[tpm2] Re: How can I prevent MITM attacks for unsealing?

joseph at zeronsoftn.com Mon, 03 Oct 2022 18:01:09 +0300
Newsgroups dev.linux.lists.tpm2
Message-ID <[email protected]>
Hello,
Does anyone know about this issue?
https://github.com/jc-lab/securekit/blob/466abe16bfe4f28ef86db6bc72649214ab2e4b51/pkg/securekit-disk/opt/securekit/sbin/disk-init#L82-L86
Here's one example of sealing and unsealing.
This method seems (probably?) to prevent the sniffing attack, which was a vulnerability of Bitlocker in the past.
But isn't a MITM attack possible in the process of creating an encrypted session?
I am not familiar with the process of establishing a session,
However, it seems that MITM can be prevented only by using a session key encrypted with the EK of the TPM, or by signing the asymmetric key with the EK to derive the key, when creating a session.
Is MITM not considered in TPM? Or is there another way?
Regards,
attachment.htm (text/html, 1.1 KB)
<html><head></head><body><p style="margin-top: 0px;" dir="ltr">Hello,</p>
<p dir="ltr">Does anyone know about this issue?</p>
<p dir="ltr">https://github.com/jc-lab/securekit/blob/466abe16bfe4f28ef86db6bc72649214ab2e4b51/pkg/securekit-disk/opt/securekit/sbin/disk-init#L82-L86</p>
<p dir="ltr">Here's one example of sealing and unsealing.<br>
This method seems (probably?) to prevent the sniffing attack, which was a vulnerability of Bitlocker in the past.</p>
<p dir="ltr">But isn't a MITM attack possible in the process of creating an encrypted session?</p>
<p dir="ltr">I am not familiar with the process of establishing a session,<br>
However, it seems that MITM can be prevented only by using a session key encrypted with the EK of the TPM, or by signing the asymmetric key with the EK to derive the key, when creating a session.</p>
<p dir="ltr">Is MITM not considered in TPM? Or is there another way?<br></p>
<p dir="ltr">Regards,</p>

<div><br><br><br><img src="https://mail.zeronsoftn.com/mthumbnail/fcd01b64-f9d3-45bf-9e41-358205c84055.png" style="max-height: 32px"></div></body></html>