summaryrefslogtreecommitdiff
path: root/drivers/tpm/Kconfig
diff options
context:
space:
mode:
authormario.six@gdsys.cc <mario.six@gdsys.cc>2017-03-20 10:28:28 +0100
committerSimon Glass <sjg@chromium.org>2017-03-26 13:22:58 -0600
commit0f4b2ba1762d74c0b5520d99a58796d6ca78abf0 (patch)
tree28b6986105615b2a538e42cdaaf265955883bfd9 /drivers/tpm/Kconfig
parent5efa1bfbfa871f5bc3f07357088e8cf3c19e6f61 (diff)
tpm: Add function to load keys via their parent's SHA1 hash
If we want to load a key into a TPM, we need to know the designated parent key's handle, so that the TPM is able to insert the key at the correct place in the key hierarchy. However, if we want to load a key whose designated parent key we also previously loaded ourselves, we first need to memorize this parent key's handle (since the handles for the key are chosen at random when they are inserted into the TPM). If we are, however, unable to do so, for example if the parent key is loaded into the TPM during production, and its child key during the actual boot, we must find a different mechanism to identify the parent key. To solve this problem, we add a function that allows U-Boot to load a key into the TPM using their designated parent key's SHA1 hash, and the corresponding auth data. Signed-off-by: Mario Six <mario.six@gdsys.cc> Reviewed-by: Simon Glass <sjg@chromium.org>
Diffstat (limited to 'drivers/tpm/Kconfig')
-rw-r--r--drivers/tpm/Kconfig8
1 files changed, 8 insertions, 0 deletions
diff --git a/drivers/tpm/Kconfig b/drivers/tpm/Kconfig
index 3490ee0c3b..a54b6a988a 100644
--- a/drivers/tpm/Kconfig
+++ b/drivers/tpm/Kconfig
@@ -88,4 +88,12 @@ config TPM_FLUSH_RESOURCES
help
Enable support to flush specific resources (e.g. keys) from the TPM.
The functionality is available via the 'tpm' command as well.
+
+config TPM_LOAD_KEY_BY_SHA1
+ bool "Enable TPM key loading by SHA1 support"
+ depends on TPM
+ help
+ Enable support to load keys into the TPM by identifying
+ their parent via the public key's SHA1 hash.
+ The functionality is available via the 'tpm' command as well.
endmenu