Recommend X509. Create EK/SRK if not read.

Author: micahl

articles/iot-edge/how-to-create-iot-edge-device.md

@@ -138,21 +138,13 @@ To see more of the features of DPS, see the [Features section of the overview pa
 
 ## Choose an authentication method
 
-### Symmetric keys attestation
-
-Symmetric key attestation is a simple approach to authenticating a device. This attestation method represents a "Hello world" experience for developers who are new to device provisioning, or don't have strict security requirements.
-
-When you create a new device identity in IoT Hub, the service creates two keys. You place one of the keys on the device, and it presents the key to IoT Hub when authenticating.
-
-This authentication method is faster to get started but not as secure. Device provisioning using a TPM or X.509 certificates is more secure and should be used for solutions with more stringent security requirements.
-
 ### X.509 certificate attestation
 
-Using X.509 certificates as an attestation mechanism is the recommended way to scale production and simplify device provisioning. Typically, X.509 certificates are arranged in a certificate chain of trust. Starting with a self-signed or trusted root certificate, each certificate in the chain signs the next lower certificate. This pattern creates a delegated chain of trust from the root certificate down through each intermediate certificate to the final "leaf" certificate installed on a device.
+Using X.509 certificates as an attestation mechanism is the recommended way to scale production and simplify device provisioning. Typically, X.509 certificates are arranged in a certificate chain of trust. Starting with a self-signed or trusted root certificate, each certificate in the chain signs the next lower certificate. This pattern creates a delegated chain of trust from the root certificate down through each intermediate certificate to the final "leaf" certificate installed on a device. 
 
-You create two X.509 identity certificates and place them on the device. When you create a new device identity in IoT Hub, you provide thumbprints from both certificates. When the device authenticates to IoT Hub, it presents one certificate and IoT Hub verifies that the certificate matches its thumbprint.
+You create two X.509 identity certificates and place them on the device. When you create a new device identity in IoT Hub, you provide thumbprints from both certificates. When the device authenticates to IoT Hub, it presents one certificate and IoT Hub verifies that the certificate matches its thumbprint. The X.509 keys on the device should be stored in a Hardware Security Module (HSM). E.g. PKCS#11 modules, ATECC, dTPM, etc.
 
-This authentication method is more secure than symmetric keys and is recommended for production scenarios.
+This authentication method is more secure than symmetric keys and supports group enrollments which provides a simplified management experience for a high number of devices. This authentication method is recommended for production scenarios.
 
 ### Trusted platform module (TPM) attestation
 
@@ -164,6 +156,14 @@ TPM 2.0 is required when you use TPM attestation with the device provisioning se
 
 This authentication method is more secure than symmetric keys and is recommended for production scenarios.
 
+### Symmetric keys attestation
+
+Symmetric key attestation is a simple approach to authenticating a device. This attestation method represents a "Hello world" experience for developers who are new to device provisioning, or don't have strict security requirements.
+
+When you create a new device identity in IoT Hub, the service creates two keys. You place one of the keys on the device, and it presents the key to IoT Hub when authenticating.
+
+This authentication method is faster to get started but not as secure. Device provisioning using a TPM or X.509 certificates is more secure and should be used for solutions with more stringent security requirements.
+
 ## Next steps
 
 You can use the table of contents to navigate to the appropriate end-to-end guide for creating an IoT Edge device for your IoT Edge solution's platform, provisioning, and authentication requirements.

articles/iot-edge/how-to-provision-devices-at-scale-linux-tpm.md

@@ -54,8 +54,6 @@ A physical Linux device to be the IoT Edge device.
 
 If you are a device manufacturer then refer to guidance on [integrating a TPM into the manufacturing process](../iot-dps/concepts-device-oem-security-practices.md#integrating-a-tpm-into-the-manufacturing-process).
 
-This article assumes ownership of the TPM has been taken already and the endorsement key (EK) and storage root key (SRK) have been persisted. Follow the instructions relevant to your system to take ownership.
-
 # [Virtual machine](#tab/virtual-machine)
 
 A Windows development machine with [Hyper-V enabled](/virtualization/hyper-v-on-windows/quick-start/enable-hyper-v). This article uses Windows 10 running an Ubuntu Server VM.
@@ -143,6 +141,31 @@ After the installation is finished and you've signed back in to your VM, you're
 
 ---
 
+<!-- iotedge-1.4 -->
+:::moniker range=">=iotedge-1.4"
+
+### Install the TPM2 Tools
+   1. Sign in to your device, and install the `tpm2-tools` package.
+
+# [Ubuntu / Debian / Raspberry Pi OS](#tab/ubuntu+debian+rpios)
+
+
+      ```bash
+      sudo apt-get install tpm2-tools
+      ```
+
+# [Red Hat Enterprise Linux](#tab/rhel)
+
+
+      ```bash
+      sudo yum install tpm2-tools
+      ```
+
+---
+
+:::moniker-end
+<!-- end 1.4 -->
+
 ## Retrieve provisioning information for your TPM
 
 <!-- 1.1 -->
@@ -174,42 +197,57 @@ In this section, you use the TPM2 software tools to retrieve the endorsement key
 > [!NOTE]
 > This article previously used the `tpm_device_provision` tool from the IoT C SDK to generate provisioning info. If you relied on that tool previously, then be aware the steps below generate a different registration ID for the same public endorsement key. If you need to recreate the registration ID as before then refer to how the C SDK's [tpm_device_provision tool](https://github.com/Azure/azure-iot-sdk-c/tree/main/provisioning_client/tools/tpm_device_provision) generates it. Be sure the registration ID for the individual enrollment in DPS matches the regisration ID the IoT Edge device is configured to use.
 
