NV (UWP) : TbsCommandBlocked

[jfa-ing]

Hi!
Everything is working in administration mode but for the NV (UWP) project the result is always:
"TPM exception occurred: TbsCommandBlocked"
Even in the Visual Studio "administration" mode!

So how to use it in standard mode?
Yes with the simulator connection (tpmDevice = new TcpTpmDevice("127.0.0.1", 2321);), this project is working.
Is there a way to use TPM in a UWP application (for Microsoft store)?
Or I forgot something...

[RonaldAi]

Hi!
Yes, the TPM driver blocks certain commands based on the context from which the command is sent.
One of the cases where commands are blocked is NV manipulation of indices that are assigned to the owner hierarchy. The intention is to prevent apps from manipulating indices that are used by Windows.
For UWP apps: you can link your app against the TSS.Net library. However, the TSS.Net lib eventually accesses the TBS API, which may fail the approval process when publishing to the Windows Store.
Hope that helps.

[jfa-ing]

Thank you RonaldAi,
You said that I can use others TMP API available in a standard UWP application.
But why this NV (UWP) sample provided implement a code that is not possible to run?
I do not understand that, and all the others samples needs to be in an administrator rights... that is far from a UWP standard application... is'nt it? What do you think?

[RonaldAi]

Sorry, I meant to say that you can use TSS.MSR to write a UWP app. (TSS.Net was the old, internal name of TSS.MSR.)
Some TPM commands should work from UWP applications.
I'm not sure about the requirement for administrator rights. It's been a while since I tried to write a UWP app that uses the TPM directly. Usually UWP apps would use other APIs, such as https://docs.microsoft.com/en-us/windows/uwp/security/cryptography
Hope that helps.

[jfa-ing]

Uwp security cryptography is the way to encrypt, but if I want to encrypt with TPM hard link, I need the TSS.MSR project.
But when I run this project as is, the NV (UWP) does not work (and will never work if it needs more rights!).
Administrator rights are required by this project to use the TPM API (without the simulator) for all other examples included in this TSS.MSR. So that's what I'm talking about rights.
In summary, "how to use TPM in a standard UWP application directly (without specific rights)?"
I don't understand why this project included the NV (UWP) example if it is not working.

[RonaldAi]

You can use TSS.MSR in non-UWP apps.

[jfa-ing]

"You can use TSS.MSR in non-UWP apps."
Thanks RonaldAi! I know, all non UWP sample applications included seems to work. Except that they need administrator rights... and my goal is to secure a UWP payment application... so the NV (UWP) could be a interesting way to link with the TPM to the hardware to insure a higher level of security protection.
But with this sample NV (UWP) included in this project and could not work... finally it was not the way to implement a more secured UWP application.