AuthData information. The new AuthData information “encNewAuth” is encrypted using the
6234“tempKey” variable obtained via TPM_ChangeAuthAsymStart.
6235A parent therefore retains control over a change in the AuthData of a child, but is prevented
6236from knowing the new AuthData for that child.
6237The changeProof parameter provides a proof that the new AuthData value was properly
6238inserted into the entity. The inclusion of a nonce from the TPM provides an entropy source
6239in the case where the AuthData value may be in itself be a low entropy value (hash of a
6240password etc).
6241 End of informative comment.
6242Incoming Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of input bytes including paramSize and tag

3

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_ChangeAuthAsymFinish

4

4

TPM_KEY_HANDLE

parentHandle

The keyHandle of the parent key for the input data

5

4

TPM_KEY_HANDLE

ephHandle

The keyHandle identifier for the ephemeral key

6

2

3S

2

TPM_ENTITY_TYPE

entityType

The type of entity to be modified

7

20

4s

20

TPM_HMAC

newAuthLink

HMAC calculation that links the old and new AuthData values together

8

4

5S

4

UINT32

newAuthSize

Size of encNewAuth

9

<>

6S

<>

BYTE[ ]

encNewAuth

New AuthData encrypted with ephemeral key.

10

4

7S

4

UINT32

encDataSize

The size of the inData parameter

11

<>

8S

<>

BYTE[ ]

encData

The encrypted entity that is to be modified.

12

4

TPM_AUTHHANDLE

authHandle

Authorization for parent key.

2H1

20

TPM_NONCE

authLastNonceEven

Even nonce previously generated by TPM to cover inputs

13

20

3H1

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

14

1

4H1

1

BOOL

continueAuthSession

The continue use flag for the authorization session handle

15

20

TPM_AUTHDATA

privAuth

The authorization session digest for inputs and parentHandle. HMAC key:
parentKey.usageAuth.

#

SZ

1

#

1S

SZ

4

6243
1452
1453

312

Level 2 Revision 116 28 February 2011
TCG Published

1454TPM Main Part 3 Commands

TCG © Copyright

1455Specification Version 1.2

6244Outgoing Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RSP_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

#

SZ

1

#

SZ

1S

4

TPM_RESULT

returnCode

The return code of the operation.

2S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_ChangeAuthAsymFinish

4

4

3S

4

UINT32

outDataSize

The used size of the output area for outData

5

<>

4S

<>

BYTE[ ]

outData

The modified, encrypted entity.

6

20

5s

20

TPM_NONCE

saltNonce

A nonce value from the TPM RNG to add entropy to the changeProof
value

7

<>

6S

<>

TPM_DIGEST

changeProof

Proof that AuthData has changed.

8

20

2H1

20

TPM_NONCE

nonceEven

Even nonce newly generated by TPM to cover outputs

3H1

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

4H1

1

BOOL

continueAuthSession

Continue use flag, TRUE if handle is still active

TPM_AUTHDATA

resAuth

The authorization session digest for the returned parameters. HMAC key:
parentKey.usageAuth.

9

1

10

20

6245Description
6246If the parentHandle points to the SRK then the HMAC key MUST be built using the TPM
6247Owner authentication.
6248Actions
62491. The TPM SHALL validate that the authHandle parameter authorizes use of the key in
6250
parentHandle.
62512. The encData field MUST be the encData field from TPM_STORED_DATA or TPM_KEY.
62523. The TPM SHALL create e1 by decrypting the entity held in the encData parameter.
62534. The TPM SHALL create a1 by decrypting encNewAuth using the ephHandle ->
6254
TPM_KEY_AUTHCHANGE
private
key.
a1
is
a
structure
of
type
6255
TPM_CHANGEAUTH_VALIDATE.
62565.
6257
6258
6259

The TPM SHALL create b1 by performing the following HMAC calculation: b1 = HMAC
(a1 -> newAuthSecret). The secret for this calculation is encData -> currentAuth. This
means that b1 is a value built from the current AuthData value (encData ->
currentAuth) and the new AuthData value (a1 -> newAuthSecret).

