Questions tagged [trusted-computing]

Trusted Platform Module (TPM) and other protocols and components of trust in a computer or computer network

Filter by
Sorted by
Tagged with
2
votes
1answer
96 views

What's the difference between the endorsement key and the attestation identity key within the TPM?

I'm trying to make notes about the TPM and what it does. More specifically I'm looking at the 3 RSA key pairs: the 'endorsement key', the 'storage root key' and the 'attestation identity key'. This is ...
1
vote
1answer
52 views

In an Arm TrustZone based Trusted Application (TA), how can a remote party tie an output to a particular TA?

I've been looking at the following figure which shows, with Arm TrustZone architecture, resources of a system can be divided into a Rich Execution Environment (REE) and a Trusted Execution Environment ...
4
votes
1answer
80 views

What Trusted Execution Environment (TEE) solutions exist for mobile devices?

A trusted execution environment (TEE) provides a way for one to deploy tamper-proof programs on a device. The most prominent example of TEEs seem to be Intel SGX for PCs. What I wonder is, if there ...
0
votes
0answers
27 views

Why local attestation?

It seems that the term "local attestation" is usually used to refer an attestation conducted within an Intel environment. While the term "remote attestation" is widely used with a big range of ...
0
votes
0answers
28 views

Trusted Execution Environment (TEE) internal API vs. external (client) API

I am studying Trusted Execution Environment (TEE) in Android mobile phone. From reading, I found there are 2 APIs in TEE (isolated OS): Internal API: a programming and services API for Trusted ...
1
vote
0answers
59 views

How can I create restricted signing key or attestation key and certify it in TPM 2.0?

I need to create an attestation key (AK) and use it to sign arbitrary data in TPM 2.0. The TCG Guidance documents, suggest that some TPMs may come pre-provisioned with an AK that is part of the ...
2
votes
0answers
57 views

“Trusted memory” What does it mean?

It is often cited "to load from untrusted memory to a trusted system memory" when describing the secure boot process. I wonder, when can we consider a memory as "trusted"?
0
votes
0answers
90 views

Bypassing Secure Boot in System on Chip

To bypass a secure boot for System on Chip (SoC), some attacks target the phase of copying the bootloader from where it is stored to the main memory. Instead, a malicious code will be copied to the ...
1
vote
1answer
240 views

Why authenticated boot not Secure boot?

Context: Secure boot is one of the important elements of Trusted Computing in computer system. One variety of the Secure boot is authenticated boot. While secure boot prevent the boot of a non trusted ...
1
vote
3answers
247 views

Is a cryptographically signing camera possible?

What kind of digital / cryptographic signing would make it possible to create a camera that cryptographically signs the photos it takes so that the images can be verified to have been taken with that ...
1
vote
1answer
65 views

Using keys inside a secure enclave on a non trusted hardware and OS

Are secure enclaves like intel SGX protected from memory leaks? What if a non trusted privileged user dumps all the physical RAM memory. Is it possible to extract the keys in this way?
6
votes
2answers
2k views

What are the differences between HSM and SE?

What are the differences between a Hardware Security Module (HSM) and a Secure Element (SE)? Can both terms be used interchangeably? I came across various related question (TPM vs. HSM and TPM vs. SE)...
2
votes
1answer
258 views

Where to store signing key in TPM

I'm using TPM 2.0 to do a remote attestation for a computer. In order to do that you have to generate a signing key from a primary key. This generate a public key and an encrypted private key. As per ...
3
votes
1answer
315 views

Extra features required for TrustZone to provide main security features

The paper Trustworthy Execution on Mobile Devices: What Security Properties Can My Mobile Platform Give Me? describes 5 desired security features for mobile devices: Isolated Execution Secure Storage ...
0
votes
1answer
352 views

Asymmetric/Symmetric Encryption of a TPM key hierarchy

I know that keys in a TPM key hierarchy are encrypted with their parent keys. But I read that those parent keys (for instance an asymmetric SRK) need to have some symmetric secret for said encryption. ...
2
votes
1answer
602 views

Can I prove the relation between AIK and EK without asking to the TPM 2.0?

