8 ms·

Technical Introduction to the Use of Trusted Platform Module 2.0 with Linux [pdf]

67 points by 0xdeadb00f 5y ago

dane-pgp 5y ago
> tboot (Trusted Boot) is one of the applications related to TPM 2.0 that uses Intel TXT to create an MLE (Measured Launch Environment) to verify a kernel or a hypervisor For people worried that governments will one day start mandating the use of "approved" operating systems, this will no doubt be reassuring, as it means Linux distros will be able to apply for inclusion on the whitelist.
- tasogare 5y ago
  The fact you can install Linux doesn't mean a government won't force you to use another OS by other mean. Looking at the current news in France which is nominally a democracy, that could include forcing one to take unpaid work leave, denying access to vital (supermarkets) and social places (restaurants, any entertainment facility) and even hospital.
  - eliaspro 5y ago
    Which seems like a rather reasonable measure to keep people from spreading a dangerous disease for which they refuse to get vaccinated against.
    - gruez 5y ago
      That's why you have to use one of the operating systems on the NSA Certified Secured Operating Systems list, which contain antivirus software[1]. It's a rather reasonable measure, because it keeps computers from spreading dangerous worms/viruses/ransomware for which they refuse to get to protection against. [1] https://news.ycombinator.com/item?id=27917105 https://news.ycombinator.com/item?id=27917105
    - deleted 5y ago
      [deleted]
    - alexseman 5y ago
      oh give me a break...
    - vetinari 5y ago
      Given that experience has shown that vaccinated people can spread the same disease as well AND they are more reckless because they think that they are immune now, I would not consider that a reasonable measure. Now it seems more like punishment for not obeying the government, and less like health concern.
      - tasogare 5y ago
        Yes, and the biggest proof of this is hospitals will soon impose the sanitary pass (from 1st August). If the pass was really about public health of the population, hospitals would be the last place to be restricted.
      - cartoonworld 5y ago
        The vaccinated people can spread the disease like you can still get herpes when you use a condom. FYI, condoms grant you a 30% reduction of infection rate for the relevant type. We should definitely be vaccinated, and in in doing so, using the power and strengths of modern society to reap the benefits we are supposedly living in it for the purpose of creating for ourselves in the first place. Vaccinated people can spread the virus, but the rates are much[0] less[4] because the immune system is actively controlling[1] the outbreak. Viral load correlates strongly with ones ability to transmit Sars-CoV-2[5] This beats my herpes example like electricity beats wood gas for lighting. Vaccinated people get and transmit the Sars-CoV-2 virus at much lower rates[3, page 10][4], and essentially never become very ill. Death is not the only effect of Sars-CoV-2, it has a variety of negative effects from the mild, to the bad, onward to the extremely taxing COVID, and critical hospitalization. This is aside from other secondary social, psychological and economic impacts. If you rate the risk of death as fine and think we should just take a chance, everybody in the world feeling very ill for a few weeks is not nothing. Those people are air traffic controllers, doctors, mechanics, chefs, pilots, nuclear safety officers, police, etc and their normal operation matters for the operation of society. [0] - https://www.medrxiv.org/content/10.1101/2021.07.12.21260377v1 https://www.medrxiv.org/content/10.1101/2021.07.12.21260377v... [1] - https://www.nature.com/articles/s41591-021-01316-7 https://www.nature.com/articles/s41591-021-01316-7 [3] - March 2021 representing early evidence: https://www.ecdc.europa.eu/sites/default/files/documents/Risk-of-transmission-and-reinfection-of-SARS-CoV-2-following-vaccination.pdf https://www.ecdc.europa.eu/sites/default/files/documents/Ris... [4] - https://www.medrxiv.org/content/10.1101/2021.03.11.21253275v1 https://www.medrxiv.org/content/10.1101/2021.03.11.21253275v... [5] - https://www.sciencedirect.com/science/article/pii/S1473309920309853 https://www.sciencedirect.com/science/article/pii/S147330992...
    - penultimatebro 5y ago
      Now just solve for people that have had the dangerous disease, have recovered from it, and now are arguably better protected from variants than the vaccinated.
      - deegles 5y ago
        You can argue for anything you believe in, but that doesn't make it true. https://www.cdc.gov/coronavirus/2019-ncov/vaccines/faq.html https://www.cdc.gov/coronavirus/2019-ncov/vaccines/faq.html
    - loup-vaillant 5y ago
