debian - 在没有所有者密码的情况下清除 TPM

Question

我想使用通过 CryptoCape 启用 TPM 的 BeagleBone Black .

我正在关注this tutorial由于其合规模式，我可以在某种程度上清除 TPM。

当我运行tpm_clear -l debug时，系统提示我输入所有者密码，但我不知道该密码。这样，我收到了身份验证失败消息，但我没有成功。

tpm_clear -l debug
Tspi_Context_Create success
Tspi_Context_Connect success
Tspi_Context_GetTpmObject success
Enter owner password: 
Tspi_GetPolicyObject success
Tspi_Policy_SetSecret success
Tspi_TPM_ClearOwner failed: 0x00000001 - layer=tpm, code=0001 (1), Authentication failed
Tspi_Context_FreeMemory success
Tspi_Context_Close success

有人知道如何在没有所有者密码的情况下执行此操作吗？

Answer 1

不知道所有者密码将需要 physical presence在主机平台上断言:

An example of an implementation of the hardware method is a button on the front of the platform wired to a pin on the TPM. Pressing the button causes the pin to change the polarity and would cause the TPM to set its internal physical presence flag. Using this hardware method, commands requiring the indication of physical presence could be executed at any time (in the pre OS environment or from the OS environment) as long as the button were pressed.

Providing a wire along with a button or switch to the outside of the platform is not feasible in some cases due to cost, form factor, usage, or other issues. For this reason, a second method of asserting physical presence called the “command method” is defined. For the command method, firmware presents a user interface (UI) to explain the operation that has been requested. A physically present user confirms or rejects the operation by pressing a key on the keyboard. The command method then authorizes the TPM command to be sent to the TPM. No further check for physical presence is done in the TPM. The TPM performs the TPM operation if the user confirmed it through the UI.

查找主板上的硬件按钮，希望有。如果没有，CryptoCape可能支持命令方法，但我不太熟悉，无法说出如何支持。