Clearing TPM: How to Remove Stored Keys for a New OS?

What is TPM?

TPM is a dedicated microcontroller that provides hardware-based security features, including:

• Secure Boot: Verifies the authenticity of the bootloader and operating system.
• BitLocker Drive Encryption: Protects data stored on the hard drive.
• Secure Boot for UEFI: Secures the boot process for UEFI-based systems.
• Secure Remote Access: Allows secure remote access to systems.

Stored Keys in TPM

The TPM stores various cryptographic keys, including:

• Platform Configuration Registers (PCRs): Stores cryptographic hashes of system components and configurations.
• Endorsement Key (EK): Unique key generated during the manufacturing process.
• Owner Authorization Key (OAK): Used to authorize other keys and perform certain TPM operations.
• Platform Key (PK): Used to sign and verify platform measurements.

Removing Stored Keys

When upgrading to a new operating system, you might want to remove stored keys from the TPM for various reasons, such as:

• Privacy concerns: You might not want your old keys to be accessible to the new operating system.
• Security reasons: You might want to start fresh with new keys.

Using TPM Utilities

To remove stored keys from the TPM, you can use various TPM utilities, such as:

• TPM 2.0 Toolkit: A free and open-source TPM toolkit that supports TPM 1.2 and TPM 2.0.
• Microsoft TPM Management Tool: A tool provided by Microsoft for managing TPM on Windows systems.

Using TPM 2.0 Toolkit

To remove stored keys using TPM 2.0 Toolkit, follow these steps:

1. Install TPM 2.0 Toolkit on your system.
2. Run the following command to list the keys in the TPM:

tpm2_list --owner-auth

3. Identify the key to be removed by its handle.
4. Run the following command to delete the key:

tpm2_evictcontrol --owner-auth --handle  --delete

Replace

Using Microsoft TPM Management Tool

To remove stored keys using Microsoft TPM Management Tool, follow these steps:

1. Open Microsoft TPM Management Tool.
2. Select the TPM device from the list.
3. Click on the "Keys" tab and identify the key to be removed.
4. Right-click on the key and select "Delete Key."

Summary

In this article, we discussed how to remove stored keys from the TPM when upgrading to a new operating system. We covered what TPM is, the types of keys stored in it, and how to remove keys using TPM 2.0 Toolkit and Microsoft TPM Management Tool. Remember that removing keys can have privacy and security implications, so make sure you understand the consequences before proceeding.