      It is not at all clear that we French were actually refusing to get vaccinated. First, it would seem the least vaccinated people were generally the poorest as well. The vaccine is free, but we generally need to get an appointment through some web site, on our own initiative. Our appointed family doctor did not call us to even ask whether we'd like to be vaccinated. This hints towards an accessibility problem. Second, when you look at the charts https://covidtracker.fr/vaccintracker/ https://covidtracker.fr/vaccintracker/ (Click the "Injections Quotidiennes" tab on the second figure.), you can see that the daily injection didn't fall. It merely plateaued. Sure, first injections did fall, but they did so at the same time second injections were soaring, so they compensated each other. This plateau suggests our vaccination centres were simply functioning at (or close to) full capacity. Third, on July the 12th, at the time our President made his speech about restricting everyone's freedom (including the vaccinated, since you'd have to present your digital pass basically everywhere to basically anyone), they were justifying our "Reluctance" by quoting vaccination rate across the whole population, which was around 52%. What they didn't say is that this stats includes children under 12, for which vaccination is simply not available, and teenagers, for which our CCNE (Comité Consultatif National d'Éthique) said on June the 9th that it was not clear teenage vaccination was safe enough https://www.ccne-ethique.fr/fr/actualites/enjeux-ethiques-relatifs-la-vaccination-contre-la-covid-19-des-enfants-et-des-adolescents https://www.ccne-ethique.fr/fr/actualites/enjeux-ethiques-re... It's only reasonable under these circumstances to exclude all underage people from the statistics. I found that the vaccination rate among adults was almost reaching 70%, and climbing. My conclusion: what our president is attempting is utterly disproportionate and unjustified. Don't get me wrong, we are facing a fourth wave right now. Maybe something does indeed need to be done. But a digital pass? https://www.youtube.com/watch?v=fCUTX1jurJ4 https://www.youtube.com/watch?v=fCUTX1jurJ4 No thanks.
      - 908B64B197 5y ago
        > The vaccine is free, but we generally need to get an appointment through some web site, on our own initiative. Our appointed family doctor did not call us to even ask whether we'd like to be vaccinated. This hints towards an accessibility problem. Just put walk-in vaccination stands in super-markets/subway stations. Why exactly is there a need for an appointment to get a 30 second jab + 15 minute observation period?
- no_time 5y ago
  This doesn't reassure me at all. Linux can be just as oppressive as windows if configured accordingly.
decodebytes 5y ago
Anyone interested in leveraging a TPM, it's worth a look at the open source project https://keylime.dev https://keylime.dev In regards to dane-pgp highlighting Intel TXT / tboot, Keylime does not use this. It measures via grub and a uefi shim (for measure boot) for run time file monitoring, it uses the Linux Kernels IMA.
ratiolat 5y ago
I'm really interested in instructions which would enable storage encryption key to be stored in the TPM so Linux could have the similar user friendly flow as MacOS and Windows with Bitlocker has - boot up computer, storage is decrypted automatically so user only needs to know username and password. If storage is removed from computer or booted from "untrusted source", storage stays "locked". Backup key, for recovery purposes, needs to be stored in a password vault/physical safe/some external system. The same as it is with MacOS Filevault/Microsoft Windows Bitlocker.
- zer0-c00l 5y ago
  This exists. https://wiki.archlinux.org/title/Trusted_Platform_Module#Data-at-rest_encryption_with_LUKS https://wiki.archlinux.org/title/Trusted_Platform_Module#Dat...
- WhyNotHugo 5y ago
  Honestly, I think providing the disk decryption password during early boot is a lot safer. If the TPM yields the decryption key, then the disk is mounted without the user being present, so any RUNTIME security hole can be exploited by the attacker (e.g.: USB exploits, etc). The Mac/Windows model just seems less-safe (though more friendly for shared devices). I would like a shared system though: where I provide half the key, and the TPM has the other half, so BOTH are necessary to decrypt the disk.
  - michaelt 5y ago
