3 ms·
I found something that concerns me a lot at the "announced" link at the start of the article. http://blogs.msdn.com/b/b8/archive/2011/09/22/protecting-the-pre-
by gwillen 15y ago
I found something that concerns me a lot at the "announced" link at the start of the article.
http://blogs.msdn.com/b/b8/archive/2011/09/22/protecting-the-pre-os-environment-with-uefi.aspx http://blogs.msdn.com/b/b8/archive/2011/09/22/protecting-the...
If you look at the diagram, it appears that Remote Attestation is being brought back. For those of you who weren't around, or weren't paying attention, during the first Trusted Computing War, that means something like the following:
- You try to log on to your bank's website
- Your bank queries your TPM
- Your TPM sends back a signed hash attesting that you're running an unmodified version of Windows 8
- The bank lets you on
Versus:
- You try to log on to your bank's website
- Your bank queries your TPM
- Your TPM sends back a signed hash attesting that you're running an unmodified version of RedHat Linux
- The bank denies your login for violating the security policy
- There is NOTHING you can do about it, short of taking an electron microscope to your TPM to extract the keys.
Of course, none of this is possible as long as there are a nontrivial number of people whose machines aren't capable of Remote Attestation. But it's likely that every machine you've bought in the last 5 years has a TPM with this capability, which means that as soon as Windows 8 and UEFI Secure Boot have critical mass, Remote Attestation will have critical mass too. And then it will start showing up in security requirements for banks and other secure applications. And then the Linux users will start to feel the heat...
- albertzeyer 15y agoIsn't it always possible to just fake that Remote Attestation request? Or I wonder, how would it be possible to implement that in a way that it is non-breakable security wise / cryptographically?
- a3_nm 15y agoIf the private key is stored on the TPM chip, if the crypto takes place on the TPM chip, and if the remote service knows your public key (or, more likely, a master key which signed your key), then you won't be able to break the scheme by intercepting the request. Of course, even though the general scheme might be sound, there might still be a lot of possible attacks. I'm not saying it's unbreakable.
- albertzeyer 15y agoAh ok. But probably it also wont take long until the private key from the TPM chips gets hacked.
- mjg59 15y agoThe TPM-based measured boot isn't part of the UEFI secure boot specification. It's a separate TCG spec. Secure boot doesn't use the TPM and doesn't support remote (or even local) attestation.
- gwillen 15y agoInteresting. It still worries me to see it in the "Windows 8 Platform Integrity Architecture". Are you not worried about it, or just pointing out that it's not relevant to the topic at hand?
- mjg59 15y agoLots of (especially cheaper) machines ship without a TPM, so it's difficult for anything to explicitly require it yet. It's something to be concerned about in future, but not an immediate issue.