116
We can analyze your setup by comparing it against a system known to be not tamper proof, the Sony PlayStation 3.
OS control
You have no control over the OS. Sony did write the OS themselves.
Size of the OS
The PS3 OS can be very simple as it just needs to boot games. Windows is a generic OS, with many, many functions. This exposes many API's.
Shell
The ...
89
There are too many things that can be done at the OS level. That's the actual problem. There are numerous ways to launch processes and/or explore the system. One important aspect is that it looks like you failed to consider is running everything from a non-admin account. Also, you did not mention anything about USB, other peripherals, F-keys, default ...
39
It sounds like you're creating an arcade machine. In that case, learn from the companies who actually make and sell arcade machines, and Use Windows Embedded instead of the desktop version.
Using TPM + full-disk encryption is a good start. You should also remove as many Windows components you're not using as possible, and lock down as many access surfaces ...
36
Trusted Platform Modules
A Trusted Platform Module (TPM) is a hardware chip on the computer’s motherboard that stores cryptographic
keys used for encryption. Many laptop computers include a TPM, but if
the system doesn’t include it, it is not feasible to add one. Once
enabled, the Trusted Platform Module provides full disk encryption
...
30
This is not secure. The hardware is under the control of the user, so they can always find a way.
I'm assuming that TPM is meant to prevent the user from starting another OS (like Ubuntu) from CD, DVD or USB. This is a good precaution.
However... the user can still remove the harddisk, and put it in another computer. Then they can read the harddisk. So you ...
28
Sorry, but I think there are some gaps in this conversation:
TPMs can't be added later : False. Many modern motherboards include a header to which a TPM can be added after the fact. Visit Amazon and look at the TPM modules cards for MSI, Asus, and other motherboards
HSMs are typically removed or network attached : False. HSMs can be embedded in a range ...
27
Some ideas of attack against that:
Windows normally comes with a Repair mode. It may be more or less easy to activate it (ref., but if it is possible the user can make the computer start in command line mode -> do not forget to filter the cmd.exe program in addition to explorer.exe
TPM may be weaker than what you expect, and successful attacks have already ...
25
It depends on your threat model. A TPM has multiple purposes, but the most common purpose is measured boot. That is, a TPM will verify the integrity of the BIOS, option ROMs, bootloader, and other sensitive boot components so that it is able to detect an evil maid attack or modified firmware. If your threat model includes an adversary which is able to modify ...
23
The difference between using some hardware backed key store (i.e. TPM, HSM, smartcard ...) and a "pure software" solution like openssl genrsa is not so much about the security of the key generation but about the security of the key storage.
HSM and similar are designed to never actually provide the created private key but only do operations like ...
21
First let's layout the different definitions:
TPM is a piece of Hardware specifically created to do crypto calculation with. It is physically isolated from the rest of the processing system and is often a separated IC on the mainboard to be so.
TEE is an area on the chipset that works like a TPM, but is not physically isolated from the rest of the chip.
SE ...
19
Only one attack is enough to prove that it's insecure, right?
Press the Shift key 5 times. A dialog will pop up, asking if you want to activate some feature for disabled persons.
On that dialog, click the link to go to the Control Center for accessibility.
In that dialog, click in the address bar
type cmd Enter
Here's the screenshot in a German system:
...
14
Well first off, SGX is not a crypto chip. It is a feature built into Intel chipsets themselves, whereas the TPM is often a discrete chip positioned on the LPC bus, though sometimes it can be emulated in the chipset (in which case it's called fTPM, for firmware TPM, or iTPM, for integrated TPM). On Intel processors, an integrated TPM will be present for any ...
13
It's complicated.
Both are Root of Trust for Measurements meaning they can be used to measure the running environment.
The main problem with SRTM is that you need to keep measurements of the entire platform boot sequence (BIOS config, 3rd party boot rom (e.g. network cards), etc) and this includes a LOT of code. Any change to any of this requires new ...
13
The purpose of a TPM module is to ensure that there is absolutely no way to obtain the keys stored on it. Whether or not it actually fulfills that purpose is a topic for another question. For now let's assume that it works as designed. That means when the TPM module is destroyed, so is the key, and so is any hope to decrypt the data encrypted with it.
...
11
How does memory encryption impact DMA attacks?
Full-memory encryption is not designed to protect against DMA attacks. That is what an IOMMU is for. The IOMMU is configured using a type of ACPI table for DMA Remapping, or DMAR. This table contains a list of regions used by each DMA-capable device connected to the PCH. The IOMMU will then restrict memory ...
10
Boot Process
Secure Boot
There are quite a few steps to booting Windows 8. Now secure boot in general means that the boot loader is only run if its integrity can be checked. In this case, if enabled, the UEFI is started before anything else and checks that the boot loader is signed by a trusted Certificate Authority. For an operating system generally ...
10
Unfortunately there is not a single source of truth about attestation. I'll try to make it as clear as possible and cite when necessary.
TL;DR: The Endorsement Key is used to prove that you are talking to a real TPM. However, it cannot be used for signing. The AK can be used for signing and is associated with the EK.
Endorsement Key
You can consider the ...
9
AIKs are only allowed to perform two signature-based operations:
TPM_Quote, which generates a signed statement of the state of the PCRs using an AIK; this is the operation used in remote attestation.
TPM_CertifyKey, which generates a signed statement that another key (not the AIK) is in the TPM's storage hierarchy and is non-migratable. (Obviously, the key ...
9
Briefly, no.
There's a lot of problem with this diagram so I'll start by trying to clear things up before talking about your question.
SRTM ~ the left part of your diagram
The diagram propose the AC module would measure the processor which isn't right. The BIOS CRTM (Bios Boot Block) is executed by the CPU and used to measure the BIOS firmware. Then, it ...
9
Let's take a look at the Android Developer docs "Android keystore system". We'll need to break this down depending on how you use the KeyStore object. If you're using the Android KeyStore KeyStore.getInstance("AndroidKeyStore"), then:
1) If the device the app is running on has hardware-backed secure storage, then
Key material may be bound to the secure ...
8
If the TPM 'breaks' or becomes otherwise inaccessible, all cryptography dependent on keys stored by the TPM also breaks. This is the most concise and inclusive way I could think to put it.
I say 'cryptography' because the TPM does more than just encryption. Encryption is just one use of cryptography, as are signatures, authentication, etc.
The TPM stores ...
7
A little more on the functional aspects:
TPM is fixed, well-specified functionality by an ISO and TCG standard. You can‘t just add or change this.
Usually it‘s a discrete security chip connected through SPI to the host uC.
TEE is (as explained by the previous posters) an execution environment on a larger chip/SoC, but the code running inside this TEE, is ...
7
CRTM is saved in the Platform Configuration Registers (PCR), register 0 to be more precise (PCR-0). CRTM is (physically) embedded into chip silicon and provided by the BIOS, but is a logical part of the TBB (Trusted Building Block). The measurement itself is stored in PCR0.
In order to fully understand how CRTM works, you should study the chain of trust in ...
6
The most direct answer to your question is that the TPM doesn't do the measurements. The measurements and PCR values are completely proprietary to the platform in which the TPM is installed.
The other answers are great at describing this process for some well established systems, but in short, the TPM just stores/updates 160-bit SHA hashes and seals keys ...
6
As others have said, this cannot be considered secure. You can however remove the 'low hanging fruit', both to reduce the chances of your software being stolen and to ensure your users experience is positive.
Your primary goal is to protect software sold with the hardware.
First, ensure you have designed your hardware in such a way as only authorized ...
6
If it isn't in the spec it isn't in there. The question is if you need it if e.g. the NIST SP 800-108 KDF in counter mode is present. That's a fine KDF even if it lacks explicit extract / expand steps and salt. So I think you are only in big trouble if you need
extract functionality;
HKDF because of protocol compatibility.
There seems to be HMAC, but that ...
5
The TPM is used to seal the LUKS secret and nothing else. Once decrypted by the TPM (i.e. the proper environment has been loaded) the secret is stored in RAM hence it can be captured by coldboot attacks.
You can look at any documentation about Bitlocker with or without a PIN depending on your setup and the same will apply to tpm-luks, e.g. wikipedia.
The ...
5
The Intel TXT is a complex system designed to provide a hardware layer of security that can prevent software layer changes from resulting in increased access for attackers. Through use of stored hashes of known good states for firmware, bios, and OS loads, TXT can indicate when something has changed outside of a known good state. This is helpful for ...
5
First of all, my condolences for your loss! Hope you're alright.
If I understood correctly, your general concern is how to totally prevent further stolen device usage (and/or sale) by a criminal.
In this case, this question won't ever have any answer that would age well, because whenever your machine becomes unreachable physically, the only way to ensure ...
Only top voted, non community-wiki answers of a minimum length are eligible