    Just keying in the password at boot is indeed more secure than using a TPM, when it comes to the threat of someone snatching your powered-off laptop. But if you want full disk encryption for a server without the need to attend it in person to enter the password every time it restarts, you might feel the middling security a TPM provides is an improvement over not encrypting the disk at all. Or if you issue a big fleet of laptops to forgetful users, and remote password reset is a must-have feature, the TPM is more secure than the user writing the password on a post-it note stuck to the laptop. Or if you're making something like a TiVo where you want it to work without a password - while also locking down the device, even against the owner. So TPMs are great if you're a big corporation!
WhyNotHugo 5y ago
> The EK is a 2048-bit RSA key pair used as a cryptographic identity to distinguish and authenticate an individual TPM. This seems risky. Aside from not being very privacy-friendly, I can image all sort of shady scenarios, like apps only running if you're using hardware from a certain vendor. Also sounds like it makes a TPM2 for VMs a no-go.
- chousuke 5y ago
  There are ways to generate an anonymous proof that a TPM module is certified genuine by its manufacturer, without leaking the actual identity of the individual device. Using TPM2 in VMs means you either pass through the hardware to the VM or use a software TPM module that's managed by the hypervisor. I've had to dig in to TPM2 somewhat lately, and honestly the biggest problem with it is that it's too damn flexible, so it's really difficult to tell how to use one properly. There are a dozen concepts that you need to understand before you can even begin to make sense of any documentation.
  - raxxorrax 5y ago
    There is a key for the TPM chip that authenticates it. It is a unique identifier you cannot change. How can this be anonymized?
    - gruez 5y ago
      AFAIK it's accomplished by having two keys in the TPM. One is unique to the TPM, and the other is unique to the manufacturer/batch of TPMs.
      - raxxorrax 5y ago
        True, I found it in the manual. There is the ECC-based Direct Anonymous Attestation, but the paper is behind a paywall right now. My country (GER) currently wants to force OS developers to block sites not intended for children by default. TPM is a mechanism that could facilitate such restrictions. Imagine all content on the net would check that the boot loader of your device is locked and that you use a state approved OS. See the dangers here? Even if the chance of success is low, boot sector attacks by ransomware, currently the most prominent threat, are extreme rare, I don't know of any case to be honest. This infrastructure decreases security for free and general computing to such a degree, that the threat from boot sector or bios attacks is laughable at best.
raxxorrax 5y ago
I don't really think TPM can offer me reasonable security. The result is clear already, some apps refuse to run if you don't have TPM because they need to make sure you cannot freely modify your own devices. We see the same strategy on mobile phones. So sorry, the "security advantage" isn't worth it as I could achieve the same with other methods. And I need to expect severe disadvantages. https://seclab.stanford.edu/pcl/cs259/projects/cs259_final_lavina_jayesh/CS259_report_lavina_jayesh.pdf https://seclab.stanford.edu/pcl/cs259/projects/cs259_final_l... We need tools to fake it, like we do in our jobs. There are other ways, but also your device gets a unique identifier that you cannot change. This is "security" done wrong as described in the textbook. This WILL be used as a DRM component.
- gruez 5y ago
  >I don't really think TPM can offer me reasonable security >So sorry, the "security advantage" isn't worth it as I could achieve the same with other methods. And I need to expect severe disadvantages. The main security benefits to me are for full-disk encryption: 1. it ensures the bootloader isn't compromised so I know I'm not giving my FDE encryption keys to a bootkit 2. I can use a simpler/more memorable password because entry attempts have to go through the TPM, rather than being able to be bruteforced with a GPU cluster. I'm not sure how what the "other methods" for accomplishing these are. >The result is clear already, some apps refuse to run if you don't have TPM because they need to make sure you cannot freely modify your own devices. We see the same strategy on mobile phones. >This WILL be used as a DRM component. Resisting TPM isn't really going to change much. All the major CPUs produced today (intel, amd, most ARM vendors) all have trusted execution environments, which does everything a TPM can do and more. They're also already required for many DRM schemes (eg. intel SGX for watching netflix 4k, arm trustzone for widevine L1).
  - ajklsdhfniuwehf 5y ago
    > 2. I can use a simpler/more memorable password because entry attempts have to go through the TPM, rather than being able to be bruteforced with a GPU cluster. this is already the case with every single open source encryption model out there. You have a simple password which then encodes the true key. Nothing will save you from GPU cluster brute forcing it, if the adversary have your harddrive.
