1

Any application can use a TPM chip to securely create and store cryptographic keys. For example for Digital Rights Management (DRM) or for prevention of cheating in online games.

However, how can a TPM be sure of the identity of the process/service that is calling it (and consequently be sure the secrets will not be shared with a malicious entity)?

"Hi TPM, I'm Windows Defender, give me all the secrets you have". (Actually just another malicious process).

I suppose there is some kind of authentication/authorization of the process/service in place.

Can someone explain how that works?

1 Answer 1

0

TPM is a passive device and only responds to commands. It does not directly verify which application/software is sending the commands to access particular resources. It's the application that must set up a process to restrict access.

To achieve trust in the process, trust in the application, OS, and the underlying hardware (TPM, CMOS) is necessary. Once this trust is established, TPM, to some extent, will restrict access to resources for your application only. One of the way is to use binding mechanisms along with PIN setup.

For example, let's consider an application, X, with the following available values:

  1. Hash of application binary
  2. Version info
  3. Name or any other important application parameter

Now, create a hash of all the above parameters. Use this hash in your application as initial measures during installation on the system and bind the generated hash to TPM into a particular PCR, like the OS PCR, which can ensure that if the OS is compromised, your application won't start. Encrypt the application startup binary with the key inside TPM. You can also set the PIN, which the user can define during installation. (Note that you will need to generate keys with TPM before binding)

Now, whenever the application starts, you can first initiate accessing the keys from TPM for starting the application and provide the hash for unbinding, which will release the keys for decryption.

NOTE: The above is an example process, not a foolproof measure. Also, even with this measure, if the end user has root/administrative privileges, they can access the resources.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .