Trusted Platform Module (TPM) and other protocols and components of trust in a computer or computer network

learn more… | top users | synonyms

0
votes
0answers
25 views

Kernel-based integrity measurement of an operating system startup in RAM

This idea is based on the Integrity Measurement Architecture and the usage of a trusted platform module to ensure the integrity of boot procedures. Let's say we have a kernel designed for an embedded ...
1
vote
1answer
33 views

Difference between TMP, TEE and SE

What is the difference between a Secure Element (SE), a Trusted Execution Environment (TEE) and a Trusted Platform Module (TPM)? I understand that they all refer to an external secure ...
0
votes
0answers
25 views

Decrypting keys wrapped by the Storage Root Key (SRK) of a TPM

Lets say I have a symmetric key wrapped with a storage root key (SRK) in a TPM. The SRK cannot be read by an attacker and so I perform the decryption and using the SRK and get the symmetric key in ...
2
votes
1answer
53 views

Is TPM ownership required for secure boot or measured boot?

I know: Secure Boot - can use the TPM Measured Boot - must use the TPM Can anyone intimately familiar with these processes explain if any TPM owner-authorized commands are required or used in ...
0
votes
0answers
40 views

What is the market acceptance of ARM trustzone vs standalone TPM?

ARM are keen on marketing their Trustzone features, in a secure implementation (e.g. with OTP memory/fuses), to establish a TEE on an SOC. Generally, what is the market view on the security of this ...
0
votes
0answers
31 views

Is it OK to seal data to TPM SRK directly?

In reviewing various TPM programs and libraries, I have noticed that when sealing data to the TPM, a new key is always created (wrapped by the SRK), and that new key is loaded and used in the seal ...
0
votes
1answer
42 views

tpm sealing and secure boot

I have worked with TPM for a while, and I'm interested in some of its features. Especially sealing and the use of TPM's PCRs in the secure boot process. My question is: What is stopping an attacker ...
0
votes
0answers
35 views

TPM based authentication without a trusted third party

Consider a scenario - Device manufacture provides in advance the TPM’s endorsement key certificate(containing EK public key) for device to be deployed. In general, what are the TPM operations that ...
0
votes
0answers
37 views

In practice, does TPM SRK really be decrypted by EK first, before it decrypt its child keys

I know that TPM SRK was generated when user take TPM ownership, and it is encrypted by EK public part. All the child keys under SRK need to be loaded into TPM and decrypted by SRK before use. (These ...
2
votes
1answer
97 views

What, or who, exactly is a Certificate Authority (CA) for TPM attestation?

I'm learning about and researching the Trusted Platform Module (TPM) to incorporate into a solution involving remote machines. As I understand it: all attestation methods (AIK, DAA) still require ...
3
votes
0answers
35 views

how to create TPM_AUTHDATA as input in tpm commands ?

I'm writing my first program which use tpm (version 1.2) services in Windows 7 using TBS, in this program I'm trying to execute the TPM_CreateWrapKey command. I noticed that many commands like the ...
3
votes
1answer
140 views

Securely read encryption key from NVRAM of TPM 1.2

I have configured a disk encryption in linux using LUKS with TPM with secure boot. The encryption key is loaded from TPM from NV memory using command TPM_NV_ReadValueAuth. The problem is that it is ...
3
votes
0answers
51 views

How can one protect TPM firmware from tampering?

I know that a TPM includes ROM, nonvolatile (e.g. EEPROM), and volatile (e.g. SRAM) memories. The executable firmware is stored in ROM, such as various drivers and commands. But this time, I want to ...
4
votes
0answers
87 views

Issues/Vulnerabilities that TPM 2.0 aims to enhance/solve comparing to TPM 1.2

I have read some documents that comparing TPM 1.2 and TPM 2.0 (e.g. more supported algorithms like SHA-2, reduced code size, or even symmetric keys seems added, etc.) I want to ask that what are the ...
2
votes
1answer
390 views

Is there are any mechanism available in Android platform for remote attestation?

I recently read about PC/Desktops which comes with TPM chips which is used for remote attestation. So following are my questions: Does any Android smartphone comes with TPM chip? Is there any way ...
3
votes
1answer
75 views

Can a TPM storage key used to generate encrypt leaf key (child key) if it is stored outside TPM?

