How do reset SRK of TPM 2.0?

Question

I want to reset SRK. It can also be seen as a Factory Reset of the TPM.

I tried tpm2_clear but it doesn't work.

---

Machine: VMWare Workstation

# tpm2_getcap properties-variable
TPM2_PT_PERSISTENT:
  ownerAuthSet:              0
  endorsementAuthSet:        0
  lockoutAuthSet:            1
  reserved1:                 0
  disableClear:              0
  inLockout:                 0
  tpmGeneratedEPS:           1
  reserved2:                 0
TPM2_PT_STARTUP_CLEAR:
  phEnable:                  0
  shEnable:                  1
  ehEnable:                  1
  phEnableNV:                1
  reserved1:                 0
  orderly:                   0

# tpm2_clear -c p
WARNING:esys:src/tss2-esys/api/Esys_Clear.c:282:Esys_Clear_Finish() Received TPM Error
ERROR:esys:src/tss2-esys/api/Esys_Clear.c:97:Esys_Clear() Esys Finish ErrorCode (0x00000185)
ERROR: Esys_Clear(0x185) - tpm:handle(1):hierarchy is not enabled or is not correct for the use
ERROR: Unable to run tpm2_clear

In VMWare, phEnable is not set even after Cold-Start.

---

Machine: HP EliteBook 850 G5

~# tpm2_getcap properties-variable
TPM2_PT_PERSISTENT:
  ownerAuthSet:              0
  endorsementAuthSet:        0
  lockoutAuthSet:            1
  reserved1:                 0
  disableClear:              0
  inLockout:                 0
  tpmGeneratedEPS:           0
  reserved2:                 0
TPM2_PT_STARTUP_CLEAR:
  phEnable:                  1
  shEnable:                  0
  ehEnable:                  1
  phEnableNV:                1
  reserved1:                 0
  orderly:                   1

# tpm2_clear -c p
WARNING:esys:src/tss2-esys/api/Esys_Clear.c:282:Esys_Clear_Finish() Received TPM Error
ERROR:esys:src/tss2-esys/api/Esys_Clear.c:97:Esys_Clear() Esys Finish ErrorCode (0x000009a2)
ERROR: Esys_Clear(0x9A2) - tpm:session(1):authorization failure without DA implications
ERROR: Unable to run tpm2_clear

# tpm2_clear -c o
ERROR: Unexpected handle - TPM2_RH_OWNER
ERROR: Unknown or unsupported handle, got: "o"
ERROR: Cannot make sense of object context "o"
ERROR: Invalid lockout authorization
ERROR: Unable to run tpm2_clear

Is there any way SRK reset?

Answer 1

You're on the right track, tpm2_clear clears the owner hierarchy, that is the SRK and all its child keys.

According to the command specification (sec. 24.6) there are multiple reasons why tpm2_clear could fail.

1. The platform hierarchy is disabled

This error is quite subtle because it is not mentioned explicitly in the command description for TPM2_Clear. By default, TPM2_Clear operates on the platform hierarchy. However, the platform hierarchy can be disabled (phEnable bit clear) via the command TPM2_HierarchyControl:

tpm2_hierarchycontrol -C p phEnable clear

Any future use of the platform hierarchy should result in the return code TPM2_RC_HANDLE = 0x0000010B. However, there is no TPM command to re-enable the platform hierarchy. Architecture specification (Sec 13.3):

When phEnable is CLEAR, a _TPM_Init is required to SET it.

It seems you need to reset your TPM (toggling the hardware reset signal or power off) to re-enable the platform hierarchy.

If this does not solve your problem, see the next potential issue.

2. TPM2_Clear Command is disabled

This is probably not your problem, because it would yield another error (return code TPM_RC_DISABLED = 0x0000120).

The TPM2_Clear command can be disabled (disableClear bit set). This is done via the command TPM2_ClearControl. To enable clearing, call tpm2_clearcontrol -Cp c. Like tpm2_clear, tpm2_clearcontrol requires platform authorization.