How to use TPM to perform platform authentication?

Question

I am currently looking at TPM (Trusted Platform Module) and wondering how does TPM offer platform authentication. Suppose a legal host is deployed on the cloud. How do I use TPM to assure that the host I am connecting to is that very host, rather than some other host that has the same configuration?

In principle, since that very host is equipped with TPM, whose Endorsement Key is unique, I can verify it via the public key of EK (Endorsement Key). For example, I can have TPM to encrypt a message with its private key of EK. And I decrypt it with the public key of EK. However, I looked up the documents, and didn't find any API to explicitly encrypt arbitrary message with private key of EK.

So, usually, how can TPM be used to perform such host authentication?

Answer 1

What you need is remote attestation (QUOTE operation).

The Endorsement Key (EK) is not directly accessible as this would be privacy issue - we could track a system using this unique identifier. The EK can be used in conjunction with an Attestation Identity Key (AIK) or using Direct Anonymous Attestation (DAA).

• The AIK model make use of a Privacy CA (Certificate Authority) which assert the validity of your EK to a third party. Multiple AIKs can be created to protect your identity (e.g. one AIK per thrid party, one AIK per security domain).
• The DAA model use 'Zero-knowledge proof' to anonymously verify your EK. See this to get a general idea how zero-knowledge protocols works.

I suggest you take a look at OpenAttestation open-source solution from Intel, PrivateCA and this presentation.

Answer 2

Just a minor correction to what northox said: remote attestation uses an AIK, and is what you need. You can get a properly-certified AIK using either a Privacy CA or DAA, depending on what you have available.

However, for this kind of use, you might not actually need the AIK certificate: if you have physical access (or an equivalently secure channel) to the machine, you can have it generate an AIK, and just export its public key and use that to authenticate it.

Answer 3

While there isn't a direct API to encrypt arbitrary messages with the private key of the EK, you can achieve platform authentication using TPM through a process called remote attestation. Remote attestation allows a remote verifier to confirm the configuration and state of a TPM-equipped host.

Here's a simplified outline of the process:

The host with the TPM generates a quote, which includes information about its current state and a signature using the EK's private key.

This quote is sent to the remote verifier, which has access to the corresponding EK's public key.

The remote verifier can use the EK's public key to verify the signature on the quote. If the verification is successful, it confirms that the host is indeed the one with the unique EK.

Additionally, you can incorporate other measurements, such as PCR (Platform Configuration Register) values, to further ensure the host's integrity.

This process helps you assure that the host you're connecting to is the genuine one and not a malicious copy with the same configuration. TPM-based remote attestation is a fundamental component of secure platform authentication in various scenarios, including cloud deployments.