0

I am trying to add a manual enrollment using the device's TPM.

I have grabbed the Endorsement Key from the device running Linux.

Now, when I save the configuration in the Azure Portal, it returns a 400 Bad Request with the message stating that Endorsement key is invalid, or does not match the Enrollment:

IoT Device Provisioning

What am I missing?

Kzryzstof
  • 7,688
  • 10
  • 61
  • 108
  • Can you eloborate, what device are you using ? and how are you getting the key – KarthikBhyresh-MT Dec 06 '21 at 04:12
  • @KarthikBhyresh-MT The device is a camera that my company builds and it uses a firmware TPM from Intel. Strangely enough, the same type of f-TPM is used in different iterations of that device: one on Windows and the other on Linux. The EK has been retrieved using the azure-iot-sdk-c sample. – Kzryzstof Dec 06 '21 at 13:40

2 Answers2

0

If you are sure you are getting the TPM information from your device correctly, make sure you have the right IoT Hub Device ID, if not specified, Registration ID is considered.

Note: endorsementKey

The endorsement key is an encryption key that is permanently embedded in the Trusted Platform Module (TPM) security hardware, generally at the time of manufacture. This private portion of the endorsement key is never released outside of the TPM. The public portion of the endorsement key helps to recognize a genuine TPM. The endorsement key is a base64 encoded value.

Refer: Create a TPM individual enrollment

KarthikBhyresh-MT
  • 4,560
  • 2
  • 5
  • 12
  • I do believe I have the right EK as it is the one being returned from the azure-iot-sdk-c sample. I put both the registration ID and EK but it is failing. Somehow, it works well when we are using our device running Windows; in that case, the EK is much longer... – Kzryzstof Dec 06 '21 at 13:42
0

While using a firmware TPM from Intel, the Endorsement Key gets tampered.

It could be caused by the TSS.NET library (which I doubt). Or it could be caused by the prototype itself which is requesting an RSA key somehow causing the alteration of the EK. Or the issue could lie in the Firmware itself.

In any cases, the EK that I was using is not valid (it is a lot shorter -80 bytes- compared to a valid one) and I assume this is why the Dps is throwing the error.

Kzryzstof
  • 7,688
  • 10
  • 61
  • 108