[tpm2] Re: Is the tpm2_create command safe against sniffing attacks?

Joseph Lee (ZeronsoftN) <joseph at zeronsoftn.com>
Newsgroups dev.linux.lists.tpm2
Message-ID <embc50f58e-9f9d-4b11-8f71-8ebc3d052ec0@desktop-hihridj> 
Hi Dimi,

Thank you for your kind answer. Looking at the link you gave, I think I 
can get more ideas.

I've been trying session encryption via tpm2-tools all weekend.
But I haven't found a way to create an encrypted session in tpm2-tools 
yet. Maybe tpm2-tools doesn't support encrypted sessions?

If this is clear, I will implement parameter encryption through 
tpm2-tools with referring to wolfTPM.

Thanks & Regards,
Joseph

------ Original Message ------
보낸 사람: "Dimitar Tomov" <dimi(a)designfirst.ee>
받는 사람: "tpm2(a)lists.01.org" <tpm2(a)lists.01.org>; "Joseph Lee 
(ZeronsoftN)" <joseph(a)zeronsoftn.com>
보낸 날짜: 2021-08-02 오전 4:33:02
제목: [tpm2] Re: Is the tpm2_create command safe against sniffing attacks?

>Hi Joseph,
>
>TPM 2.0 offers Parameter Encryption capability and HMAC sessions as 
>measures against Man-in-the-middle attacks.
>
>Examples in wolfTPM demonstrate how to enable Parameter Encryption
>
>  
>https://github.com/wolfSSL/wolfTPM/blob/b0a65e44b8a25be88b2f9ff4e35fbf08360e5d01/examples/nvram/store.c#L121
>
>There is also Keygen , Key import and Key loading examples with 
>Parameter Encryption
>
>https://github.com/wolfSSL/wolfTPM/blob/b0a65e44b8a25be88b2f9ff4e35fbf08360e5d01/examples/nvram/store.c#L121
>
>Last week we discussed the Dolos Group story about a stolen laptop with 
>TPM https://developers.tpm.dev/posts/15883726
>
>If Parameter Encryption and HMAC session have been used, this story 
>would have developed differently.
>
>Hope this helps.
>
>Dimi
>--
>Founder of TPM.dev
>
>--------------------------------------------------------------------------------
>From: Joseph Lee (ZeronsoftN) <joseph(a)zeronsoftn.com>
>Sent: Saturday, July 31, 2021 2:09 AM
>To:tpm2(a)lists.01.org <tpm2(a)lists.01.org>
>Subject: [tpm2] Is the tpm2_create command safe against sniffing 
>attacks?
>
>Hello,
>
>https://pulsesecurity.co.nz/articles/TPM-sniffing
>In this article, can see that communication with the TPM is vulnerable 
>to sniffing if not careful.
>
>https://tpm2-software.github.io/2020/04/13/Disk-Encryption.html
>Is the disk encryption described in tpm2-software's blog safe against 
>these attacks?
>
>tpm2_createprimary -Q -C o -c prim.ctx
>dd if=/dev/urandom bs=1 count=32 status=none | tpm2_create -Q -g sha256 
>-u seal.pub -r seal.priv -i- -C prim.ctx
>tpm2_load -Q -C prim.ctx -u seal.pub -r seal.priv -n seal.name -c 
>seal.ctx
>tpm2_evictcontrol -C o -c seal.ctx 0x81010001
>
>My question is:
>     1. Is there a tool in linux that can sniff communication with the 
>current system's TPM?
>     2. How to encrypt communications if the methods described above are 
>not secure?
>         It seems that encryption is possible through 
>tpm2_startauthsession , but I do not know how to apply it to 
>tpm2_create . (The -S option simply did not work.)
>
>Thank you.
>
>
>
>
attachment.htm (text/html, 10.4 KB) 
<html><head>

<style id="pgp_css" type="text/css"><!----></style><style type="text/css"><!----></style><style id="css_styles" type="text/css"><!--blockquote.cite { margin-left: 5px; margin-right: 0px; padding-left: 10px; padding-right:0px; border-left: 1px solid #cccccc }
blockquote.cite2 {margin-left: 5px; margin-right: 0px; padding-left: 10px; padding-right:0px; border-left: 1px solid #cccccc; margin-top: 3px; padding-top: 0px; }
a img { border: 0px; }
li[style='text-align: center;'], li[style='text-align: center; '], li[style='text-align: right;'], li[style='text-align: right; '] {  list-style-position: inside;}
body { font-family: Segoe UI; font-size: 12pt;   } 
quote { margin-left: 1em; margin-right: 1em; border-left: 5px #ebebeb solid; padding-left: 0.3em; }--></style>
</head>
<body><div>Hi Dimi,</div><div><br></div><div>Thank you for your kind answer. Looking at the link you gave, I think I can get more ideas.
</div><div><br></div><div>I've been trying session encryption via tpm2-tools all weekend.
</div><div>But I haven't found a way to create an encrypted session in tpm2-tools yet. Maybe tpm2-tools doesn't support encrypted sessions?</div><div><br></div><div>If this is clear, I will implement parameter encryption through tpm2-tools with referring to wolfTPM.</div><div><br></div><div><span>Thanks &amp; Regards,</span></div><div>Joseph</div>
<div><br></div>
<div>------ Original Message ------</div>
<div>보낸 사람: "Dimitar Tomov" &lt;<a href="mailto:[email protected]" style="">[email protected]</a>&gt;</div>
<div>받는 사람: "<a href="mailto:[email protected]" style="">[email protected]</a>" &lt;<a href="mailto:[email protected]" style="">[email protected]</a>&gt;; "Joseph Lee (ZeronsoftN)" &lt;<a href="mailto:[email protected]">[email protected]</a>&gt;</div>
<div>보낸 날짜: 2021-08-02 오전 4:33:02</div>
<div>제목: [tpm2] Re: Is the tpm2_create command safe against sniffing attacks?</div><div><br></div>
<div id="x8ebb9e3798dc4fa"><blockquote cite="HE1PR08MB265161B58D8BE61444DD11B5B5EE9@he1pr08mb2651.eurprd08prod.outlook.com" type="cite" class="cite2">

