Trusted Platform Module (TPM) and other protocols and components of trust in a computer or computer network

learn more… | top users | synonyms

0
votes
0answers
19 views

Decrypting keys wrapped by the Storage Root Key (SRK) of a TPM

Lets say I have a symmetric key wrapped with a storage root key (SRK) in a TPM. The SRK cannot be read by an attacker and so I perform the decryption and using the SRK and get the symmetric key in ...
2
votes
1answer
45 views

Is TPM ownership required for secure boot or measured boot?

I know: Secure Boot - can use the TPM Measured Boot - must use the TPM Can anyone intimately familiar with these processes explain if any TPM owner-authorized commands are required or used in ...
0
votes
0answers
38 views

What is the market acceptance of ARM trustzone vs standalone TPM?

ARM are keen on marketing their Trustzone features, in a secure implementation (e.g. with OTP memory/fuses), to establish a TEE on an SOC. Generally, what is the market view on the security of this ...
0
votes
0answers
27 views

Is it OK to seal data to TPM SRK directly?

In reviewing various TPM programs and libraries, I have noticed that when sealing data to the TPM, a new key is always created (wrapped by the SRK), and that new key is loaded and used in the seal ...
0
votes
1answer
40 views

tpm sealing and secure boot

I have worked with TPM for a while, and I'm interested in some of its features. Especially sealing and the use of TPM's PCRs in the secure boot process. My question is: What is stopping an attacker ...
0
votes
0answers
29 views

TPM based authentication without a trusted third party

Consider a scenario - Device manufacture provides in advance the TPM’s endorsement key certificate(containing EK public key) for device to be deployed. In general, what are the TPM operations that ...
0
votes
0answers
35 views

In practice, does TPM SRK really be decrypted by EK first, before it decrypt its child keys

I know that TPM SRK was generated when user take TPM ownership, and it is encrypted by EK public part. All the child keys under SRK need to be loaded into TPM and decrypted by SRK before use. (These ...
2
votes
1answer
84 views

What, or who, exactly is a Certificate Authority (CA) for TPM attestation?

I'm learning about and researching the Trusted Platform Module (TPM) to incorporate into a solution involving remote machines. As I understand it: all attestation methods (AIK, DAA) still require ...
3
votes
0answers
32 views

how to create TPM_AUTHDATA as input in tpm commands ?

I'm writing my first program which use tpm (version 1.2) services in Windows 7 using TBS, in this program I'm trying to execute the TPM_CreateWrapKey command. I noticed that many commands like the ...
3
votes
1answer
127 views

Securely read encryption key from NVRAM of TPM 1.2

I have configured a disk encryption in linux using LUKS with TPM with secure boot. The encryption key is loaded from TPM from NV memory using command TPM_NV_ReadValueAuth. The problem is that it is ...
3
votes
0answers
47 views

How can one protect TPM firmware from tampering?

I know that a TPM includes ROM, nonvolatile (e.g. EEPROM), and volatile (e.g. SRAM) memories. The executable firmware is stored in ROM, such as various drivers and commands. But this time, I want to ...
3
votes
0answers
82 views

Issues/Vulnerabilities that TPM 2.0 aims to enhance/solve comparing to TPM 1.2

I have read some documents that comparing TPM 1.2 and TPM 2.0 (e.g. more supported algorithms like SHA-2, reduced code size, or even symmetric keys seems added, etc.) I want to ask that what are the ...
2
votes
1answer
337 views

Is there are any mechanism available in Android platform for remote attestation?

I recently read about PC/Desktops which comes with TPM chips which is used for remote attestation. So following are my questions: Does any Android smartphone comes with TPM chip? Is there any way ...
3
votes
1answer
68 views

Can a TPM storage key used to generate encrypt leaf key (child key) if it is stored outside TPM?

In a TPM, if I create a storage key by Storage Root Key (SRK) and store it outside TPM (migratable), the SRK can be its parent key to encrypt it. If the storage key is generated by SRK and then ...
3
votes
1answer
177 views

Can TPM “Storage Keys” be created outside the TPM?

I am interested in 'adding' preexisting keys to a TPM's storage hierarchy. An example of a desired key hierarchy can be shown as: (SRK)----->(User Storage Key)-------> User Working Key 1 ...
0
votes
0answers
303 views

TPM Command Line Tools

I am trying to create a key storage hierarchy on TPM (Trusted Platform Module) on Linux (CentOS 6.4). The most commonly recommended TPM tool suite on Linux is TrouSerS. However, the command line suite ...
5
votes
1answer
474 views

TPM: signing key or Attestation Identity Key?

I am dealing with the TPM right now and do not get why there is a need for an extra signing key. Instead one could use one of the Attestation Identity Keys (AIKs) for signing as well?! Using different ...
1
vote
1answer
82 views

TPM - number of AIKs and signing key [closed]

I try to learn a bit about the TPM and have a few questions I could not solve by myself. There are some privacy concerns about using the EK for identifying a TPM. I do not get these privacy ...
2
votes
1answer
371 views

Loading code securely in the Trusted Execution Environment (ARM)

I am reading up on TEE in ARM. I am looking for pointers for the following questions: How does the TEE load code from the OS securely and guarantee that its not malicious code? I am guessing the ...
3
votes
1answer
139 views

TPM support with OpenSSL FIPS Object Module

How can I use a TPM chip along with the OpenSSL FIPS Object Module without modifying OpenSSL FIPS Object Module (to avoid Private Label certification)? Should we add an engine interface in OpenSSL ...
1
vote
1answer
511 views

Encrypting a symmetric key or Small File using TPM and Windows (TBS?)

I'm looking at encrypting a small (500bytes) file using the TPM. This is either doing assymetric encryption with the TPM directly, or using the TPM to store a symmetric key for decryption. This needs ...
2
votes
2answers
218 views

Is there a technical survey report related to BitLocker and TPM?

I want to understand the technical aspect of BitLocker and TPM, especially with Startup PIN. Does anyone know a technical survey report, preferred by a competent third party (not MS)? I have a few ...
2
votes
1answer
299 views

Trusted Platform Module (TPM) secure password

I'm trying to set secure Trusted Platform Module (TPM) passwords on a network and would like to set it to the maximum length possible. How long can the TPM's password be? Is it limited by bits or by ...
4
votes
2answers
5k views

Using a TPM with Linux

I have the need for a company laptop (Dell e6540) that contains our java application on it to go out for evaluation purposes. For this reason I would like to make sure that the HDD is protected from ...
7
votes
2answers
2k views

Does the ARM TrustZone technology support sealing a private key under a code hash?

One of the extremely valuable functions of a Trusted Platform Module (TPM) chip is its ability to seal a private key under the hash of the code that will use it. This means that one can create a ...
1
vote
1answer
124 views

Secure Azure to Data Centre Web Service Calls via Trusted IP?

Background The company I work for have a system with some data. This system's hosted in our private data centre. This system provides some ReST web services. We're looking to create a website, hosted ...
5
votes
0answers
4k views

OPAL Hardware Encryption [closed]

I recently bought a laptop which has OPAL compliant Self encrypting hard drive. I wanted to know how I could use/check the status of the Hardware Encryption features of an OPAL drive (windows, linux ...
1
vote
0answers
917 views

TPM PCR value unchanged with BIOS configuration changes

I have been experimenting with the TPM on a Dell R710 (BIOS version 6.3.0). My goal was to detect changes to BIOS settings through TPM PCRs. The research I have done leads me to believe that BIOS ...
4
votes
2answers
1k views

How to use TPM to perform platform authentication?

I am currently looking at TPM (Trusted Platform Module) and wondering how does TPM offer platform authentication. Suppose a legal host is deployed on the cloud. How do I use TPM to assure that the ...
7
votes
1answer
842 views

What prevents the Intel TXT boot loader from being maliciously altered?

From my understanding of Intel TXT, the technology can be used to put the processor in a trusted state where measurements can be performed. My understanding looks something like this, where I believe ...
6
votes
1answer
2k views

Dynamic vs Static root of trust

In TCG specification (for TPM devices) they specify how a static root of trust can be built up using secure boot and trusted boot. An alternative method appears to be Intel's Dynamic boot using their ...
2
votes
2answers
725 views

Why doesn't Bitlocker mix the password with stored key?

Bitlocker doesn't support USB key + PIN (password). The reasoning was "the password is too weak to provide additional security". Isn't that flawed? With a USB key and password, I've got some level of ...
9
votes
4answers
197 views

How to trust ICs?

