Understanding the TPM endorsement key
Applies To: Windows Server 2008
The endorsement key is an encryption key that is permanently embedded in the TPM security hardware, generally at the time of manufacture. This private portion of the endorsement key is never released outside of the TPM. The public portion of the endorsement key helps to recognize a genuine TPM.
TPM operations that involve signing pieces of data can make use of the endorsement key to allow other components to verify that the data can be trusted. To sign a piece of data, a private key is used to encrypt a small piece of information. The signature can be verified by using the corresponding public key to decrypt that same piece of data. If it can be decrypted with the public key, then it must have been encrypted by the corresponding private key. As long as that private key has been kept secret, this digital signature can be trusted.
The endorsement key is defined by the Trusted Computing group. For more information, consult the “TCG Architecture overview” specification document available from the Trusted Computing Group Web site (https://go.microsoft.com/fwlink/?LinkId=69584).
Additional references