62606. The TPM SHALL compare b1 with newAuthLink. The TPM SHALL indicate a failure if the
6261
values do not match.
62627. The TPM SHALL replace e1 -> authData with a1 -> newAuthSecret
62638. The TPM SHALL encrypt e1 using the appropriate functions for the entity type. The key
6264
to encrypt with is parentHandle.
62659. The TPM SHALL create saltNonce by taking the next 20 bytes from the TPM RNG.

1456Level 2 Revision 116 28 February 2011
1457

313
TCG Published

1458Copyright © TCG
1459
1460

TPM Main Part 3 Commands
Specification Version 1.2

626610.The TPM SHALL create changeProof a HMAC of (saltNonce concatenated with a1 -> n1)
6267
using a1 -> newAuthSecret as the HMAC secret.
626811.The TPM MUST destroy the TPM_KEY_AUTHCHANGE key associated with the
6269
authorization session.

1461
1462

314

Level 2 Revision 116 28 February 2011
TCG Published

1463TPM Main Part 3 Commands

TCG © Copyright

1464Specification Version 1.2

627027.5

TPM_Reset

6271Start of informative comment:
6272TPM_Reset releases all resources associated with existing authorization sessions. This is
6273useful if a TSS driver has lost track of the state in the TPM.
6274End of informative comment.
6275Deprecated Command in 1.2
6276Incoming Parameters and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_COMMAND

2

4

UINT32

paramSize

Total number of input bytes including paramSize and tag

3

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_Reset.

Type

Name

Description

#

SZ

1

#

SZ

1S

4

6277Outgoing Parameters and Sizes
PARAM

HMAC

#

SZ

#

SZ

1

2

TPM_TAG

tag

TPM_TAG_RSP_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

1S

4

TPM_RESULT

returnCode

The return code of the operation.

2S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_Reset.

6278Description
6279This is a deprecated command in V1.2. This command in 1.1 only referenced authorization
6280sessions and is not upgraded to affect any other TPM entity in 1.2
6281Actions
62821. The TPM invalidates all resources allocated to authorization sessions as per version 1.1
6283
extant in the TPM
6284

a. This includes structures created by TPM_SaveAuthContext and TPM_SaveKeyContext

6285

b. The TPM MUST invalidate OSAP sessions

6286

c. The TPM MAY invalidate DSAP sessions

6287

d. The TPM MUST NOT invalidate structures created by TPM_SaveContext

62882. The TPM does not reset any PCR or DIR values.
62893. The TPM does not reset any flags in the TPM_STCLEAR_FLAGS structure.
62904. The TPM does not reset or invalidate any keys

1465Level 2 Revision 116 28 February 2011
1466

315
TCG Published

1467Copyright © TCG
1468
1469

629127.6

TPM Main Part 3 Commands
Specification Version 1.2

TPM_OwnerReadPubek

6292Start of informative comment:
6293Return the endorsement key public portion. This is authorized by the TPM Owner.
6294End of informative comment.
6295Incoming Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of input bytes including paramSize and tag

3

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_OwnerReadPubek

4

4

TPM_AUTHHANDLE

authHandle

The authorization session handle used for owner authentication.

#

SZ

1

#

SZ

1S

4

2H1

20

TPM_NONCE

authLastNonceEven

Even nonce previously generated by TPM to cover inputs

5

20

3H1

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

6

1

4H1

1

BOOL

continueAuthSession

The continue use flag for the authorization session handle

7

20

TPM_AUTHDATA

ownerAuth

The authorization session digest for inputs and owner authentication.
HMAC key: ownerAuth.

6296Outgoing Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RSP_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

#

SZ

1

#

SZ

1S

4

TPM_RESULT

returnCode

The return code of the operation.

2S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_OwnerReadPubek

4

<>

3S

<>

TPM_PUBKEY

pubEndorsementKey

The public endorsement key

5

20

2H1

20

TPM_NONCE

nonceEven

Even nonce newly generated by TPM to cover outputs

3H1

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

4H1

1

BOOL

continueAuthSession

Continue use flag, TRUE if handle is still active

TPM_AUTHDATA

resAuth

The authorization session digest for the returned parameters. HMAC key:
ownerAuth.

