Trusted Platform Module (TPM) and other protocols and components of trust in a computer or computer network

learn more… | top users | synonyms

0
votes
0answers
10 views

Is it OK to seal data to TPM SRK directly?

In reviewing various TPM programs and libraries, I have noticed that when sealing data to the TPM, a new key is always created (wrapped by the SRK), and that new key is loaded and used in the seal ...
0
votes
0answers
20 views

tpm sealing and secure boot

I have worked with TPM for a while, and I'm interested in some of its features. Especially sealing and the use of TPM's PCRs in the secure boot process. My question is: What is stopping an attacker ...
0
votes
0answers
18 views

TPM based authentication without a trusted third party

Consider a scenario - Device manufacture provides in advance the TPM’s endorsement key certificate(containing EK public key) for device to be deployed. In general, what are the TPM operations that ...
0
votes
0answers
14 views

In practice, does TPM SRK really be decrypted by EK first, before it decrypt its child keys

I know that TPM SRK was generated when user take TPM ownership, and it is encrypted by EK public part. All the child keys under SRK need to be loaded into TPM and decrypted by SRK before use. (These ...
2
votes
1answer
58 views

What, or who, exactly is a Certificate Authority (CA) for TPM attestation?

I'm learning about and researching the Trusted Platform Module (TPM) to incorporate into a solution involving remote machines. As I understand it: all attestation methods (AIK, DAA) still require ...
3
votes
0answers
23 views

how to create TPM_AUTHDATA as input in tpm commands ?

I'm writing my first program which use tpm (version 1.2) services in Windows 7 using TBS, in this program I'm trying to execute the TPM_CreateWrapKey command. I noticed that many commands like the ...
3
votes
1answer
65 views

Securely read encryption key from NVRAM of TPM 1.2

I have configured a disk encryption in linux using LUKS with TPM with secure boot. The encryption key is loaded from TPM from NV memory using command TPM_NV_ReadValueAuth. The problem is that it is ...
3
votes
0answers
36 views

How can one protect TPM firmware from tampering?

I know that a TPM includes ROM, nonvolatile (e.g. EEPROM), and volatile (e.g. SRAM) memories. The executable firmware is stored in ROM, such as various drivers and commands. But this time, I want to ...
3
votes
0answers
60 views

Issues/Vulnerabilities that TPM 2.0 aims to enhance/solve comparing to TPM 1.2

I have read some documents that comparing TPM 1.2 and TPM 2.0 (e.g. more supported algorithms like SHA-2, reduced code size, or even symmetric keys seems added, etc.) I want to ask that what are the ...
2
votes
1answer
112 views

Is there are any mechanism available in Android platform for remote attestation?

I recently read about PC/Desktops which comes with TPM chips which is used for remote attestation. So following are my questions: Does any Android smartphone comes with TPM chip? Is there any way ...
3
votes
1answer
45 views

Can a TPM storage key used to generate encrypt leaf key (child key) if it is stored outside TPM?

In a TPM, if I create a storage key by Storage Root Key (SRK) and store it outside TPM (migratable), the SRK can be its parent key to encrypt it. If the storage key is generated by SRK and then ...
3
votes
1answer
155 views

Can TPM “Storage Keys” be created outside the TPM?

I am interested in 'adding' preexisting keys to a TPM's storage hierarchy. An example of a desired key hierarchy can be shown as: (SRK)----->(User Storage Key)-------> User Working Key 1 ...
0
votes
0answers
214 views

TPM Command Line Tools

I am trying to create a key storage hierarchy on TPM (Trusted Platform Module) on Linux (CentOS 6.4). The most commonly recommended TPM tool suite on Linux is TrouSerS. However, the command line suite ...
6
votes
1answer
385 views

TPM: signing key or Attestation Identity Key?