In a TPM, if I create a storage key by Storage Root Key (SRK) and store it outside TPM (migratable), the SRK can be its parent key to encrypt it. If the storage key is generated by SRK and then ...
3
votes
1answer
185 views

Can TPM “Storage Keys” be created outside the TPM?

I am interested in 'adding' preexisting keys to a TPM's storage hierarchy. An example of a desired key hierarchy can be shown as: (SRK)----->(User Storage Key)-------> User Working Key 1 ...
0
votes
0answers
326 views

TPM Command Line Tools

I am trying to create a key storage hierarchy on TPM (Trusted Platform Module) on Linux (CentOS 6.4). The most commonly recommended TPM tool suite on Linux is TrouSerS. However, the command line suite ...
5
votes
1answer
510 views

TPM: signing key or Attestation Identity Key?

I am dealing with the TPM right now and do not get why there is a need for an extra signing key. Instead one could use one of the Attestation Identity Keys (AIKs) for signing as well?! Using different ...
1
vote
1answer
83 views

TPM - number of AIKs and signing key [closed]

I try to learn a bit about the TPM and have a few questions I could not solve by myself. There are some privacy concerns about using the EK for identifying a TPM. I do not get these privacy ...
2
votes
1answer
384 views

Loading code securely in the Trusted Execution Environment (ARM)

I am reading up on TEE in ARM. I am looking for pointers for the following questions: How does the TEE load code from the OS securely and guarantee that its not malicious code? I am guessing the ...
3
votes
1answer
146 views

TPM support with OpenSSL FIPS Object Module

How can I use a TPM chip along with the OpenSSL FIPS Object Module without modifying OpenSSL FIPS Object Module (to avoid Private Label certification)? Should we add an engine interface in OpenSSL ...
1
vote
1answer
575 views

Encrypting a symmetric key or Small File using TPM and Windows (TBS?)

I'm looking at encrypting a small (500bytes) file using the TPM. This is either doing assymetric encryption with the TPM directly, or using the TPM to store a symmetric key for decryption. This needs ...
2
votes
2answers
218 views

Is there a technical survey report related to BitLocker and TPM?

I want to understand the technical aspect of BitLocker and TPM, especially with Startup PIN. Does anyone know a technical survey report, preferred by a competent third party (not MS)? I have a few ...
2
votes
1answer
307 views

Trusted Platform Module (TPM) secure password

I'm trying to set secure Trusted Platform Module (TPM) passwords on a network and would like to set it to the maximum length possible. How long can the TPM's password be? Is it limited by bits or by ...
4
votes
2answers
5k views

Using a TPM with Linux

I have the need for a company laptop (Dell e6540) that contains our java application on it to go out for evaluation purposes. For this reason I would like to make sure that the HDD is protected from ...
8
votes
2answers
2k views

Does the ARM TrustZone technology support sealing a private key under a code hash?

One of the extremely valuable functions of a Trusted Platform Module (TPM) chip is its ability to seal a private key under the hash of the code that will use it. This means that one can create a ...
1
vote
1answer
124 views

Secure Azure to Data Centre Web Service Calls via Trusted IP?

Background The company I work for have a system with some data. This system's hosted in our private data centre. This system provides some ReST web services. We're looking to create a website, hosted ...
5
votes
0answers
4k views

OPAL Hardware Encryption [closed]

I recently bought a laptop which has OPAL compliant Self encrypting hard drive. I wanted to know how I could use/check the status of the Hardware Encryption features of an OPAL drive (windows, linux ...
1
vote
0answers
938 views

TPM PCR value unchanged with BIOS configuration changes

I have been experimenting with the TPM on a Dell R710 (BIOS version 6.3.0). My goal was to detect changes to BIOS settings through TPM PCRs. The research I have done leads me to believe that BIOS ...
4
votes
2answers
1k views

How to use TPM to perform platform authentication?

I am currently looking at TPM (Trusted Platform Module) and wondering how does TPM offer platform authentication. Suppose a legal host is deployed on the cloud. How do I use TPM to assure that the ...
7
votes
1answer
869 views

What prevents the Intel TXT boot loader from being maliciously altered?

