[tpm2] Re: How can I prevent MITM attacks for unsealing?
Roberts, William C <william.c.roberts at intel.com>
| Newsgroups | dev.linux.lists.tpm2 |
|---|---|
| Message-ID | <SN6PR11MB343793A8C91EB0DFAF75F1EDB8F79@SN6PR11MB3437.namprd11.prod.outlook.com> |
Imran can you comment on the state this is in? If you want a session that encrypts and decrypts, when starting the session you need to supply the option `--key-context`. you'll need to verify independently that the context points to a key you know and trust, you can just do a sign/verify. We need to add a name/public parameter to the input so we can perform this verification for users in the tool. I think theirs an open bug somewhere for this. If you use persistent keys, you can get the "serialized handle", which under the hood is the ESYS_TR blob and use that for "--key-context" and it will verify the name. You can obtain the ESYS_TR with read public command. You'll still want to do something to ensure that no-one has swapped out your key until you get through the startauthsession. At that point it's not swappable without detection (crypto would fail). From there, you need to add that session to the -S parameter for all commands that you want encryption for. I am not 100% sure of where that feature state is now, I haven't looked in a while, but Imran might know more. ________________________________ From: Joseph Lee (ZeronsoftN) <joseph(a)zeronsoftn.com> Sent: Tuesday, August 3, 2021 9:02 AM To: tpm2(a)lists.01.org <tpm2(a)lists.01.org> Subject: [tpm2] How can I prevent MITM attacks for unsealing? Hi, From the previous messages, I learned how salted sessions exchange keys and are encrypted. However, I have yet to get an idea to prevent MITM attacks. I was able to get an salted session in the following way. Sealing: > tpm2_startauthsession -S session.ctx > tpm2_policypcr -Q -S session.ctx -l sha256:0,2,4 -L pcrs.sha256.policy > tpm2_flushcontext session.ctx > tpm2_createprimary -C o -c tpm-primary.ctx > tpm2_startauthsession --hmac-session -c tpm-primary.ctx -S session.ctx > tpm2_create -g sha256 -u seal.pub -r seal.priv -i INPUT_KEY -C tpm-primary.ctx -S session.ctx -L pcrs.sha256.policy > tpm2_load -C tpm-primary.ctx -u seal.pub -r seal.priv -n seal.name -c tpm-seal.ctx > tpm2_evictcontrol -C o -c tpm-seal.ctx 0x81000002 > tpm2_flushcontext session.ctx Unsealing: > tpm2_startauthsession --policy-session -S session.ctx > tpm2_policypcr -S session.ctx -l sha256:0,2,4 > tpm2_unseal -p session:session.ctx -c 0x81000002 -o OUTPUT_KEY > tpm2_flushcontext session.ctx However, in my opinion, from the tpm2_startauthsession part of the unsealing process, an MITM attack is performed to establish a session between the attacker-PC and the TPM-attacker session is established so that the attacker will be able to obtain plaintext data for subsequent unsealing. Thanks & Regards, Joseph. ------ Previous Message ------ "Steven Clark" <davolfman(a)gmail.com<mailto:davolfman(a)gmail.com>> wrote on 08/02/2021 01:26:56 PM: > I think it may be an optional standard but my TPM has some certs > permanently stored in nv-indices in the 0x1c0000x range that can be > checked against the manufacturer cert. I haven't learned how to > leverage those into trusted parameter encryption keys yet but they > should be able to verify there's a real TPM at the other end at the > very least (and more if you learn to use them correctly). The EK certificates in NV are in theory optional, but every TPM I have encountered has them. Checking the certificate against the manufacturer's CA is a standard crypto library function. Once you have an authentic EK, create a salted session using the EK. Once you have the salted session, set the encrypt and/or decrypt bit when running the command. Underneath, there's some complicated crypto, but it's all hidden from the application. _______________________________________________ tpm2 mailing list -- tpm2(a)lists.01.org<mailto:tpm2(a)lists.01.org> To unsubscribe send an email to tpm2-leave(a)lists.01.org<mailto:tpm2-leave(a)lists.01.org> %(web_page_url)slistinfo%(cgiext)s/%(_internal_name)s [https://mail.zeronsoftn.com/mthumbnail/4e645b05-f948-4090-8a7d-a1196f1fafbe.png] [https://mail.zeronsoftn.com/mthumbnail/12cf28f0-6d3a-4e52-913d-c53ed8a8dcd7.png]
attachment.htm
(text/html, 10.3 KB)