6

1

7

20

6297Description
6298This command returns the PUBEK.
6299Actions
6300The TPM_OwnerReadPubek command SHALL
63011. Validate the TPM Owner AuthData to execute this command
63022. Export the PUBEK

1470
1471

316

Level 2 Revision 116 28 February 2011
TCG Published

1472TPM Main Part 3 Commands

TCG © Copyright

1473Specification Version 1.2

630327.7

TPM_DisablePubekRead

6304Start of informative comment:
6305The TPM Owner may wish to prevent any entity from reading the PUBEK. This command
6306sets the non-volatile flag so that the TPM_ReadPubek command always returns
6307TPM_DISABLED_CMD.
6308This command has in essence been deprecated as TPM_TakeOwnership now sets the value
6309to false. The command remains at this time for backward compatibility.
6310End of informative comment.
6311Incoming Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of input bytes including paramSize and tag

3

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_DisablePubekRead

4

4

TPM_AUTHHANDLE

authHandle

The authorization session handle used for owner authentication.

#

SZ

1

#

SZ

1S

4

2H1

20

TPM_NONCE

authLastNonceEven

Even nonce previously generated by TPM to cover inputs

5

20

3H1

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

6

1

4H1

1

BOOL

continueAuthSession

The continue use flag for the authorization session handle

7

20

TPM_AUTHDATA

ownerAuth

The authorization session digest for inputs and owner authorization.
HMAC key: ownerAuth.

6312Outgoing Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RSP_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

#

SZ

1

#

SZ

5

1

6

TPM_RESULT

returnCode

The return code of the operation.

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_DisablePubekRead

2H1

20

TPM_NONCE

nonceEven

Even nonce newly generated by TPM to cover outputs

3H1

20

4

2S
4

1S

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

4H1

1

BOOL

continueAuthSession

Continue use flag, TRUE if handle is still active

TPM_AUTHDATA

resAuth

The authorization session digest for the returned parameters. HMAC key:
ownerAuth.

20

6313Actions
63141. This capability sets the TPM_PERMANENT_FLAGS -> readPubek flag to FALSE.

1474Level 2 Revision 116 28 February 2011
1475

317
TCG Published

1476Copyright © TCG
1477
1478

631527.8

TPM Main Part 3 Commands
Specification Version 1.2

TPM_LoadKey

6316Start of informative comment:
6317Version 1.2 deprecates TPM_LoadKey due to the HMAC of the new key handle on return.
6318The wrapping makes use of the handle difficult in an environment where the TSS, or other
6319management entity, is changing the TPM handle to a virtual handle.
6320Software using TPM_LoadKey on a 1.2 TPM can have a collision with the returned handle as
6321the 1.2 TPM uses random values in the lower three bytes of the handle. All new software
6322must use LoadKey2 to allow management software the ability to manage the key handle.
6323Before the TPM can use a key to either wrap, unwrap, bind, unbind, seal, unseal, sign or
6324perform any other action, it needs to be present in the TPM. The TPM_LoadKey function
6325loads the key into the TPM for further use.
6326The TPM assigns the key handle. The TPM always locates a loaded key by use of the handle.
6327The assumption is that the handle may change due to key management operations. It is the
6328responsibility of upper level software to maintain the mapping between handle and any
6329label used by external software.
6330This command has the responsibility of enforcing restrictions on the use of keys. For
6331example, when attempting to load a STORAGE key it will be checked for the restrictions on
6332a storage key (2048 size etc.).
6333The load command must maintain a record of whether any previous key in the key
6334hierarchy was bound to a PCR using parentPCRStatus.
6335The flag parentPCRStatus enables the possibility of checking that a platform passed
6336through some particular state or states before finishing in the current state. A grandparent
6337key could be linked to state-1, a parent key could linked to state-2, and a child key could be
6338linked to state-3, for example. The use of the child key then indicates that the platform
6339passed through states 1 and 2 and is currently in state 3, in this example. TPM_Startup
6340with stType == TPM_ST_CLEAR indicates that the platform has been reset, so the platform
6341has not passed through the previous states. Hence keys with parentPCRStatus==TRUE
6342must be unloaded if TPM_Startup is issued with stType == TPM_ST_CLEAR.
6343If a TPM_KEY structure has been decrypted AND the integrity test using "pubDataDigest"
6344has passed AND the key is non-migratory, the key must have been created by the TPM. So
6345there is every reason to believe that the key poses no security threat to the TPM. While there
6346is no known attack from a rogue migratory key, there is a desire to verify that a loaded
6347migratory key is a real key, arising from a general sense of unease about execution of
6348arbitrary data as a key. Ideally a consistency check would consist of an encrypt/decrypt
6349cycle, but this may be expensive. For RSA keys, it is therefore suggested that the
6350consistency test consists of dividing the supposed RSA product by the supposed RSA prime,
6351and checking that there is no remainder.
6352End of informative comment.

