Upload
others
View
7
Download
0
Embed Size (px)
Citation preview
Copyright© 2004 Trusted Computing Group - Other names and brands are properties of their respective owners. Slide #1
TCG 101
Boot Camp9 November 2004
Slide #2
Terminology• Trust
– An entity can be trusted if it always behaves in the expected manner for the intended purpose
Slide #3
What is TCG Technology• Defines a set of services
– Trusted Platform Module = a TPM– Adding protocols and messages that take advantage of
the TPM• The TPM cannot be moved
– Attached to the platform• The TPM contains
– cryptographic engine– protected storage
• Functions and storage are isolated– Provides a “Trust Boundary”
Slide #4
TCG Doc RoadmapTCG DocumentationRoadmap & GlossaryTCG DocumentationRoadmap & Glossary
Architectural Overview
Architectural Overview
Platform-SpecificDesign Guide
Platform-SpecificDesign Guide
TCG Main Specification Parts 1-4
TCG Main Specification Parts 1-4
PC Platform Specification
PC Platform Specification
PC Platform Compliance
PC Platform Compliance
Server Specification
Server Specification
Server Compliance
Server Compliance
Mobile Phone Specification
Mobile Phone Specification
Mobile PhoneCompliance
Mobile PhoneCompliance
OtherPlatformOther
Platform
OtherCompliance
OtherCompliance
TCG Software Stack
(TSS)
TCG Software Stack
(TSS)
ISO-15408 Common Criteria Protection Profiles
- Normative Reference -
Common Criteria
Rev: 1.4
Common Criteria
Common Evaluation
Methodology
Common Evaluation
Methodology
Slide #5
TCG Main Spec Roadmap
Part 1Design Philosophies
Part 1Design Philosophies
Part 3TPM Commands
Part 3TPM Commands
Part 4Test Vectors
Part 4Test Vectors
Part2TPM Structures
Part2TPM Structures
ISO-15408 Common Criteria Protection Profile
Rev 1.1
- Normative Reference -
Slide #6
What is the heart of TCG?• TCG defines TPM’s functionality
– Protected capabilities– Shielded locations
• Not the implementation– Vendors are free to differentiate the
TPM implementation– Must still meet the protected
capabilities and shielded locations requirements
TPMTPM
Slide #7
MCH
TCG PC Client H/W Design
• In 1.1b all designs used the LPC bus– LPC bus was not
required• In 1.2 all designs
MUST use the LPC bus
ICH
AGP
NetworkPort
LPC
RemoteAgent
network
TPM
CPU
RAM
BIOS
TPM is connected to the motherboard
Slide #8
Basic TPM Block Diagram
RNGRNGRSARSA
EngineEngine
NonNon--VolatileVolatile
StorageStorage
Key Key
GenerationGeneration
PlatformPlatform
ConfigurationConfiguration
Register (PCR)Register (PCR)
OptOpt--InIn
SHASHA--11
Trusted Platform Module (TPM)Trusted Platform Module (TPM)
PackagingPackaging
I/OI/O
Exec EngineExec Engine Program CodeProgram Code
Volatile Volatile
StorageStorage
AIKAIK
Slide #9
Functional TPM Diagram• Root of Trust for Reporting RTR
– Provides cryptographic mechanism to digitally sign TPM state and information
• Root of Trust for Storage RTS– Provides cryptographic
mechanism to protect information held outside of the TPM
• Root of Trust for Measurement– Provided by platform to measure platform state– Defined by platform specification
• Interaction between RTR and RTS is important TPM capability
TPM
RTRRTR RTSRTS
Shielded LocationsShielded Locations
Protected CapabilitiesProtected
Capabilities
RTMRTM
Slide #10
Generic Architecture
• TPM attached to platform• Credentials held outside TPM
– Endorsement credential normally provided by TPM manufacturer
– Platform credential normally provided by platform manufacturer
– Conformance credential provided by lab
• TPM can load and use a virtually unlimited number of AIK, signature and encryption keys
TPM
Platform
Platform Credential
Conformance Credential
Endorsement Credential
TPM
PCR
Endorsement Key (EK)
AttestationID Keys
Signature keys
Encryption keys
Slide #11
• Each TPM has a unique EK• The EK is a 2048-bit RSA key• The EK is generated:
– When the entity that issues the EK credential has control and is willing to certify the creation of the EK
• There are mechanisms to change the EK
Endorsement Key (EK) Details
• The EK only participates in two operations– Taking TPM ownership– Creation of Attestation Identity Keys
TPM
Platform
Platform Credential
Conformance Credential
Endorsement Credential
TPM
PCR
Endorsement Key (EK)
AttestationID Keys
Signature keys
Encryption keys
Slide #12
Persistent Keys• Endorsement Key (EK)
– Not part of the key hierarchy
• Storage Root Key (SRK)– All keys are protected by
this key• Root of Key Hierarchy
– Changed on new owner
TPM
Platform
Platform Credential
Conformance Credential
Endorsement Credential
TPM
PCR
EK AttestationID Keys
Signature keys
Encryption keys
SRK
Slide #13
Key HierarchyStorage Root Key
(SRK)
Non-Migratable Storage Key
Migratable Storage Key
Endorsement Key
Migratable Storage Key
Migratable Signing Key
Migratable Signing Key
Non-Migratable Storage Key
Non-Migratable Signing Key
Migratable Signing or Storage Key
Attestation ID Keys
Migratable Signing or Storage Key
Protected by the RTS
Protected by the TPM
Slide #14
Key Types and Classes• Storage Keys
– Protects keys or external data
• Signing Keys– Digital signatures
• Attestation Identity Keys (AIKs)– Special Signing keys– Provides attestation
• Non-Migratable Keys– Permanently bound specific
TPM, i.e., platform
• Migratable Keys– Can be migrated to other
platforms
• Certified Migratable Keys– Can be migrated to only
“certified” authorities
Slide #15
PCR Definition• Platform Configuration Registers (PCR)• Store measurement values in a fixed amount of space
– Size of PCR is 160-bits or the result of a SHA operation– 1.2 PC TPM requires 24 PCR
• Outside entities never write directly to the PCR they must use the Extend operation– Extend is [PCRnew] = SHA-1 ( [PCRold] + extend value)– A property of SHA-1 is that it is infeasible to calculate a value A
such that• PCRdesired = Extend (A)
Slide #16
PCR Types• Two PCR
– Static• Reset on TPM_Startup (ST_CLEAR)• Default value 0x00..00• PC TPM has 16 static PCR (0-15)
– Dynamic• Reset on TPM_PCRReset or any TPM_Init• Default value 0xff..ff• PC TPM has 8 dynamic PCR (16-23)
Slide #17
Sealing Data to the TPM
• Send data, authorization value and requested PCR value– Not the PCR value at the
time of sealing• TPM encrypts data to
create a bound blob– Including the request PCR
values• Blob stored outside TPM
LocalStorage
SealedData
AuthMaterial
Data
Config
Storage key
TPM
PCR
Slide #18
Unsealing Data
• Load sealed blob into TPM– Send in authorization values to
use storage key
• TPM decrypts blob• After decryption TPM validates
that current PCR values match requested PCR values in sealed blob
• Data only returned on matchLocal
StorageSealedData
AuthMaterial
Data
Storage key
TPM
PCR
Slide #19
Transitive TrustRTM Component 1
Code
Data
Component 2Code
Data
Stored Measurement
Log 1. RTM measures component1
11
Event Structure1
Event Data
Extend Value
2. RTM creates event structure
22
3. RTM stores event in SML
33
4. RTM extends PCR with value
5. Comp1 measures component2
55
Event Structure2
Event Data
Extend Value
6. Comp1 creates event structure
66
7. Comp1 stores event in SML
88
8. Comp1 extends PCR with value
77
PCR1
PCR2
TPM 44
Slide #20
Verifying the Measurement Log
Stored Measurement
Log
5. Get PCR value from TPM6. Compare calculated value with PCR – mismatch indicates problem no information as to what the problem is
1. Read struct1 from SML
11 Event Structure1
Event Data
Extend Value
Compare values
2. Calculate PCR value
22
3. Read struct2 from SML
Event Structure2
Event Data
Extend Value
33
Expected Value
4. Calculate PCR value
44
55 66
PCR1
PCR2
TPM
Slide #22
Verifying the Measurement Log
Stored Measurement
Log
11 Event Structure1
Event Data
Extend Value
Compare values
22Event Structure2
Event Data
Extend Value
33
Expected Value
44
55 66
PCR1
PCR2
TPM
What mechanism allows the challenger to believe the report
from the TPM?
Slide #23
CredentialsAIK Credential
ID Label
ID Pub Key
TPM Model
TPM Mfg
Platform Type
Platform Mfg
Ref to TPM Conformance
Ref to Platform Conformance
Ref to signer
Signature
Platform Credential
Ref to EK Cred
Platform Type(e.g., model)
Platform Mfg
Plat Mfg Signature
Endorsement Credential
Public EK
TPM Model
TPM Mfg
TPM Mfg Signature
TPM Conf Credential
Ref to TPMMfg & Model
Conformance Lab Signature
Conformance Lab Signature
Plat Conf CredentialRef to Platform Mfg
& Model
TPMTPM
TPMTPM
Slide #24
Platform
TPM
Certifying an AIK
AIK PubKey
1. Owner bundles into an AIK request:
• New AIK PubKey• Endorsement Cred,• Platform Cred,• Conformance Creds
1
3. TTP verifies Credentials
3
Endorsement Credential
2
2. Owner sends AIK request to P-CA
5
5. Signed AIK sent to TPM
4
4. TTP signs AIK
Endorsement Key (EK)
AttestationID Keys
Platform Credential
Conformance Credentials
Privacy CA(P-CA)Privacy CA
(P-CA)
Slide #25
Platform
TPM
Verifier
Using an AIK1
1. Service requested by Platform User
5. Evaluates trust in AIK
2
2. Challenger requests attestation
[PCR]
3. Integrity signed by an AIK3 4. Attestation sent to
challenger
4
6. Evaluate Platform’s Integrity
6
Attestation = Platform Integrity
signed by AIK
Privacy CA(P-CA)Privacy CA
(P-CA)5
AttestationID Keys
Slide #26
Verifying the Measurement Log
Stored Measurement
Log
11 Event Structure1
Event Data
Extend Value
Compare values
22Event Structure2
Event Data
Extend Value
33
Expected Value
44
55 66
PCR1
PCR2
TPM
This step uses an AIK validation
Slide #28
TSS Block Architecture
Process 1Process 1
TSS Service Provider
TSS Service Provider
TSS SPITSS SPIProcess 2Process 2
TSS Core ServicesTSS Core ServicesTSS CSITSS CSI
RPC ClientRPC
Client Use
r Pro
cess
Syst
em P
roce
ssK
erne
l Mod
e
TPM Device Driver LibraryTPM Device Driver LibraryTPM DDLI
TPM DDLI
TPM Device DriverTPM Device Driver
TPMTPM
Remote ProcessRemote Process
RPC ClientRPC
Client
TSS Service Provider
TSS Service Provider
TSS enables application
development and
interoperability
TSS enables application
development and
interoperability
Slide #29
Using Crypto Infrastructures
Process 1Process 1
TSS Service ProviderTSS Service Provider
TSS SPITSS SPI
Crypto Infrastructure(e.g., CAPI, PKCS #11)Crypto Infrastructure
(e.g., CAPI, PKCS #11)
TSS Crypto Service Provider (CSP)
TSS Crypto Service Provider (CSP)
Non-TCG Aware Application
Non-TCG Aware Application
Other Crypto Service Provider (CSP)
Other Crypto Service Provider (CSP)
TCG Aware ApplicationTCG Aware Application