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Imran can you comment on the state this is in?</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="color: rgb(0, 0, 0); font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt;">If you want a session that encrypts and decrypts, when starting the session you need to supply the option `</span><span style="color: rgb(0, 0, 0); font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt;">--key-context`.</span><br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
you'll need to verify independently that the context points to a key you know and trust, you can just do a sign/verify. We need</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
to add a name/public parameter to the input so we can perform this verification for users in the tool. I think theirs an open bug</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
somewhere for this. If you use persistent keys, you can get the "serialized handle", which under the hood is the ESYS_TR blob and</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
use that for "--key-context" and it will verify the name. You can obtain the ESYS_TR with read public command. You'll still want to</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
do something to ensure that no-one has swapped out your key until you get through the startauthsession. At that point it's not swappable</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
without detection (crypto would fail).</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
From there, you need to add that session to the -S parameter for all commands that you want encryption for. I am not 100% sure of where</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
that feature state is now, I haven't looked in a while, but Imran might know more.</div>
<div id="appendonsend"></div>
<div style="font-family: "Segoe UI"; font-size: 12pt;font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr" style="font-family: "Segoe UI"; font-size: 12pt;">
<font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> Joseph Lee (ZeronsoftN) <[email protected]><br>
<b>Sent:</b> Tuesday, August 3, 2021 9:02 AM<br>
<b>To:</b> [email protected] <[email protected]><br>
<b>Subject:</b> [tpm2] How can I prevent MITM attacks for unsealing?</font>
<div style="font-family: "Segoe UI"; font-size: 12pt;"> </div>
</div>
<div style="font-family: "Segoe UI"; font-size: 12pt;">
<div style="font-family: "Segoe UI"; font-size: 12pt;">Hi,</div>
<div style="font-family: "Segoe UI"; font-size: 12pt;"><br>
</div>
<div style="font-family: "Segoe UI"; font-size: 12pt;">From the previous messages, I learned how salted sessions exchange keys and are encrypted.</div>
<div style="font-family: "Segoe UI"; font-size: 12pt;"><br>
</div>
<div style="font-family: "Segoe UI"; font-size: 12pt;">However, I have yet to get an idea to prevent MITM attacks.</div>
<div style="font-family: "Segoe UI"; font-size: 12pt;"><br>
</div>
<div style="font-family: "Segoe UI"; font-size: 12pt;">I was able to get an salted session in the following way.</div>
<div style="font-family: "Segoe UI"; font-size: 12pt;"><br>
</div>
<div style="font-family: "Segoe UI"; font-size: 12pt;">Sealing:</div>
<div style="font-family: "Segoe UI"; font-size: 12pt;">> tpm2_startauthsession -S session.ctx
</div>
<div style="font-family: "Segoe UI"; font-size: 12pt;">> tpm2_policypcr -Q -S session.ctx -l sha256:0,2,4 -L pcrs.sha256.policy
</div>
<div style="font-family: "Segoe UI"; font-size: 12pt;">> tpm2_flushcontext session.ctx
</div>
<div style="font-family: "Segoe UI"; font-size: 12pt;">> tpm2_createprimary -C o -c tpm-primary.ctx
</div>
<div style="font-family: "Segoe UI"; font-size: 12pt;">> tpm2_startauthsession --hmac-session -c tpm-primary.ctx -S session.ctx
</div>
<div style="font-family: "Segoe UI"; font-size: 12pt;">> tpm2_create -g sha256 -u seal.pub -r seal.priv -i INPUT_KEY -C tpm-primary.ctx -S session.ctx -L pcrs.sha256.policy
</div>
<div style="font-family: "Segoe UI"; font-size: 12pt;">> tpm2_load -C tpm-primary.ctx -u seal.pub -r seal.priv -n seal.name -c tpm-seal.ctx
</div>
<div style="font-family: "Segoe UI"; font-size: 12pt;">> tpm2_evictcontrol -C o -c tpm-seal.ctx 0x81000002
</div>
<div style="font-family: "Segoe UI"; font-size: 12pt;">> tpm2_flushcontext session.ctx</div>
<div style="font-family: "Segoe UI"; font-size: 12pt;"><br>
</div>