-# [Ubuntu / Debian / Raspberry Pi OS](#tab/ubuntu+debian+rpios)
-
-   1. Sign in to your device, and install the `tpm2-tools` package.
+   1. Run the script below to read the endorsement key, creating one if it does not already exist.
 
       ```bash
-      sudo apt-get install tpm2-tools
-      ```
-
-   1. Run the following commands to read the endorsement key in your TPM and generate a unique registration ID. This assumes the endorsement key is at the default location of 0x81010001.
+      #!/bin/sh
+      if [ "$USER" != "root" ]; then
+        SUDO="sudo "
+      fi
+
+      $SUDO tpm2_readpublic -Q -c 0x81010001 -o ek.pub 2> /dev/null
+      if [ $? -gt 0 ]; then
+        # Create the endorsement key (EK)
+        $SUDO tpm2_createek -c ek.ctx > /dev/null
+        $SUDO tpm2_evictcontrol -c ek.ctx 0x81010001 > /dev/null
+        $SUDO tpm2_readpublic -c 0x81010001 -o ek.pub > /dev/null
+        $SUDO tpm2_flushcontext -t > /dev/null
+
+        $SUDO tpm2_getcap handles-persistent >/dev/null | grep 0x81000001 > /dev/null
+        if [ $? -gt 0 ]; then
+          # Create a storage root key (SRK)
+          $SUDO tpm2_startauthsession --policy-session -S session.ctx > /dev/null
+          $SUDO tpm2_policysecret -S session.ctx -c 0x4000000B > /dev/null
+          $SUDO tpm2_create -C 0x81010001 \
+            -G rsa2048 \
+            -a 'restricted|decrypt|fixedtpm|fixedparent|sensitivedataorigin|userwithauth' \
+            -u srk.pub -r srk.priv \
+            -P session:session.ctx > /dev/null
+          $SUDO tpm2_flushcontext --transient-object > /dev/null
+
+          # store the key
+          $SUDO tpm2_startauthsession -S session.ctx --policy-session > /dev/null
+          $SUDO tpm2_policysecret -S session.ctx -c 0x4000000B > /dev/null
+          $SUDO tpm2_load -C 0x81010001 \
+            -u srk.pub -r srk.priv \
+            -P session:session.ctx \
+            -c srk.ctx > /dev/null
+
+          # make the SRK persistent
+          $SUDO tpm2_evictcontrol -c srk.ctx 0x81000001 > /dev/null
+
+          # clean up
+          $SUDO rm session.ctx srk.pub srk.priv srk.ctx ek.ctx 2> /dev/null
+        fi
+      fi
 
-      ```bash
-      tpm2_readpublic -Q -c 0x81010001 -o ek.pub
       printf "Gathering the registration information...\n\nRegistration Id:\n%s\n\nEndorsement Key:\n%s\n" $(sha256sum -b ek.pub | cut -d' ' -f1 | sed -e 's/[^[:alnum:]]//g') $(base64 -w0 ek.pub)
-      ```
-
-   1. The output window displays the device's **Endorsement key** and a unique **Registration ID**. Copy these values for use later when you create an individual enrollment for your device in the device provisioning service.
-
-# [Red Hat Enterprise Linux](#tab/rhel)
 
-   1. Sign in to your device, and install the `tpm2-tools` package.
-
-      ```bash
-      sudo yum install tpm2-tools
-      ```
-
-   1. Run the following commands to read the endorsement key in your TPM and generate a unique registration ID. This assumes the endorsement key is at the default location of 0x81010001.
-
-      ```bash
-      tpm2_readpublic -Q -c 0x81010001 -o ek.pub
-      printf "Gathering the registration information...\n\nRegistration Id:\n%s\n\nEndorsement Key:\n%s\n" $(sha256sum -b ek.pub | cut -d' ' -f1 | sed -e 's/[^[:alnum:]]//g') $(base64 -w0 ek.pub)
+      $SUDO rm ek.pub 2> /dev/null
       ```
 
    1. The output window displays the device's **Endorsement key** and a unique **Registration ID**. Copy these values for use later when you create an individual enrollment for your device in the device provisioning service.
 
----
-
 :::moniker-end
 <!-- end iotedge-1.4 -->
 

articles/iot-edge/how-to-provision-devices-at-scale-linux-x509.md

@@ -24,6 +24,9 @@ The tasks are as follows:
 
 Using X.509 certificates as an attestation mechanism is an excellent way to scale production and simplify device provisioning. Typically, X.509 certificates are arranged in a certificate chain of trust. Starting with a self-signed or trusted root certificate, each certificate in the chain signs the next lower certificate. This pattern creates a delegated chain of trust from the root certificate down through each intermediate certificate to the final "leaf" certificate installed on a device.
 
+> [!TIP]
+> If your device has a Hardware Security Module (HSM) such as a TPM 2.0, then we recommend storing the X.509 keys securely in the HSM. Learn more about how to implement the zero-touch provisioning at scale described in [this blueprint](https://azure.microsoft.com/en-us/blog/the-blueprint-to-securely-solve-the-elusive-zerotouch-provisioning-of-iot-devices-at-scale) with the [https://aka.ms/iotedge-tpm2cloud](https://aka.ms/iotedge-tpm2cloud) sample.
+
 ## Prerequisites
 
 <!-- Cloud resources prerequisites H3 and content -->