---
# System prepended metadata

title: TPM Device enrollment

---

# TPM Device enrollment

This define the Steps to enroll a new device on Pantahub Using the TPM to ensure that the device will run always a version that hasn't been modificated by other source more that pantavisor.

This is separeted in two big enrollments, the IDevID enrollment that is a process to identify the device and the TPM

More details on this here: [TCG_Guidance_for_Securing -- Identity for Attestation](https://trustedcomputinggroup.org/wp-content/uploads/TCG_Guidance_for_Securing_NetEq_1_0r29.pdf)

## Client Variables

```

PEN_OID=1.3.6.1.4.1                                              
PH_OID=${PEN_OID}.54621                                                            
PH_OWNERPRN_OID=${PH_OID}.100.1
PH_HMAC_OID=${PH_OID}.100.2
PH_TOKEN_ID_OID=${PH_OID}.100.3
PH_CERTIFY_ATTEST_OID=${PH_OID}.100.4
PH_CERTIFY_SIG_OID=${PH_OID}.100.5
PH_QUOTE_ATTEST_OID=${PH_OID}.100.6
PH_QUOTE_SIG_OID=${PH_OID}.100.7
PH_QUOTE_PCR_OID=${PH_OID}.100.8
PH_DEVICE_PRN_OID=${PH_OID}.100.9

EK_NV=0x1c00002
AIK_NV=0x1c00003
IDEVID_NV=0x01C90000
LDEVID_NV=0x01C90001
EK_HANDLE=0x81010001
AK_HANDLE=0x81010002
IDEVID_HANDLE=0x81020001
LDEVID_HANDLE=0x81020002

PCRLIST=${PCRLIST:-sha256:0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16}
```

## IDevID Enrollment


![IDevID Enrollment Diagram](https://www.websequencediagrams.com/cgi-bin/cdraw?lz=dGl0bGUgSURldklEIEVucm9sbG1lbnQKCkRldmljZS0-QUNBOgAOCyBwYXlsb2FkIElBSyBjZXJ0aWZpY2F0ZSAKQUNBLT4AMAY6IEFDQSBTaWduZQAjBkMAHgtlbmNyeXB0ZWQAVQ5TZW5kAIEBBy5jc3IASQYAeAVWYWxpZGF0AIEdCShzZXZlcmFsIHN0ZXBzKQBzBlBIX0FQSQAiCwCBOgYgT3duZXJzaGlwCgAcBgCBSgcAFwdpcwBYBj8ANw5SZWdpc3RlciBOZXcAQQhXaXRoAIIhBwBCCUNBOgCBTg1SZXF1ZXN0ACYGQ1NSCgCBDgwAGw5zcG9uc2UgREVSIG9uIEJBU0U2NACBGgkAKglyZQCBQAtpbiBEQgCBOQ4AglsIAIM5BmFuZACBbwhQAIMgBgCDBw4Ag18HAIMqDChzZXJpYWxOdW1iZXIgPT0AgjAHSUQpCg&s=earth)


Device->ACA: [Enroll Payload IAK certificate](https://hackmd.io/x_DsA0WuRfq6kHj7MDryug#Enroll-Payload-IAK-certificate)
ACA->Device: [ACA encrypted IAK Certificate](https://hackmd.io/x_DsA0WuRfq6kHj7MDryug#ACA-Signed-IAK-Certificate)
Device->ACA: [Send IDevID.csr](https://hackmd.io/x_DsA0WuRfq6kHj7MDryug#Send-IDevIDcsr)
ACA->ACA: [Validate IDevID.csr](https://hackmd.io/x_DsA0WuRfq6kHj7MDryug#Validate-IDevIDcsr)
ACA->PH_API: [Validate Device Ownership](https://hackmd.io/x_DsA0WuRfq6kHj7MDryug#Validate-IDevIDcsr)
PH_API->ACA: [Ownership is valid ?](https://hackmd.io/x_DsA0WuRfq6kHj7MDryug?both#Ownership-is-valid)
ACA->PH_API: [Register New Device With IDevID](https://hackmd.io/x_DsA0WuRfq6kHj7MDryug?both#Register-New-Device-With-IDevID)
PH_API->CA: [Certificate Request With CSR](https://hackmd.io/x_DsA0WuRfq6kHj7MDryug?both#Certificate-Request-With-CSR)
CA->PH_API: [Certificate Response DER on BASE64](https://hackmd.io/x_DsA0WuRfq6kHj7MDryug?both#Certificate-Response-DER-on-BASE64)
PH_API->PH_API: [Create Device in DB - if not exists.](https://hackmd.io/x_DsA0WuRfq6kHj7MDryug?both#Create-Device-in-DB---if-not-exists)
PH_API->ACA: [Signed IDevID and Device Payload](https://hackmd.io/x_DsA0WuRfq6kHj7MDryug?both#Signed-IDevID-and-Device-Payload)
ACA->Device: [IDevID certificate (serialNumber == DeviceID)](https://hackmd.io/x_DsA0WuRfq6kHj7MDryug?both#IDevID-certificate-serialNumber--DeviceID)
