Project Description

Currently a key rotation via fdectl regenerate-key is used to revoke all released tpm2 sealed keys. However the procedure can be a bit risky as the result to change key slots. Using tpm2 policynv may provide better approach in this regard given a counter or timestamp can be matched to validate tpm keys before using it.

Goal for this Hackweek

  1. Write a POC of using policynv in the session of authorized PCR policy to validate a sealed key
  2. Make pcr-oracle able to create nv index and use policynv to authorize keys against counter or timestamps in the index
  3. Make policynv support in grub and it's tpm2 protector can use it in the key unsealing process
  4. If it is ok, fde-tools may use it as another method to invalidate old keys to prevent rollback attack


  1. unattended boot with tpm 2.0
  2. tpm2-policynv

Looking for hackers with the skills:

Nothing? Add some keywords!

This project is part of:

Hack Week 23


  • 7 months ago: epaolantonio liked this project.
  • 7 months ago: wfrisch liked this project.
  • 8 months ago: michael-chang started this project.
  • 8 months ago: michael-chang originated this project.

  • Comments

    Be the first to comment!

    Similar Projects

    This project is one of its kind!