Questions tagged [trusted-computing]
Trusted Platform Module (TPM) and other protocols and components of trust in a computer or computer network
119
questions
1
vote
0
answers
66
views
How to wrap/unwrap with TPM2 endorsement key
I have a remote client A which wants to communicate securely with a server B having a discrete TPM. My understanding is that each TPM normally come with a endorsement key from manufacture like ...
- 11
1
vote
0
answers
109
views
Is it possible to see the pubkeys that pair with private keys inside the TPM in Windows?
Is it possible to inspect data (pubkeys, domain names used for webauthn, not private keys) related to private keys stored in the TPM on Windows?
I legally own the hardware and have maximum ...
- 423
3
votes
1
answer
407
views
How can an application, using Apple's Secure Enclave on macOS or TPM on Windows, protect itself from other applications accessing its private keys?
I'm interested in using Apple's Secure Enclave on macOS or TPM on Windows to protect cryptographic keys used by an application from being accessed by other applications running with the same or higher ...
- 56
2
votes
1
answer
138
views
Are TPM PCRs volatile, non-volatile, or both?
Do PCRs (Platform Configuration Registers) on TPMs (Trusted Platform Modules) retain their data on reboot?
I'm trying to find out if all (or some) of the PCRs on a TPM are volatile (will loose their ...
- 978
1
vote
0
answers
70
views
Is there any use case of DAA (Direct Anonymous Attestation) in TPM?
I want to know the use cases of DAA (Direct Anonymous Attestation) in the real world.
- 11
1
vote
1
answer
238
views
How to distribute Android mobile app functionality between OS, Trusted Execution Environment (TEE) and Secure Element (SE)?
There are different scenarios when it's about secure computation/storage on mobile devices, e.g., "REE only", "REE + TEE", or "REE + SE" or "REE + TEE + SE".
...
- 13
4
votes
1
answer
1k
views
Practicality of outsourcing password hashing using enclaves
I've been pondering some potential cybersecurity applications for enclaves. One of them being the problem of password hashing.
Some clients have enclave support, meaning part of their CPU can securely ...
- 280
3
votes
1
answer
8k
views
Understanding TPM PCRs, PCR banks, indexes and their relations
I'm reading about TPM, and I'm currently thinking how to visualize their relationships.
Basically, reading from https://link.springer.com/chapter/10.1007/978-1-4302-6584-9_12 (and the TPM documents) I ...
- 259
1
vote
0
answers
243
views
Hardware roots of trust nowadays
I find that names and terms used in relation to Trusted (Trustworthy, Confidential,..) Computing are highly interchanged and thus creating confusion for laymen as am I.
Trusted Computing has been ...
- 135
0
votes
0
answers
264
views
What is the difference betwen a Trusted Computing Base and a Root of Trust?
What is the difference betwen a Trusted Computing Base (TCB) and a Root of Trust (RoT)? Can both terms be used interchangeably?
A TCB is defined by the NIST as follows:
Totality of protection ...
- 127
2
votes
0
answers
229
views
Using TPM to generate certificates associated with different users on the same device
I plan to use the TPM to generate CSR's backed by a private key stored on the TPM. The CSR's will then be signed by an external HSM.
Since a certificate is tied to a particular private key, how do you ...
- 121
1
vote
0
answers
136
views
Can I damage my hardware TPM by improperly treating it?
I read somewhere that TPMs are not hard to be rendered useless or broken by improper use of its API, considering I have complete user access to it via the command line. Is that true? Could you give an ...
- 135
8
votes
3
answers
19k
views
What really is the difference between firmware TPM and a discrete one and should it be trusted more?
What really is the difference between a physical TPM and any implementation of a fTPM?
I get that both adhere to the same specification and in my mind should be the same thing, but then, I don't ...
- 135
2
votes
1
answer
106
views
Root of Trust - The general Mechanism of how RoT Authenticates higher levels of software
I've been reading many research articles about RoT - Root of Trust - for establishing a chained root of trust going up from BIOS to the Kernel.
However, most of the article go briefly on how RoT works ...
- 21
0
votes
1
answer
114
views
How to ensure integrity of program execution on foreign(someone else's) computer?
I want to run my computer program(or code) on someone else's computer(with permission from the owner of the computer) and get the results back. How can I make sure the owner is running my program only,...
1
vote
0
answers
302
views
In relation to TPM specification, what are (e.g.) Apple's T2 or Google's Titan chips?
I understand that TPM is a specification and devices conforming to it are called Trusted Platform Modules and they play an important role in trusted computing (as is defined by the same people who ...