I am dealing with the TPM right now and do not get why there is a need for an extra signing key. Instead one could use one of the Attestation Identity Keys (AIKs) for signing as well?! Using different ...
1
vote
1answer
79 views

TPM - number of AIKs and signing key [closed]

I try to learn a bit about the TPM and have a few questions I could not solve by myself. There are some privacy concerns about using the EK for identifying a TPM. I do not get these privacy ...
2
votes
1answer
325 views

Loading code securely in the Trusted Execution Environment (ARM)

I am reading up on TEE in ARM. I am looking for pointers for the following questions: How does the TEE load code from the OS securely and guarantee that its not malicious code? I am guessing the ...
3
votes
1answer
126 views

TPM support with OpenSSL FIPS Object Module

How can I use a TPM chip along with the OpenSSL FIPS Object Module without modifying OpenSSL FIPS Object Module (to avoid Private Label certification)? Should we add an engine interface in OpenSSL ...
1
vote
1answer
441 views

Encrypting a symmetric key or Small File using TPM and Windows (TBS?)

I'm looking at encrypting a small (500bytes) file using the TPM. This is either doing assymetric encryption with the TPM directly, or using the TPM to store a symmetric key for decryption. This needs ...
2
votes
2answers
208 views

Is there a technical survey report related to BitLocker and TPM?

I want to understand the technical aspect of BitLocker and TPM, especially with Startup PIN. Does anyone know a technical survey report, preferred by a competent third party (not MS)? I have a few ...
2
votes
1answer
265 views

Trusted Platform Module (TPM) secure password

I'm trying to set secure Trusted Platform Module (TPM) passwords on a network and would like to set it to the maximum length possible. How long can the TPM's password be? Is it limited by bits or by ...
3
votes
2answers
4k views

Using a TPM with Linux

I have the need for a company laptop (Dell e6540) that contains our java application on it to go out for evaluation purposes. For this reason I would like to make sure that the HDD is protected from ...
6
votes
2answers
1k views

Does the ARM TrustZone technology support sealing a private key under a code hash?

One of the extremely valuable functions of a Trusted Platform Module (TPM) chip is its ability to seal a private key under the hash of the code that will use it. This means that one can create a ...
1
vote
1answer
118 views

Secure Azure to Data Centre Web Service Calls via Trusted IP?

Background The company I work for have a system with some data. This system's hosted in our private data centre. This system provides some ReST web services. We're looking to create a website, hosted ...
5
votes
0answers
3k views

OPAL Hardware Encryption [closed]

I recently bought a laptop which has OPAL compliant Self encrypting hard drive. I wanted to know how I could use/check the status of the Hardware Encryption features of an OPAL drive (windows, linux ...
1
vote
0answers
841 views

TPM PCR value unchanged with BIOS configuration changes

I have been experimenting with the TPM on a Dell R710 (BIOS version 6.3.0). My goal was to detect changes to BIOS settings through TPM PCRs. The research I have done leads me to believe that BIOS ...
4
votes
2answers
928 views

How to use TPM to perform platform authentication?

I am currently looking at TPM (Trusted Platform Module) and wondering how does TPM offer platform authentication. Suppose a legal host is deployed on the cloud. How do I use TPM to assure that the ...
7
votes
1answer
776 views

What prevents the Intel TXT boot loader from being maliciously altered?

From my understanding of Intel TXT, the technology can be used to put the processor in a trusted state where measurements can be performed. My understanding looks something like this, where I believe ...
6
votes
1answer
1k views

Dynamic vs Static root of trust

In TCG specification (for TPM devices) they specify how a static root of trust can be built up using secure boot and trusted boot. An alternative method appears to be Intel's Dynamic boot using their ...
2
votes
2answers
655 views

Why doesn't Bitlocker mix the password with stored key?

Bitlocker doesn't support USB key + PIN (password). The reasoning was "the password is too weak to provide additional security". Isn't that flawed? With a USB key and password, I've got some level of ...
9
votes
4answers
195 views

How to trust ICs?

While it is theoretically possible to thoroughly examine the source code of Open Source Software to check for backdoors (neglecting a Ken Thompson hack), and given sufficiently adequate knowledge in ...
2
votes
1answer
608 views

How to measure the integrity of the OS (Linux)?

I am working on a project which requires Integrity measurement of OS (Linux). One way to do that is using IMA but I am not sure if it fits in the scenario below. The scenario of the project is some ...
1
vote
2answers
585 views

Trusted Platform Module, daughterboard vs onboard TPM?

In many cases where a Trusted Platform Module (TPM chip) is employed, it is soldered directly onto the motherboard. Ostensibly the motherboard manufacturer is then solely responsible for integrating ...
5
votes
2answers
688 views

TPM- Symmetric key storage

I understand that the TPM can be used to store an unlimited number of keys. However I am left with a few questions: Presuming the TPM is connected on the LPC what protects the data travelling across ...
1
vote
2answers
378 views

Which PCR we can extend by using our own code?

