4 ms·

Such as plugging in a TPM after boot and programming the PCRs however you want

by mjg59 3y ago

Nextgrid 3y ago
To be fair, firmware-based TPMs which are part of the CPU/SoC should be invulnerable to that? However, TPM-backed DRM on general-purpose OSes is impossible in the current world and is fear-mongering. The TPM can attest to a remote party that you've booted a certain OS, but this OS would need to maintain that chain of trust all the way for it to be effective. That's impossible due to the number of device drivers (which need kernel-level access by design) and various other privileged components a general-purpose OS requires (security software, etc), not to mention the attack surface of all that. For a hypothetical TPM-backed DRM to work, you'd need Netflix to ship you an entire OS image that you can boot (which the TPM will prove to them that you've booted), and that OS image needs to magically have all the drivers for every potential PC their customers might have, and you need to convince people to reboot their machine every time they want to watch it. This is all unnecessary considering the current status-quo of DRM is good enough, Widewine does not require a TPM and relies entirely on security by obscurity and it's considered good enough by the industry.
- mjg59 3y ago
  fTPMs are invulnerable to interposing attacks, but if you add a second TPM and program it as Windows (eg) would and redirect all remote attestation requests to that, the remote site has no way to know that this has happened.
  - Nextgrid 3y ago
    My understanding is that TPMs have vendor-embedded certificates/keys, so I guess eventually all discrete TPMs' keys will no longer be accepted by remotely-attestable services to protect against this attack - fTPM will be the only way. This is all theory though - workable TPM-backed DRM would require so much vendor cooperation, secure programming and break legitimate use-cases that it won't happen any time soon on conventional hardware. It would be cheaper for the media industry to just sell streaming boxes or exclusively target more locked-down platforms (iOS, Android) than try to make it work on generic Windows PCs.
    - Mindwipe 3y ago
      Or just use the existing hardware security features that don't let the OS see what's in the relevant video memory at all. But as you say, that's a much, much smaller attack surface than trying to validate the OS.
- immibis 3y ago
  > However, TPM-backed DRM on general-purpose OSes is impossible in the current world and is fear-mongering. The TPM can attest to a remote party that you've booted a certain OS, but this OS would need to maintain that chain of trust all the way for it to be effective Why don't you think that can work? Windows already limits drivers to ones signed by Microsoft - or else you have to be in "test mode" where - among other things - DRM-protected video playback is disabled! And Windows already contains a "protected media path" component which protects encrypted DRMed video data. Sure, there will probably be bugs in a drivers sometimes allowing for a signing bypass and then a DRM bypass if the DRM is done in software. Once they're discovered, those drivers will be blacklisted, and yes, that will mean you can't use that hardware. And the masses will blame the pirates.
  - Nextgrid 3y ago
    > Windows already limits drivers to ones signed by Microsoft I don't believe driver signature enforcement restricts what the driver can do, intentionally or as a result of a vulnerability. Maybe your driver intentionally allows user access to privileged kernel memory, or has a vulnerability that allows the same? Also, signing keys leak every so often.
  - mjg59 3y ago
    Microsoft has signed drivers that allow you to modify arbitrary kernel code, so.
  - Mindwipe 3y ago
    Because these things are all much, much harder than just passing the decryption to the graphics card which does not permit a userland OS to see what's going on, avoiding the OS entirely. And that already happens. And has happened for years. A TPM is useless for DRM on a general purpose computing platform because it is significantly inferior to existing widely deployed solutions.
    - immibis 3y ago
      Right now, 720p video is generally not protected because not everyone has a Hollywood-approved graphics card and monitor. If DRM becomes a software thing, they can protect all video.
- comex 3y ago
  > Widewine does not require a TPM and relies entirely on security by obscurity and it's considered good enough by the industry. Widevine's highest security level, L1, does not rely on security by obscurity. But it doesn't rely on a TPM either; rather, it relies on a trusted execution environment, like ARM TrustZone or Intel CSE[1], that is more highly privileged than the OS itself. Microsoft PlayReady is similar. Apple FairPlay, in contrast, is worse: it's disabled if you turn off Secure Boot on Macs. [1] https://www.intel.com/content/www/us/en/developer/articles/news/bring-premium-protected-content-to-chrome-os.html https://www.intel.com/content/www/us/en/developer/articles/n...
  - immibis 3y ago
    And it relies on that TEE having a trusted operating system. How do you get that? Secure boot.

