Q:

Symmetric Keys for a TPM

I am currently researching the capabilities of TPM in creating and storing different kinds of cryptographic keys. I know that a TPM can create and store keys for asymmetric algorithms like RSA or elliptic curves. But what about symmetric keys, like those generated as session keys? Can a TPM create and store those as well? 
I found sources in the internet claiming both possible answers to be true. One source says that a TPM cannot handle symmetric cryptography and additional technology is necessary here. Meanwhile the documentation of the TPM library by the trusted computing group refers to some symmetric key operations, indicating that a TPM just might be able to handle them like their asymmetric counterpart. What is the truth?

A:

TPMs can seal arbitrary data. When you seal a key, you are not actually storing it inside the TPM. You are sending the raw key to the TPM which encrypts it with an internally protected key (the Storage Root Key, or SRK) and returns the encrypted, or sealed, blob. It is up to you to store this encrypted blob.