fsflover 5y ago
See also: Purism's laptop with TPM designed for Linux, where you are always in control of your keys: https://news.softpedia.com/news/purism-now-sells-the-most-secure-linux-laptops-with-heads-integrated-tpm-chips-519976.shtml https://news.softpedia.com/news/purism-now-sells-the-most-se...
- vinsci 5y ago
  I'd be cautious with that, as the Purism security guy is not necessarily a free man to do what is best for the customers of Purism. He needs assistance, support and protection from abusive people, and small popes.
pengaru 5y ago
Lately I've been experimenting with storing my kernel+initrd in an encrypted usb thumbdrive w/integrated keypad [0]. My laptop now has no bootable disks and simply enters the BIOS boot menu when powered on without something bootable on usb, everything internal is just a dmcrypt volume. This is just a way for me to help ensure my boot bits haven't been replaced or otherwise tampered with, while still letting me still trivially build/modify kernels and initrds just by unlocking the thumbdrive and inserting it. It also has the nice side effect of not leaving the boot storage attached continuously, I have to explicitly make it available when I intend to update those components. When booting, I generally yank it the moment I see systemd's version print on the console. It's also trivial to use a keyfile on the encrypted usb drive, so once the usb is unlocked and inserted, the laptop just boots to login. But then you're really relying on the black box thumbdrive for protecting secrets, vs. uninteresting boot bits you're just trying to prevent from getting replaced. Another kind of interesting UX with the DT2000 is since it has a battery, you can unlock the drive anywhere (perhaps with more privacy, or just less visibility of doing something interesting), then bring it to the laptop. I'm not saying this is a super secure solution or anything, it's just a somewhat interesting way to boot (and unlock if using a keyfile) a FDE machine which has proven to at least not be super annoying. [0] https://www.kingston.com/unitedstates/us/usb-flash-drives/datatraveler-2000-encrypted-usb-flash-drive https://www.kingston.com/unitedstates/us/usb-flash-drives/da...
- pengaru 5y ago
  Too late to edit, but forgot to mention the DT2000 also supports a read-only mode. So if desired, in regular usage for boot purposes, it's not writable. It then needs to explicitly be switched to read-write via the keypad when performing kernel/initrd updates, if configured as such.
  - vinsci 5y ago
    Ah, paranoia is a good motivator to learn more. You might want to see this[1], for example. I think his solution is likely to be a trap, ie. not actually safe, but the presentation is at least a good example of how complicated it is to get security right. [1] Open Source is Insufficient to Solve Trust Problems in Hardware [video] https://media.ccc.de/v/36c3-10690-open_source_is_insufficient_to_solve_trust_problems_in_hardware https://media.ccc.de/v/36c3-10690-open_source_is_insufficien...
alksjdalkj 5y ago
I always see people claim that TPMs will enable DRM, but aren't we already subject to plenty of DRM? There's a lot of content that I'm blocked from accessing because I use Firefox on Linux, and AFAIK none of that DRM makes use of my TPM. What kind of DRM are people worried the TPM will enable, that we aren't already subject to?
- nvllsvm 5y ago
  > AFAIK none of that DRM makes use of my TPM Right, because plenty of modern machines do not have a TPM or do not have it enabled. There's little sense in using a TPM for some users when many others can bypass the TPM restrictions by using hardware without. > What kind of DRM are people worried the TPM will enable, that we aren't already subject to? Over protective applications which refuse to run when a machine is deemed "insecure". I don't have an example of this on PC, but there are plenty of Android apps which refuse running on rooted devices.
  - alksjdalkj 5y ago
    My point is that's already happening now, so I don't understand the fear that TPMs will enable some sort of draconian DRM. They don't enable anything that isn't already possible with respect to DRM and locking down machines.
    - no_time 5y ago
      Remote attestation of machine parameters, which is arguably even worse than the DRM aspect is not yet possible on PCs to my knowledge.
anonymousDan 5y ago
Does anyone know of a good performance analysis of modern TPMs? I'm particularly interested in persistent counter performance and durability.
- strstr 5y ago
  Physical TPMs are crazy slow (though fTPMs might be reasonable). Is that a performance analysis? Not really, but if you are looking for performance look elsewhere.

