Protecting systems with the TPM [LWN.net]

Protecting systems with the TPM

Posted Feb 10, 2016 12:24 UTC (Wed) by jem (subscriber, #24231)
Parent article: Protecting systems with the TPM

In other words, the TPM is worse than the CPU in every single way, so why do manufacturers bother installing them in so many machines? Answering that question was the focus of much of the rest of the talk. A core feature of a TPM is the platform configuration registers, or PCRs.

I would say the core feature of the TPM, or at least why it is implemented as a separate piece of hardware, is that it focuses on "doing one thing, and doing it well". A TPM is not a general purpose computer, but a combination of custom software and specialized hardware whose raison d'être is to keep secrets (encryption keys) safe and to be able to operate on data using the stored secrets using a narrow and well-defined interface.

The chips used in TPMs are not off-the-shelf microcontrollers. They are designed to be as tamper proof as possible and typically contain special hardware to accelerate cryptographic operations.

Of course, nothing is perfect and every claim should be met with a healthy dose of scepticism, but I think the TPM wins in comparison with the huge attack surface of the kernel.

to post comments

Protecting systems with the TPM

Posted Feb 11, 2016 23:40 UTC (Thu) by dlang (guest, #313) [Link] (6 responses)

> The chips used in TPMs are not off-the-shelf microcontrollers. They are designed to be as tamper proof as possible and typically contain special hardware to accelerate cryptographic operations.

you missed this section of the article.

> Some TPMs are minimal in functionality and slow, while others are essentially ARM cores running at several hundred MHz.

I'll bet that they are far closer to the off-the-shelf chips than you would like to think.

Protecting systems with the TPM

Posted Feb 12, 2016 8:14 UTC (Fri) by jem (subscriber, #24231) [Link] (5 responses)

> > Some TPMs are minimal in functionality and slow, while others are essentially ARM cores running at several hundred MHz.

>I'll bet that they are far closer to the off-the-shelf chips than you would like to think.

The TPM chips should be able to detect and resist all kinds of physical attacks, including altering the supply voltage, voltage spikes, light, dissolving with acid etc. The chips may contain up to dozens of special hardware security features like sensors, shields and obfuscation of the circuitry. Protection against Differential Power Analysis, which involves both hardware and the chips firmware, is also important. As I mentioned earlier, the TPM chips typically also contain hardware blocks to accelerate crypto operations like RSA and AES. On the other hand, the chips should be stripped of all unnecessary hardware features, especially I/O blocks.

These requirements mean that these chips have totally different part numbers than the off-the-shelf microcontrollers. Data sheets are available only on request, and these parts are not for sale to the public on Digi-Key. There is no reason, however, that these chips can't have a CPU core implementing a well known instruction set, like ARM or 8051. It might even be an advantage because of better (less buggy) tooling.

You can, of course, program a run-off-the-mill microcontroller to behave like a TPM chip. However, note that there is a certification program for these products and you would have a hard time getting your design pass evaluation.

https://www.trustedcomputinggroup.org/certification/certi...

Protecting systems with the TPM

Posted Feb 12, 2016 13:07 UTC (Fri) by ksandstr (guest, #60862) [Link] (4 responses)

>The chips may contain up to dozens of special hardware security features like sensors, shields and obfuscation of the circuitry.

Why would the mass-market TPM in Joe Random's laptop be this ludicrously high-tech? Most likely a discrete component will have been manufactured in China[0] using masks generated years ago from a design originally produced for generic purposes, and packaged in el cheapo 28-pin BGA just like everything else that's got very modest thermal requirements.

As a reminder, about a decade ago the plan was that from the second generation on, TPMs would be integrated into motherboard chipsets, e.g. the south bridge, to save on costs and to put Hollywood's Bespoke Magic behind the hardware veil. Certainly a dormant functional block in a mandatory chipset is cheaper than having a specially-wired bus and an extra package on the actual board just to add a feature which no-one uses.

Consequently the best way to hack a TPM is to build one, or to wield real-world power over people who do. Given that this is the case, and has been for a dog's lifetime, the avenues of compromise that're cost-effective to guard against will be at the other end of the TPM-to-CPU bus. Other solutions don't make economic sense given that software running on the CPU is always the first thing to suffer compromise -- as in various "born secure" game consoles, where manufacturer controls are overridden by microcontrollers hooked up to a USB port and CPLD gadgets hot-glued to the motherboard.

[0] complete with the chinese manufacturer's own backdoor, and a backdoor for every layer of China's security establishment

Protecting systems with the TPM

Posted Feb 12, 2016 18:41 UTC (Fri) by jem (subscriber, #24231) [Link] (3 responses)

> Why would the mass-market TPM in Joe Random's laptop be this ludicrously high-tech?

Maybe because otherwise the manufacturer wouldn't be allowed to call it Trusted Platform Module? Besides, Joe Random's mass-market laptops rarely contain TPMs, they are more likely to be found in high-end business laptops and servers.

TPMs are closely related to smartcard chips and a lot of the groundwork has been done already. Smart card chips have been used for years in Id cards, payment cards, phone SIMs, TV set top box smart cards, so these "ludicrously high-tech" chips are in fact mass-market products at this stage, and are not overly expensive anymore.

Protecting systems with the TPM

Posted Feb 13, 2016 2:00 UTC (Sat) by dlang (guest, #313) [Link] (2 responses)

please show the requirements for all the fancy features you outlined, and where to read the testing regime that proves that they live up to all these esoteric corner cases.

given the vulnerabilities that we are seeing in such systems (rm -rf / deltes everything on the TPM for example), I really doubt if there is the certification process you think exists.

Protecting systems with the TPM

Posted Feb 13, 2016 5:29 UTC (Sat) by mjg59 (subscriber, #23239) [Link]

> rm -rf / deltes everything on the TPM for example

rm --no-preserve-root / will delete all the runtime-accessible UEFI variables on a system, but it won't touch the TPM in any way

Protecting systems with the TPM

Posted Feb 18, 2016 3:04 UTC (Thu) by rahvin (guest, #16953) [Link]

In case you didn't get it from the previous reply. You are confusing UEFI and TPM. They are separate, sort of like confusing boats and trains, not the same thing at all.