The Endorsement Key (EK), the Public part, is available directly on the TPM chip, I know that you can generate an AIK key and then sign with that key, the hash must be generated by the TPM. The idea ...
1
vote
1answer
359 views

Symmetric Keys for a TPM [duplicate]

I am currently researching the capabilities of TPM in creating and storing different kinds of cryptographic keys. I know that a TPM can create and store keys for asymmetric algorithms like RSA or ...
1
vote
1answer
291 views

With TPM how are the initial PCR values seeded with 'good' values?

I am trying to learn more about trusted boot / trusted platform modules and I understand about platform configuration values being a measurement of a 'good' configuration signed by a key locked from ...
3
votes
0answers
137 views

TPM - Device Softwareupdate - What happens to my sealed key?

Imagine having a device that has a TPM (Trusted Platform Module). This TPM is used to store keys. Some of these keys are sealed to PCR constraints, meaning that they can only be opened if the PCRs ...
2
votes
0answers
663 views

Use TPM 1.2 to store the private key of a certificate

Let's say I have an application that requires certificates (HTTPS, MQTTs, etc.) due to the use of TLS. I'm planning to build my own tier-1 PKI hierarchy with my own company CA signing device ...
4
votes
0answers
1k views

What is Silent Lake?

The Wikipédia's TEE entry mentions a hardware technology called Silent Lake that can support TEE implementations: The following embedded hardware technologies can be used to support TEE ...
1
vote
0answers
45 views

TPM and trust in cloud provider [closed]

I'm kinda unclear and confused ,i'm searching on the subject of trusted module platform and i can resume the main tpm's functions are: authentication functions, integrity measurement functions and ...
0
votes
0answers
125 views

TPM and the secret key

It's written that the TPM never allows these private keys to be exported outside the chip. This means that the only way to sign something with one of those keys is to use the computer to send a ...
1
vote
1answer
265 views

TPM with the three main groups of functions

I’m a little unclear on this (marked strong): "The public key authentication functions provide for on-chip key pair generation using a hardware random number generator, along with public key ...
0
votes
2answers
377 views

How does the TPM provide security for the cloud?

The primary scope of TPM is to assure the integrity of a platform. In this context, "integrity" means "behave as intended". ~Wiki I'm learning more about how the TPM performs integrity covering ...
1
vote
1answer
182 views

Verifying that the CRTM is read-only for the purpose of trusted computing

When using a TPM to provide integrity measurements for a system via SRTM, the trusted computing base is reduced to only the TPM and CRTM. The CRTM is a component of the BIOS (specifically the ...
2
votes
1answer
95 views

Distinguishing features of TPM from software solutions

It's said that TPM is proposed to address issues that software alone cannot. To my understanding, this means TPM cannot be simulated using software. For example, as far as I know, TPM comes with a ...
1
vote
0answers
300 views

TCG OPAL 2.0 Specification on technical Implementation?

Where can one find more technical information on the TCG OPAL 2.0 standard regarding how exactly the crypto has to been implemented in self encrypting drives? I couldn't find OPAL 2.0 implementation ...
13
votes
1answer
5k views

What are the functional similarities and differences between TPM and SGX in trusted computing?

I know about the TPM (Trusted Platform Module). In recent years, more researchers start to develop on Intel SGX, which I do not have any experience with. They are both crypto chips, but what are ...
1
vote
1answer
196 views

Understanding differences between kernel-based TCB and micro-kernel TCB

Recently I've been learning the concept of trusted computing base, and I've seen 2 types of TCB: Kernel-based TCB Micro-kernel TCB Where, from my understanding, the main difference is that in the ...
2
votes
1answer
477 views

Preventing new NVRAM areas from being defined in a TPM

Is there anyway to prevent new NVRAM areas from being defined on a TPM until the next reboot (similar to power-cycle types of protection)? The reason I ask is because firmware could check for NVRAM ...
2
votes
1answer
133 views

what make a TEE secure?

A TEE implementation such developed in ARM trustzone OS is a carved out partition isolated from the main OS. What makes such a TEE secure? Is it the fact that the TEE is accessible only through a ...
2
votes
2answers
163 views

Is ransomware that threatens with publication and verifiably deletes upon payment possible?

Inspired by the article The future of Ransomware and its description of possible ransomware with verifiable key delivery, I wonder if the idea can be taken further into ransomware that credibly ...
3
votes
1answer
1k views

How to reset the TPM PCRs?