67 points by 0xdeadb00f 5y ago

> tboot (Trusted Boot) is one of the applications related to TPM 2.0 that uses Intel TXT to create an MLE (Measured Launch Environment) to verify a kernel or a hypervisor For people worried that governments will one day start mandating the use of "approved" operating systems, this will no doubt be reassuring, as it means Linux distros will be able to apply for inclusion on the whitelist.

tasogare 5y ago
The fact you can install Linux doesn't mean a government won't force you to use another OS by other mean. Looking at the current news in France which is nominally a democracy, that could include forcing one to take unpaid work leave, denying access to vital (supermarkets) and social places (restaurants, any entertainment facility) and even hospital.
- eliaspro 5y ago
  Which seems like a rather reasonable measure to keep people from spreading a dangerous disease for which they refuse to get vaccinated against.
  - gruez 5y ago
    That's why you have to use one of the operating systems on the NSA Certified Secured Operating Systems list, which contain antivirus software[1]. It's a rather reasonable measure, because it keeps computers from spreading dangerous worms/viruses/ransomware for which they refuse to get to protection against. [1] https://news.ycombinator.com/item?id=27917105 https://news.ycombinator.com/item?id=27917105
  - deleted 5y ago
    [deleted]
  - alexseman 5y ago
    oh give me a break...
  - vetinari 5y ago
    Given that experience has shown that vaccinated people can spread the same disease as well AND they are more reckless because they think that they are immune now, I would not consider that a reasonable measure. Now it seems more like punishment for not obeying the government, and less like health concern.
    - tasogare 5y ago
      Yes, and the biggest proof of this is hospitals will soon impose the sanitary pass (from 1st August). If the pass was really about public health of the population, hospitals would be the last place to be restricted.
    - cartoonworld 5y ago
      The vaccinated people can spread the disease like you can still get herpes when you use a condom. FYI, condoms grant you a 30% reduction of infection rate for the relevant type. We should definitely be vaccinated, and in in doing so, using the power and strengths of modern society to reap the benefits we are supposedly living in it for the purpose of creating for ourselves in the first place. Vaccinated people can spread the virus, but the rates are much[0] less[4] because the immune system is actively controlling[1] the outbreak. Viral load correlates strongly with ones ability to transmit Sars-CoV-2[5] This beats my herpes example like electricity beats wood gas for lighting. Vaccinated people get and transmit the Sars-CoV-2 virus at much lower rates[3, page 10][4], and essentially never become very ill. Death is not the only effect of Sars-CoV-2, it has a variety of negative effects from the mild, to the bad, onward to the extremely taxing COVID, and critical hospitalization. This is aside from other secondary social, psychological and economic impacts. If you rate the risk of death as fine and think we should just take a chance, everybody in the world feeling very ill for a few weeks is not nothing. Those people are air traffic controllers, doctors, mechanics, chefs, pilots, nuclear safety officers, police, etc and their normal operation matters for the operation of society. [0] - https://www.medrxiv.org/content/10.1101/2021.07.12.21260377v1 https://www.medrxiv.org/content/10.1101/2021.07.12.21260377v... [1] - https://www.nature.com/articles/s41591-021-01316-7 https://www.nature.com/articles/s41591-021-01316-7 [3] - March 2021 representing early evidence: https://www.ecdc.europa.eu/sites/default/files/documents/Risk-of-transmission-and-reinfection-of-SARS-CoV-2-following-vaccination.pdf https://www.ecdc.europa.eu/sites/default/files/documents/Ris... [4] - https://www.medrxiv.org/content/10.1101/2021.03.11.21253275v1 https://www.medrxiv.org/content/10.1101/2021.03.11.21253275v... [5] - https://www.sciencedirect.com/science/article/pii/S1473309920309853 https://www.sciencedirect.com/science/article/pii/S147330992...
  - penultimatebro 5y ago
    Now just solve for people that have had the dangerous disease, have recovered from it, and now are arguably better protected from variants than the vaccinated.
    - deegles 5y ago
      You can argue for anything you believe in, but that doesn't make it true. https://www.cdc.gov/coronavirus/2019-ncov/vaccines/faq.html https://www.cdc.gov/coronavirus/2019-ncov/vaccines/faq.html
  - loup-vaillant 5y ago
    It is not at all clear that we French were actually refusing to get vaccinated. First, it would seem the least vaccinated people were generally the poorest as well. The vaccine is free, but we generally need to get an appointment through some web site, on our own initiative. Our appointed family doctor did not call us to even ask whether we'd like to be vaccinated. This hints towards an accessibility problem. Second, when you look at the charts https://covidtracker.fr/vaccintracker/ https://covidtracker.fr/vaccintracker/ (Click the "Injections Quotidiennes" tab on the second figure.), you can see that the daily injection didn't fall. It merely plateaued. Sure, first injections did fall, but they did so at the same time second injections were soaring, so they compensated each other. This plateau suggests our vaccination centres were simply functioning at (or close to) full capacity. Third, on July the 12th, at the time our President made his speech about restricting everyone's freedom (including the vaccinated, since you'd have to present your digital pass basically everywhere to basically anyone), they were justifying our "Reluctance" by quoting vaccination rate across the whole population, which was around 52%. What they didn't say is that this stats includes children under 12, for which vaccination is simply not available, and teenagers, for which our CCNE (Comité Consultatif National d'Éthique) said on June the 9th that it was not clear teenage vaccination was safe enough https://www.ccne-ethique.fr/fr/actualites/enjeux-ethiques-relatifs-la-vaccination-contre-la-covid-19-des-enfants-et-des-adolescents https://www.ccne-ethique.fr/fr/actualites/enjeux-ethiques-re... It's only reasonable under these circumstances to exclude all underage people from the statistics. I found that the vaccination rate among adults was almost reaching 70%, and climbing. My conclusion: what our president is attempting is utterly disproportionate and unjustified. Don't get me wrong, we are facing a fourth wave right now. Maybe something does indeed need to be done. But a digital pass? https://www.youtube.com/watch?v=fCUTX1jurJ4 https://www.youtube.com/watch?v=fCUTX1jurJ4 No thanks.
    - 908B64B197 5y ago
      > The vaccine is free, but we generally need to get an appointment through some web site, on our own initiative. Our appointed family doctor did not call us to even ask whether we'd like to be vaccinated. This hints towards an accessibility problem. Just put walk-in vaccination stands in super-markets/subway stations. Why exactly is there a need for an appointment to get a 30 second jab + 15 minute observation period?
no_time 5y ago
This doesn't reassure me at all. Linux can be just as oppressive as windows if configured accordingly.

