EK Cert shall be provisioned with both RSA2048 and ECP384

[mxu9]

In EK Credential Spec v2.3 Section 2.2.1.5: For TPMs designed to meet Windows [22], the High Range can be used for additional RSA 2048 or ECC NIST P256 keys, but the first RSA 2048 and ECC NIST P256 key MUST be provisioned in the Low Range.
It means EK Cert of RSA2048 is mandatory.

But in EK Credential Spec v2.4 Section 2.2.1.4: NOTE 2: Earlier versions of this specification (V2.1 - V2.3) required that for TPMs designed to meet a specific operating system, the low range had to be used for the RSA 2048 EK and the ECC NIST P256 EK. This has been removed as of version 2.4. The reader should consult their respective operating system requirements.

To be compatible with both rev 2.3 and rev 2.4, EK of RSA2048 and ECP384 shall be both provisioned.

[jyao1]

Should we use RSA3072 and ECP384 ? Otherwise it is NOT CNSA compliance.