Trusted Platform Module (TPM) and other protocols and components of trust in a computer or computer network

learn more… | top users | synonyms

21
votes
3answers
4k views

How does the TPM perform integrity measurements on a system?

I am trying to find out how the TPM performs an integrity measurement on a system. It is well-documented in the TPM specification how it seals the data it has measured in the PCRs and how it is ...
18
votes
3answers
2k views

Status of Trusted Computing and Remote Attestation deployment

Hardware support for various client-side controls based on Trusted Computing (Wikipedia) has been evolving over the years, e.g. TCPM, TPM, TXT (LaGrande, DRTM). I've heard of one practical ...
16
votes
3answers
2k views

How secure is Microsoft-mandated UEFI Secure Boot, really?

I've read a few articles recently about the UEFI Secure Boot feature, and how Microsoft will be requiring it to be enabled by default on all Windows 8 certified x86 systems. In theory, it sounds like ...
15
votes
2answers
3k views

Tamper-proof BIOS password & settings storage with Trusted Platform Module?

In the olden days, one could trivially bypass BIOS passwords on most PCs by removing the BIOS battery and clearing the CMOS. My question is: On modern PCs equipped with a Trusted Platform Module (TPM)...
14
votes
3answers
5k views

Using TPM with DMcrypt?

Is it possible to use TPM for storage of some private key? It's not a full-disk encryption , I want it to be compatible with existing LUKS, just add another key, and store it in the TPM.
9
votes
2answers
444 views

How do you know a computer is not compromised when you first get it?

How do you know a computer is not compromised when you first get it? How do you know that manufacturers have not intentionally built vulnerabilities into the system?
9
votes
4answers
202 views

How to trust ICs?

While it is theoretically possible to thoroughly examine the source code of Open Source Software to check for backdoors (neglecting a Ken Thompson hack), and given sufficiently adequate knowledge in ...
8
votes
2answers
2k views

TPM and storage of keys

A TPM hardware device has very limited non-volatile protected memory just sufficient to store the EK (Endorsement Key) and SRK (Storage Root Key). How does a TPM allow nearly unlimited number of ...
8
votes
2answers
2k views

Does the ARM TrustZone technology support sealing a private key under a code hash?

One of the extremely valuable functions of a Trusted Platform Module (TPM) chip is its ability to seal a private key under the hash of the code that will use it. This means that one can create a ...
7
votes
3answers
2k views

vt-d Virtualisation and Trusted Execution Technology

Being a long time VirtualBox user and having recently purchased a new laptop equipped with an intel i7 720QM I discovered that it supported vt-d. In the meantime I've found out that vt-d comes with ...
7
votes
3answers
696 views

Does “late launch”/“dynamic chain of trust” allow remote attestation?

One of the features support by modern processes and Trusted Platform Modules is "dynamic chain of trust" (also known under the acronym DRTM, for dynamic root of trust measurement). This allows ...
7
votes
1answer
896 views

What prevents the Intel TXT boot loader from being maliciously altered?

From my understanding of Intel TXT, the technology can be used to put the processor in a trusted state where measurements can be performed. My understanding looks something like this, where I believe ...
7
votes
2answers
2k views

When taking ownership of a TPM in Windows 7, how is the SRK derived from the password?

When you take ownership of a TPM in Windows 7 you encounter a screen like this: Based on this document, it is my understanding that completing this dialog box somehow results in the generation of ...
6
votes
3answers
5k views

Can someone detect the URL an android app uses?

I have an android app that makes HTTPS connection to specific URL. Is there a way to keep this URL secret? I know that the IP address and the port number of that connection can be detected, but what ...
6
votes
3answers
1k views

Does any tablet support remote attestation?

Some PCs come with a TPM. One of the nifty capabilities of TPMs is the ability to perform remote attestation. Remote attestation allows your computer to tell a third computer what software your ...
6
votes
1answer
2k views

Dynamic vs Static root of trust

In TCG specification (for TPM devices) they specify how a static root of trust can be built up using secure boot and trusted boot. An alternative method appears to be Intel's Dynamic boot using their ...
6
votes
0answers
4k views

OPAL Hardware Encryption [closed]

I recently bought a laptop which has OPAL compliant Self encrypting hard drive. I wanted to know how I could use/check the status of the Hardware Encryption features of an OPAL drive (windows, linux ...
5
votes
2answers
801 views

TPM- Symmetric key storage

I understand that the TPM can be used to store an unlimited number of keys. However I am left with a few questions: Presuming the TPM is connected on the LPC what protects the data travelling across ...
5
votes
1answer
564 views

TPM: signing key or Attestation Identity Key?

