Block Diagram
Communication with the PI:
The communication between the Raspberry pi and the TPM uses SPI interface to send commands and receive responses. The driver of the TPM through which the communication takes place will be installed on th Pi. To utilize this communication link to pass in commands to the TPM, we used an Embedded Linux TPM Toolbox 2 (ELTT2), an open source implementation from Infineon can be downloaded from and is used to communicate with the TPM on Linux-based embedded devices. The ELTT2 is an executable program written in C consists of one single file and its header. The intention is to perform testing, diagnosis and some TPM basic operations using commands that are provided by TCG under TPM 2.0 specifications.
Using ELTT2:
The ELTT2 has list of TPM commands to perform such as: getting random numbers, generating sequences of SHA-1 or SHA-256, reading the TPM internal clock, reading PCR register values, etc. The ELTT2 communicates with the TPM device through TPM driver layer directly, which means all commands must first be converted into low-level format i.e. hexadecimal or binary. FAPI implementations contains profiles, which are pre-created configuration files that define the most common choices like algorithms, key size, mode of encryption, etc. For instance: P_RSA2048SHA256 profile uses the RSA 2048-bit asymmetric keys using PKCS#1 version 1.5 for signing scheme, SHA-256 for the hash algorithm, and the AES-128 with CFB mode for asymmetric encryption. Writing to this layer is similar to writing in high level languages like Java or C#.
Using TSS and TPM2.0 tools:
Need to download and install the TPM 2 & TSS Software repository including the dependencies .compile the projects using gcc tool. compile the projects using gcc tool
Creating and storing keys:
1) creating an object for TPM2.0 using input parameters of hierarchy, hashing algorithm type, lgorithm associated with the object itself.
2) a)Create a key with input as hashing algorithm, encryption algorithm and the primary object to create an encryption and decryption key.
b)Returns both the public and private portion of that key.
c) Both parts will stored as files (for example: primary.pub and primary.priv) in the folder where the command was executed.
d)The private part (i.e.primary.priv) will encrypted with the public part of the parent key and can therefore only be decrypted and used inside the TPM, and thus will be kept secret and will never be revealed to the outside world.
e) The public part is unencrypted, but the private part is encrypted with the public part of the parent key. Both are stored in the memory of the embedded board.Since we shall not focus on performance in this simple use case, the keys are not stored permanently inside the TPM and must therefore be loaded in advance.
f) The public key is loaded in the tpm to return a refernce file that can be used for encryption.
3) The command tpm2_rsaencrypt,performs an RSA encryption operation using the rsaencrypt_key.ctxobject. To perform the encryption using the TPM, we will use a sensor input data file and we will pass a filename for the data that shall be encrypted (for ex: cipher.enc)
4)The content of the file will be critical secrets that require to be protected by TPM using encryption. Only the owner of the private key would be able to decrypt them, which in this case is the TPM.
5)Decryption command will be used for decryption. The previously created encrypted file cipher.enc and a file descriptor for the output data output.txt will be the command line arguments
6) By executing this command TPM will decrypt the cipher.enc file and save the output data in an output data file. The content of output data file is identical to original data file which indicates that the decryption process has been done successfully.