tpm2-software
How to execute tpm2_changeeps
I have more of a question, and that is how can I run tpm2_changeeps. It always tells me that I have no authorization, or that it is wrong, and I can also run tpm2_changeauth on the plaform hierarchy. My question now is, is there any way to run it? (And if it works with other programs, e.g. with a UEFI application that uses the tcg2 protocol (in uefi shell))
@botellum what is the error message you are receiving when you execute tpm2_changeeps with the auth value you did define with tpm2_changeauth?
@botellum what is the error message you are receiving when you execute
tpm2_changeepswith the auth value you did define withtpm2_changeauth?
tpm2_changeauth doesnt work for me, it says that the auth value is wrong. I know that the auth value is being set at boot by the firmware, but is there any way to still execute a ChangeEPS command? (UEFI Applications or something like that)
Anyway here's the error message I receive when I try to do anything with platform auth: It always says the following if I either try to do something with platform auth or set its auth (phEnable is 1):
WARNING:esys:src/tss2-esys/api/Esys_HierarchyChangeAuth.c:309:Esys_HierarchyChangeAuth_Finish() Received TPM Error ERROR:esys:src/tss2-esys/api/Esys_HierarchyChangeAuth.c:114:Esys_HierarchyChangeAuth() Esys Finish ErrorCode (0x000009a2) ERROR: Esys_HierarchyChangeAuth(0x9A2) - tpm:session(1):authorization failure without DA implications ERROR: Unable to run tpm2_changeauth
@botellum sorry i thought that you could change the auth value of the platform hierarchy because you wrote:
I can also run tpm2_changeauth on the plaform hierarchy
The remaining possibilities are described in: https://github.com/tpm2-software/tpm2-tools/issues/3183#issuecomment-1372380251
@botellum sorry i thought that you could change the auth value of the platform hierarchy because you wrote:
I can also run tpm2_changeauth on the plaform hierarchy
The remaining possibilities are described in: #3183 (comment)
I can clear my tpm module using platform auth but what is that gonna do ?
Endorsement seeds can only be changed through a firmware update on a real TPM. This is not a normal event and the manufacturer will need to re-certify all the resulting endorsement keys. In a normal scenario, you can only change the authorization for the endorsement hierarchy. That said, the command may work on the sims.
You might want to try the ACPI command defined in the TCG Physical Presence Interface Specification, if it is implemented by your firmware. But as idesai said, you will lose the manufacturer-certified EK and probably never get it back.