I am working on the ATMEL TPM device on an embedded platform. While experimenting with the extend operation of the PCR, I extended the PCR 0 with a string of 20 bytes. As mentioned in the TPM ...
0
votes
1answer
156 views

What do I need to ask 3rd party to add trust

We have ADFS and want to add a 3rd party application as trusted to it. I have certificate and metadata (xml) URI to give them but want to have a checklist what they need to give me. So far HTTP ...
7
votes
2answers
292 views

If smart hardware is evil can I still securely run software?

I was thinking. And I was searching the Internet. I want to check if there is more than I found. I considered asking on crypto.se. But the question might involve hardware and out of the box thinking. ...
1
vote
1answer
111 views

Does periodically rebooting secure-boot-enabled devices improve security by preventing persistent compromise?

Many devices now enforce verified/trusted/secure boot, which according to Wikipedia "will only allow signed software to run on the device." Platforms that support this feature include Android, iOS, ...
20
votes
2answers
7k views

What is known about the capabilities of AMD's Secure Processor?

I've found a fair amount of research about what Intel's ME does, including the "Intel x86 considered harmful (Chapter 4 is about ME)" survey paper by Joanna Rutkowska, but I'm having a much harder ...
1
vote
0answers
506 views

How is hardware based chain of trust implemented in practice for secure boot?

To do secure boot we need an immutable public key baked into the ROM. This key is used to sign the boot loader or the key used to sign the boot loader. I have these questions - Which code does this ...
1
vote
1answer
40 views

Secure communication protocol for equality test

I'm solving a theoretical problem with two entities, each having one secret number. They need to find out whether these number equal without disclosing their number when they differ. Easy solution is ...
3
votes
1answer
377 views

Windows Secure Boot compromise: are fully-patched PCs vulnerable?

Are fully-patched (as of Aug. 10, 2016) Windows installs vulnerable to allowing self-signed early-boot malware to run- because of this ? If so, which versions of Windows are vulnerable. What in ...
1
vote
1answer
204 views

Deep attestation of VM's

Hypervisors like Xen have virtual TPM (vTPM) support. In cloud environments, are there any implementations where such vTPM's are being used during remote attestation in addition to the host TPM based ...
2
votes
1answer
487 views

Differences between Intel TXT and Linux IMA

I understand that Intel TXT provides a Dynamic Root of Trust Measurement (DRTM). Does the Linux integrity measurement architecture do logically similar things? If not, what are the differences?
3
votes
1answer
379 views

How are TPMs used to detect tampering?

I've known some stuff about trusted platform modules for over six or seven years. I understand their usage in (un)wrapping keys and storing information in NVRAM which may then be locked permanently or ...
0
votes
1answer
4k views

Take ownership on TPM 2.0

When I try to take the ownership on my TPM 2.0, I run the tpm2_takeownership command. For the first time, I got this error: ./tpm2_takeownership -e 0123 -o 0123 -l 0123 ......Change Hierarchy Owner ...
7
votes
1answer
3k views

What does CRTM refer to?

The Definition of CRTM in TCG specification says: Typically, the RTM is the CPU controlled by the Core Root of Trust for Measurement (CRTM). The CRTM is the first set of instructions executed when ...
14
votes
1answer
2k views

How are TPMs provisioned for Intel Trusted Execution Environment (TXT)?

For Intel TXT to work, the TPM must be provisioned. Intel provides some tools for doing this but many are protected by non-public login or an NDA. Many OEM platform vendors provision their boards and ...
4
votes
1answer
3k views

How is the AIK TPM generated?

Here is what I understood from the AIK(Attestation Identity Key) generation the AIK is generated after the boot, when all the PCRs have been initialized. The algorithm will take some PCRs (not ...
2
votes
1answer
453 views

Chain of Trust Extension with TPM2.0

I am looking for a way to implement a trusted boot using a firmware TPM2.0 on Arch Linux. I am using TPM2.0-TSS, and tpm2-tools, however I cannot find a way to do this with tpm2-tools, as I do not ...
18
votes
2answers
11k views

Difference between TPM, TEE and SE

What is the difference between a Secure Element (SE), a Trusted Execution Environment (TEE) and a Trusted Platform Module (TPM)? I understand that they all refer to an external secure cryptoprocessor,...