From my understanding of Intel TXT, the technology can be used to put the processor in a trusted state where measurements can be performed. My understanding looks something like this, where I believe ...
6
votes
1answer
2k views

Dynamic vs Static root of trust

In TCG specification (for TPM devices) they specify how a static root of trust can be built up using secure boot and trusted boot. An alternative method appears to be Intel's Dynamic boot using their ...
2
votes
2answers
737 views

Why doesn't Bitlocker mix the password with stored key?

Bitlocker doesn't support USB key + PIN (password). The reasoning was "the password is too weak to provide additional security". Isn't that flawed? With a USB key and password, I've got some level of ...
9
votes
4answers
198 views

How to trust ICs?

While it is theoretically possible to thoroughly examine the source code of Open Source Software to check for backdoors (neglecting a Ken Thompson hack), and given sufficiently adequate knowledge in ...
2
votes
1answer
666 views

How to measure the integrity of the OS (Linux)?

I am working on a project which requires Integrity measurement of OS (Linux). One way to do that is using IMA but I am not sure if it fits in the scenario below. The scenario of the project is some ...
1
vote
2answers
697 views

Trusted Platform Module, daughterboard vs onboard TPM?

In many cases where a Trusted Platform Module (TPM chip) is employed, it is soldered directly onto the motherboard. Ostensibly the motherboard manufacturer is then solely responsible for integrating ...
5
votes
2answers
769 views

TPM- Symmetric key storage

I understand that the TPM can be used to store an unlimited number of keys. However I am left with a few questions: Presuming the TPM is connected on the LPC what protects the data travelling across ...
1
vote
2answers
469 views

Which PCR we can extend by using our own code?

As there are 24 PCR's in TPM 1.2 specification. Some of these PCRs are reserved and cannot be extended by user's code. Below are the PCR Index with their usage: 0 - CRTM, BIOS and Platform Extensions ...
19
votes
3answers
4k views

How does the TPM perform integrity measurements on a system?

I am trying to find out how the TPM performs an integrity measurement on a system. It is well-documented in the TPM specification how it seals the data it has measured in the PCRs and how it is ...
4
votes
2answers
561 views

Is it possible to share BitLocker decryption keys between multiple TPMs?

The TPM specification mentions that some keys are migratable, i.e. transferable to another TPM. Does this mean that it would be possible to share (transfer) a BitLocker decryption key between several ...
2
votes
2answers
431 views

Is there any way of recover a locked drive using TPM?

Just reading I learned about the TPM technology and how it works. However, it make me wonder... if the motherboard crashes, is the data lost forever? Because you can't use the drive in other system ...
7
votes
2answers
2k views

When taking ownership of a TPM in Windows 7, how is the SRK derived from the password?

When you take ownership of a TPM in Windows 7 you encounter a screen like this: Based on this document, it is my understanding that completing this dialog box somehow results in the generation of ...
3
votes
1answer
284 views

Is this a security risk for us to lost TPM or others to access to reset BIOS ?

In the previous post Physically secure the system case it is recommended to physically protect the system. But in case stolen laptops where intruder have physical access to TPMs. What are the security ...
9
votes
2answers
435 views

How do you know a computer is not compromised when you first get it?

How do you know a computer is not compromised when you first get it? How do you know that manufacturers have not intentionally built vulnerabilities into the system?
7
votes
3answers
674 views

Does “late launch”/“dynamic chain of trust” allow remote attestation?

One of the features support by modern processes and Trusted Platform Modules is "dynamic chain of trust" (also known under the acronym DRTM, for dynamic root of trust measurement). This allows ...
6
votes
3answers
1k views

Does any tablet support remote attestation?

Some PCs come with a TPM. One of the nifty capabilities of TPMs is the ability to perform remote attestation. Remote attestation allows your computer to tell a third computer what software your ...
0
votes
2answers
801 views

Bypassing Trusted Computing

I have not been able to find any information about trusted computing on the Internet. I am reasonably sure that its software manifestation can be bypassed by a Linux live disk, but what about hardware ...
5
votes
3answers
5k views

Can someone detect the URL an android app uses?

I have an android app that makes HTTPS connection to specific URL. Is there a way to keep this URL secret? I know that the IP address and the port number of that connection can be detected, but what ...
8
votes
2answers
2k views

TPM and storage of keys

A TPM hardware device has very limited non-volatile protected memory just sufficient to store the EK (Endorsement Key) and SRK (Storage Root Key). How does a TPM allow nearly unlimited number of ...