I am dealing with the TPM right now and do not get why there is a need for an extra signing key. Instead one could use one of the Attestation Identity Keys (AIKs) for signing as well?! Using different ...
5
votes
1answer
979 views

TPM bootstrap process

Assume that the file partition where the PC operating system and user data reside are sealed by a number of PCRs (Platform Configuration Registers) dedicated to BIOS measurements. What happens during ...
5
votes
1answer
106 views

Issues/Vulnerabilities that TPM 2.0 aims to enhance/solve comparing to TPM 1.2

I have read some documents that comparing TPM 1.2 and TPM 2.0 (e.g. more supported algorithms like SHA-2, reduced code size, or even symmetric keys seems added, etc.) I want to ask that what are the ...
4
votes
2answers
1k views

How to use TPM to perform platform authentication?

I am currently looking at TPM (Trusted Platform Module) and wondering how does TPM offer platform authentication. Suppose a legal host is deployed on the cloud. How do I use TPM to assure that the ...
4
votes
2answers
5k views

Using a TPM with Linux

I have the need for a company laptop (Dell e6540) that contains our java application on it to go out for evaluation purposes. For this reason I would like to make sure that the HDD is protected from ...
4
votes
2answers
573 views

Is it possible to share BitLocker decryption keys between multiple TPMs?

The TPM specification mentions that some keys are migratable, i.e. transferable to another TPM. Does this mean that it would be possible to share (transfer) a BitLocker decryption key between several ...
4
votes
0answers
59 views

How can one protect TPM firmware from tampering?

I know that a TPM includes ROM, nonvolatile (e.g. EEPROM), and volatile (e.g. SRAM) memories. The executable firmware is stored in ROM, such as various drivers and commands. But this time, I want to ...
4
votes
1answer
156 views

TPM support with OpenSSL FIPS Object Module

How can I use a TPM chip along with the OpenSSL FIPS Object Module without modifying OpenSSL FIPS Object Module (to avoid Private Label certification)? Should we add an engine interface in OpenSSL ...
3
votes
1answer
289 views

Is this a security risk for us to lost TPM or others to access to reset BIOS ?

In the previous post Physically secure the system case it is recommended to physically protect the system. But in case stolen laptops where intruder have physical access to TPMs. What are the security ...
3
votes
1answer
91 views

Can a TPM storage key used to generate encrypt leaf key (child key) if it is stored outside TPM?

In a TPM, if I create a storage key by Storage Root Key (SRK) and store it outside TPM (migratable), the SRK can be its parent key to encrypt it. If the storage key is generated by SRK and then ...
3
votes
1answer
74 views

Is TPM ownership required for secure boot or measured boot?

I know: Secure Boot - can use the TPM Measured Boot - must use the TPM Can anyone intimately familiar with these processes explain if any TPM owner-authorized commands are required or used in ...
3
votes
1answer
156 views

Securely read encryption key from NVRAM of TPM 1.2

I have configured a disk encryption in linux using LUKS with TPM with secure boot. The encryption key is loaded from TPM from NV memory using command TPM_NV_ReadValueAuth. The problem is that it is ...
3
votes
1answer
197 views

Can TPM “Storage Keys” be created outside the TPM?

I am interested in 'adding' preexisting keys to a TPM's storage hierarchy. An example of a desired key hierarchy can be shown as: (SRK)----->(User Storage Key)-------> User Working Key 1 ...
3
votes
0answers
17 views

How are TPMs provisioned for Intel Trusted Execution Environment (TXT)?

For Intel TXT to work, the TPM must be provisioned. Intel provides some tools for doing this but many are protected by non-public login or an NDA. Many OEM platform vendors provision their boards and ...
3
votes
0answers
39 views

how to create TPM_AUTHDATA as input in tpm commands ?

I'm writing my first program which use tpm (version 1.2) services in Windows 7 using TBS, in this program I'm trying to execute the TPM_CreateWrapKey command. I noticed that many commands like the ...
2
votes
2answers
437 views

Is there any way of recover a locked drive using TPM?

