Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [trusted-computing]

Trusted Platform Module (TPM) and other protocols and components of trust in a computer or computer network

2
votes
2answers
176 views

What are the differences between HSM and SE?

What are the differences between a Hardware Security Module (HSM) and a Secure Element (SE)? Can both terms be used interchangeably? I came across various related question (TMP vs. HSM and TPM vs. SE)...
2
votes
1answer
79 views

Where to store signing key in TPM

I'm using TPM 2.0 to do a remote attestation for a computer. In order to do that you have to generate a signing key from a primary key. This generate a public key and an encrypted private key. As per ...
2
votes
1answer
129 views

Extra features required for TrustZone to provide main security features

The paper Trustworthy Execution on Mobile Devices: What Security Properties Can My Mobile Platform Give Me? describes 5 desired security features for mobile devices: Isolated Execution Secure Storage ...
0
votes
1answer
98 views

Asymmetric/Symmetric Encryption of a TPM key hierarchy

I know that keys in a TPM key hierarchy are encrypted with their parent keys. But I read that those parent keys (for instance an asymmetric SRK) need to have some symmetric secret for said encryption. ...
2
votes
1answer
88 views

Can I prove the relation between AIK and EK without asking to the TPM 2.0?

The Endorsement Key (EK), the Public part, is available directly on the TPM chip, I know that you can generate an AIK key and then sign with that key, the hash must be generated by the TPM. The idea ...
1
vote
1answer
135 views

Symmetric Keys for a TPM [duplicate]

I am currently researching the capabilities of TPM in creating and storing different kinds of cryptographic keys. I know that a TPM can create and store keys for asymmetric algorithms like RSA or ...
1
vote
0answers
149 views

With TPM how are the initial PCR values seeded with 'good' values?

I am trying to learn more about trusted boot / trusted platform modules and I understand about platform configuration values being a measurement of a 'good' configuration signed by a key locked from ...
3
votes
0answers
91 views

TPM - Device Softwareupdate - What happens to my sealed key?

Imagine having a device that has a TPM (Trusted Platform Module). This TPM is used to store keys. Some of these keys are sealed to PCR constraints, meaning that they can only be opened if the PCRs ...
2
votes
0answers
476 views

Use TPM 1.2 to store the private key of a certificate

Let's say I have an application that requires certificates (HTTPS, MQTTs, etc.) due to the use of TLS. I'm planning to build my own tier-1 PKI hierarchy with my own company CA signing device ...
3
votes
0answers
605 views

What is Silent Lake?

The Wikipédia's TEE entry mentions a hardware technology called Silent Lake that can support TEE implementations: The following embedded hardware technologies can be used to support TEE ...
1
vote
0answers
41 views

TPM and trust in cloud provider [closed]

I'm kinda unclear and confused ,i'm searching on the subject of trusted module platform and i can resume the main tpm's functions are: authentication functions, integrity measurement functions and ...
0
votes
0answers
92 views

TPM and the secret key

It's written that the TPM never allows these private keys to be exported outside the chip. This means that the only way to sign something with one of those keys is to use the computer to send a ...
1
vote
1answer
169 views

TPM with the three main groups of functions

I’m a little unclear on this (marked strong): "The public key authentication functions provide for on-chip key pair generation using a hardware random number generator, along with public key ...
0
votes
1answer
184 views

How does the TPM provide security for the cloud?

The primary scope of TPM is to assure the integrity of a platform. In this context, "integrity" means "behave as intended". ~Wiki I'm learning more about how the TPM performs integrity covering ...
1
vote
1answer
116 views

Verifying that the CRTM is read-only for the purpose of trusted computing

When using a TPM to provide integrity measurements for a system via SRTM, the trusted computing base is reduced to only the TPM and CRTM. The CRTM is a component of the BIOS (specifically the ...
2
votes
1answer
83 views

Distinguishing features of TPM from software solutions

It's said that TPM is proposed to address issues that software alone cannot. To my understanding, this means TPM cannot be simulated using software. For example, as far as I know, TPM comes with a ...
1
vote
0answers
262 views

TCG OPAL 2.0 Specification on technical Implementation?

Where can one find more technical information on the TCG OPAL 2.0 standard regarding how exactly the crypto has to been implemented in self encrypting drives? I couldn't find OPAL 2.0 implementation ...
9
votes
1answer
3k views

What are the functional similarities and differences between TPM and SGX in trusted computing?

