How to get EK or public EK of TPM? We are able to get the public key hash using powershell command: get-tpmendorsementkeyinfo -hash "Sha256" Is there any API in C# or C++ to get public key hash of EK. We are planning to use this EK to uniquely identify a device, as each device has a unique EK. reference: Stackoverflow question about using TPM as a device fingerprint

Maybe this will help https://github.com/Microsoft/TSS.MSR

Hello anonymous user -5396 , The TPM is supported for securing the IoT connection with the Azure Device provisioning service resource. A programming sample in C# for this communication solution is seen here . This is part of a bigger story of course (where the Azure IoT Edge runtime will complete the full enrollment circle). Still, this could be your starting point for getting an endorsement key.

Is there any API to get public part of Endorsement Key(EK) of TPM?

Rahul K 51

How to get EK or public EK of TPM?
We are able to get the public key hash using powershell command: get-tpmendorsementkeyinfo -hash "Sha256"
Is there any API in C# or C++ to get public key hash of EK.

We are planning to use this EK to uniquely identify a device, as each device has a unique EK.

reference: Stackoverflow question about using TPM as a device fingerprint

Junjie Zhu - MSFT 15,366 Reputation points Microsoft Vendor

2021-12-31T08:46:23.86+00:00

I searched the related API in Microsoft documentation, and it seems that there is no other API except get-TpmEndorSementKeyInfo.
Castorix31 81,831 Reputation points

2021-12-31T09:02:24.833+00:00

Maybe you could send commands like TPM_GetPubKey with Tbsip_Submit_Command
(I have no TPM on my old PC, so I cannot test...)

2 answers

Ken Tucker 5,846 Reputation points

2021-12-30T22:32:34.157+00:00

Maybe this will help

https://github.com/Microsoft/TSS.MSR
Please sign in to rate this answer.
Rahul K 51 Reputation points

2021-12-31T05:37:18.39+00:00

Ya, we already saw this project. But did not find anything that we can use for device fingerprint.
Sign in to comment
Sander van de Velde 29,286 Reputation points MVP

2022-01-02T22:53:41.703+00:00

Hello anonymous user-5396 ,

The TPM is supported for securing the IoT connection with the Azure Device provisioning service resource.

A programming sample in C# for this communication solution is seen here.

This is part of a bigger story of course (where the Azure IoT Edge runtime will complete the full enrollment circle).

Still, this could be your starting point for getting an endorsement key.
Please sign in to rate this answer.
aurel-LX 6 Reputation points

2022-01-28T17:02:12.69+00:00

The sample does not explain how to retrieve the public part of the endorsement key.

This public part is needed to manually enroll the device in the Device Provisioning Service in Azure.
Using the command Get-TpmEndorsementKeyInfo -Hash "Sha256" on power shell returns the hash of the key, things that is not accepted in Azure as Endorsement Key.

Gino 1 Reputation point

2022-03-16T19:56:15.453+00:00

Have you found a solution? I have the same problem.

Sander van de Velde 29,286 Reputation points MVP

2022-03-16T22:01:58.91+00:00

Hello @aurel-LX , anonymous user-5773 ,

in the past, I have used the TPM in combination with the Azure Device Provisioning Service.

I used this GitHub repo to get the endorsement key.

I think it needs some rework but this should still work.

Gino 1 Reputation point

2022-03-17T10:17:54.123+00:00

@Sander van de Velde thank you for your help!

Currently I am working on three tasks

DPS with TPM (read the EK and use it in the dps process)

DPS with X.509 (store the x.509 certificate in the tpm and read it for the dps process)

DPS with symmetric key (store the symmetric key in the tpm and read it for the dps process)

Have you found some examples written in c++?

Sander van de Velde 29,286 Reputation points MVP

2022-03-17T17:23:24.48+00:00

Hello anonymous user-5773 ,

I checked the documentation and only see it for other languages there:

The Github library does only show this individual enrollment sample.

The valid alternative is making use of the DPS Rest API.
Sign in to comment