As there are 24 PCR's in TPM 1.2 specification. Some of these PCRs are reserved and cannot be extended by user's code. Below are the PCR Index with their usage: 0 - CRTM, BIOS and Platform Extensions ...
18
votes
3answers
3k views

How does the TPM perform integrity measurements on a system?

I am trying to find out how the TPM performs an integrity measurement on a system. It is well-documented in the TPM specification how it seals the data it has measured in the PCRs and how it is ...
3
votes
2answers
480 views

Is it possible to share BitLocker decryption keys between multiple TPMs?

The TPM specification mentions that some keys are migratable, i.e. transferable to another TPM. Does this mean that it would be possible to share (transfer) a BitLocker decryption key between several ...
2
votes
2answers
403 views

Is there any way of recover a locked drive using TPM?

Just reading I learned about the TPM technology and how it works. However, it make me wonder... if the motherboard crashes, is the data lost forever? Because you can't use the drive in other system ...
7
votes
2answers
2k views

When taking ownership of a TPM in Windows 7, how is the SRK derived from the password?

When you take ownership of a TPM in Windows 7 you encounter a screen like this: Based on this document, it is my understanding that completing this dialog box somehow results in the generation of ...
3
votes
1answer
265 views

Is this a security risk for us to lost TPM or others to access to reset BIOS ?

In the previous post Physically secure the system case it is recommended to physically protect the system. But in case stolen laptops where intruder have physical access to TPMs. What are the security ...
9
votes
2answers
415 views

How do you know a computer is not compromised when you first get it?

How do you know a computer is not compromised when you first get it? How do you know that manufacturers have not intentionally built vulnerabilities into the system?
6
votes
3answers
626 views

Does “late launch”/“dynamic chain of trust” allow remote attestation?

One of the features support by modern processes and Trusted Platform Modules is "dynamic chain of trust" (also known under the acronym DRTM, for dynamic root of trust measurement). This allows ...
6
votes
3answers
1k views

Does any tablet support remote attestation?

Some PCs come with a TPM. One of the nifty capabilities of TPMs is the ability to perform remote attestation. Remote attestation allows your computer to tell a third computer what software your ...
0
votes
2answers
720 views

Bypassing Trusted Computing

I have not been able to find any information about trusted computing on the Internet. I am reasonably sure that its software manifestation can be bypassed by a Linux live disk, but what about hardware ...
6
votes
3answers
5k views

Can someone detect the URL an android app uses?

I have an android app that makes HTTPS connection to specific URL. Is there a way to keep this URL secret? I know that the IP address and the port number of that connection can be detected, but what ...
8
votes
2answers
1k views

TPM and storage of keys

A TPM hardware device has very limited non-volatile protected memory just sufficient to store the EK (Endorsement Key) and SRK (Storage Root Key). How does a TPM allow nearly unlimited number of ...
5
votes
1answer
899 views

TPM bootstrap process

Assume that the file partition where the PC operating system and user data reside are sealed by a number of PCRs (Platform Configuration Registers) dedicated to BIOS measurements. What happens during ...
2
votes
1answer
318 views

Windows 8 in a VDI environment and the use of Secure Boot

I have a question, How would secure boot be implemented in a virtulized environment, say XEN hypervisor with multiple guest OS's including Windows 8 guest VM? does the guest VM need access to the ...
1
vote
3answers
3k views

How do I use a TPM to protect my BIOS/EFI from “remote” attacks

I have a work/gaming computer. The work side is a SSD with linux and the game side is a SSD with Win7 (all security turned off, planning to get viruses and rewipe every LAN). Only one of the drives ...
16
votes
3answers
1k views

How secure is Microsoft-mandated UEFI Secure Boot, really?

I've read a few articles recently about the UEFI Secure Boot feature, and how Microsoft will be requiring it to be enabled by default on all Windows 8 certified x86 systems. In theory, it sounds like ...
13
votes
3answers
4k views

Using TPM with DMcrypt?

Is it possible to use TPM for storage of some private key? It's not a full-disk encryption , I want it to be compatible with existing LUKS, just add another key, and store it in the TPM.