Search code examples
sha1ubuntu-20.04tpm

Does TPM2.0 supports SHA1 algorithm?


We have Dell EMC PowerEdge R740 machine with Ubuntu 20.04 OS. This machine has Trusted Platform Module(TPM)2.0. When we try to clear TPM or take TPM Ownership, we are getting error. It has required PCRs for TPM provisioning.

By default SHA1 is enabled in advance settings of bios. SHA1 is also supported as per this Dell document - https://www.dell.com/support/manuals/en-in/poweredge-r740xd2/per740xd2_bios_pub/system-security-settings-details?guid=guid-46361969-bb8d-4bdc-bd8c-ed63d4f0ae26&lang=en-us

Is SHA256 mandatory for TPM2.0 ?


Solution

  • Yes, SHA256 PCRs must be supported.

    Since your title also asks about SHA1 - SHA1 is not mandatory as a PCR algorithm (although it is mandatory for other features and deprecated, i.e. it will probably be removed in future specifications).

    As per the TCG PC Client Platform TPM Profile Specification for TPM 2.0, 4.6 PCR Requirements:

    A conformant TPM SHALL support SHA-384 (0x000C) and SHA-256 (0x000B). The TPM MAY support Hash algorithms

    For information about supported algorithms generally, see PC Client Algorithms.