File tree 1 file changed +17
-6
lines changed
1 file changed +17
-6
lines changed Original file line number Diff line number Diff line change @@ -62,20 +62,31 @@ advertisement is stored, or the JSON contents of the advertisement itself. When
62
62
the advertisement is specified manually like this, Clevis presumes that the
63
63
advertisement is trusted.
64
64
65
- #### PIN: TPM2
65
+ #### PIN: TPM1 and TPM2
66
66
67
- Clevis provides support to encrypt a key in a Trusted Platform Module 2.0 (TPM2)
68
- chip. The cryptographically-strong, random key used for encryption is encrypted
69
- using the TPM2 chip, and is decrypted using TPM2 at the time of decryption to allow clevis to decrypt the secret stored in the JWE.
67
+ Clevis provides support to encrypt a key in a Trusted Platform Module 1.2 (TPM1)
68
+ and 2.0 (TPM2) chip. The cryptographically-strong, random key used for
69
+ encryption is encrypted using the TPM chip, and is decrypted using TPM at the
70
+ time of decryption to allow clevis to decrypt the secret stored in the JWE.
70
71
71
- For example:
72
+ For example for TPM1 pin:
73
+
74
+ ``` bash
75
+ $ echo hi | clevis encrypt tpm1 ' {}' > hi.jwe
76
+ ```
77
+
78
+ or TPM2 pin:
72
79
73
80
``` bash
74
81
$ echo hi | clevis encrypt tpm2 ' {}' > hi.jwe
75
82
```
76
83
77
84
Clevis store the public and private keys of the encrypted key in the JWE object,
78
- so those can be fetched on decryption to unseal the key encrypted using the TPM2.
85
+ so those can be fetched on decryption to unseal the key encrypted using the TPM
86
+ chip.
87
+
88
+ Check manual pages for ` clevis-encrypt-tpm1 ` and ` clevis-encrypt-tpm2 ` tools for
89
+ more options, like binding to a particular PCR registry states and/or values.
79
90
80
91
#### PIN: Shamir Secret Sharing
81
92
You can’t perform that action at this time.
0 commit comments