1479
1480

318

Level 2 Revision 116 28 February 2011
TCG Published

1481TPM Main Part 3 Commands

TCG © Copyright

1482Specification Version 1.2

6353Incoming Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of input bytes including paramSize and tag

3

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_LoadKey.

4

4

TPM_KEY_HANDLE

parentHandle

TPM handle of parent key.

5

<>

TPM_KEY

inKey

Incoming key structure, both encrypted private and clear public portions.
MAY be TPM_KEY12

6

4

TPM_AUTHHANDLE

authHandle

The authorization session handle used for parentHandle authorization.

#

SZ

1

#

SZ

1S

2S

4

<>

2H1

20

TPM_NONCE

authLastNonceEven

Even nonce previously generated by TPM to cover inputs

7

20

3H1

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

8

1

4H1

1

BOOL

continueAuthSession

The continue use flag for the authorization session handle

9

20

TPM_AUTHDATA

parentAuth

The authorization session digest for inputs and parentHandle. HMAC key:
parentKey.usageAuth.

Type

Name

Description

6354Outgoing Operands and Sizes
PARAM

HMAC

#

SZ

#

SZ

1

2

TPM_TAG

tag

TPM_TAG_RSP_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

1S

4

TPM_RESULT

returnCode

The return code of the operation.

2S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_LoadKey

4

4

3S

4

TPM_KEY_HANDLE

inkeyHandle

Internal TPM handle where decrypted key was loaded.

5

20

2H1

20

TPM_NONCE

nonceEven

Even nonce newly generated by TPM to cover outputs

3H1

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

4H1

1

BOOL

continueAuthSession

Continue use flag, TRUE if handle is still active

TPM_AUTHDATA

resAuth

The authorization session digest for the returned parameters. HMAC key:
parentKey.usageAuth.

6

1

7

20

6355Actions
6356The TPM SHALL perform the following steps:
63571. Validate the command and the parameters using parentAuth and parentHandle ->
6358
usageAuth
63592. If
parentHandle
->
6360
TPM_INVALID_KEYUSAGE

keyUsage

is

NOT

TPM_KEY_STORAGE

return

63613. If the TPM is not designed to operate on a key of the type specified by inKey, return the
6362
error code TPM_BAD_KEY_PROPERTY
63634. The TPM MUST handle both TPM_KEY and TPM_KEY12 structures
63645. Decrypt the inKey -> privkey to obtain TPM_STORE_ASYMKEY structure using the key
6365
in parentHandle
1483Level 2 Revision 116 28 February 2011
1484

319
TCG Published

1485Copyright © TCG
1486
1487

TPM Main Part 3 Commands
Specification Version 1.2

63666. Validate the integrity of inKey and decrypted TPM_STORE_ASYMKEY
6367
6368

a. Reproduce inKey -> TPM_STORE_ASYMKEY -> pubDataDigest using the fields of
inKey, and check that the reproduced value is the same as pubDataDigest

63697. Validate the consistency of the key and it’s key usage.
6370
6371
6372
6373
6374
6375

a. If inKey -> keyFlags -> migratable is TRUE, the TPM SHALL verify consistency of the
public and private components of the asymmetric key pair. If inKey -> keyFlags ->
migratable is FALSE, the TPM MAY verify consistency of the public and private
components of the asymmetric key pair. The consistency of an RSA key pair MAY be
verified by dividing the supposed (P*Q) product by a supposed prime and checking that
there is no remainder.

6376
6377

b. If inKey -> keyUsage is TPM_KEY_IDENTITY, verify that inKey->keyFlags->migratable
is FALSE. If it is not, return TPM_INVALID_KEYUSAGE

6378

c. If inKey -> keyUsage is TPM_KEY_AUTHCHANGE, return TPM_INVALID_KEYUSAGE

6379
6380

d. If inKey -> keyFlags -> migratable equals 0 then verify that TPM_STORE_ASYMKEY
-> migrationAuth equals TPM_PERMANENT_DATA -> tpmProof

6381

e. Validate the mix of encryption and signature schemes

6382

f. If TPM_PERMANENT_FLAGS -> FIPS is TRUE then

6383

i.

