9 votes
Accepted

TPM: signing key or Attestation Identity Key?

AIKs are only allowed to perform two signature-based operations: TPM_Quote, which generates a signed statement of the state of the PCRs using an AIK; this is the operation used in remote attestation. ...
8 votes

Practicality of outsourcing password hashing using enclaves

While trusted execution environments are useful, I don't think that outsourcing password hashing from server to the client is the right approach. Either the server only has the hashed password for ...
4 votes

Is there any mechanism available in Android platform for remote attestation?

To my knowledge, no Android smartphones comes with a TPM. However, in theory, a TPM could be implemented in software within ARM's TrustZone but I never seen this in practice. Samsung KNOX offers this ...
  • 1,403
3 votes

What, or who, exactly is a Certificate Authority (CA) for TPM attestation?

I think you are certainly right, the verifier knows your TPM is trusted. In the DAA case the verifier cannot map TPM to user though. In AIK certificate enrollment, the Certificate Authority may well ...
2 votes

Is there any mechanism available in Android platform for remote attestation?

There are Android phones with hardware-backed storage. This is supported since Android 4.3, ie. mid 2013, (SDK18) over the KeyChain API. From the changelog: Android also now supports hardware-...
  • 129
2 votes

TPM - number of AIKs and signing key

The EK is unique for each TPM. If we would all be using the EK for TPM operations (remote attestation via TPM_Quote()), anyone could correlate our actions. In other words, anonymity wouldn't be ...
  • 1,403
2 votes

How to use TPM to perform platform authentication?

Just a minor correction to what northox said: remote attestation uses an AIK, and is what you need. You can get a properly-certified AIK using either a Privacy CA or DAA, depending on what you have ...
2 votes

How to verify that a host applied a firewall ruleset as is?

If the attacker has enough control of the host to manipulate your codes perception of the state of iptables then the host is compromised and you can't trust it at all! Iptables maybe patched to ...
  • 401
2 votes

Is ransomware that threatens with publication and verifiably deletes upon payment possible?

I don't see any way how this could be possible. When you have a copy of data, there is no way to prove that no other copy of that data exists, because you can not prove a negative. Trying to prove a ...
  • 48.9k
2 votes

Is ransomware that threatens with publication and verifiably deletes upon payment possible?

I don't think it's possible to prove that you DON'T know a piece of information. This is relevant to your question because in order to guarantee that he won't publish your files after payment is ...
  • 9,150
2 votes

Differences between Intel TXT and Linux IMA

No, they are complementary. DRTM provides a Root of Trust on which you can build applications/use-cases such as Integrity measurement of your entire linux system (IMA). However, it is not part of it. ...
  • 1,403
1 vote
Accepted

What's the feasibility of making a hostile TPM chip?

fundamentally if you can read bits you can clone them. Yes. But remote attestation relies on a signature, not just a hash. The signature is made by a private key which is located in the TPM, and you ...
1 vote
Accepted

TPM with the three main groups of functions

the TPM guarantees that malicious software cannot access the keys at all. Even the owner of the keys cannot give the private keys away to phishing or pharming attacks, as the keys are never visible ...
1 vote

Intel SGX - Remote attestation

The article Code Sample: Intel Software Guard Extensions Remote Attestation End-to-End Example (by John M. from Intel), describes an example of remote attestation. (The source code of most of the ...
1 vote

Using the TPM module to measure boot process and remote attestation

The TPM seals arbitrary data using a key derived from the state of its PCRs. It is up to you to tell if that data is correct. It could be a decryption key, so the disk can only be read when the PCRs ...
  • 64.6k
1 vote

How Can I know Which Files are Transfered From my System through team viewer?Unable to understand log files

First of all, make sure you secure the TeamViewer log files. Did you find the two files called Connections_incoming.txt TeamViewerX_Logfile.log on your machine? This is where TeamViewer logs its ...
  • 818
1 vote
Accepted

TPM based authentication without a trusted third party

TPM operations which need the EK: Take the ownership Clear the TPM Change the SRK Change the Owner(obviously) Allow SRK read using SRK auth (tpm_restrictsrk -a) Basically, these are all ...
  • 293
1 vote

What, or who, exactly is a Certificate Authority (CA) for TPM attestation?

A TPM is equipped with a key pair during manufacture. The private key is stored inside the TPM and it is physically protected by tamper-resistant technologies. The public key is certified. Given such ...
  • 117
1 vote
Accepted

How to verify that a host applied a firewall ruleset as is?

I agree with the previous answerers: one of the obvious steps is to do port scans and vulnerability scans from the external sides of the firewalls. Doing so isn't firing a silver bullet (as has been ...
1 vote

How to verify that a host applied a firewall ruleset as is?

Naked black box scanning (scanning from the outside with no network defenses in between) with a tool like SAINT or Nessus will give you a reasonable idea if the firewall is correctly configured. It ...
  • 1,615
1 vote

Is there any mechanism available in Android platform for remote attestation?

The current answers here are now out of date. The Google Pixel 2 now contains the hardware support for remote attestation, and has it's own variant to meets the needs of the TPM. "TEE - trusted ...
1 vote

Revoking AIK Key

AIKs are signed by Certificate Authorities (CA) and like any certificate, they can be revoked in the same way. Checking for revocation status is mandated by the TCG specification. See page 43.
  • 1,403

Only top scored, non community-wiki answers of a minimum length are eligible