Duplicate has the "auth role: DUP"
Roles DUP and ADMIN require a PolicyCommandCode to be present.
(see section 19.2 of tpm spec part 1)
What you want is a PolicyOr with one branch for the PolicyCommandCode(CC_Duplicate) and
one without a PolicyCommandCode for the unseal.
From: tpm2 [tpm2-bounces(a)lists.01.org] on behalf of Jordan Hand [jordanhand22(a)gmail.com]
Sent: Wednesday, June 05, 2019 18:38
Subject: [tpm2] TPM Object Duplication questions
I am wondering, is it possible to have the TPM duplicate a key without
adding a policy digest with
“Esys_PolicyCommandCode(TPM2_CC_DUPLICATION)” to the object's
Here is why I ask:
I have some data that I want to (1) seal to the PCR state on a TPM
with EK, duplicate, (2) import/load on the same TPM as a child of the
EK, and (3) unseal. I do this to test unsealing data that was sealed
For background on why I need to do this: The remote service whose
behavior I am emulating doesn't use a TPM to do the sealing, it
implements the same functionality outside the TPM and uses the EK pub
it gets from the client. But I am not able to run this code in my
The flow I use is:
* Create and start a trial session
* call Esys_PolicyCommandCode(TPM2_CC_DUPLICATION) on the session
* call Esys_PolicyPcr on the session
* Get the digest of the session
* Set session digest as inPub.publicArea.authPolicy
* Start policy session
* call same Esys_PolicyCommandCode and Esys_PolicyPcr
This works fine. Now the problem is that the created object requires a
policy that has Esys_PolicyCommandCode and Esys_PolicyPcr set. But the
caller to Esys_Unseal should be able to unseal with just the PolicyPcr
session. I need to set PolicyCommandCode to duplicate the object but
then I don’t want to enforce that policy during Unseal. It seems like
the policy digest from authPolicy needs to match exactly the session
digest I use when calling Esys_Unseal.
The other option is to create the object outside the TPM and just
implement all the object creation/sealing myself. But I would rather
have the TPM do the heavy lifting.
Please let me know if I can clarify anything here.
tpm2 mailing list