[tpm2] How can I prevent MITM attacks for unsealing?
Joseph Lee (ZeronsoftN) <joseph at zeronsoftn.com>
| Newsgroups | dev.linux.lists.tpm2 |
|---|---|
| Message-ID | <emf01f7daf-5ca7-4f42-8f83-d3525b1216b1@desktop-hihridj> |
Hi, From the previous messages, I learned how salted sessions exchange keys and are encrypted. However, I have yet to get an idea to prevent MITM attacks. I was able to get an salted session in the following way. Sealing: > tpm2_startauthsession -S session.ctx > tpm2_policypcr -Q -S session.ctx -l sha256:0,2,4 -L pcrs.sha256.policy > tpm2_flushcontext session.ctx > tpm2_createprimary -C o -c tpm-primary.ctx > tpm2_startauthsession --hmac-session -c tpm-primary.ctx -S session.ctx > tpm2_create -g sha256 -u seal.pub -r seal.priv -i INPUT_KEY -C tpm-primary.ctx -S session.ctx -L pcrs.sha256.policy > tpm2_load -C tpm-primary.ctx -u seal.pub -r seal.priv -n seal.name -c tpm-seal.ctx > tpm2_evictcontrol -C o -c tpm-seal.ctx 0x81000002 > tpm2_flushcontext session.ctx Unsealing: > tpm2_startauthsession --policy-session -S session.ctx > tpm2_policypcr -S session.ctx -l sha256:0,2,4 > tpm2_unseal -p session:session.ctx -c 0x81000002 -o OUTPUT_KEY > tpm2_flushcontext session.ctx However, in my opinion, from the tpm2_startauthsession part of the unsealing process, an MITM attack is performed to establish a session between the attacker-PC and the TPM-attacker session is established so that the attacker will be able to obtain plaintext data for subsequent unsealing. Thanks & Regards, Joseph. ------ Previous Message ------ > >>"Steven Clark" <davolfman(a)gmail.com> wrote on 08/02/2021 01:26:56 PM: >> >> > I think it may be an optional standard but my TPM has some certs >> > permanently stored in nv-indices in the 0x1c0000x range that can be >> > checked against the manufacturer cert. I haven't learned how to >> > leverage those into trusted parameter encryption keys yet but they >> > should be able to verify there's a real TPM at the other end at the >> > very least (and more if you learn to use them correctly). >> >>The EK certificates in NV are in theory optional, but every TPM >>I have encountered has them. >> >>Checking the certificate against the manufacturer's CA is >>a standard crypto library function. >> >>Once you have an authentic EK, create a salted session using >>the EK. >> >>Once you have the salted session, set the encrypt and/or decrypt bit >>when running the command. >> >>Underneath, there's some complicated crypto, but it's all >>hidden from the application. >> >> >>_______________________________________________ >>tpm2 mailing list -- tpm2(a)lists.01.org >>To unsubscribe send an email to tpm2-leave(a)lists.01.org >>%(web_page_url)slistinfo%(cgiext)s/%(_internal_name)s > > >
attachment.htm
(text/html, 5 KB)
<html><head><style id="pgp_css" type="text/css"><!----></style><style id="css_styles" type="text/css"><!--blockquote.cite { margin-left: 5px; margin-right: 0px; padding-left: 10px; padding-right:0px; border-left: 1px solid #cccccc }
blockquote.cite2 {margin-left: 5px; margin-right: 0px; padding-left: 10px; padding-right:0px; border-left: 1px solid #cccccc; margin-top: 3px; padding-top: 0px; }
a img { border: 0px; }
li[style='text-align: center;'], li[style='text-align: center; '], li[style='text-align: right;'], li[style='text-align: right; '] { list-style-position: inside;}
body { font-family: Segoe UI; font-size: 12pt; }
quote { margin-left: 1em; margin-right: 1em; border-left: 5px #ebebeb solid; padding-left: 0.3em; }--></style></head><body><div>Hi,</div><div><br></div><div>From the previous messages, I learned how salted sessions exchange keys and are encrypted.</div><div><br></div><div>However, I have yet to get an idea to prevent MITM attacks.</div><div><br></div><div>I was able to get an salted session in the following way.</div><div><br></div><div>Sealing:</div><div>> tpm2_startauthsession -S session.ctx
