1.3.2.2 Key Attestation
The trusted platform module (TPM) can be used to create cryptographic public/private key pairs in such a way that the private key can never be revealed or used outside the TPM (that is, the key is non-migratable). This type of key can be used to guarantee that a certain cryptographic operation occurred in the TPM of a particular computer by virtue of the fact that any operation that uses the private key of such a key pair must occur inside that specific TPM.
It can also be useful to be able to cryptographically prove such a property of a key, so that a relying party can know that any use of the private key must have occurred inside that TPM.
An Attestation Identity Key (AIK) is used to provide such a cryptographic proof by signing the properties of the non-migratable key and providing the properties and signature to the CA for verification. Since the signature is created using the AIK private key, which can only be used in the TPM that created it, the CA can trust that the attested key is truly non-migratable and cannot be used outside that TPM.
A CA needs to know that it can trust an AIK, and that it is not being provided just any key that was created outside a TPM and can be used anywhere. This trust is formed by AIK activation, which is a process defined by the TPM that can be used to transfer trust from a TPM endorsement key (EK) to an AIK.
A TPM EK is another public/private key pair of which the private portion never leaves the TPM, but the EK is the root of the TPM's identity, and should be assumed to be unchangeable. As the root of the TPM's identity, there has to be a way to establish trust in the EK so that CA can have some degree of trust that the private portion of the EK will never be used outside the TPM.
Windows server supports the following methods for establishing trust in a TPM device:
Trust module key validation where a SHA2 hash of the client-provided EK public key (EKPub) or AIK public key (AIKPub) is checked against an administrator-managed list. For processing rules, see section 3.2.2.6.2.1.2.5.2.
Trust module certificate validation where the chain for the client-provided EK certificate ([TCG-Cred] section 3.2) or AIK certificate is built and verified to chain up to an administrator-selected list of CAs and root CAs. For processing rules, see section 3.2.2.6.2.1.2.5.1.
Trust the calling client's assertion that the EKPub is from a TPM. For processing rules, see section 3.2.2.6.2.1.2.5.
The Windows Client Certificate Enrollment Protocol allows clients and CAs to perform key attestation.<1> Enterprise key attestation is communicated by setting either of the following flags in the certificate template: CT_FLAG_ATTEST_REQUIRED or CT_FLAG_ATTEST_PREFERRED.