I know about the TPM (Trusted Platform Module). In recent years, more researchers start to develop on Intel SGX, which I do not have any experience with. They are both crypto chips, but what are ...
1
vote
1answer
143 views

Understanding differences between kernel-based TCB and micro-kernel TCB

Recently I've been learning the concept of trusted computing base, and I've seen 2 types of TCB: Kernel-based TCB Micro-kernel TCB Where, from my understanding, the main difference is that in the ...
2
votes
1answer
332 views

Preventing new NVRAM areas from being defined in a TPM

Is there anyway to prevent new NVRAM areas from being defined on a TPM until the next reboot (similar to power-cycle types of protection)? The reason I ask is because firmware could check for NVRAM ...
2
votes
1answer
125 views

what make a TEE secure?

A TEE implementation such developed in ARM trustzone OS is a carved out partition isolated from the main OS. What makes such a TEE secure? Is it the fact that the TEE is accessible only through a ...
2
votes
2answers
160 views

Is ransomware that threatens with publication and verifiably deletes upon payment possible?

Inspired by the article The future of Ransomware and its description of possible ransomware with verifiable key delivery, I wonder if the idea can be taken further into ransomware that credibly ...
2
votes
1answer
706 views

How to reset the TPM PCRs?

I am working on the ATMEL TPM device on an embedded platform. While experimenting with the extend operation of the PCR, I extended the PCR 0 with a string of 20 bytes. As mentioned in the TPM ...
0
votes
1answer
136 views

What do I need to ask 3rd party to add trust

We have ADFS and want to add a 3rd party application as trusted to it. I have certificate and metadata (xml) URI to give them but want to have a checklist what they need to give me. So far HTTP ...
7
votes
2answers
274 views

If smart hardware is evil can I still securely run software?

I was thinking. And I was searching the Internet. I want to check if there is more than I found. I considered asking on crypto.se. But the question might involve hardware and out of the box thinking. ...
1
vote
1answer
101 views

Does periodically rebooting secure-boot-enabled devices improve security by preventing persistent compromise?

Many devices now enforce verified/trusted/secure boot, which according to Wikipedia "will only allow signed software to run on the device." Platforms that support this feature include Android, iOS, ...
20
votes
2answers
7k views

What is known about the capabilities of AMD's Secure Processor?

I've found a fair amount of research about what Intel's ME does, including the "Intel x86 considered harmful (Chapter 4 is about ME)" survey paper by Joanna Rutkowska, but I'm having a much harder ...
1
vote
0answers
426 views

How is hardware based chain of trust implemented in practice for secure boot?

To do secure boot we need an immutable public key baked into the ROM. This key is used to sign the boot loader or the key used to sign the boot loader. I have these questions - Which code does this ...
1
vote
1answer
40 views

Secure communication protocol for equality test

I'm solving a theoretical problem with two entities, each having one secret number. They need to find out whether these number equal without disclosing their number when they differ. Easy solution is ...
3
votes
1answer
333 views

Windows Secure Boot compromise: are fully-patched PCs vulnerable?

Are fully-patched (as of Aug. 10, 2016) Windows installs vulnerable to allowing self-signed early-boot malware to run- because of this ? If so, which versions of Windows are vulnerable. What in ...
1
vote
1answer
177 views

Deep attestation of VM's

Hypervisors like Xen have virtual TPM (vTPM) support. In cloud environments, are there any implementations where such vTPM's are being used during remote attestation in addition to the host TPM based ...
2
votes
1answer
387 views

Differences between Intel TXT and Linux IMA

I understand that Intel TXT provides a Dynamic Root of Trust Measurement (DRTM). Does the Linux integrity measurement architecture do logically similar things? If not, what are the differences?
3
votes
1answer
264 views

How are TPMs used to detect tampering?

I've known some stuff about trusted platform modules for over six or seven years. I understand their usage in (un)wrapping keys and storing information in NVRAM which may then be locked permanently or ...
0
votes
1answer
3k views

Take ownership on TPM 2.0

When I try to take the ownership on my TPM 2.0, I run the tpm2_takeownership command. For the first time, I got this error: ./tpm2_takeownership -e 0123 -o 0123 -l 0123 ......Change Hierarchy Owner ...
6
votes
1answer
2k views

What does CRTM refer to?

