€•î€      Œsphinx.addnodes”Œdocument”“”)”}”(Œ	rawsource”Œ ”Œchildren”]”(Œtranslations”ŒLanguagesNode”“”)”}”(hhh]”(h Œpending_xref”“”)”}”(hhh]”Œdocutils.nodes”ŒText”“”ŒChinese (Simplified)”…””}”Œparent”hsbaŒ
attributes”}”(Œids”]”Œclasses”]”Œnames”]”Œdupnames”]”Œbackrefs”]”Œ	refdomain”Œstd”Œreftype”Œdoc”Œ	reftarget”Œ-/translations/zh_CN/security/tpm/tpm-security”Œmodname”NŒ	classname”NŒrefexplicit”ˆuŒtagname”hhhubh)”}”(hhh]”hŒChinese (Traditional)”…””}”hh2sbah}”(h]”h ]”h"]”h$]”h&]”Œ	refdomain”h)Œreftype”h+Œ	reftarget”Œ-/translations/zh_TW/security/tpm/tpm-security”Œmodname”NŒ	classname”NŒrefexplicit”ˆuh1hhhubh)”}”(hhh]”hŒItalian”…””}”hhFsbah}”(h]”h ]”h"]”h$]”h&]”Œ	refdomain”h)Œreftype”h+Œ	reftarget”Œ-/translations/it_IT/security/tpm/tpm-security”Œmodname”NŒ	classname”NŒrefexplicit”ˆuh1hhhubh)”}”(hhh]”hŒJapanese”…””}”hhZsbah}”(h]”h ]”h"]”h$]”h&]”Œ	refdomain”h)Œreftype”h+Œ	reftarget”Œ-/translations/ja_JP/security/tpm/tpm-security”Œmodname”NŒ	classname”NŒrefexplicit”ˆuh1hhhubh)”}”(hhh]”hŒKorean”…””}”hhnsbah}”(h]”h ]”h"]”h$]”h&]”Œ	refdomain”h)Œreftype”h+Œ	reftarget”Œ-/translations/ko_KR/security/tpm/tpm-security”Œmodname”NŒ	classname”NŒrefexplicit”ˆuh1hhhubh)”}”(hhh]”hŒSpanish”…””}”hh‚sbah}”(h]”h ]”h"]”h$]”h&]”Œ	refdomain”h)Œreftype”h+Œ	reftarget”Œ-/translations/sp_SP/security/tpm/tpm-security”Œmodname”NŒ	classname”NŒrefexplicit”ˆuh1hhhubeh}”(h]”h ]”h"]”h$]”h&]”Œcurrent_language”ŒEnglish”uh1h
hhŒ	_document”hŒsource”NŒline”NubhŒcomment”“”)”}”(hŒ%SPDX-License-Identifier: GPL-2.0-only”h]”hŒ%SPDX-License-Identifier: GPL-2.0-only”…””}”hh£sbah}”(h]”h ]”h"]”h$]”h&]”Œ	xml:space”Œpreserve”uh1h¡hhhžhhŸŒG/var/lib/git/docbuild/linux/Documentation/security/tpm/tpm-security.rst”h KubhŒsection”“”)”}”(hhh]”(hŒtitle”“”)”}”(hŒTPM Security”h]”hŒTPM Security”…””}”(hh»hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h¹hh¶hžhhŸh³h KubhŒ	paragraph”“”)”}”(hX  The object of this document is to describe how we make the kernel's
use of the TPM reasonably robust in the face of external snooping and
packet alteration attacks (called passive and active interposer attack
in the literature).  The current security document is for TPM 2.0.”h]”hX  The object of this document is to describe how we make the kernelâ€™s
use of the TPM reasonably robust in the face of external snooping and
packet alteration attacks (called passive and active interposer attack
in the literature).  The current security document is for TPM 2.0.”…””}”(hhËhžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÉhŸh³h Khh¶hžhubhµ)”}”(hhh]”(hº)”}”(hŒIntroduction”h]”hŒIntroduction”…””}”(hhÜhžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h¹hhÙhžhhŸh³h KubhÊ)”}”(hXˆ  The TPM is usually a discrete chip attached to a PC via some type of
low bandwidth bus.  There are exceptions to this such as the Intel
PTT, which is a software TPM running inside a software environment
close to the CPU, which are subject to different attacks, but right at
the moment, most hardened security environments require a discrete
hardware TPM, which is the use case discussed here.”h]”hXˆ  The TPM is usually a discrete chip attached to a PC via some type of
low bandwidth bus.  There are exceptions to this such as the Intel
PTT, which is a software TPM running inside a software environment
close to the CPU, which are subject to different attacks, but right at
the moment, most hardened security environments require a discrete
hardware TPM, which is the use case discussed here.”…””}”(hhêhžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÉhŸh³h KhhÙhžhubeh}”(h]”Œintroduction”ah ]”h"]”Œintroduction”ah$]”h&]”uh1h´hh¶hžhhŸh³h Kubhµ)”}”(hhh]”(hº)”}”(hŒ/Snooping and Alteration Attacks against the bus”h]”hŒ/Snooping and Alteration Attacks against the bus”…””}”(hj  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h¹hj   hžhhŸh³h KubhÊ)”}”(hXò  The current state of the art for snooping the `TPM Genie`_ hardware
interposer which is a simple external device that can be installed in
a couple of seconds on any system or laptop.  Recently attacks were
successfully demonstrated against the `Windows Bitlocker TPM`_ system.
Most recently the same `attack against TPM based Linux disk
encryption`_ schemes.  The next phase of research seems to be hacking
existing devices on the bus to act as interposers, so the fact that
the attacker requires physical access for a few seconds might
evaporate.  However, the goal of this document is to protect TPM
secrets and integrity as far as we are able in this environment and to
try to insure that if we can't prevent the attack then at least we can
detect it.”h]”(hŒ.The current state of the art for snooping the ”…””}”(hj  hžhhŸNh NubhŒ	reference”“”)”}”(hŒ`TPM Genie`_”h]”hŒ	TPM Genie”…””}”(hj  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”Œname”Œ	TPM Genie”Œrefuri”ŒKhttps://www.nccgroup.trust/globalassets/about-us/us/documents/tpm-genie.pdf”uh1j  hj  Œresolved”KubhŒº hardware
interposer which is a simple external device that can be installed in
a couple of seconds on any system or laptop.  Recently attacks were
successfully demonstrated against the ”…””}”(hj  hžhhŸNh Nubj  )”}”(hŒ`Windows Bitlocker TPM`_”h]”hŒWindows Bitlocker TPM”…””}”(hj2  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”Œname”ŒWindows Bitlocker TPM”j+  ŒThttps://dolosgroup.io/blog/2021/7/9/from-stolen-laptop-to-inside-the-company-network”uh1j  hj  j-  KubhŒ  system.
Most recently the same ”…””}”(hj  hžhhŸNh Nubj  )”}”(hŒ1`attack against TPM based Linux disk
encryption`_”h]”hŒ.attack against TPM based Linux disk
encryption”…””}”(hjG  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”Œname”Œ.attack against TPM based Linux disk encryption”j+  ŒNhttps://www.secura.com/blog/tpm-sniffing-attacks-against-non-bitlocker-targets”uh1j  hj  j-  KubhX—   schemes.  The next phase of research seems to be hacking
existing devices on the bus to act as interposers, so the fact that
the attacker requires physical access for a few seconds might
evaporate.  However, the goal of this document is to protect TPM
secrets and integrity as far as we are able in this environment and to
try to insure that if we canâ€™t prevent the attack then at least we can
detect it.”…””}”(hj  hžhhŸNh Nubeh}”(h]”h ]”h"]”h$]”h&]”uh1hÉhŸh³h Khj   hžhubhÊ)”}”(hŒÎUnfortunately, most of the TPM functionality, including the hardware
reset capability can be controlled by an attacker who has access to
the bus, so we'll discuss some of the disruption possibilities below.”h]”hŒÐUnfortunately, most of the TPM functionality, including the hardware
reset capability can be controlled by an attacker who has access to
the bus, so weâ€™ll discuss some of the disruption possibilities below.”…””}”(hjb  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÉhŸh³h K%hj   hžhubeh}”(h]”Œ/snooping-and-alteration-attacks-against-the-bus”ah ]”h"]”Œ/snooping and alteration attacks against the bus”ah$]”h&]”uh1h´hh¶hžhhŸh³h Kubhµ)”}”(hhh]”(hº)”}”(hŒMeasurement (PCR) Integrity”h]”hŒMeasurement (PCR) Integrity”…””}”(hj{  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h¹hjx  hžhhŸh³h K*ubhÊ)”}”(hX%  Since the attacker can send their own commands to the TPM, they can
send arbitrary PCR extends and thus disrupt the measurement system,
which would be an annoying denial of service attack.  However, there
are two, more serious, classes of attack aimed at entities sealed to
trust measurements.”h]”hX%  Since the attacker can send their own commands to the TPM, they can
send arbitrary PCR extends and thus disrupt the measurement system,
which would be an annoying denial of service attack.  However, there
are two, more serious, classes of attack aimed at entities sealed to
trust measurements.”…””}”(hj‰  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÉhŸh³h K,hjx  hžhubhŒenumerated_list”“”)”}”(hhh]”(hŒ	list_item”“”)”}”(hŒíThe attacker could intercept all PCR extends coming from the system
and completely substitute their own values, producing a replay of
an untampered state that would cause PCR measurements to attest to
a trusted state and release secrets
”h]”hÊ)”}”(hŒìThe attacker could intercept all PCR extends coming from the system
and completely substitute their own values, producing a replay of
an untampered state that would cause PCR measurements to attest to
a trusted state and release secrets”h]”hŒìThe attacker could intercept all PCR extends coming from the system
and completely substitute their own values, producing a replay of
an untampered state that would cause PCR measurements to attest to
a trusted state and release secrets”…””}”(hj¢  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÉhŸh³h K2hjž  ubah}”(h]”h ]”h"]”h$]”h&]”uh1jœ  hj™  hžhhŸh³h Nubj  )”}”(hŒËAt some point in time the attacker could reset the TPM, clearing
the PCRs and then send down their own measurements which would
effectively overwrite the boot time measurements the TPM has
already done.
”h]”hÊ)”}”(hŒÊAt some point in time the attacker could reset the TPM, clearing
the PCRs and then send down their own measurements which would
effectively overwrite the boot time measurements the TPM has
already done.”h]”hŒÊAt some point in time the attacker could reset the TPM, clearing
the PCRs and then send down their own measurements which would
effectively overwrite the boot time measurements the TPM has
already done.”…””}”(hjº  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÉhŸh³h K7hj¶  ubah}”(h]”h ]”h"]”h$]”h&]”uh1jœ  hj™  hžhhŸh³h Nubeh}”(h]”h ]”h"]”h$]”h&]”Œenumtype”Œarabic”Œprefix”hŒsuffix”Œ.”uh1j—  hjx  hžhhŸh³h K2ubhÊ)”}”(hXR  The first can be thwarted by always doing HMAC protection of the PCR
extend and read command meaning measurement values cannot be
substituted without producing a detectable HMAC failure in the
response.  However, the second can only really be detected by relying
on some sort of mechanism for protection which would change over TPM
reset.”h]”hXR  The first can be thwarted by always doing HMAC protection of the PCR
extend and read command meaning measurement values cannot be
substituted without producing a detectable HMAC failure in the
response.  However, the second can only really be detected by relying
on some sort of mechanism for protection which would change over TPM
reset.”…””}”(hjÙ  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÉhŸh³h K<hjx  hžhubeh}”(h]”Œmeasurement-pcr-integrity”ah ]”h"]”Œmeasurement (pcr) integrity”ah$]”h&]”uh1h´hh¶hžhhŸh³h K*ubhµ)”}”(hhh]”(hº)”}”(hŒSecrets Guarding”h]”hŒSecrets Guarding”…””}”(hjò  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h¹hjï  hžhhŸh³h KDubhÊ)”}”(hXJ  Certain information passing in and out of the TPM, such as key sealing
and private key import and random number generation, is vulnerable to
interception which HMAC protection alone cannot protect against, so
for these types of command we must also employ request and response
encryption to prevent the loss of secret information.”h]”hXJ  Certain information passing in and out of the TPM, such as key sealing
and private key import and random number generation, is vulnerable to
interception which HMAC protection alone cannot protect against, so
for these types of command we must also employ request and response
encryption to prevent the loss of secret information.”…””}”(hj   hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÉhŸh³h KFhjï  hžhubeh}”(h]”Œsecrets-guarding”ah ]”h"]”Œsecrets guarding”ah$]”h&]”uh1h´hh¶hžhhŸh³h KDubhµ)”}”(hhh]”(hº)”}”(hŒ'Establishing Initial Trust with the TPM”h]”hŒ'Establishing Initial Trust with the TPM”…””}”(hj  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h¹hj  hžhhŸh³h KMubhÊ)”}”(hX  In order to provide security from the beginning, an initial shared or
asymmetric secret must be established which must also be unknown to
the attacker.  The most obvious avenues for this are the endorsement
and storage seeds, which can be used to derive asymmetric keys.
However, using these keys is difficult because the only way to pass
them into the kernel would be on the command line, which requires
extensive support in the boot system, and there's no guarantee that
either hierarchy would not have some type of authorization.”h]”hX  In order to provide security from the beginning, an initial shared or
asymmetric secret must be established which must also be unknown to
the attacker.  The most obvious avenues for this are the endorsement
and storage seeds, which can be used to derive asymmetric keys.
However, using these keys is difficult because the only way to pass
them into the kernel would be on the command line, which requires
extensive support in the boot system, and thereâ€™s no guarantee that
either hierarchy would not have some type of authorization.”…””}”(hj'  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÉhŸh³h KOhj  hžhubhÊ)”}”(hXê  The mechanism chosen for the Linux Kernel is to derive the primary
elliptic curve key from the null seed using the standard storage seed
parameters.  The null seed has two advantages: firstly the hierarchy
physically cannot have an authorization, so we are always able to use
it and secondly, the null seed changes across TPM resets, meaning if
we establish trust on the null seed at start of day, all sessions
salted with the derived key will fail if the TPM is reset and the seed
changes.”h]”hXê  The mechanism chosen for the Linux Kernel is to derive the primary
elliptic curve key from the null seed using the standard storage seed
parameters.  The null seed has two advantages: firstly the hierarchy
physically cannot have an authorization, so we are always able to use
it and secondly, the null seed changes across TPM resets, meaning if
we establish trust on the null seed at start of day, all sessions
salted with the derived key will fail if the TPM is reset and the seed
changes.”…””}”(hj5  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÉhŸh³h KXhj  hžhubhÊ)”}”(hXK  Obviously using the null seed without any other prior shared secrets,
we have to create and read the initial public key which could, of
course, be intercepted and substituted by the bus interposer.
However, the TPM has a key certification mechanism (using the EK
endorsement certificate, creating an attestation identity key and
certifying the null seed primary with that key) which is too complex
to run within the kernel, so we keep a copy of the null primary key
name, which is what is exported via sysfs so user-space can run the
full certification when it boots.  The definitive guarantee here is
that if the null primary key certifies correctly, you know all your
TPM transactions since start of day were secure and if it doesn't, you
know there's an interposer on your system (and that any secret used
during boot may have been leaked).”h]”hXO  Obviously using the null seed without any other prior shared secrets,
we have to create and read the initial public key which could, of
course, be intercepted and substituted by the bus interposer.
However, the TPM has a key certification mechanism (using the EK
endorsement certificate, creating an attestation identity key and
certifying the null seed primary with that key) which is too complex
to run within the kernel, so we keep a copy of the null primary key
name, which is what is exported via sysfs so user-space can run the
full certification when it boots.  The definitive guarantee here is
that if the null primary key certifies correctly, you know all your
TPM transactions since start of day were secure and if it doesnâ€™t, you
know thereâ€™s an interposer on your system (and that any secret used
during boot may have been leaked).”…””}”(hjC  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÉhŸh³h Kahj  hžhubeh}”(h]”Œ'establishing-initial-trust-with-the-tpm”ah ]”h"]”Œ'establishing initial trust with the tpm”ah$]”h&]”uh1h´hh¶hžhhŸh³h KMubhµ)”}”(hhh]”(hº)”}”(hŒStacking Trust”h]”hŒStacking Trust”…””}”(hj\  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h¹hjY  hžhhŸh³h KpubhÊ)”}”(hXt  In the current null primary scenario, the TPM must be completely
cleared before handing it on to the next consumer.  However the kernel
hands to user-space the name of the derived null seed key which can
then be verified by certification in user-space.  Therefore, this chain
of name handoff can be used between the various boot components as
well (via an unspecified mechanism).  For instance, grub could use the
null seed scheme for security and hand the name off to the kernel in
the boot area.  The kernel could make its own derivation of the key
and the name and know definitively that if they differ from the handed
off version that tampering has occurred.  Thus it becomes possible to
chain arbitrary boot components together (UEFI to grub to kernel) via
the name handoff provided each successive component knows how to
collect the name and verifies it against its derived key.”h]”hXt  In the current null primary scenario, the TPM must be completely
cleared before handing it on to the next consumer.  However the kernel
hands to user-space the name of the derived null seed key which can
then be verified by certification in user-space.  Therefore, this chain
of name handoff can be used between the various boot components as
well (via an unspecified mechanism).  For instance, grub could use the
null seed scheme for security and hand the name off to the kernel in
the boot area.  The kernel could make its own derivation of the key
and the name and know definitively that if they differ from the handed
off version that tampering has occurred.  Thus it becomes possible to
chain arbitrary boot components together (UEFI to grub to kernel) via
the name handoff provided each successive component knows how to
collect the name and verifies it against its derived key.”…””}”(hjj  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÉhŸh³h KrhjY  hžhubeh}”(h]”Œstacking-trust”ah ]”h"]”Œstacking trust”ah$]”h&]”uh1h´hh¶hžhhŸh³h Kpubhµ)”}”(hhh]”(hº)”}”(hŒSession Properties”h]”hŒSession Properties”…””}”(hjƒ  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h¹hj€  hžhhŸh³h KubhÊ)”}”(hXÊ  All TPM commands the kernel uses allow sessions.  HMAC sessions may be
used to check the integrity of requests and responses and decrypt and
encrypt flags may be used to shield parameters and responses.  The
HMAC and encryption keys are usually derived from the shared
authorization secret, but for a lot of kernel operations that is well
known (and usually empty).  Thus, every HMAC session used by the
kernel must be created using the null primary key as the salt key
which thus provides a cryptographic input into the session key
derivation.  Thus, the kernel creates the null primary key once (as a
volatile TPM handle) and keeps it around in a saved context stored in
tpm_chip for every in-kernel use of the TPM.  Currently, because of a
lack of de-gapping in the in-kernel resource manager, the session must
be created and destroyed for each operation, but, in future, a single
session may also be reused for the in-kernel HMAC, encryption and
decryption sessions.”h]”hXÊ  All TPM commands the kernel uses allow sessions.  HMAC sessions may be
used to check the integrity of requests and responses and decrypt and
encrypt flags may be used to shield parameters and responses.  The
HMAC and encryption keys are usually derived from the shared
authorization secret, but for a lot of kernel operations that is well
known (and usually empty).  Thus, every HMAC session used by the
kernel must be created using the null primary key as the salt key
which thus provides a cryptographic input into the session key
derivation.  Thus, the kernel creates the null primary key once (as a
volatile TPM handle) and keeps it around in a saved context stored in
tpm_chip for every in-kernel use of the TPM.  Currently, because of a
lack of de-gapping in the in-kernel resource manager, the session must
be created and destroyed for each operation, but, in future, a single
session may also be reused for the in-kernel HMAC, encryption and
decryption sessions.”…””}”(hj‘  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÉhŸh³h Kƒhj€  hžhubeh}”(h]”Œsession-properties”ah ]”h"]”Œsession properties”ah$]”h&]”uh1h´hh¶hžhhŸh³h Kubhµ)”}”(hhh]”(hº)”}”(hŒProtection Types”h]”hŒProtection Types”…””}”(hjª  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h¹hj§  hžhhŸh³h K”ubhÊ)”}”(hŒéFor every in-kernel operation we use null primary salted HMAC to
protect the integrity.  Additionally, we use parameter encryption to
protect key sealing and parameter decryption to protect key unsealing
and random number generation.”h]”hŒéFor every in-kernel operation we use null primary salted HMAC to
protect the integrity.  Additionally, we use parameter encryption to
protect key sealing and parameter decryption to protect key unsealing
and random number generation.”…””}”(hj¸  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÉhŸh³h K–hj§  hžhubeh}”(h]”Œprotection-types”ah ]”h"]”Œprotection types”ah$]”h&]”uh1h´hh¶hžhhŸh³h K”ubeh}”(h]”Œtpm-security”ah ]”h"]”Œtpm security”ah$]”h&]”uh1h´hhhžhhŸh³h Kubhµ)”}”(hhh]”(hº)”}”(hŒ+Null Primary Key Certification in Userspace”h]”hŒ+Null Primary Key Certification in Userspace”…””}”(hjÙ  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h¹hjÖ  hžhhŸh³h KœubhÊ)”}”(hŒýEvery TPM comes shipped with a couple of X.509 certificates for the
primary endorsement key.  This document assumes that the Elliptic
Curve version of the certificate exists at 01C00002, but will work
equally well with the RSA certificate (at 01C00001).”h]”hŒýEvery TPM comes shipped with a couple of X.509 certificates for the
primary endorsement key.  This document assumes that the Elliptic
Curve version of the certificate exists at 01C00002, but will work
equally well with the RSA certificate (at 01C00001).”…””}”(hjç  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÉhŸh³h KžhjÖ  hžhubhÊ)”}”(hX£  The first step in the certification is primary creation using the
template from the `TCG EK Credential Profile`_ which allows comparison
of the generated primary key against the one in the certificate (the
public key must match).  Note that generation of the EK primary
requires the EK hierarchy password, but a pre-generated version of the
EC primary should exist at 81010002 and a TPM2_ReadPublic() may be
performed on this without needing the key authority.  Next, the
certificate itself must be verified to chain back to the manufacturer
root (which should be published on the manufacturer website).  Once
this is done, an attestation key (AK) is generated within the TPM and
it's name and the EK public key can be used to encrypt a secret using
TPM2_MakeCredential.  The TPM then runs TPM2_ActivateCredential which
will only recover the secret if the binding between the TPM, the EK
and the AK is true. the generated AK may now be used to run a
certification of the null primary key whose name the kernel has
exported.  Since TPM2_MakeCredential/ActivateCredential are somewhat
complicated, a more simplified process involving an externally
generated private key is described below.”h]”(hŒTThe first step in the certification is primary creation using the
template from the ”…””}”(hjõ  hžhhŸNh Nubj  )”}”(hŒ`TCG EK Credential Profile`_”h]”hŒTCG EK Credential Profile”…””}”(hjý  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”Œname”ŒTCG EK Credential Profile”j+  ŒXhttps://trustedcomputinggroup.org/resource/tcg-ek-credential-profile-for-tpm-family-2-0/”uh1j  hjõ  j-  KubhX5   which allows comparison
of the generated primary key against the one in the certificate (the
public key must match).  Note that generation of the EK primary
requires the EK hierarchy password, but a pre-generated version of the
EC primary should exist at 81010002 and a TPM2_ReadPublic() may be
performed on this without needing the key authority.  Next, the
certificate itself must be verified to chain back to the manufacturer
root (which should be published on the manufacturer website).  Once
this is done, an attestation key (AK) is generated within the TPM and
itâ€™s name and the EK public key can be used to encrypt a secret using
TPM2_MakeCredential.  The TPM then runs TPM2_ActivateCredential which
will only recover the secret if the binding between the TPM, the EK
and the AK is true. the generated AK may now be used to run a
certification of the null primary key whose name the kernel has
exported.  Since TPM2_MakeCredential/ActivateCredential are somewhat
complicated, a more simplified process involving an externally
generated private key is described below.”…””}”(hjõ  hžhhŸNh Nubeh}”(h]”h ]”h"]”h$]”h&]”uh1hÉhŸh³h K£hjÖ  hžhubhÊ)”}”(hXÐ  This process is a simplified abbreviation of the usual privacy CA
based attestation process.  The assumption here is that the
attestation is done by the TPM owner who thus has access to only the
owner hierarchy.  The owner creates an external public/private key
pair (assume elliptic curve in this case) and wraps the private key
for import using an inner wrapping process and parented to the EC
derived storage primary.  The TPM2_Import() is done using a parameter
decryption HMAC session salted to the EK primary (which also does not
require the EK key authority) meaning that the inner wrapping key is
the encrypted parameter and thus the TPM will not be able to perform
the import unless is possesses the certified EK so if the command
succeeds and the HMAC verifies on return we know we have a loadable
copy of the private key only for the certified TPM.  This key is now
loaded into the TPM and the Storage primary flushed (to free up space
for the null key generation).”h]”hXÐ  This process is a simplified abbreviation of the usual privacy CA
based attestation process.  The assumption here is that the
attestation is done by the TPM owner who thus has access to only the
owner hierarchy.  The owner creates an external public/private key
pair (assume elliptic curve in this case) and wraps the private key
for import using an inner wrapping process and parented to the EC
derived storage primary.  The TPM2_Import() is done using a parameter
decryption HMAC session salted to the EK primary (which also does not
require the EK key authority) meaning that the inner wrapping key is
the encrypted parameter and thus the TPM will not be able to perform
the import unless is possesses the certified EK so if the command
succeeds and the HMAC verifies on return we know we have a loadable
copy of the private key only for the certified TPM.  This key is now
loaded into the TPM and the Storage primary flushed (to free up space
for the null key generation).”…””}”(hj  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÉhŸh³h K¶hjÖ  hžhubhÊ)”}”(hX/  The null EC primary is now generated using the Storage profile
outlined in the `TCG TPM v2.0 Provisioning Guidance`_; the name of
this key (the hash of the public area) is computed and compared to the
null seed name presented by the kernel in
/sys/class/tpm/tpm0/null_name.  If the names do not match, the TPM is
compromised.  If the names match, the user performs a TPM2_Certify()
using the null primary as the object handle and the loaded private key
as the sign handle and providing randomized qualifying data.  The
signature of the returned certifyInfo is verified against the public
part of the loaded private key and the qualifying data checked to
prevent replay.  If all of these tests pass, the user is now assured
that TPM integrity and privacy was preserved across the entire boot
sequence of this kernel.”h]”(hŒOThe null EC primary is now generated using the Storage profile
outlined in the ”…””}”(hj&  hžhhŸNh Nubj  )”}”(hŒ%`TCG TPM v2.0 Provisioning Guidance`_”h]”hŒ"TCG TPM v2.0 Provisioning Guidance”…””}”(hj.  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”Œname”Œ"TCG TPM v2.0 Provisioning Guidance”j+  ŒNhttps://trustedcomputinggroup.org/resource/tcg-tpm-v2-0-provisioning-guidance/”uh1j  hj&  j-  KubhX»  ; the name of
this key (the hash of the public area) is computed and compared to the
null seed name presented by the kernel in
/sys/class/tpm/tpm0/null_name.  If the names do not match, the TPM is
compromised.  If the names match, the user performs a TPM2_Certify()
using the null primary as the object handle and the loaded private key
as the sign handle and providing randomized qualifying data.  The
signature of the returned certifyInfo is verified against the public
part of the loaded private key and the qualifying data checked to
prevent replay.  If all of these tests pass, the user is now assured
that TPM integrity and privacy was preserved across the entire boot
sequence of this kernel.”…””}”(hj&  hžhhŸNh Nubeh}”(h]”h ]”h"]”h$]”h&]”uh1hÉhŸh³h KÆhjÖ  hžhubhŒtarget”“”)”}”(hŒZ.. _TPM Genie: https://www.nccgroup.trust/globalassets/about-us/us/documents/tpm-genie.pdf”h]”h}”(h]”Œ	tpm-genie”ah ]”h"]”Œ	tpm genie”ah$]”h&]”j+  j,  uh1jI  h KÔhjÖ  hžhhŸh³Œ
referenced”KubjJ  )”}”(hŒo.. _Windows Bitlocker TPM: https://dolosgroup.io/blog/2021/7/9/from-stolen-laptop-to-inside-the-company-network”h]”h}”(h]”Œwindows-bitlocker-tpm”ah ]”h"]”Œwindows bitlocker tpm”ah$]”h&]”j+  jB  uh1jI  h KÕhjÖ  hžhhŸh³jW  KubjJ  )”}”(hŒ‚.. _attack against TPM based Linux disk encryption: https://www.secura.com/blog/tpm-sniffing-attacks-against-non-bitlocker-targets”h]”h}”(h]”Œ.attack-against-tpm-based-linux-disk-encryption”ah ]”h"]”Œ.attack against tpm based linux disk encryption”ah$]”h&]”j+  jW  uh1jI  h KÖhjÖ  hžhhŸh³jW  KubjJ  )”}”(hŒw.. _TCG EK Credential Profile: https://trustedcomputinggroup.org/resource/tcg-ek-credential-profile-for-tpm-family-2-0/”h]”h}”(h]”Œtcg-ek-credential-profile”ah ]”h"]”Œtcg ek credential profile”ah$]”h&]”j+  j  uh1jI  h K×hjÖ  hžhhŸh³jW  KubjJ  )”}”(hŒv.. _TCG TPM v2.0 Provisioning Guidance: https://trustedcomputinggroup.org/resource/tcg-tpm-v2-0-provisioning-guidance/”h]”h}”(h]”Œ"tcg-tpm-v2-0-provisioning-guidance”ah ]”h"]”Œ"tcg tpm v2.0 provisioning guidance”ah$]”h&]”j+  j>  uh1jI  h KØhjÖ  hžhhŸh³jW  Kubeh}”(h]”Œ+null-primary-key-certification-in-userspace”ah ]”h"]”Œ+null primary key certification in userspace”ah$]”h&]”uh1h´hhhžhhŸh³h Kœubeh}”(h]”h ]”h"]”h$]”h&]”Œsource”h³uh1hŒcurrent_source”NŒcurrent_line”NŒsettings”Œdocutils.frontend”ŒValues”“”)”}”(h¹NŒ	generator”NŒ	datestamp”NŒsource_link”NŒ
source_url”NŒtoc_backlinks”Œentry”Œfootnote_backlinks”KŒsectnum_xform”KŒstrip_comments”NŒstrip_elements_with_classes”NŒstrip_classes”NŒreport_level”KŒ
halt_level”KŒexit_status_level”KŒdebug”NŒwarning_stream”NŒ	traceback”ˆŒinput_encoding”Œ	utf-8-sig”Œinput_encoding_error_handler”Œstrict”Œoutput_encoding”Œutf-8”Œoutput_encoding_error_handler”j³  Œerror_encoding”Œutf-8”Œerror_encoding_error_handler”Œbackslashreplace”Œlanguage_code”Œen”Œrecord_dependencies”NŒconfig”NŒ	id_prefix”hŒauto_id_prefix”Œid”Œdump_settings”NŒdump_internals”NŒdump_transforms”NŒdump_pseudo_xml”NŒexpose_internals”NŒstrict_visitor”NŒ_disable_config”NŒ_source”h³Œ_destination”NŒ_config_files”]”Œ7/var/lib/git/docbuild/linux/Documentation/docutils.conf”aŒfile_insertion_enabled”ˆŒraw_enabled”KŒline_length_limit”M'Œpep_references”NŒpep_base_url”Œhttps://peps.python.org/”Œpep_file_url_template”Œpep-%04d”Œrfc_references”NŒrfc_base_url”Œ&https://datatracker.ietf.org/doc/html/”Œ	tab_width”KŒtrim_footnote_reference_space”‰Œsyntax_highlight”Œlong”Œsmart_quotes”ˆŒsmartquotes_locales”]”Œcharacter_level_inline_markup”‰Œdoctitle_xform”‰Œdocinfo_xform”KŒsectsubtitle_xform”‰Œimage_loading”Œlink”Œembed_stylesheet”‰Œcloak_email_addresses”ˆŒsection_self_link”‰Œenv”NubŒreporter”NŒindirect_targets”]”Œsubstitution_defs”}”Œsubstitution_names”}”Œrefnames”}”(Œ	tpm genie”]”j  aŒwindows bitlocker tpm”]”j2  aŒ.attack against tpm based linux disk encryption”]”jG  aŒtcg ek credential profile”]”jý  aŒ"tcg tpm v2.0 provisioning guidance”]”j.  auŒrefids”}”Œnameids”}”(jÓ  jÐ  hýhúju  jr  jì  jé  j  j  jV  jS  j}  jz  j¤  j¡  jË  jÈ  j  jŠ  jT  jQ  ja  j^  jm  jj  jy  jv  j…  j‚  uŒ	nametypes”}”(jÓ  ‰hý‰ju  ‰jì  ‰j  ‰jV  ‰j}  ‰j¤  ‰jË  ‰j  ‰jT  ˆja  ˆjm  ˆjy  ˆj…  ˆuh}”(jÐ  h¶húhÙjr  j   jé  jx  j  jï  jS  j  jz  jY  j¡  j€  jÈ  j§  jŠ  jÖ  jQ  jK  j^  jX  jj  jd  jv  jp  j‚  j|  uŒfootnote_refs”}”Œcitation_refs”}”Œautofootnotes”]”Œautofootnote_refs”]”Œsymbol_footnotes”]”Œsymbol_footnote_refs”]”Œ	footnotes”]”Œ	citations”]”Œautofootnote_start”KŒsymbol_footnote_start”K Œ
id_counter”Œcollections”ŒCounter”“”}”…”R”Œparse_messages”]”Œtransform_messages”]”Œtransformer”NŒinclude_log”]”Œ
decoration”Nhžhub.