- 135
2
votes
1
answer
942
views
What does a TPM have in common with smart cards?
The title really says it all. I'm starting to dig a little bit into computer security and from what I've watched or from what I have read in books or articles there's always a mention of basic smart ...
- 135
9
votes
1
answer
8k
views
What's the difference between the endorsement key and the attestation identity key within the TPM?
I'm trying to make notes about the TPM and what it does. More specifically I'm looking at the 3 RSA key pairs: the 'endorsement key', the 'storage root key' and the 'attestation identity key'.
This is ...
2
votes
1
answer
458
views
In an Arm TrustZone based Trusted Application (TA), how can a remote party tie an output to a particular TA?
I've been looking at the following figure which shows, with Arm TrustZone architecture, resources of a system can be divided into a Rich Execution Environment (REE) and a Trusted Execution Environment ...
- 187
4
votes
1
answer
317
views
What Trusted Execution Environment (TEE) solutions exist for mobile devices?
A trusted execution environment (TEE) provides a way for one to deploy tamper-proof programs on a device. The most prominent example of TEEs seem to be Intel SGX for PCs.
What I wonder is, if there ...
- 187
1
vote
0
answers
189
views
How can I create restricted signing key or attestation key and certify it in TPM 2.0?
I need to create an attestation key (AK) and use it to sign arbitrary data in TPM 2.0. The TCG Guidance documents, suggest that some TPMs may come pre-provisioned with an AK that is part of the ...
- 11
1
vote
0
answers
150
views
"Trusted memory" What does it mean?
It is often cited "to load from untrusted memory to a trusted system memory" when describing the secure boot process. I wonder, when can we consider a memory as "trusted"?
- 259
0
votes
0
answers
223
views
Bypassing Secure Boot in System on Chip
To bypass a secure boot for System on Chip (SoC), some attacks target the phase of copying the bootloader from where it is stored to the main memory. Instead, a malicious code will be copied to the ...
- 259
1
vote
1
answer
2k
views
Why authenticated boot not Secure boot?
Context: Secure boot is one of the important elements of Trusted Computing in computer system. One variety of the Secure boot is authenticated boot. While secure boot prevent the boot of a non trusted ...
- 259
6
votes
3
answers
2k
views
Is a cryptographically signing camera possible?
What kind of digital / cryptographic signing would make it possible to create a camera that cryptographically signs the photos it takes so that the images can be verified to have been taken with that ...
- 275
1
vote
1
answer
178
views
Using keys inside a secure enclave on a non trusted hardware and OS
Are secure enclaves like intel SGX protected from memory leaks? What if a non trusted privileged user dumps all the physical RAM memory. Is it possible to extract the keys in this way?
- 13
10
votes
2
answers
7k
views
What are the differences between HSM and SE?
What are the differences between a Hardware Security Module (HSM) and a Secure Element (SE)? Can both terms be used interchangeably?
I came across various related question (TPM vs. HSM and TPM vs. SE)...
- 127
3
votes
1
answer
1k
views
Where to store signing key in TPM
I'm using TPM 2.0 to do a remote attestation for a computer. In order to do that you have to generate a signing key from a primary key. This generate a public key and an encrypted private key. As per ...
- 33
3
votes
1
answer
883
views
Extra features required for TrustZone to provide main security features
The paper Trustworthy Execution on Mobile Devices: What Security Properties Can My Mobile Platform Give Me? describes 5 desired security features for mobile devices:
Isolated Execution
Secure Storage
...
- 149
0
votes
1
answer
1k
views
Asymmetric/Symmetric Encryption of a TPM key hierarchy
I know that keys in a TPM key hierarchy are encrypted with their parent keys. But I read that those parent keys (for instance an asymmetric SRK) need to have some symmetric secret for said encryption. ...
- 55
2
votes
1
answer
2k
views
Can I prove the relation between AIK and EK without asking to the TPM 2.0?
The Endorsement Key (EK), the Public part, is available directly on the TPM chip, I know that you can generate an AIK key and then sign with that key, the hash must be generated by the TPM.
The idea ...
- 23
1
vote
1
answer
819
views
Symmetric Keys for a TPM [duplicate]
I am currently researching the capabilities of TPM in creating and storing different kinds of cryptographic keys. I know that a TPM can create and store keys for asymmetric algorithms like RSA or ...
- 55
2
votes
1
answer
1k
views
With TPM how are the initial PCR values seeded with 'good' values?
I am trying to learn more about trusted boot / trusted platform modules and I understand about Platform Configuration Register (PCR) values being a measurement of a 'good' configuration signed by a ...