</div><div>> tpm2_policypcr -Q -S session.ctx -l sha256:0,2,4 -L pcrs.sha256.policy
</div><div>> tpm2_flushcontext session.ctx
</div><div>> tpm2_createprimary -C o -c tpm-primary.ctx
</div><div>> tpm2_startauthsession --hmac-session -c tpm-primary.ctx -S session.ctx
</div><div>> tpm2_create -g sha256 -u seal.pub -r seal.priv -i INPUT_KEY -C tpm-primary.ctx -S session.ctx -L pcrs.sha256.policy
</div><div>> tpm2_load -C tpm-primary.ctx -u seal.pub -r seal.priv -n seal.name -c tpm-seal.ctx
</div><div>> tpm2_evictcontrol -C o -c tpm-seal.ctx 0x81000002
</div><div>> tpm2_flushcontext session.ctx</div><div><br></div><div>Unsealing:</div><div>> tpm2_startauthsession --policy-session -S session.ctx
</div><div>> tpm2_policypcr -S session.ctx -l sha256:0,2,4
</div><div>> tpm2_unseal -p session:session.ctx -c 0x81000002 -o OUTPUT_KEY</div><div>> tpm2_flushcontext session.ctx</div>
<div><br></div><div>However, in my opinion, from the tpm2_startauthsession part of the unsealing process, an MITM attack is performed to establish a session between the attacker-PC and the TPM-attacker session is established so that the attacker will be able to obtain plaintext data for subsequent unsealing.</div><div><br></div><div><br></div><div>Thanks & Regards,</div><div>Joseph.</div><div><br></div>
<div>------ Previous Message ------</div><div id="x7136381c5cf4412"><blockquote cite="[email protected]" type="cite" class="cite2">
<p style="margin-top: 0px;" dir="ltr"></p><blockquote id="mail-app-auto-quote" cite="16279307420000005606" style="border-left:1px solid #FC2C38; margin:0px 0px 0px 10px; padding:0px 0px 0px 10px;">
<div class="js-helper js-readmsg-msg">
<div>
<div id="style_16279307420000005606_BODY"><div class="cl_938656"><p><tt><font size="2">"Steven Clark" <<a href="mailto:[email protected]">[email protected]</a>> wrote on 08/02/2021 01:26:56 PM:<br><br>> I think it may be an optional standard but my TPM has some certs <br>> permanently stored in nv-indices in the 0x1c0000x range that can be <br>> checked against the manufacturer cert. I haven't learned how to <br>> leverage those into trusted parameter encryption keys yet but they <br>> should be able to verify there's a real TPM at the other end at the <br>> very least (and more if you learn to use them correctly).</font></tt><br><tt><font size="2"><br>The EK certificates in NV are in theory optional, but every TPM</font></tt><br><tt><font size="2">I have encountered has them.</font></tt><br><br><tt><font size="2">Checking the certificate against the manufacturer's CA is</font></tt><br><tt><font size="2">a standard crypto library function.</font></tt><br><br><tt><font size="2">Once you have an authentic EK, create a salted session using</font></tt><br><tt><font size="2">the EK.</font></tt><br><br><tt><font size="2">Once you have the salted session, set the encrypt and/or decrypt bit</font></tt><br><tt><font size="2">when running the command.</font></tt><br><br><tt><font size="2">Underneath, there's some complicated crypto, but it's all</font></tt><br><tt><font size="2">hidden from the application.</font></tt><br>
<br>
</p></div></div>
<div>_______________________________________________<br>
tpm2 mailing list -- <a href="mailto:[email protected]">[email protected]</a><br>
To unsubscribe send an email to <a href="mailto:[email protected]">[email protected]</a><br>
%(web_page_url)slistinfo%(cgiext)s/%(_internal_name)s</div>
</div>
</div>
</blockquote>
<div><br><br><br><img src="https://mail.zeronsoftn.com/mthumbnail/4e645b05-f948-4090-8a7d-a1196f1fafbe.png" style="max-height: 32px"></div></blockquote></div>
<div><br><br><br><img src="https://mail.zeronsoftn.com/mthumbnail/12cf28f0-6d3a-4e52-913d-c53ed8a8dcd7.png" style="max-height: 32px"></div></body></html>