Trusted Computing and the Trusted Platform Module

1. Trusted Computingand theTrusted Platform Module Bruce Maggs (with some slides from Bryan Parno)

2. Bryan Parno’s Travel Story

3. Attestation • How can we know that a system that we would like to use has not been compromised?

4. Bootstrapping Trust is Hard! Challenges: App 1 App 4 App 5 App 2 App N App 3 • Hardware assurance • Ephemeral software • User Interaction S2( ) S14( ) S1( ) S15( ) S3( ) S11( ) S5( ) S6( ) S13( ) S12( ) S7( ) S8( ) S9( ) S10( ) S4( ) OS Module 1 Module 3 Module 2 Module 4 ^ Safe? H( ) H( ) Yes!

5. Bootstrapping Trust is Hard! Challenges: Evil App • Hardware assurance • Ephemeral software • User Interaction Evil OS Safe? Yes!

6. Trusted Platform Module Components https://en.wikipedia.org/wiki/Trusted_Platform_Module#/media/File:TPM.svg

7. TPM Chip Often found in business-class laptops https://en.wikipedia.org/wiki/Trusted_Platform_Module#/media/File:TPM_Asus.jpg

8. Caveat • The TPM is not 100% tamper proof! • Safe use requires physical security • In 2010 Christopher Tarnovsky extracted the private key from an Infineon TPM chip by • soaking the chip in acid to remove plastic • removing RF-shield wire mesh • probing with an extremely small needle

9. Built-In Unique Identifier • “Endorsement Key” permanently embedded in TPM • RSA public-private key pair • Private key never leaves the TPM chip • Public key can be certified • Master “storage root key” (SRK) created when TPM first used

10. On-Chip Algorithms • RSA key-pair generation • RSA encryption/decryption • RSA signing • Random number generation • SHA-1 hashing • Keyed-hash message authentication code (HMAC)

11. Platform Configuration Registers (PCRs) • A TPM contains several 20-byte PCRs • A PCR is initialized to zero at power on. • The only operation allowed on a PCR is to extend it: • val[PCR] = SHA1(val[PCR] . newval) • At boot time, a TPM-enabled PC takes a series of measurements and stores them in PCRs

12. HMAC • Hash with two inputs: a key and a block of data • Typically key is randomly generated • Key can be used (for example) to guarantee that the hash was freshly created

13. How HMAC can be used • TPM can hash contents of all storage on computer, or storage in certain places • Disks • Memory • Registers in the CPU • User can choose to execute only from known safe states

14. Applications • Storing and protecting sensitive information • Trusted boot • Attestation

15. TPM-Based Attestation Example • [Gasser et al. ‘89], [Arbaugh et al. ‘97], [Sailer et al. ‘04], [Marchesini et al. ‘04] BIOS Bootloader Bootloader BIOS App App App App PCRs App App OS OS Module Module Module Module Module Module KPriv TPM Module Module

16. Establishing Trust via a TPM • [Gasser et al. ‘89], [Arbaugh et al. ‘97], [Sailer et al. ‘04], [Marchesini et al. ‘04] Guarantees freshness random # Accurate! random # Guarantees real TPM BIOS Bootloader BIOS BIOS Bootloader Bootloader App App App ( ) App App App PCRs App App App OS OS OS Module Module Module Sign Module Module Module Module Module Module Guarantees actual TPM logs random # KPriv TPM Kpriv Module Module Module KPub

17. Microsoft BitLocker Drive Encryption • Password-protected encryption of volume containing Windows OS, user files, e.g., C: • Separate unencrypted volume contains files needed to load Windows • TPM protects disk encryption key by encrypting it • TPM releases key only after comparing hash of early (unencrypted) boot files with previous hash

18. Microsoft Secure Boot (Windows 8+) • Enabled by “UEFI” – Unified Extensible Firmware Interface (replacement for traditional BIOS) • Manufacturer’s and Microsoft public keys stored in firmware (can add other OS vendors) • TPM checks that firmware is signed • TPM checks that hash of boot loader has been signed with Microsoft public key

19. Microsoft Trusted Boot • Takes over after Secure Boot • Verifies all OS components, starting with Windows kernel • Windows kernel verifies boot drivers, start-up files

20. Microsoft Measured Boot • TPM signs measured boot log file • Remote attestation possible by transmitting signed boot log