6384
6385

ii. If keyInfo
TPM_NOTFIPS

6386

iii. If keyInfo -> keyUsage specifies TPM_KEY_LEGACY return TPM_NOTFIPS

6387

If keyInfo -> keySize is less than 1024 return TPM_NOTFIPS
->

authDataUsage

specifies

TPM_AUTH_NEVER

return

g. If inKey -> keyUsage is TPM_KEY_STORAGE or TPM_KEY_MIGRATE

6388

i.

6389

ii. Key size MUST be 2048

6390

iii. exponentSize MUST be 0

6391

iv. sigScheme MUST be TPM_SS_NONE

6392

algorithmID MUST be TPM_ALG_RSA

h. If inKey -> keyUsage is TPM_KEY_IDENTITY

6393

i.

6394

ii. Key size MUST be 2048

6395

iii. exponentSize MUST be 0

6396

iv. encScheme MUST be TPM_ES_NONE

6397

i.

6398
6399
6400

If the decrypted inKey -> pcrInfo is NULL,
i. The TPM MUST set the internal indicator to indicate that the key is not using
any PCR registers.

j.

6401
6402

1488
1489

algorithmID MUST be TPM_ALG_RSA

Else
i. The TPM MUST store pcrInfo in a manner that allows the TPM to calculate a
composite hash whenever the key will be in use

320

Level 2 Revision 116 28 February 2011
TCG Published

1490TPM Main Part 3 Commands

TCG © Copyright

1491Specification Version 1.2

6403
6404

ii. The TPM MUST handle both version 1.1 TPM_PCR_INFO and 1.2
TPM_PCR_INFO_LONG structures according to the type of TPM_KEY structure

6405
6406
6407

(1) The TPM MUST validate the TPM_PCR_INFO or TPM_PCR_INFO_LONG
structures for legal values.
However, the digestAtRelease and
localityAtRelease are not validated for authorization until use time.

64088. Perform any processing necessary to make TPM_STORE_ASYMKEY key available for
6409
operations
64109. Load key and key information into internal memory of the TPM. If insufficient memory
6411
exists, return error TPM_NOSPACE.
641210.Assign inKeyHandle according to internal TPM rules.
641311.Set InKeyHandle -> parentPCRStatus to parentHandle -> parentPCRStatus.
641412.If parentHandle indicates it is using PCR registers, then set inKeyHandle ->
6415
parentPCRStatus to TRUE.

1492Level 2 Revision 116 28 February 2011
1493

321
TCG Published

1494Copyright © TCG
1495
1496

TPM Main Part 3 Commands
Specification Version 1.2

641628.
Deleted Commands
6417Start of informative comment:
6418These commands are no longer active commands. Their removal is due to security concerns
6419with their use.
6420End of informative comment.
64211. The TPM MUST return TPM_BAD_ORDINAL for any deleted command

1497
1498

322

Level 2 Revision 116 28 February 2011
TCG Published

1499TPM Main Part 3 Commands

TCG © Copyright

1500Specification Version 1.2

323
TCG Published

1503Copyright © TCG
1504
1505

643628.2

TPM Main Part 3 Commands
Specification Version 1.2

TPM_GetOrdinalAuditStatus

6437Start of informative comment:
6438Get the status of the audit flag for the given ordinal.
6439End of informative comment.
6440Incoming Operands and Sizes
PARAM

HMAC

Type

Name

Description

2

TPM_TAG

tag

TPM_TAG_RQU_COMMAND

2

4

UINT32

paramSize

Total number of input bytes including paramSize and tag

3

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_GetOrdinalAuditStatus

4

4

TPM_COMMAND_CODE

ordinalToQuery

The ordinal whose audit flag is to be queried

Type

Name

Description

#

SZ

1

#

SZ

6441Outgoing Operands and Sizes
PARAM

HMAC

#

SZ

#

SZ

1

2

TPM_TAG

tag

TPM_TAG_RSP_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

TPM_RESULT

returnCode

The return code of the operation.

4

1

BOOL

State

Value of audit flag for ordinalToQuery

6442Actions
64431. The TPM returns the Boolean value for the given ordinal. The value is TRUE if the
6444
command is being audited.

1506
1507

324

Level 2 Revision 116 28 February 2011
TCG Published

1508TPM Main Part 3 Commands

TCG © Copyright

1509Specification Version 1.2

644528.3

TPM_CertifySelfTest

6446Start of informative comment:
6447TPM_CertifySelfTest causes the TPM to perform a full self-test and return an authenticated
6448value if the test passes.
6449If a caller itself requires proof, it is sufficient to use any signing key for which only the TPM
6450and the caller have AuthData.
6451If a caller requires proof for a third party, the signing key must be one whose signature is
6452trusted by the third party. A TPM-identity key may be suitable.
6453End of informative comment.
6454Incoming Operands and Sizes
PARAM
#

SZ

1

4

4
5

20

6

4

2S

4

20

TPM_TAG

tag

TPM_TAG_RQU_AUTH1_COMMAND

UINT32

paramSize

Total number of input bytes including paramSize and tag

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_CertifySelfTest

TPM_KEY_HANDLE

keyHandle

The keyHandle identifier of a loaded key that can perform digital
signatures.

TPM_NONCE

antiReplay

Anti Replay nonce to prevent replay of messages

TPM_AUTHHANDLE

4

1S


SZ

Name


3

#

Type

2

2

HMAC

authHandle

The authorization session handle used for keyHandle authorization

2H1

20

TPM_NONCE

authLastNonceEven

Even nonce previously generated by TPM to cover inputs

7

20

3H1

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

8

1

4H1

1

BOOL

continueAuthSession

The continue use flag for the authorization session handle

9

20

TPM_AUTHDATA

privAuth

The authorization session digest that authorizes the inputs and use of
keyHandle. HMAC key: key.usageAuth

Type

Name

Description

6455Outgoing Operands and Sizes
PARAM

HMAC

#

SZ

#

SZ

1

2

TPM_TAG

tag

TPM_TAG_RSP_AUTH1_COMMAND

2

4

UINT32

paramSize

Total number of output bytes including paramSize and tag

3

4

1S

4

TPM_RESULT

returnCode

The return code of the operation.

2S

4

TPM_COMMAND_CODE

ordinal

Command ordinal: TPM_ORD_CertifySelfTest

4

4

3S

4

UINT32

sigSize

The length of the returned digital signature

5

<>

4S

<>

BYTE[ ]

sig

The resulting digital signature.

6

20

2H1

20

TPM_NONCE

nonceEven

Even nonce newly generated by TPM to cover outputs

3H1

20

TPM_NONCE

nonceOdd

Nonce generated by system associated with authHandle

4H1

1

BOOL

continueAuthSession

Continue use flag, TRUE if handle is still active

TPM_AUTHDATA

resAuth

The authorization session digest for the returned parameters. HMAC key:
key.usageAuth

7

1

8

20

1510Level 2 Revision 116 28 February 2011
1511

325
TCG Published

1512Copyright © TCG
1513
1514

TPM Main Part 3 Commands
Specification Version 1.2

6456Description
6457The key in keyHandle MUST have a KEYUSAGE value of type TPM_KEY_SIGNING or
6458TPM_KEY_LEGACY or TPM_KEY_IDENTITY.
6459Information returned by TPM_CertifySelfTest MUST NOT aid identification of an individual
6460TPM.
6461Actions
64621. The TPM SHALL perform TPM_SelfTestFull. If the test fails the TPM returns the
6463
appropriate error code.
64642. After successful completion of the self-test the TPM then validates the authorization to
6465
use the key pointed to by keyHandle
6466
6467
6468

a. If the key pointed to by keyHandle has a signature scheme that is not
TPM_SS_RSASSAPKCS1v15_SHA1, the TPM may either return TPM_BAD_SCHEME or
may return TPM_SUCCESS and a vendor specific signature.

64693. Create t1 the NOT null terminated string of "Test Passed", i.e. 11 bytes.
64704. The TPM creates m2 the message to sign by concatenating t1 || AntiReplay || ordinal.
64715. The TPM signs the SHA-1 of m2 using the key identified by keyHandle, and returns the
6472
signature as sig.
6473

1515
1516

326

Level 2 Revision 116 28 February 2011
TCG Published

1517TPM Main Part 3 Commands

TCG © Copyright

1518Specification Version 1.2