4 ms·

DRM is certainly a use case and was widely maligned as the idea behind early TEE / keystore concepts like Intel TPM, but they’re much more broadly useful. Commo

by bri3d 8y ago

DRM is certainly a use case and was widely maligned as the idea behind early TEE / keystore concepts like Intel TPM, but they’re much more broadly useful. Common use cases include trusted boot (verification of OS components in an environment an attacker can’t tamper with) and secure key management (private keys which aren’t accessible to even a root level attacker). Secure key management enables a variety of trust scenarios like machine level root identity for service to service authentication in the data center (see Google Titan). TEE with access to biometric hardware also provides strong user identity, as is the case in the iPhone where data can be encrypted using a key which is undiscoverable without access to the user’s biometrics like fingerprint or face print and theoretically impossible to exfiltrate for offline use.

jolmg 8y ago
> DRM is certainly a use case and was widely maligned as the idea behind early TEE / keystore concepts like Intel TPM As I recall from my skimming on the issue back then, and as I see from what was written on the issue in Wikipedia[1], the criticism circulated mostly around basically the possibility of a manufacturer like Intel requiring booted software to be trusted by them (IOW, trusting Windows but not Linux and others because money, further grounding Microsoft as a monopoly of consumer OSes): > The concerns include the abuse of remote validation of software (where the manufacturer‍—‌and not the user who owns the computer system‍—‌decides what software is allowed to run That's actually part of the "trusted boot" feature you mention, and not what allows for DRM. There were also concerns of: > possible ways to follow actions taken by the user being recorded in a database, in a manner that is completely undetectable to the user. But that seems like an issue with using closed source stuff in general, not specifically of TEEs. Anyway, I can see how DRM can always be maligned from a GNUish we-should-never-trust-closed-source perspective. While very much appreciate the ideals that GNU/FSF promotes, I worry a bit about the current trend of how software vendors prefer to provide software as a web service when it doesn't really provide any technical benefit from the user's perspective. I know there are other reasons for doing so, but it seems to me that a big reason for that trend is that it's the most effective and available way to avoid piracy. I wonder if widespread availability of TEEs (ones that wouldn't have the trusted boot issue mentioned) and a standard procedure like what I've mentioned in this SE question[2] could reverse that trend of further making the web an operating system, moving ownership/control of our data and processes from our own machines to various online entities. [1] https://en.wikipedia.org/wiki/Trusted_Platform_Module#Criticism https://en.wikipedia.org/wiki/Trusted_Platform_Module#Critic... [2] https://security.stackexchange.com/questions/199324/is-there-a-compiled-list-of-tee-trusted-execution-environment-manufacturer-ca https://security.stackexchange.com/questions/199324/is-there...
- nybble41 8y ago
  > I worry a bit about the current trend of how software vendors prefer to provide software as a web service when it doesn't really provide any technical benefit from the user's perspective. Given that I'm not going to have control over the software either way, I'd rather it were running on their hardware, safely isolated on the other side of an Internet link, than on hardware which I payed for and nominally own but which has been partitioned off for someone else's use. TEEs and TPMs have legitimate uses, but only so long as they are fully controlled by the owner of the device. That implies that there are no pre-installed keys which the owner doesn't control: to a remote exploiter, an emulated TEE/TPM should be indistinguishable from an official hardware device. Unfortunately this is not something that can be designed into the hardware, short of omitting the feature altogether, since non-owner-controlled keys could be installed at any point prior to final delivery. Erasing them after delivery is no good; the mere expectation that the manufacturer's key is present is enough to make treacherous remote attestation practical. Devices controlled by their owners should be the norm, not second-class citizens. The problem is ultimately a social one, not a technical one, but the technical capabilities of TEEs and TPMs are empowering the wrong side. From one point of view they may just be tools, but they're tools which are more readily used against the interests of device owners then for them.

by bri3d 8y ago

jolmg 8y ago

> DRM is certainly a use case and was widely maligned as the idea behind early TEE / keystore concepts like Intel TPM As I recall from my skimming on the issue back then, and as I see from what was written on the issue in Wikipedia[1], the criticism circulated mostly around basically the possibility of a manufacturer like Intel requiring booted software to be trusted by them (IOW, trusting Windows but not Linux and others because money, further grounding Microsoft as a monopoly of consumer OSes): > The concerns include the abuse of remote validation of software (where the manufacturer‍—‌and not the user who owns the computer system‍—‌decides what software is allowed to run That's actually part of the "trusted boot" feature you mention, and not what allows for DRM. There were also concerns of: > possible ways to follow actions taken by the user being recorded in a database, in a manner that is completely undetectable to the user. But that seems like an issue with using closed source stuff in general, not specifically of TEEs. Anyway, I can see how DRM can always be maligned from a GNUish we-should-never-trust-closed-source perspective. While very much appreciate the ideals that GNU/FSF promotes, I worry a bit about the current trend of how software vendors prefer to provide software as a web service when it doesn't really provide any technical benefit from the user's perspective. I know there are other reasons for doing so, but it seems to me that a big reason for that trend is that it's the most effective and available way to avoid piracy. I wonder if widespread availability of TEEs (ones that wouldn't have the trusted boot issue mentioned) and a standard procedure like what I've mentioned in this SE question[2] could reverse that trend of further making the web an operating system, moving ownership/control of our data and processes from our own machines to various online entities. [1] https://en.wikipedia.org/wiki/Trusted_Platform_Module#Criticism https://en.wikipedia.org/wiki/Trusted_Platform_Module#Critic... [2] https://security.stackexchange.com/questions/199324/is-there-a-compiled-list-of-tee-trusted-execution-environment-manufacturer-ca https://security.stackexchange.com/questions/199324/is-there...

nybble41 8y ago
> I worry a bit about the current trend of how software vendors prefer to provide software as a web service when it doesn't really provide any technical benefit from the user's perspective. Given that I'm not going to have control over the software either way, I'd rather it were running on their hardware, safely isolated on the other side of an Internet link, than on hardware which I payed for and nominally own but which has been partitioned off for someone else's use. TEEs and TPMs have legitimate uses, but only so long as they are fully controlled by the owner of the device. That implies that there are no pre-installed keys which the owner doesn't control: to a remote exploiter, an emulated TEE/TPM should be indistinguishable from an official hardware device. Unfortunately this is not something that can be designed into the hardware, short of omitting the feature altogether, since non-owner-controlled keys could be installed at any point prior to final delivery. Erasing them after delivery is no good; the mere expectation that the manufacturer's key is present is enough to make treacherous remote attestation practical. Devices controlled by their owners should be the norm, not second-class citizens. The problem is ultimately a social one, not a technical one, but the technical capabilities of TEEs and TPMs are empowering the wrong side. From one point of view they may just be tools, but they're tools which are more readily used against the interests of device owners then for them.