Imagine having a device that has a TPM (Trusted Platform Module). This TPM is used to store keys. Some of these keys are sealed to PCR constraints, meaning that they can only be opened if the PCRs have certain values, i.e. the values they had when the key was created on the TPM. So far so good, works.

This device allows for software updates over USB. It is possible that these software updates contain a completely new BIOS, kernel, OS, etc., meaning that the PCR values inside the TPM would differ with update of the software components. The problem now is that I cannot use the sealed key anymore as the PCR values do not correspond to the expected ones. Is there any way to save the sealed key somehow and seal it to the new device software?

  • I don’t really know anything about TPM, but this sounds like a situation where you would use code signing. – nbering Aug 8 '18 at 8:59
  • Code Signing and Secure Boot is included as well. But the problem is that I have a sealed key on the TPM which I want to be able to use after the complete update of the system (e.g. in case of a hard software failure). – TrinityTonic Aug 8 '18 at 9:15
  • You will naturally have to change the valid PCRs. Change them to the to-be-expected values before you finally update the firmware. – forest Aug 8 '18 at 9:19
  • The problem is that in some cases I do not know that I will update the firmware. Imagine the software on the device is broken and doesn't even boot-up. How could I change the values in that case ... not possible. If I knew that I'd want to make a firmware update, I'd just migrate the key and then seal it to my new PCR values, the problem however is that I cannot be sure that my current firmware is still working. – TrinityTonic Aug 8 '18 at 9:50
  • There is certainly a risk when using hardware security like a TPM module that you won't be able to recover the key if something unexpected happens. Backups are super important when you have things locked-down so tight. It's not a lot different than locking something in a vault. If you lose the combination, you risk losing access to the contents. The higher the security, the most costly it will be to recover the contents if the key is lost (if it's even possible to recover). – nbering Aug 8 '18 at 13:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.