<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
Hi Joseph,</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
TPM 2.0 offers Parameter Encryption capability and HMAC sessions as measures against Man-in-the-middle attacks</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
Examples in wolfTPM demonstrate how to enable Parameter Encryption&nbsp;</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
&nbsp;<a href="https://github.com/wolfSSL/wolfTPM/blob/b0a65e44b8a25be88b2f9ff4e35fbf08360e5d01/examples/nvram/store.c#L121" id="LPlnk619952">https://github.com/wolfSSL/wolfTPM/blob/b0a65e44b8a25be88b2f9ff4e35fbf08360e5d01/examples/nvram/store.c#L121</a>&nbsp;</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
There is also Keygen , Key import and Key loading examples with Parameter Encryption</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<a href="https://github.com/wolfSSL/wolfTPM/blob/b0a65e44b8a25be88b2f9ff4e35fbf08360e5d01/examples/nvram/store.c#L121" id="LPlnk585337">https://github.com/wolfSSL/wolfTPM/blob/b0a65e44b8a25be88b2f9ff4e35fbf08360e5d01/examples/nvram/store.c#L121</a><br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
Last week we discussed the Dolos Group story about a stolen laptop with TPM&nbsp;<a href="https://developers.tpm.dev/posts/15883726" id="LPlnk">https://developers.tpm.dev/posts/15883726</a>&nbsp;</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
If Parameter Encryption and HMAC session have been used, this story would have developed differently.</div>
<br>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
Hope this helps.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
Dimi</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
--</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
Founder of TPM.dev</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<br>
</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> Joseph Lee (ZeronsoftN) &lt;<a href="mailto:[email protected]">joseph@zeronsoftncom</a>&gt;<br>
<b>Sent:</b> Saturday, July 31, 2021 2:09 AM<br>
<b>To:</b> <a href="mailto:[email protected]">[email protected]</a> &lt;<a href="mailto:[email protected]">[email protected]</a>&gt;<br>
<b>Subject:</b> [tpm2] Is the tpm2_create command safe against sniffing attacks?</font>
<div>&nbsp;</div>
</div>
<style type="text/css"><!--#x8ebb9e3798dc4fa blockquote.x_cite
{margin-left: 5px; margin-right: 0px; padding-left: 10px; padding-right: 0px; border-left: 1px solid rgb(204, 204, 204);}
#x8ebb9e3798dc4fa blockquote.x_cite2
{margin-left: 5px; margin-right: 0px; padding-left: 10px; padding-right: 0px; border-left: 1px solid rgb(204, 204, 204); margin-top: 3px; padding-top: 0px;}
#x8ebb9e3798dc4fa a img
{border: 0px;}
#x8ebb9e3798dc4fa li#x8ebb9e3798dc4fa [style="'text-align: center;'"], #x8ebb9e3798dc4fa li#x8ebb9e3798dc4fa [style="'text-align: center; '"], #x8ebb9e3798dc4fa li#x8ebb9e3798dc4fa [style="'text-align: right;'"], #x8ebb9e3798dc4fa li#x8ebb9e3798dc4fa [style="'text-align: right; '"]
{list-style-position: inside;}
#x8ebb9e3798dc4fa div
{font-family: "Segoe UI"; font-size: 12pt;}
#x8ebb9e3798dc4fa quote
{margin-left: 1em; margin-right: 1em; border-left: 5px solid rgb(235, 235, 235); padding-left: 0.3em;}
--></style>
<div>Hello,
<div><br>
</div>
<div><a href="https://pulsesecurity.co.nz/articles/TPM-sniffing">https://pulsesecurity.co.nz/articles/TPM-sniffing</a></div>
<div>In this article, can see that communication with the TPM is vulnerable to sniffing if not careful.<br>
<div><br>
</div>
<div><span style="color:#00E; background-color:rgba(0,0,0,0); text-decoration:underline solid #00E"><a href="https://tpm2-software.github.io/2020/04/13/Disk-Encryption.html">https://tpm2-software.github.io/2020/04/13/Disk-Encryption.html</a></span></div>
<div>Is the disk encryption described in tpm2-software's blog safe against these attacks?</div>
<div><br>
</div>
<ol style="margin:0px 0px 15px 30px; padding:0px; color:rgb(17,17,17); background-color:rgb(253,253,253)">
<li style=""><code class="x_language-plaintext x_highlighter-rouge" style="font-size:15px; border:1px solid #E8E8E8; border-radius:3px; background-color:#EEF; padding:1px 5px">tpm2_createprimary -Q -C o -c prim.ctx</code><br style="">
</li><li style=""><code class="x_language-plaintext x_highlighter-rouge" style="font-size:15px; border:1px solid #E8E8E8; border-radius:3px; background-color:#EEF; padding:1px 5px">dd if=/dev/urandom bs=1 count=32 status=none | tpm2_create -Q -g sha256 -u seal.pub
 -r seal.priv -i- -C prim.ctx</code><br style="">
</li><li style=""><code class="x_language-plaintext x_highlighter-rouge" style="font-size:15px; border:1px solid #E8E8E8; border-radius:3px; background-color:#EEF; padding:1px 5px">tpm2_load -Q -C prim.ctx -u seal.pub -r seal.priv -n seal.name -c seal.ctx</code><br style="">
</li><li style=""><code class="x_language-plaintext x_highlighter-rouge" style="font-size:15px; border:1px solid #E8E8E8; border-radius:3px; background-color:#EEF; padding:1px 5px">tpm2_evictcontrol -C o -c seal.ctx 0x81010001</code></li></ol>
<div><br>
</div>
<div>My question is:</div>
<div>&nbsp; &nbsp; 1. Is there a tool in linux that can sniff communication with the current system's TPM?</div>
<div>&nbsp; &nbsp; 2. How to encrypt communications if the methods described above are not secure?<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;It seems that encryption is possible through tpm2_startauthsession , but I do not know how to apply it to tpm2_create . (The -S option simply did not work.)</div>
<div><br>
</div>
<div>Thank you.</div>
<div><br>
</div>
</div>
<div><br>
<br>
<br>
<img style="max-height:32px" src="https://mail.zeronsoftn.com/mthumbnail/ffbd1000-b8b6-44ea-b660-35333967ae6e.png"></div>
</div>
</blockquote></div>


<div><br><br><br><img src="https://mail.zeronsoftn.com/mthumbnail/a99c90be-a687-4f14-91cc-d7f28553e551.png" style="max-height: 32px"></div></body></html>
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.