2

I've learned that a TPM can supposedly attest to the state of a computer's BIOS being good. It does this by asking the BIOS to send a hash of its current state.

So what stops a compromised BIOS from sending a precalculated hash of a good state (that it is not in)?

Improve this question
6

1 Answer 1

Reset to default
2

The BIOS module stores the CRTM (Core Root of Trust for Measurements) and as per TCG specification it should be immutable. CRTM measures the integrity of rest of BIOS code. CRTM ensures that measurement taken is valid and then give control to rest of BIOS code.

Integrity Measurement

This measurement also involves Digital Signature verification, and public keys for verification are hardwired AFAIK (also known as Hardware root of trust). The BIOS code is generally digitally signed. So, if you modify the BIOS code, the signature verification will fail and CRTM won't pass the control to the rest of BIOS code.

Below link will be helpful:

root-of-trust

Improve this answer
5
  • Thank you, this is interesting. So the CRTM is completely immutable then?
    – Bob
    Commented Jul 26, 2021 at 12:09
  • Completely immutable is not the word I'll use. It's immutable and generally use read-only storage area for e.g. NV-memory.
    – sau_t
    Commented Jul 26, 2021 at 12:38
  • Ok. So could any normal malware modify it or would you need special hardwarw tools or something?
    – Bob
    Commented Jul 26, 2021 at 12:42
  • OTP (One time programmable) NVM is used and AFAIK malware cannot modify them. Attacks on these NVM requires special equipment.
    – sau_t
    Commented Jul 26, 2021 at 13:00
  • @Bob: I'll note that if you have a bios password, then retrieving protected keys from the TPM (e.g., those used for whole disk encryption) won't be feasible without that password. A competent design will use cryptography in a way that precludes compromising this key with via physical access (exceptions for brute forcing bad passwords, hardware intercepts/keyloggers, video cameras pointed at the keyboard, etc.).
    – Brian
    Commented Jul 28, 2021 at 15:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .