Protecting systems with the TPM [LWN.net]

Protecting systems with the TPM

Posted Feb 10, 2016 22:19 UTC (Wed) by mjg59 (subscriber, #23239)
In reply to: Protecting systems with the TPM by luto
Parent article: Protecting systems with the TPM

Most recent hardware TPMs have a certificate chain tying their EK back to the manufacturer, and Windows 10 requires it. The easiest way to avoid DRM is to simply attach a second genuine TPM post-boot and program whatever PCR values you want, and then get that to perform the quote.

You can perform a dance around the EK to verify that you're communicating with the TPM that you think you are, and once that's established you can get it to certify that it controls a key. That should be sufficient - generate a non-migrateable key, get the TPM to certify it, seal the secret with it. Next time round, hand over the encrypted key blob, ensure that you get back a certification signed by the same EK, hand over the encrypted secret and ask for it to be unsealed.

to post comments

Protecting systems with the TPM

Posted Feb 10, 2016 23:39 UTC (Wed) by luto (subscriber, #39314) [Link] (1 responses)

> That should be sufficient - generate a non-migrateable key, get the TPM to certify it, seal the secret with it. Next time round, hand over the encrypted key blob, ensure that you get back a certification signed by the same EK, hand over the encrypted secret and ask for it to be unsealed.

Is this secure against a MITM between host and TPM? The unsealed secret is protected by the authorization session, but there's so much gobbledygook and semi-home-brewed crypto in the authorization session stuff that I can't tell whether a MITM would have to know the authorization key, know the SRK, both, or neither.

If I actually trusted trousers at all, I would care as much about this issue.

Protecting systems with the TPM

Posted Feb 10, 2016 23:49 UTC (Wed) by mjg59 (subscriber, #23239) [Link]

Mm. Yeah, I don't think there's a good way to ask the TPM to certify that what appears to be a sealed blob was encrypted by the TPM. I think anyone on the LPC bus could probably MITM that while leaving the rest of the validation correct. I'll look into that some more.