Questions on fdo-owner-tool

[rprakashg-redhat]

Device manufacturer would use fdo-owner-tool to perform device initialization and create ownership voucher for device?

initialize-device command takes device-id as arg, how is the device_id generated?
Does the initialize device need to be run in the device?
I was under the impression that the device credentials can be written on to the TPM. Here it seems like we are specifying a directory path. Don't we have to make sure device credentials are securely stored on the device.

[nullr0ute]

See the #587 ticket for details of what needs to be done for TPM, the support for creating or reading credentials in tpms is still outstanding

When the support was first created the tpm standard didn't exist so the credentials were stored on disk and (I believe - @puiterwijk can confirm) were signed by the tpm. Now there is a standard, but no one has yet implemented either the reading the standardised format, or writing as part of manufacturing, the new standardised format.

[runcom]

Device manufacturer would use fdo-owner-tool to perform device initialization and create ownership voucher for device?

initialize-device command takes device-id as arg, how is the device_id generated? Does the initialize device need to be run in the device?

this part of the flow, unfortunately, isn't even covered by the normative fdo spec and hence left to manufacturers/oems to figure out, which causes this kind of tricky situations - the owner-tool itself isn't meant (at all if you ask me) to be run by manufacturers to generate credentials and vouchers but it's meant, for now, as a debugging tool.
The "flow" implemented instead relies on the manufacturing-client being run early when manufacturers provision their devices (in bulk I think). In Fedora IoT, a similar flow is implemented by using the simplified-provisioner which is just dd (coreos-installer) with a subsequent call to the manufacturing server (though the manufacturing client) in order to generate credentials on the provisioned device on one hand, and a voucher on the manufacturing server storage. This is more or less documented here https://docs.fedoraproject.org/en-US/iot/fdo-the-process-of-device-onboarding/

[runcom]

If you want to follow what's happening, here's the link to the TPM proposal in the fdo spec too https://fidoalliance.org/specs/FDO/securing-fdo-in-tpm-v1.0-rd-20231010/securing-fdo-in-tpm-v1.0-rd-20231010.html

[rprakashg-redhat]

So today when the device is initialized, where is the device credentials stored?