1

I have a stateless machine that is PXE booting from some host, and I'm curious if there is some clever way to achieve host authentication by only using the TMP (No UEFI Secure Boot).

For obvious reasons, I cannot really use code downloaded from the unauthenticated host to do the authentication. Considering that I have plain vanilla PXE, there isn't much trusted code in my machines ROMs (Firmware, BIOS, PXE...etc) that can help do this authentication.

But I do have a TPM. Considering that I can configure the TPM before hand, is there some way I could use it to achieve host authentication?

I saw developments on a recent TPM ACT "Authenticated Watchdog Timer" [PDF], which could allow me to configure the TPM to reboot in x amount of time if the watchdog was not kicked (or disabled) by some signed message (or shared secret) from the host, effectively authenticating it.

Are there any better schemes that could enable TPM-only host verification, without running any code from the unauthorized host, and not relying on something like UEFI Secure Boot?

Thanks!

Improve this question
2
  • Isn't Secure Boot (you can upload custom keys to any good UEFI firmware) meant to do what you want? So when you download code you can check the signature.. host wouldn't matter in this case. I haven't heard of any motherboards out there that support TLS or TPM authentication of remote devices/connections. PXE protocol also has no means of authentication, seems like a dead end? I think TianoCore supports HTTPS, but does TC support your specific setup?
    – Raf
    Aug 14 at 13:29
  • For Achieving HTTPS boot you still need to upload certificates to the motherboard, same as Secure Boot keys. lenovopress.lenovo.com/lp1584.pdf (p. 15). I don't think this would be a valid answer though - No usage of TPM.
    – Raf
    Aug 14 at 13:36

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .