Trusted Computing and the Trusted Platform Module Bruce Maggs (with some slides from Bryan Parno)

Bryan Parno’s Travel Story 2

Attestation How can we know that a system that we would like to use has not been compromised? 3

H( ) ^ Bootstrapping Trust is Hard! 4 OS Ap p 1 Ap p 1 Ap p 2 Ap p 2 Ap p 3 Ap p 3 Ap p 4 Ap p 4 Ap p N Ap p N Module 1 Module 3 Module 2 Module 4 Ap p 5 Ap p 5 Challenges: Hardware assurance Ephemeral software User Interaction Safe? Yes! S 1 ( ) S 2 ( ) S 3 ( ) S 4 ( ) S 5 ( ) S 6 ( ) S 7 ( ) S 8 ( ) S 9 ( ) S 10 ( ) S 11 ( ) S 12 ( ) S 13 ( ) S 14 ( ) S 15 ( )

Evil App Evil App Evil OS Evil OS Bootstrapping Trust is Hard! 5 Challenges: Hardware assurance Ephemeral software User Interaction Safe? Yes!

TPM Chip Often found in business-class laptops (image from Wikipedia) 6

Caveat The TPM is not tamper proof! Safe use requires physical security! 7

Built-In Unique Identifier “Endorsement Key” RSA public-private key pair Private key never leaves the TPM chip Public key can be certified 8

On-Chip Algorithms RSA key-pair generation RSA encryption/decryption RSA signing Random number generation SHA-1 hashing Keyed-hash message authentication code (HMAC) 9

Platform Configuration Registers (PCRs) A TPM contains several 20-byte PCRs A PCR is initialized to zero at power on. The only operation allowed on a PCR is to extend it: val[PCR] = SHA1(val[PCR]. newval) At boot time, a TPM-enabled PC takes a series of measurements and stores them in PCRs 10

HMAC Hash with two inputs: a key and a block of data Typically key is randomly generated Key can be used (for example) to guarantee that the hash was freshly created 11

How HMAC can be used TPM can hash contents of all storage on computer, or storage in certain places Disks Memory Registers in the CPU User can choose to execute only from known safe states 12

Applications Storing and protecting sensitive information Trusted boot Attestation 13

TPM-Based Attestation Example 14 BIOS TPM PCRs K Priv BIOS [Gasser et al. ‘89], [Arbaugh et al. ‘97], [Sailer et al. ‘04], [Marchesini et al. ‘04] Bootloader

Establishing Trust via a TPM [Gasser et al. ‘89], [Arbaugh et al. ‘97], [Sailer et al. ‘04], [Marchesini et al. ‘04] 15 BIOSBootloader TPM PCRs K Priv random # Guarantees freshness K Pu b Guarantees real TPM Sign ( ) K priv BIOS Bootloader random # Guarantees actual TPM logs Accurate! BIOS Bootloader

Microsoft uses of TPM Bitlocker drive encryption Secure Boot 16