decodebytes 5y ago

Anyone interested in leveraging a TPM, it's worth a look at the open source project https://keylime.dev https://keylime.dev In regards to dane-pgp highlighting Intel TXT / tboot, Keylime does not use this. It measures via grub and a uefi shim (for measure boot) for run time file monitoring, it uses the Linux Kernels IMA.

ratiolat 5y ago

I'm really interested in instructions which would enable storage encryption key to be stored in the TPM so Linux could have the similar user friendly flow as MacOS and Windows with Bitlocker has - boot up computer, storage is decrypted automatically so user only needs to know username and password. If storage is removed from computer or booted from "untrusted source", storage stays "locked". Backup key, for recovery purposes, needs to be stored in a password vault/physical safe/some external system. The same as it is with MacOS Filevault/Microsoft Windows Bitlocker.

zer0-c00l 5y ago
This exists. https://wiki.archlinux.org/title/Trusted_Platform_Module#Data-at-rest_encryption_with_LUKS https://wiki.archlinux.org/title/Trusted_Platform_Module#Dat...
WhyNotHugo 5y ago
Honestly, I think providing the disk decryption password during early boot is a lot safer. If the TPM yields the decryption key, then the disk is mounted without the user being present, so any RUNTIME security hole can be exploited by the attacker (e.g.: USB exploits, etc). The Mac/Windows model just seems less-safe (though more friendly for shared devices). I would like a shared system though: where I provide half the key, and the TPM has the other half, so BOTH are necessary to decrypt the disk.
- michaelt 5y ago
  Just keying in the password at boot is indeed more secure than using a TPM, when it comes to the threat of someone snatching your powered-off laptop. But if you want full disk encryption for a server without the need to attend it in person to enter the password every time it restarts, you might feel the middling security a TPM provides is an improvement over not encrypting the disk at all. Or if you issue a big fleet of laptops to forgetful users, and remote password reset is a must-have feature, the TPM is more secure than the user writing the password on a post-it note stuck to the laptop. Or if you're making something like a TiVo where you want it to work without a password - while also locking down the device, even against the owner. So TPMs are great if you're a big corporation!

WhyNotHugo 5y ago

> The EK is a 2048-bit RSA key pair used as a cryptographic identity to distinguish and authenticate an individual TPM. This seems risky. Aside from not being very privacy-friendly, I can image all sort of shady scenarios, like apps only running if you're using hardware from a certain vendor. Also sounds like it makes a TPM2 for VMs a no-go.

chousuke 5y ago
There are ways to generate an anonymous proof that a TPM module is certified genuine by its manufacturer, without leaking the actual identity of the individual device. Using TPM2 in VMs means you either pass through the hardware to the VM or use a software TPM module that's managed by the hypervisor. I've had to dig in to TPM2 somewhat lately, and honestly the biggest problem with it is that it's too damn flexible, so it's really difficult to tell how to use one properly. There are a dozen concepts that you need to understand before you can even begin to make sense of any documentation.
- raxxorrax 5y ago
  There is a key for the TPM chip that authenticates it. It is a unique identifier you cannot change. How can this be anonymized?
  - gruez 5y ago
    AFAIK it's accomplished by having two keys in the TPM. One is unique to the TPM, and the other is unique to the manufacturer/batch of TPMs.
    - raxxorrax 5y ago
      True, I found it in the manual. There is the ECC-based Direct Anonymous Attestation, but the paper is behind a paywall right now. My country (GER) currently wants to force OS developers to block sites not intended for children by default. TPM is a mechanism that could facilitate such restrictions. Imagine all content on the net would check that the boot loader of your device is locked and that you use a state approved OS. See the dangers here? Even if the chance of success is low, boot sector attacks by ransomware, currently the most prominent threat, are extreme rare, I don't know of any case to be honest. This infrastructure decreases security for free and general computing to such a degree, that the threat from boot sector or bios attacks is laughable at best.

raxxorrax 5y ago

I don't really think TPM can offer me reasonable security. The result is clear already, some apps refuse to run if you don't have TPM because they need to make sure you cannot freely modify your own devices. We see the same strategy on mobile phones. So sorry, the "security advantage" isn't worth it as I could achieve the same with other methods. And I need to expect severe disadvantages. https://seclab.stanford.edu/pcl/cs259/projects/cs259_final_lavina_jayesh/CS259_report_lavina_jayesh.pdf https://seclab.stanford.edu/pcl/cs259/projects/cs259_final_l... We need tools to fake it, like we do in our jobs. There are other ways, but also your device gets a unique identifier that you cannot change. This is "security" done wrong as described in the textbook. This WILL be used as a DRM component.

gruez 5y ago
>I don't really think TPM can offer me reasonable security >So sorry, the "security advantage" isn't worth it as I could achieve the same with other methods. And I need to expect severe disadvantages. The main security benefits to me are for full-disk encryption: 1. it ensures the bootloader isn't compromised so I know I'm not giving my FDE encryption keys to a bootkit 2. I can use a simpler/more memorable password because entry attempts have to go through the TPM, rather than being able to be bruteforced with a GPU cluster. I'm not sure how what the "other methods" for accomplishing these are. >The result is clear already, some apps refuse to run if you don't have TPM because they need to make sure you cannot freely modify your own devices. We see the same strategy on mobile phones. >This WILL be used as a DRM component. Resisting TPM isn't really going to change much. All the major CPUs produced today (intel, amd, most ARM vendors) all have trusted execution environments, which does everything a TPM can do and more. They're also already required for many DRM schemes (eg. intel SGX for watching netflix 4k, arm trustzone for widevine L1).
- ajklsdhfniuwehf 5y ago
  > 2. I can use a simpler/more memorable password because entry attempts have to go through the TPM, rather than being able to be bruteforced with a GPU cluster. this is already the case with every single open source encryption model out there. You have a simple password which then encodes the true key. Nothing will save you from GPU cluster brute forcing it, if the adversary have your harddrive.

