9

I see that there is an increasing number of PCs shipped with firmware based TPM (fTPM), e.g. the Intel NUC.

As far as I understand, these solutions practically emulate a TPM chip using the CPUs special instructions (ARM TrustZone or Intel SGX). This makes fTPM a cheaper and more simple solution, since there is no need for another chip in the system.

However, discrete TPM chips have some degree of protection against physical attacks, but I don't see how is this possible with current fTPM implementations.

For example in this paper on the subject, the authors explicitly state, that this form of attack was not considered:

[...] However, we do not defend against power analysis or other sidechannel attacks that require physical access to hardware or hardware modifications.

That paper also lists a number of shortcomings for an Intel SGX based approach. Are these limitations addressed by later development? Platform Trust Technology (PTT), maybe?

Or am I missing something, and the private keys generated by the fTPM cannot be read even with physical access?

Improve this question
2
  • 1
    Many motherboards with a hardware TPM are also vulnerable to physical attacks. Even if the TPM itself is hardened — which AFAIK many aren't — the bus between the CPU and the TPM usually isn't, so even if the attacker can't extract the key from the TPM, they can make it believe that the CPU is in a good state and make the TPM sign stuff.
    – Gilles 'SO- stop being evil'
    Feb 26, 2017 at 18:01
  • @Gilles this question is more about possible offline attacks against fTPM implementations, and not about comparison of software and hardware TPM implementations.
    – KovBal
    May 28, 2017 at 16:37

1 Answer 1

Reset to default
-2

Every software implementation is weaker than the hardware one. If a real chip for tpm is done to be resistant to even physical tampering, the CPU is a general purpose chip and can be easily traced

Improve this answer
12
  • 5
    A software implementation is not necessarily weaker, than a hardware one. Bad solutions exists in both software and hardware. Do you have any source that claims that an fTPM solution is not resistant to this form of attack?
    – KovBal
    Dec 29, 2016 at 13:06
  • 2
    @AlexeyVesnin OP mentions TrustZone and SGX, which are not normal instructions you can emulate. They provide a simple but still HW-based root-of-trust the TPM firmware can be buily upon. In other words, an fTPM is not purely done in software.
    – SquareRootOfTwentyThree
    Dec 31, 2016 at 15:27
  • 6
    SGX and several TZ implementation encrypt the memory bus: wiretapping does not lead any information. As a matter of fact, this potentially makes them more secure than having TPM implemented via a separate chip on the motherboard.
    – SquareRootOfTwentyThree
    Jan 3, 2017 at 11:57
  • 1
    What do you mean "can easily be traced"? This makes no sense. Not to mention, a dTPM (especially pre-1.2) is vulnerable to platform reset attacks, which do not affect fTPM.
    – forest
    Nov 29, 2017 at 18:07
  • 1
    But it is stored inside the CPU. I mean technically it is stored in the chipset (since the CPU is a specific part of the chipset), but it is stored in the physical component itself, which is tamper-resistant. You can't monitor traces to get the keys anymore than you can intercept data between the PCH and CPU. To get the keys, you would have to either 1) attack the CPU to compromise it (glitching, etc), 2) debug it with JTAG, or 3) physically decap it and get at the internal, microscopic traces. There is no exposed bus carrying the keys like there is for the LPC on a dTPM.
    – forest
    Jan 25, 2018 at 4:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.