3 ms·

RSA Keys Generated by Infineon TPMs Are Insecure

6 points by jlgaddis 9y ago

jlgaddis 9y ago
Summary: > Lenovo Security Advisory: LEN-15552 > Potential Impact: RSA keys generated by the Infineon TPM using certain firmware levels are insecure > Severity: Varies: None to High > Scope of Impact: Industry-Wide --- FYI, when submitting this I linked to Lenovo's informational page about this issue instead of the original vendor's page [0] since it doesn't really contain much useful information. (mods: feel free to change the URL) I also found some technical information (although mostly ChromeOS-specific) about this issue in a Google document [1]. Links to information from other vendors: Fujitsu [2], HP [3], Microsoft Windows [4]. [0]: https://www.infineon.com/TPM-update https://www.infineon.com/TPM-update [1]: https://sites.google.com/a/chromium.org/dev/chromium-os/tpm_firmware_update https://sites.google.com/a/chromium.org/dev/chromium-os/tpm_... [2]: http://www.fujitsu.com/global/support/products/software/security/products-f/ifsa-201701e.html http://www.fujitsu.com/global/support/products/software/secu... [3]: https://support.hp.com/us-en/document/c05792935 https://support.hp.com/us-en/document/c05792935 [4]: https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/ADV170012 https://portal.msrc.microsoft.com/en-us/security-guidance/ad...
julian_1 9y ago
Will upgrading the firmware fix already generated keys?
- jlgaddis 9y ago
  No, any keys generated on the TPM need to be re-generated (cf. Microsoft's advisory).
  - julian_1 9y ago
    That's interesting. The Windows firmware update works by entirely bypassing the hardware. I wonder if other fabricators could have licensed the same core ip.? > Microsoft is releasing Windows security updates to help work around the vulnerability by logging events and by allowing the generation of software based keys.
mtgx 9y ago
Wasn't Infineon bought by Intel?
- jlgaddis 9y ago
  Just part of it, AFAICT: > On 31 January 2011, the sale of the business segment of wireless solutions to Intel was completed. [0] [0]: https://en.wikipedia.org/wiki/Infineon_Technologies#Acquisitions_and_divestitures https://en.wikipedia.org/wiki/Infineon_Technologies#Acquisit...

6 points by jlgaddis 9y ago

Summary: > Lenovo Security Advisory: LEN-15552 > Potential Impact: RSA keys generated by the Infineon TPM using certain firmware levels are insecure > Severity: Varies: None to High > Scope of Impact: Industry-Wide --- FYI, when submitting this I linked to Lenovo's informational page about this issue instead of the original vendor's page [0] since it doesn't really contain much useful information. (mods: feel free to change the URL) I also found some technical information (although mostly ChromeOS-specific) about this issue in a Google document [1]. Links to information from other vendors: Fujitsu [2], HP [3], Microsoft Windows [4]. [0]: https://www.infineon.com/TPM-update https://www.infineon.com/TPM-update [1]: https://sites.google.com/a/chromium.org/dev/chromium-os/tpm_firmware_update https://sites.google.com/a/chromium.org/dev/chromium-os/tpm_... [2]: http://www.fujitsu.com/global/support/products/software/security/products-f/ifsa-201701e.html http://www.fujitsu.com/global/support/products/software/secu... [3]: https://support.hp.com/us-en/document/c05792935 https://support.hp.com/us-en/document/c05792935 [4]: https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/ADV170012 https://portal.msrc.microsoft.com/en-us/security-guidance/ad...

julian_1 9y ago

Will upgrading the firmware fix already generated keys?

jlgaddis 9y ago
No, any keys generated on the TPM need to be re-generated (cf. Microsoft's advisory).
- julian_1 9y ago
  That's interesting. The Windows firmware update works by entirely bypassing the hardware. I wonder if other fabricators could have licensed the same core ip.? > Microsoft is releasing Windows security updates to help work around the vulnerability by logging events and by allowing the generation of software based keys.

mtgx 9y ago

Wasn't Infineon bought by Intel?

jlgaddis 9y ago
Just part of it, AFAICT: > On 31 January 2011, the sale of the business segment of wireless solutions to Intel was completed. [0] [0]: https://en.wikipedia.org/wiki/Infineon_Technologies#Acquisitions_and_divestitures https://en.wikipedia.org/wiki/Infineon_Technologies#Acquisit...