When a user requires an AIK (Attestation Identity Key) the user wants its key to be certified by a CA (Certification Authority). The user through a TPM (Trusted Platform Module) sends three credentials: a public key credential, a platform credential, and a conformance credential. This set of certificates and cryptographic keys will in short be referred to as "EK". The EK can be split into two main parts, the private part "EKpr" and the public part "EKpub". The EKpr never leaves the TPM.