The Definition of CRTM in TCG specification says: Typically, the RTM is the CPU controlled by the Core Root of Trust for Measurement (CRTM). The CRTM is the first set of instructions executed when ...
13
votes
1answer
1k views

How are TPMs provisioned for Intel Trusted Execution Environment (TXT)?

For Intel TXT to work, the TPM must be provisioned. Intel provides some tools for doing this but many are protected by non-public login or an NDA. Many OEM platform vendors provision their boards and ...
4
votes
1answer
2k views

How is the AIK TPM generated?

Here is what I understood from the AIK(Attestation Identity Key) generation the AIK is generated after the boot, when all the PCRs have been initialized. The algorithm will take some PCRs (not ...
2
votes
1answer
397 views

Chain of Trust Extension with TPM2.0

I am looking for a way to implement a trusted boot using a firmware TPM2.0 on Arch Linux. I am using TPM2.0-TSS, and tpm2-tools, however I cannot find a way to do this with tpm2-tools, as I do not ...
12
votes
2answers
7k views

Difference between TPM, TEE and SE

What is the difference between a Secure Element (SE), a Trusted Execution Environment (TEE) and a Trusted Platform Module (TPM)? I understand that they all refer to an external secure cryptoprocessor,...
3
votes
2answers
845 views

Decrypting keys wrapped by the Storage Root Key (SRK) of a TPM

Lets say I have a symmetric key wrapped with a storage root key (SRK) in a TPM. The SRK cannot be read by an attacker and so I perform the decryption and using the SRK and get the symmetric key in ...
3
votes
1answer
957 views

Is TPM ownership required for secure boot or measured boot?

I know: Secure Boot - can use the TPM Measured Boot - must use the TPM Can anyone intimately familiar with these processes explain if any TPM owner-authorized commands are required or used in these ...
1
vote
1answer
703 views

Is it OK to seal data to TPM SRK directly?

In reviewing various TPM programs and libraries, I have noticed that when sealing data to the TPM, a new key is always created (wrapped by the SRK), and that new key is loaded and used in the seal ...
1
vote
1answer
714 views

tpm sealing and secure boot

I have worked with TPM for a while, and I'm interested in some of its features. Especially sealing and the use of TPM's PCRs in the secure boot process. My question is: What is stopping an attacker ...
2
votes
1answer
237 views

TPM based authentication without a trusted third party

Consider a scenario - Device manufacture provides in advance the TPM’s endorsement key certificate(containing EK public key) for device to be deployed. In general, what are the TPM operations that ...
1
vote
1answer
439 views

In practice, does TPM SRK really be decrypted by EK first, before it decrypt its child keys

I know that TPM SRK was generated when user take TPM ownership, and it is encrypted by EK public part. All the child keys under SRK need to be loaded into TPM and decrypted by SRK before use. (These ...
4
votes
2answers
1k views

What, or who, exactly is a Certificate Authority (CA) for TPM attestation?

I'm learning about and researching the Trusted Platform Module (TPM) to incorporate into a solution involving remote machines. As I understand it: all attestation methods (AIK, DAA) still require ...
4
votes
0answers
99 views

how to create TPM_AUTHDATA as input in tpm commands ?

I'm writing my first program which use tpm (version 1.2) services in Windows 7 using TBS, in this program I'm trying to execute the TPM_CreateWrapKey command. I noticed that many commands like the ...
3
votes
1answer
907 views

Securely read encryption key from NVRAM of TPM 1.2

I have configured a disk encryption in linux using LUKS with TPM with secure boot. The encryption key is loaded from TPM from NV memory using command TPM_NV_ReadValueAuth. The problem is that it is ...
7
votes
1answer
391 views

How can one protect TPM firmware from tampering?

I know that a TPM includes ROM, nonvolatile (e.g. EEPROM), and volatile (e.g. SRAM) memories. The executable firmware is stored in ROM, such as various drivers and commands. But this time, I want to ...
8
votes
1answer
826 views

Issues/Vulnerabilities that TPM 2.0 aims to enhance/solve comparing to TPM 1.2

I have read some documents that comparing TPM 1.2 and TPM 2.0 (e.g. more supported algorithms like SHA-2, reduced code size, or even symmetric keys seems added, etc.) I want to ask that what are the ...