Digging around, I realized that cr50 doesn't support PolicyPassword but does PolicyAuthValue which is better (HMAC).
From first sight, it seems that it could be a direct replacement, where current tpmr calls for tpm DUK were a direct translation of pcr+auth that took PolicyPassword just because it was available in full tpm2 stack.
It seems that switching for PolicyAuthValue would be a direct translation while supporting cr50 (skylake) while also newer ti50 (meteorlake).
If it is not breaking tpm2 current implementation, that would permit support of chromebooks reduced tpm2 support.
To be implemented and tested.
Digging around, I realized that cr50 doesn't support PolicyPassword but does PolicyAuthValue which is better (HMAC).
From first sight, it seems that it could be a direct replacement, where current tpmr calls for tpm DUK were a direct translation of pcr+auth that took PolicyPassword just because it was available in full tpm2 stack.
It seems that switching for PolicyAuthValue would be a direct translation while supporting cr50 (skylake) while also newer ti50 (meteorlake).
If it is not breaking tpm2 current implementation, that would permit support of chromebooks reduced tpm2 support.
To be implemented and tested.