While it is theoretically possible to thoroughly examine the source code of Open Source Software to check for backdoors (neglecting a Ken Thompson hack), and given sufficiently adequate knowledge in ...
2
votes
1answer
655 views

How to measure the integrity of the OS (Linux)?

I am working on a project which requires Integrity measurement of OS (Linux). One way to do that is using IMA but I am not sure if it fits in the scenario below. The scenario of the project is some ...
1
vote
2answers
670 views

Trusted Platform Module, daughterboard vs onboard TPM?

In many cases where a Trusted Platform Module (TPM chip) is employed, it is soldered directly onto the motherboard. Ostensibly the motherboard manufacturer is then solely responsible for integrating ...
5
votes
2answers
756 views

TPM- Symmetric key storage

I understand that the TPM can be used to store an unlimited number of keys. However I am left with a few questions: Presuming the TPM is connected on the LPC what protects the data travelling across ...
1
vote
2answers
445 views

Which PCR we can extend by using our own code?

As there are 24 PCR's in TPM 1.2 specification. Some of these PCRs are reserved and cannot be extended by user's code. Below are the PCR Index with their usage: 0 - CRTM, BIOS and Platform Extensions ...
19
votes
3answers
4k views

How does the TPM perform integrity measurements on a system?

I am trying to find out how the TPM performs an integrity measurement on a system. It is well-documented in the TPM specification how it seals the data it has measured in the PCRs and how it is ...
4
votes
2answers
548 views

Is it possible to share BitLocker decryption keys between multiple TPMs?

The TPM specification mentions that some keys are migratable, i.e. transferable to another TPM. Does this mean that it would be possible to share (transfer) a BitLocker decryption key between several ...
2
votes
2answers
427 views

Is there any way of recover a locked drive using TPM?

Just reading I learned about the TPM technology and how it works. However, it make me wonder... if the motherboard crashes, is the data lost forever? Because you can't use the drive in other system ...
7
votes
2answers
2k views

When taking ownership of a TPM in Windows 7, how is the SRK derived from the password?

When you take ownership of a TPM in Windows 7 you encounter a screen like this: Based on this document, it is my understanding that completing this dialog box somehow results in the generation of ...
3
votes
1answer
275 views

Is this a security risk for us to lost TPM or others to access to reset BIOS ?

In the previous post Physically secure the system case it is recommended to physically protect the system. But in case stolen laptops where intruder have physical access to TPMs. What are the security ...
9
votes
2answers
430 views

How do you know a computer is not compromised when you first get it?

How do you know a computer is not compromised when you first get it? How do you know that manufacturers have not intentionally built vulnerabilities into the system?
7
votes
3answers
661 views

Does “late launch”/“dynamic chain of trust” allow remote attestation?

One of the features support by modern processes and Trusted Platform Modules is "dynamic chain of trust" (also known under the acronym DRTM, for dynamic root of trust measurement). This allows ...
6
votes
3answers
1k views

Does any tablet support remote attestation?

Some PCs come with a TPM. One of the nifty capabilities of TPMs is the ability to perform remote attestation. Remote attestation allows your computer to tell a third computer what software your ...
0
votes
2answers
790 views

Bypassing Trusted Computing

I have not been able to find any information about trusted computing on the Internet. I am reasonably sure that its software manifestation can be bypassed by a Linux live disk, but what about hardware ...
5
votes
3answers
5k views

Can someone detect the URL an android app uses?

I have an android app that makes HTTPS connection to specific URL. Is there a way to keep this URL secret? I know that the IP address and the port number of that connection can be detected, but what ...
8
votes
2answers
2k views

TPM and storage of keys

A TPM hardware device has very limited non-volatile protected memory just sufficient to store the EK (Endorsement Key) and SRK (Storage Root Key). How does a TPM allow nearly unlimited number of ...
5
votes
1answer
959 views

TPM bootstrap process

Assume that the file partition where the PC operating system and user data reside are sealed by a number of PCRs (Platform Configuration Registers) dedicated to BIOS measurements. What happens during ...
2
votes
1answer
322 views

Windows 8 in a VDI environment and the use of Secure Boot

I have a question, How would secure boot be implemented in a virtulized environment, say XEN hypervisor with multiple guest OS's including Windows 8 guest VM? does the guest VM need access to the ...