[tpm2] Is the tpm2_create command safe against sniffing attacks?
Joseph Lee (ZeronsoftN) <joseph at zeronsoftn.com>
| Newsgroups | dev.linux.lists.tpm2 |
|---|---|
| Message-ID | <em4a42a75d-49fb-4d27-a52f-27f13c57a40c@desktop-hihridj> |
Hello,
https://pulsesecurity.co.nz/articles/TPM-sniffing
In this article, can see that communication with the TPM is vulnerable
to sniffing if not careful.
https://tpm2-software.github.io/2020/04/13/Disk-Encryption.html
Is the disk encryption described in tpm2-software's blog safe against
these attacks?
tpm2_createprimary -Q -C o -c prim.ctx
dd if=/dev/urandom bs=1 count=32 status=none | tpm2_create -Q -g sha256
-u seal.pub -r seal.priv -i- -C prim.ctx
tpm2_load -Q -C prim.ctx -u seal.pub -r seal.priv -n seal.name -c
seal.ctx
tpm2_evictcontrol -C o -c seal.ctx 0x81010001
My question is:
1. Is there a tool in linux that can sniff communication with the
current system's TPM?
2. How to encrypt communications if the methods described above are
not secure?
It seems that encryption is possible through
tpm2_startauthsession , but I do not know how to apply it to tpm2_create
(The -S option simply did not work.)
Thank you.
attachment.htm
(text/html, 4.2 KB)
<html><head>
<style id="css_styles">
blockquote.cite { margin-left: 5px; margin-right: 0px; padding-left: 10px; padding-right:0px; border-left: 1px solid #cccccc }
blockquote.cite2 {margin-left: 5px; margin-right: 0px; padding-left: 10px; padding-right:0px; border-left: 1px solid #cccccc; margin-top: 3px; padding-top: 0px; }
a img { border: 0px; }
li[style='text-align: center;'], li[style='text-align: center; '], li[style='text-align: right;'], li[style='text-align: right; '] { list-style-position: inside;}
body { font-family: Segoe UI; font-size: 12pt; }
quote { margin-left: 1em; margin-right: 1em; border-left: 5px #ebebeb solid; padding-left: 0.3em; }
</style>
</head>
<body>Hello,<div><br></div><div><a href="https://pulsesecurity.co.nz/articles/TPM-sniffing">https://pulsesecurity.co.nz/articles/TPM-sniffing</a></div><div>In this article, can see that communication with the TPM is vulnerable to sniffing if not careful.<br><div><br></div><div><span style="color:#00E;background-color:rgba(0,0,0,0);text-decoration:underline solid #00E;"><a href="https://tpm2-software.github.io/2020/04/13/Disk-Encryption.html">https://tpm2-software.github.io/2020/04/13/Disk-Encryption.html</a></span></div><div>Is the disk encryption described in tpm2-software's blog safe against these attacks?</div><div><br></div><ol style="margin: 0px 0px 15px 30px; padding: 0px; color: rgb(17, 17, 17); font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Helvetica, Arial, sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol"; background-color: rgb(253, 253, 253); text-shadow: transparent 0px 0px 0px, rgba(0, 0, 0, 0.68) 0px 0px 0px !important;"><li style="text-shadow:transparent 0px 0px 0px,rgba(0,0,0,0.68) 0px 0px 0px !important;"><code class="language-plaintext highlighter-rouge" style="text-shadow:transparent 0px 0px 0px,rgba(0,0,0,0.68) 0px 0px 0px !important;font-size:15px;border:1px solid #E8E8E8;border-radius:3px;background-color:#EEF;padding:1px 5px;">tpm2_createprimary -Q -C o -c prim.ctx</code><br style="text-shadow:transparent 0px 0px 0px,rgba(0,0,0,0.68) 0px 0px 0px !important;"></li><li style="text-shadow:transparent 0px 0px 0px,rgba(0,0,0,0.68) 0px 0px 0px !important;"><code class="language-plaintext highlighter-rouge" style="text-shadow:transparent 0px 0px 0px,rgba(0,0,0,0.68) 0px 0px 0px !important;font-size:15px;border:1px solid #E8E8E8;border-radius:3px;background-color:#EEF;padding:1px 5px;">dd if=/dev/urandom bs=1 count=32 status=none | tpm2_create -Q -g sha256 -u seal.pub -r seal.priv -i- -C prim.ctx</code><br style="text-shadow:transparent 0px 0px 0px,rgba(0,0,0,0.68) 0px 0px 0px !important;"></li><li style="text-shadow:transparent 0px 0px 0px,rgba(0,0,0,0.68) 0px 0px 0px !important;"><code class="language-plaintext highlighter-rouge" style="text-shadow:transparent 0px 0px 0px,rgba(0,0,0,0.68) 0px 0px 0px !important;font-size:15px;border:1px solid #E8E8E8;border-radius:3px;background-color:#EEF;padding:1px 5px;">tpm2_load -Q -C prim.ctx -u seal.pub -r seal.priv -n seal.name -c seal.ctx</code><br style="text-shadow:transparent 0px 0px 0px,rgba(0,0,0,0.68) 0px 0px 0px !important;"></li><li style="text-shadow:transparent 0px 0px 0px,rgba(0,0,0,0.68) 0px 0px 0px !important;"><code class="language-plaintext highlighter-rouge" style="text-shadow:transparent 0px 0px 0px,rgba(0,0,0,0.68) 0px 0px 0px !important;font-size:15px;border:1px solid #E8E8E8;border-radius:3px;background-color:#EEF;padding:1px 5px;">tpm2_evictcontrol -C o -c seal.ctx 0x81010001</code></li></ol><div><br></div><div>My question is:</div><div> 1. Is there a tool in linux that can sniff communication with the current system's TPM?</div><div> 2. How to encrypt communications if the methods described above are not secure?<br> It seems that encryption is possible through tpm2_startauthsession , but I do not know how to apply it to tpm2_create . (The -S option simply did not work.)</div><div><br></div><div>Thank you.</div><div><br></div>
</div><div><br><br><br><img src="https://mail.zeronsoftn.com/mthumbnail/ffbd1000-b8b6-44ea-b660-35333967ae6e.png" style="max-height: 32px"></div></body></html>