2

Is there anyway to prevent new NVRAM areas from being defined on a TPM until the next reboot (similar to power-cycle types of protection)? The reason I ask is because firmware could check for NVRAM areas at certain hard-coded indices at boot and these could conceivably modify its operation. An example would be the FWMP in Chromebooks.

1 Answer 1

1

To clear an NV index or define a new one, you need to have access to the owner auth data. If you control this data, then you control the erase and write portions of the TPM's NV storage. The access controls for reading NV data are established when each NV index is defined. If the index is defined to require owner auth to read, then that is what the TPM will enforce.

The TPM is the sole authority over its NV storage, but it doesn't really care about its contents. (There is NV space used by the TPM for internal purposes, such as the storage of the private endorsement and storage root keys, but this portion of the NV is not exposed to the TPM owner or user.) The TPM does not read, write, delete, or modify anything in NV without explicitly being requested to do so. Anything in the OS that works with TPM NV needs to be TPM-aware. The TPM's NV is not treated like other forms of non-volatile storage that an OS has at its disposal.

1
  • I understand that the TPM doesn't care about an NVRAM area's contents, but I am asking if there is some setting that would prevent new NVRAM areas from being defined, like a one that prevents them from being defined until the next power-up. Is the owner authorization data necessary? What I want to use an all-zero owner password. Is there a way to stop it from being defined then? If one does have the owner password, then could they release an NVRAM area that has the PPWRITE permission when physical presence has been locked?
    – Melab
    Jul 1, 2017 at 14:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .