trusted-computing | 易学教程

How to load and use a persistent symmetric key in the TPM?

阅读更多关于 How to load and use a persistent symmetric key in the TPM?

问题 I simply want to store one 32 bytes long symmetric key persistently in the NV storage of the TPM and after a power-cycle, use it (without getting it out of the TPM) to encrypt small-sized data. I've tried to do that in two different ways: 1) Create the key with TPM's random bytes generator Define space in NV and write the key in it Problem : I know how to read it, but how can I load it so I can use it inside the TPM? 2) Create an AES key with TPM2_Create command Make it persistent with TPM2

Remotely Verifying the Application in execution

阅读更多关于 Remotely Verifying the Application in execution

问题 Is it possible to prove to the remote party that the application I am running in my system is the same as I am claiming that I am running using DRTM or SRTM? If yes then How? 回答1: Theoretically: yes. The concept is called remote attestation. The basic idea is: First you have a sound chain of trust built on your platform, like: BIOS ==> Boot loader ==> OS ==> Applications The resulting measurements are stored in the PCRs. Now you can let the TPM sign this set of PCRs, that's called quote . You

How to extend the running application into PCR?

阅读更多关于 How to extend the running application into PCR?

问题 How to extend the running application into PCR? and Which PCR can be used for it? 回答1: I assume you mean a TPM version 1.2 on a PC platform, so the following specification documents are of interest for you: TPM Main Part 2 TPM Structures TCG PC Client Specific TPM Interface Specification (TIS) Now to your questions: "How to extend the running application into PCR?" You need some piece of software that identifies " the running application " (= measure ) and issue a TPM_Extend command to the

Intel SGX developer licensing and open-source software

阅读更多关于 Intel SGX developer licensing and open-source software

问题 Is it possible to obtaining a licensed developer certificate for signing security-reviewed, community-developed open source SGX software binary in production mode, and publish it on open source repository like apt or rpm? I just asked Intel SGX team, they said only verified vendors are able to obtain a certificate and run in production mode. It just like Apple’s App Store, no open source code allowed, right? 回答1: Well, it's possible, but it's a quite complicated task, You will need to

Which PCR can be extended by our own code?

阅读更多关于 Which PCR can be extended by our own code?

问题 As there are 24 PCR's in TPM 1.2 specification. Some of these PCRs are reserved and cannot be extended by user's code. Below are the PCR Index their PCR Usage CRTM, BIOS and Platform Extensions Platform Conguration Option ROM Code Option ROM Conguration and Data IPL7Code (MBR Information and Bootloader Stage 1) IPL Code and Conguration Data (for use by IPL Code) State Transition and Wake Events Reserved for future usage. Do not use. Bootloader Stage 2 Part 1 Bootloader Stage 2 Part 2 Not in

Remotely Verifying the Application in execution

阅读更多关于 Remotely Verifying the Application in execution

Is it possible to prove to the remote party that the application I am running in my system is the same as I am claiming that I am running using DRTM or SRTM? If yes then How? Theoretically: yes. The concept is called remote attestation. The basic idea is: First you have a sound chain of trust built on your platform, like: BIOS ==> Boot loader ==> OS ==> Applications The resulting measurements are stored in the PCRs. Now you can let the TPM sign this set of PCRs, that's called quote . You can submit this quote to a remote entity. Here the problems start: How can you proof that the quote was

How to encrypt bytes using the TPM (Trusted Platform Module)

阅读更多关于 How to encrypt bytes using the TPM (Trusted Platform Module)

How can I encrypt bytes using a machine's TPM module? CryptProtectData Windows provides a (relatively) simple API to encrypt a blob using the CryptProtectData API, which we can wrap an easy to use function: public Byte[] ProtectBytes(Byte[] plaintext) { //... } The details of ProtectBytes are less important than the idea that you can use it quite easily: here are the bytes I want encrypted by a secret key held in the System give me back the encrypted blob The returned blob is an undocumented documentation structure that contains everything needed to decrypt and return the original data (hash

Signed executables under Linux

阅读更多关于 Signed executables under Linux

For security reasons, it is desirable to check the integrity of code before execution, avoiding tampered software by an attacker. So, my question is How to sign executable code and run only trusted software under Linux? I have read the work of van Doom et al. , Design and implementation of signed executables for Linux , and the IBM's TLC (Trusted Linux Client) by Safford & Zohar. TLC uses TPM controller, what is nice, but the paper is from 2005 and I was unable to find current alternatives. Do you know another options? UPDATE : And about other OS's? OpenSolaris? BSD family? The DigSig kernel

How to encrypt bytes using the TPM (Trusted Platform Module)

阅读更多关于 How to encrypt bytes using the TPM (Trusted Platform Module)

问题 How can I encrypt bytes using a machine's TPM module? CryptProtectData Windows provides a (relatively) simple API to encrypt a blob using the CryptProtectData API, which we can wrap an easy to use function: public Byte[] ProtectBytes(Byte[] plaintext) { //... } The details of ProtectBytes are less important than the idea that you can use it quite easily: here are the bytes I want encrypted by a secret key held in the System give me back the encrypted blob The returned blob is an undocumented

Signed executables under Linux

阅读更多关于 Signed executables under Linux

问题 For security reasons, it is desirable to check the integrity of code before execution, avoiding tampered software by an attacker. So, my question is How to sign executable code and run only trusted software under Linux? I have read the work of van Doom et al. , Design and implementation of signed executables for Linux , and the IBM's TLC (Trusted Linux Client) by Safford & Zohar. TLC uses TPM controller, what is nice, but the paper is from 2005 and I was unable to find current alternatives.