- 131
3
votes
0
answers
451
views
TPM - Device Softwareupdate - What happens to my sealed key?
Imagine having a device that has a TPM (Trusted Platform Module). This TPM is used to store keys. Some of these keys are sealed to PCR constraints, meaning that they can only be opened if the PCRs ...
- 261
2
votes
0
answers
1k
views
Use TPM 1.2 to store the private key of a certificate
Let's say I have an application that requires certificates (HTTPS, MQTTs, etc.) due to the use of TLS. I'm planning to build my own tier-1 PKI hierarchy with my own company CA signing device ...
- 261
4
votes
0
answers
3k
views
What is Silent Lake?
The Wikipédia's TEE entry mentions a hardware technology called Silent Lake that can support TEE implementations:
The following embedded hardware technologies can be used to support
TEE ...
- 657
1
vote
0
answers
94
views
TPM and trust in cloud provider [closed]
I'm kinda unclear and confused ,i'm searching on the subject of trusted module platform and i can resume the main tpm's functions are: authentication functions, integrity measurement functions and ...
user180095
0
votes
0
answers
266
views
TPM and the secret key
It's written that the TPM never allows these private keys to be exported outside the chip. This means that the only way to sign something with one of those keys is to use the computer to send a ...
user180095
1
vote
1
answer
585
views
TPM with the three main groups of functions
I’m a little unclear on this (marked strong):
"The public key authentication functions provide for on-chip key pair generation using a hardware
random number generator, along with public key ...
user180095
0
votes
2
answers
919
views
How does the TPM provide security for the cloud?
The primary scope of TPM is to assure the integrity of a platform. In
this context, "integrity" means "behave as intended". ~Wiki
I'm learning more about how the TPM performs integrity covering ...
user178521
1
vote
1
answer
459
views
Verifying that the CRTM is read-only for the purpose of trusted computing
When using a TPM to provide integrity measurements for a system via SRTM, the trusted computing base is reduced to only the TPM and CRTM. The CRTM is a component of the BIOS (specifically the ...
- 66.3k
2
votes
1
answer
176
views
Distinguishing features of TPM from software solutions
It's said that TPM is proposed to address issues that software alone cannot. To my understanding, this means TPM cannot be simulated using software. For example, as far as I know, TPM comes with a ...
- 121
1
vote
1
answer
432
views
TCG OPAL 2.0 Specification on technical Implementation?
Where can one find more technical information on the TCG OPAL 2.0 standard regarding how exactly the crypto has to been implemented in self encrypting drives?
I couldn't find OPAL 2.0 implementation ...
- 871
17
votes
1
answer
9k
views
What are the functional similarities and differences between TPM and SGX in trusted computing?
I know about the TPM (Trusted Platform Module). In recent years, more researchers start to develop on Intel SGX, which I do not have any experience with.
They are both crypto chips, but what are ...
- 838
1
vote
1
answer
385
views
Understanding differences between kernel-based TCB and micro-kernel TCB
Recently I've been learning the concept of trusted computing base, and I've seen 2 types of TCB:
Kernel-based TCB
Micro-kernel TCB
Where, from my understanding, the main difference is that in the ...
- 413
2
votes
1
answer
1k
views
Preventing new NVRAM areas from being defined in a TPM
Is there anyway to prevent new NVRAM areas from being defined on a TPM until the next reboot (similar to power-cycle types of protection)? The reason I ask is because firmware could check for NVRAM ...
- 247
2
votes
1
answer
216
views
what make a TEE secure?
A TEE implementation such developed in ARM trustzone OS is a carved out partition isolated from the main OS.
What makes such a TEE secure?
Is it the fact that the TEE is accessible only through a ...
- 131
2
votes
2
answers
202
views
Is ransomware that threatens with publication and verifiably deletes upon payment possible?
Inspired by the article The future of Ransomware and its description of possible ransomware with verifiable key delivery, I wonder if the idea can be taken further into ransomware that credibly ...
- 121
6
votes
1
answer
2k
views
How to reset the TPM PCRs?
I am working on the ATMEL TPM device on an embedded platform. While experimenting with the extend operation of the PCR, I extended the PCR 0 with a string of 20 bytes. As mentioned in the TPM ...
0
votes
1
answer
221
views
What do I need to ask 3rd party to add trust
We have ADFS and want to add a 3rd party application as trusted to it. I have certificate and metadata (xml) URI to give them but want to have a checklist what they need to give me. So far
HTTP ...
- 15