<div style="font-family: "Segoe UI"; font-size: 12pt;">Unsealing:</div>
<div style="font-family: "Segoe UI"; font-size: 12pt;">> tpm2_startauthsession --policy-session -S session.ctx
</div>
<div style="font-family: "Segoe UI"; font-size: 12pt;">> tpm2_policypcr -S session.ctx -l sha256:0,2,4
</div>
<div style="font-family: "Segoe UI"; font-size: 12pt;">> tpm2_unseal -p session:session.ctx -c 0x81000002 -o OUTPUT_KEY</div>
<div style="font-family: "Segoe UI"; font-size: 12pt;">> tpm2_flushcontext session.ctx</div>
<div style="font-family: "Segoe UI"; font-size: 12pt;"><br>
</div>
<div style="font-family: "Segoe UI"; font-size: 12pt;">However, in my opinion, from the tpm2_startauthsession part of the unsealing process, an MITM attack is performed to establish a session between the attacker-PC and the TPM-attacker session is established
so that the attacker will be able to obtain plaintext data for subsequent unsealing.</div>
<div style="font-family: "Segoe UI"; font-size: 12pt;"><br>
</div>
<div style="font-family: "Segoe UI"; font-size: 12pt;"><br>
</div>
<div style="font-family: "Segoe UI"; font-size: 12pt;">Thanks & Regards,</div>
<div style="font-family: "Segoe UI"; font-size: 12pt;">Joseph.</div>
<div style="font-family: "Segoe UI"; font-size: 12pt;"><br>
</div>
<div style="font-family: "Segoe UI"; font-size: 12pt;">------ Previous Message ------</div>
<div id="x_x7136381c5cf4412" style="font-family: "Segoe UI"; font-size: 12pt;">
<blockquote type="cite" class="x_cite2" style="margin-left: 5px; margin-right: 0px; padding-left: 10px; padding-right: 0px; border-left: 1px solid rgb(204, 204, 204); margin-top: 3px; padding-top: 0px;">
<p dir="ltr" style="margin-top:0px"></p>
<blockquote id="x_mail-app-auto-quote" style="border-left:1px solid #FC2C38; margin:0px 0px 0px 10px; padding:0px 0px 0px 10px">
<div class="x_js-helper x_js-readmsg-msg" style="font-family: "Segoe UI"; font-size: 12pt;">
<div style="font-family: "Segoe UI"; font-size: 12pt;">
<div id="x_style_16279307420000005606_BODY" style="font-family: "Segoe UI"; font-size: 12pt;">
<div class="x_cl_938656" style="font-family: "Segoe UI"; font-size: 12pt;">
<p><tt><font size="2">"Steven Clark" <<a href="mailto:[email protected]">[email protected]</a>> wrote on 08/02/2021 01:26:56 PM:<br>
<br>
> I think it may be an optional standard but my TPM has some certs <br>
> permanently stored in nv-indices in the 0x1c0000x range that can be <br>
> checked against the manufacturer cert. I haven't learned how to <br>
> leverage those into trusted parameter encryption keys yet but they <br>
> should be able to verify there's a real TPM at the other end at the <br>
> very least (and more if you learn to use them correctly).</font></tt><br>
<tt><font size="2"><br>
The EK certificates in NV are in theory optional, but every TPM</font></tt><br>
<tt><font size="2">I have encountered has them.</font></tt><br>
<br>
<tt><font size="2">Checking the certificate against the manufacturer's CA is</font></tt><br>
<tt><font size="2">a standard crypto library function.</font></tt><br>
<br>
<tt><font size="2">Once you have an authentic EK, create a salted session using</font></tt><br>
<tt><font size="2">the EK.</font></tt><br>
<br>
<tt><font size="2">Once you have the salted session, set the encrypt and/or decrypt bit</font></tt><br>
<tt><font size="2">when running the command.</font></tt><br>
<br>
<tt><font size="2">Underneath, there's some complicated crypto, but it's all</font></tt><br>
<tt><font size="2">hidden from the application.</font></tt><br>
<br>
</p>
</div>
</div>
<div style="font-family: "Segoe UI"; font-size: 12pt;">_______________________________________________<br>
tpm2 mailing list -- <a href="mailto:[email protected]">[email protected]</a><br>
To unsubscribe send an email to <a href="mailto:[email protected]">[email protected]</a><br>
%(web_page_url)slistinfo%(cgiext)s/%(_internal_name)s</div>
</div>
</div>
</blockquote>
<div style="font-family: "Segoe UI"; font-size: 12pt;"><br>
<br>
<br>
<img style="max-height:32px" src="https://mail.zeronsoftn.com/mthumbnail/4e645b05-f948-4090-8a7d-a1196f1fafbe.png"></div>
</blockquote>
</div>
<div style="font-family: "Segoe UI"; font-size: 12pt;"><br>
<br>
<br>
<img style="max-height:32px" src="https://mail.zeronsoftn.com/mthumbnail/12cf28f0-6d3a-4e52-913d-c53ed8a8dcd7.png"></div>
</div>
</body>
</html>