1

My trusted root certificates are below. As an exercise, I want to be sure that a MITM is not changing the list. So, can I somehow get this list signed?

In my opinion, the list could be signed by my laptop's TPM using a key signed by my laptop's manufacturer, HP. The final verification process is then:

  1. copy these 3 items (the list, TPM's signature, and HP's signature) to a trusted computer
  2. trusted computer checks the signatures to show that their keys work
  3. trusted computer goes online to verify that the public key used for HP is trustable (ideally, trusted computer builds a certificate chain from HP to its own root, but my Googling HP or phoning HP is probably sufficient)

I'm guessing TPMs do not have this capability today, so here's a broader question: What would you do if you suspected that your TPM has an additional "evil root certificate" which always gets hidden by an "evil fake certmgr app"?

enter image description here

Improve this question
0

1 Answer 1

Reset to default
3

First: the list of trusted roots is maintained by a Microsoft Root Program and is automatically updated as program participant list changes. You can disable automatic root update, see this thread: https://stackoverflow.com/a/36077658/3997611. In any case you can get a Microsoft-signed list using this link: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab. Extract CAB and you get signed CTL. In this case, you always can compare current list with signed copy.

Next, when you are online, you are not protected much when using user account with administrative privileges. Any person with admin rights can modify this list. There is a user-scoped list of trusted roots which users can update. There is a group policy setting that locks down the user-scoped trusted root store: https://serverfault.com/a/1008039/251012

Improve this answer
3
  • My goal was not to find the Microsoft-signed trusted list, but instead to be confident that my TPM has that proper list with no evil additions.
    – bobuhito
    Jun 17, 2020 at 20:30
  • 3
    You can't write the list in the TPM because non-volatile space in TPM is quite limited.
    – Crypt32
    Jun 17, 2020 at 20:39
  • Well, that space could be increased if there were demand. I can imagine a highly-secure computer wanting to make sure that every root certificate used to install apps in its history is trustable. That requires a bigger list than the one in my question, but it could just keep the thumbprints...allowing for 1000 certificates, that's only like 20kB of non-volatile space.
    – bobuhito
    Jun 18, 2020 at 5:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .