ST33TPHF20SPI datasheet(25/47 Pages) STMICROELECTRONICS

25 / 47 page

FIPS140-2 SECURITY POLICY

Page 25 of 47

NON-PROPRIETARY DOCUMENT



HMAC used in TPM2B_PRIVATE integrity protection generation or

verification

sensitive

Object sensitive part that might be passed as encrypted parameter to

TPM2_Create command or generated with KDFa from seed or primary seed (if

sensitiveDataOrigin attribute is set) in case object is a symmetric key or a

HMAC key. For RSA or ECC key, sensitive corresponds to the private key.

Depending on object’s nature, sensitive is used as key for:



en/decryption (RSA, AES, TDES)



signature generation (RSA, ECDSA, HMAC)



secret value exchange (ECDH)

Available key lengths correspond to the ones listed in Table 9: Approved

algorithms (Key nature and length are selected by user thanks to the interface

of the keys creation commands).

TPM2_Clear

(owner &

endorsement)

TPM2_Change

PPS (platform)

TPM2_Change

EPS

(endorsement)

NV Indexes

authValue

0 to 32 bytes authorization data defined during NV index creation

(TPM2_DefineSpace) used to authorize commands based on this object.

Value can be changed with command TPM2_NV_ChangeAuth.

It is used as:



HMAC and/or KDFa keys or part of keys in authorization session based on

HMAC or password.



Secret value extended into policyDigest on TPM2_PolicySecret command

TPM2_NV_Und

efineSpace

TPM2_NV_Und

efineSpaceSpec

ial

authPolicy

0 to 32 bytes authorization data defined during object creation

(TPM2_DefineSpace) used to authorize commands based on this object.

It is used as reference value for a comparison in case of policy session

TPM2_NV_Und

efineSpace

TPM2_NV_Und

efineSpaceSpec

ial

Sessions

salt

Value passed encrypted (with a loaded decrypt key) to

TPM2_StartAuthSession.

It is used as:



Part of KDFa key to generate the sessionKey (cf. [TPM2.0 Part1 r1.16]

§19.6)

Transient value

only available

during

TPM2_StartAut

hSession

processing

sessionKey

Key generated by KDFa (cf. [TPM2.0 Part1 r1.16] §19.6) and whose value

depends on salt and bind parameters of TPM2_StartAuthSession command

(size depends on symmetric algorithm used).

It is used as:



HMAC key used to generate and verify command authorization



Part of KDFa key used to generate encryption key and IV of encryption-

based session

TPM2_FlushCo

ntext

encryption key

and IV of

encryption-based

session

Symmetric key and IV generated by KDFa (cf. [TPM2.0 Part1 r1.16] §21.3) from

sessionKey

and object’s authValue.

It is used as key and IV for:



Symmetric en/decryption of first parameter of command/response if

parameter structure is of type TPM2B_

TPM2_FlushCo

ntext

Context

contextKey

16 bytes randomly generated by HDRBG at each TPM reset.

It is used as:



1st part of key used in KDFa to generate a symmetric encryption key and IV

used in context blob en/decryption.

TPM reset

ST33TPHF20SPI датащи(PDF) 25 Page - STMicroelectronics

ST33TPHF20SPI датащи(HTML) 25 Page - STMicroelectronics

Html Pages

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47

датащи скачать

ссылки URL