I have a stateless machine that is PXE booting from some host, and I'm curious if there is some clever way to achieve host authentication by only using the TMP (No UEFI Secure Boot).
For obvious reasons, I cannot really use code downloaded from the unauthenticated host to do the authentication. Considering that I have plain vanilla PXE, there isn't much trusted code in my machines ROMs (Firmware, BIOS, PXE...etc) that can help do this authentication.
But I do have a TPM. Considering that I can configure the TPM before hand, is there some way I could use it to achieve host authentication?
I saw developments on a recent TPM ACT "Authenticated Watchdog Timer" [PDF], which could allow me to configure the TPM to reboot in x amount of time if the watchdog was not kicked (or disabled) by some signed message (or shared secret) from the host, effectively authenticating it.
Are there any better schemes that could enable TPM-only host verification, without running any code from the unauthorized host, and not relying on something like UEFI Secure Boot?