Re: [DISCUSSION] svsm: attestation: if and how to authenticate the provided secret

On Tue, 2025-10-14 at 21:33 -0400, Tyler Fanelli wrote:
> On 10/14/25 5:40 PM, James Bottomley wrote:
[...]
> > On this, how does the guest know it's pulled in the correct image? 
> > If I were a malicious host, I could encrypt my own TPM image,
> > accept your attestation to a KBS I control and release a key that
> > decrypts my malicious image.  I think you give the answer below:
> > 
> 
> We intend for the guest's rootfs to be sealed to the persistent TPM 
> found in encrypted storage. The malicious host could switch the TPM,
> but that TPM wouldn't be able to unseal the rootfs.
> 
> This doesn't directly prevent the attack you mention above, but it
> would be a DoS.

Not necessarily.  If I control the host, I also control what you boot
in all stages.  If you simply take booting up as proof, then I can
substitute both the KBS and the boot system, so you'll boot with my
image but if you're running a trusted service in the VM, it's now my
service.  An examination of the launch measurement by a trusted KBS
would defeat this, which is why I substituted the KBS as well.

The point being that there has to be validation on both sides.  If you
want a KBS to deliver a boot key by which your boot sequence continuing
is your validation, you still need to prove that you contacted the
correct KBS in the first place otherwise your launch measurement might
not actually have been validated.

Regards,

James