Just reading I learned about the TPM technology and how it works. However, it make me wonder... if the motherboard crashes, is the data lost forever? Because you can't use the drive in other system ...
2
votes
2answers
222 views

Is there a technical survey report related to BitLocker and TPM?

I want to understand the technical aspect of BitLocker and TPM, especially with Startup PIN. Does anyone know a technical survey report, preferred by a competent third party (not MS)? I have a few ...
2
votes
1answer
34 views

What does CRTM refer to?

The Definition of CRTM in TCG specification says: Typically, the RTM is the CPU controlled by the Core Root of Trust for Measurement (CRTM). The CRTM is the first set of instructions executed when ...
2
votes
1answer
131 views

What, or who, exactly is a Certificate Authority (CA) for TPM attestation?

I'm learning about and researching the Trusted Platform Module (TPM) to incorporate into a solution involving remote machines. As I understand it: all attestation methods (AIK, DAA) still require ...
2
votes
1answer
415 views

Loading code securely in the Trusted Execution Environment (ARM)

I am reading up on TEE in ARM. I am looking for pointers for the following questions: How does the TEE load code from the OS securely and guarantee that its not malicious code? I am guessing the ...
2
votes
1answer
315 views

Trusted Platform Module (TPM) secure password

I'm trying to set secure Trusted Platform Module (TPM) passwords on a network and would like to set it to the maximum length possible. How long can the TPM's password be? Is it limited by bits or by ...
2
votes
1answer
327 views

Windows 8 in a VDI environment and the use of Secure Boot

I have a question, How would secure boot be implemented in a virtulized environment, say XEN hypervisor with multiple guest OS's including Windows 8 guest VM? does the guest VM need access to the ...
2
votes
1answer
462 views

Is there are any mechanism available in Android platform for remote attestation?

I recently read about PC/Desktops which comes with TPM chips which is used for remote attestation. So following are my questions: Does any Android smartphone comes with TPM chip? Is there any way ...
2
votes
2answers
747 views

Why doesn't Bitlocker mix the password with stored key?

Bitlocker doesn't support USB key + PIN (password). The reasoning was "the password is too weak to provide additional security". Isn't that flawed? With a USB key and password, I've got some level of ...
2
votes
1answer
680 views

How to measure the integrity of the OS (Linux)?

I am working on a project which requires Integrity measurement of OS (Linux). One way to do that is using IMA but I am not sure if it fits in the scenario below. The scenario of the project is some ...
1
vote
3answers
3k views

How do I use a TPM to protect my BIOS/EFI from “remote” attacks

I have a work/gaming computer. The work side is a SSD with linux and the game side is a SSD with Win7 (all security turned off, planning to get viruses and rewipe every LAN). Only one of the drives ...
1
vote
1answer
48 views

Difference between TMP, TEE and SE

What is the difference between a Secure Element (SE), a Trusted Execution Environment (TEE) and a Trusted Platform Module (TPM)? I understand that they all refer to an external secure cryptoprocessor,...
1
vote
2answers
731 views

Trusted Platform Module, daughterboard vs onboard TPM?

In many cases where a Trusted Platform Module (TPM chip) is employed, it is soldered directly onto the motherboard. Ostensibly the motherboard manufacturer is then solely responsible for integrating ...
1
vote
1answer
76 views

Is it OK to seal data to TPM SRK directly?

In reviewing various TPM programs and libraries, I have noticed that when sealing data to the TPM, a new key is always created (wrapped by the SRK), and that new key is loaded and used in the seal ...
1
vote
1answer
52 views

tpm sealing and secure boot

I have worked with TPM for a while, and I'm interested in some of its features. Especially sealing and the use of TPM's PCRs in the secure boot process. My question is: What is stopping an attacker ...
1
vote
1answer
608 views

Encrypting a symmetric key or Small File using TPM and Windows (TBS?)

I'm looking at encrypting a small (500bytes) file using the TPM. This is either doing assymetric encryption with the TPM directly, or using the TPM to store a symmetric key for decryption. This needs ...
1
vote
1answer
124 views

Secure Azure to Data Centre Web Service Calls via Trusted IP?

Background The company I work for have a system with some data. This system's hosted in our private data centre. This system provides some ReST web services. We're looking to create a website, hosted ...