Such as plugging in a TPM after boot and programming the PCRs however you want

by mjg59 3y ago

Such as plugging in a TPM after boot and programming the PCRs however you want

To be fair, firmware-based TPMs which are part of the CPU/SoC should be invulnerable to that? However, TPM-backed DRM on general-purpose OSes is impossible in the current world and is fear-mongering. The TPM can attest to a remote party that you've booted a certain OS, but this OS would need to maintain that chain of trust all the way for it to be effective. That's impossible due to the number of device drivers (which need kernel-level access by design) and various other privileged components a general-purpose OS requires (security software, etc), not to mention the attack surface of all that. For a hypothetical TPM-backed DRM to work, you'd need Netflix to ship you an entire OS image that you can boot (which the TPM will prove to them that you've booted), and that OS image needs to magically have all the drivers for every potential PC their customers might have, and you need to convince people to reboot their machine every time they want to watch it. This is all unnecessary considering the current status-quo of DRM is good enough, Widewine does not require a TPM and relies entirely on security by obscurity and it's considered good enough by the industry.

mjg59 3y ago
fTPMs are invulnerable to interposing attacks, but if you add a second TPM and program it as Windows (eg) would and redirect all remote attestation requests to that, the remote site has no way to know that this has happened.
- Nextgrid 3y ago
  My understanding is that TPMs have vendor-embedded certificates/keys, so I guess eventually all discrete TPMs' keys will no longer be accepted by remotely-attestable services to protect against this attack - fTPM will be the only way. This is all theory though - workable TPM-backed DRM would require so much vendor cooperation, secure programming and break legitimate use-cases that it won't happen any time soon on conventional hardware. It would be cheaper for the media industry to just sell streaming boxes or exclusively target more locked-down platforms (iOS, Android) than try to make it work on generic Windows PCs.
  - Mindwipe 3y ago
    Or just use the existing hardware security features that don't let the OS see what's in the relevant video memory at all. But as you say, that's a much, much smaller attack surface than trying to validate the OS.
immibis 3y ago
> However, TPM-backed DRM on general-purpose OSes is impossible in the current world and is fear-mongering. The TPM can attest to a remote party that you've booted a certain OS, but this OS would need to maintain that chain of trust all the way for it to be effective Why don't you think that can work? Windows already limits drivers to ones signed by Microsoft - or else you have to be in "test mode" where - among other things - DRM-protected video playback is disabled! And Windows already contains a "protected media path" component which protects encrypted DRMed video data. Sure, there will probably be bugs in a drivers sometimes allowing for a signing bypass and then a DRM bypass if the DRM is done in software. Once they're discovered, those drivers will be blacklisted, and yes, that will mean you can't use that hardware. And the masses will blame the pirates.
- Nextgrid 3y ago
  > Windows already limits drivers to ones signed by Microsoft I don't believe driver signature enforcement restricts what the driver can do, intentionally or as a result of a vulnerability. Maybe your driver intentionally allows user access to privileged kernel memory, or has a vulnerability that allows the same? Also, signing keys leak every so often.
- mjg59 3y ago
  Microsoft has signed drivers that allow you to modify arbitrary kernel code, so.
- Mindwipe 3y ago
  Because these things are all much, much harder than just passing the decryption to the graphics card which does not permit a userland OS to see what's going on, avoiding the OS entirely. And that already happens. And has happened for years. A TPM is useless for DRM on a general purpose computing platform because it is significantly inferior to existing widely deployed solutions.
  - immibis 3y ago
    Right now, 720p video is generally not protected because not everyone has a Hollywood-approved graphics card and monitor. If DRM becomes a software thing, they can protect all video.
comex 3y ago
> Widewine does not require a TPM and relies entirely on security by obscurity and it's considered good enough by the industry. Widevine's highest security level, L1, does not rely on security by obscurity. But it doesn't rely on a TPM either; rather, it relies on a trusted execution environment, like ARM TrustZone or Intel CSE[1], that is more highly privileged than the OS itself. Microsoft PlayReady is similar. Apple FairPlay, in contrast, is worse: it's disabled if you turn off Secure Boot on Macs. [1] https://www.intel.com/content/www/us/en/developer/articles/news/bring-premium-protected-content-to-chrome-os.html https://www.intel.com/content/www/us/en/developer/articles/n...
- immibis 3y ago
  And it relies on that TEE having a trusted operating system. How do you get that? Secure boot.