fsflover 5y ago

See also: Purism's laptop with TPM designed for Linux, where you are always in control of your keys: https://news.softpedia.com/news/purism-now-sells-the-most-secure-linux-laptops-with-heads-integrated-tpm-chips-519976.shtml https://news.softpedia.com/news/purism-now-sells-the-most-se...

vinsci 5y ago
I'd be cautious with that, as the Purism security guy is not necessarily a free man to do what is best for the customers of Purism. He needs assistance, support and protection from abusive people, and small popes.

pengaru 5y ago

Lately I've been experimenting with storing my kernel+initrd in an encrypted usb thumbdrive w/integrated keypad [0]. My laptop now has no bootable disks and simply enters the BIOS boot menu when powered on without something bootable on usb, everything internal is just a dmcrypt volume. This is just a way for me to help ensure my boot bits haven't been replaced or otherwise tampered with, while still letting me still trivially build/modify kernels and initrds just by unlocking the thumbdrive and inserting it. It also has the nice side effect of not leaving the boot storage attached continuously, I have to explicitly make it available when I intend to update those components. When booting, I generally yank it the moment I see systemd's version print on the console. It's also trivial to use a keyfile on the encrypted usb drive, so once the usb is unlocked and inserted, the laptop just boots to login. But then you're really relying on the black box thumbdrive for protecting secrets, vs. uninteresting boot bits you're just trying to prevent from getting replaced. Another kind of interesting UX with the DT2000 is since it has a battery, you can unlock the drive anywhere (perhaps with more privacy, or just less visibility of doing something interesting), then bring it to the laptop. I'm not saying this is a super secure solution or anything, it's just a somewhat interesting way to boot (and unlock if using a keyfile) a FDE machine which has proven to at least not be super annoying. [0] https://www.kingston.com/unitedstates/us/usb-flash-drives/datatraveler-2000-encrypted-usb-flash-drive https://www.kingston.com/unitedstates/us/usb-flash-drives/da...

pengaru 5y ago
Too late to edit, but forgot to mention the DT2000 also supports a read-only mode. So if desired, in regular usage for boot purposes, it's not writable. It then needs to explicitly be switched to read-write via the keypad when performing kernel/initrd updates, if configured as such.
- vinsci 5y ago
  Ah, paranoia is a good motivator to learn more. You might want to see this[1], for example. I think his solution is likely to be a trap, ie. not actually safe, but the presentation is at least a good example of how complicated it is to get security right. [1] Open Source is Insufficient to Solve Trust Problems in Hardware [video] https://media.ccc.de/v/36c3-10690-open_source_is_insufficient_to_solve_trust_problems_in_hardware https://media.ccc.de/v/36c3-10690-open_source_is_insufficien...

alksjdalkj 5y ago

I always see people claim that TPMs will enable DRM, but aren't we already subject to plenty of DRM? There's a lot of content that I'm blocked from accessing because I use Firefox on Linux, and AFAIK none of that DRM makes use of my TPM. What kind of DRM are people worried the TPM will enable, that we aren't already subject to?

nvllsvm 5y ago
> AFAIK none of that DRM makes use of my TPM Right, because plenty of modern machines do not have a TPM or do not have it enabled. There's little sense in using a TPM for some users when many others can bypass the TPM restrictions by using hardware without. > What kind of DRM are people worried the TPM will enable, that we aren't already subject to? Over protective applications which refuse to run when a machine is deemed "insecure". I don't have an example of this on PC, but there are plenty of Android apps which refuse running on rooted devices.
- alksjdalkj 5y ago
  My point is that's already happening now, so I don't understand the fear that TPMs will enable some sort of draconian DRM. They don't enable anything that isn't already possible with respect to DRM and locking down machines.
  - no_time 5y ago
    Remote attestation of machine parameters, which is arguably even worse than the DRM aspect is not yet possible on PCs to my knowledge.

anonymousDan 5y ago

Does anyone know of a good performance analysis of modern TPMs? I'm particularly interested in persistent counter performance and durability.

strstr 5y ago
Physical TPMs are crazy slow (though fTPMs might be reasonable). Is that a performance analysis? Not really, but if you are looking for performance look elsewhere.