wolfTPM is a portable TPM 2.0 stack with backward API compatibility designed for embedded use, and the newly released wolfTPM v3.0.0 includes support for sealing/unsealing secrets to authority signed Platform Configuration Registers (PCR’s).
One of the most important features of the TPM 2.0 specification is the resolution of PCR brittleness. PCR brittleness is encountered when secrets like keys/data are sealed to PCR values and changes to hardware/software result in changes to the PCR values. With the altered PCR values, there is a mismatch of hashes and the secrets can no longer be unsealed. With the TPM 2.0 specification, it’s possible to seal/unseal secrets via cryptographic signatures of the PCR’s, removing the requirement to unseal then seal secrets whenever changes are made to the PCR values. wolfTPM now supports this feature.
See the documentation here examples/boot#secure-boot-encryption-key-storage for a wolfTPM example of using a private key to sign the state of a PCR, then seal and unseal a secret using the signed policy and a public key.
Our secure bootloader, wolfBoot, also supports this feature. See here docs/TPM.md#sealing-and-unsealing-a-secret.
If you have questions about any of the above, please contact us at facts@wolfSSL.com or call us at +1 425 245 8247.
Download wolfSSL Now