[tpm2] Re: How can I prevent MITM attacks for unsealing?
joseph at zeronsoftn.com Mon, 03 Oct 2022 18:01:09 +0300
| Newsgroups | dev.linux.lists.tpm2 |
|---|---|
| Message-ID | <[email protected]> |
Hello, Does anyone know about this issue? https://github.com/jc-lab/securekit/blob/466abe16bfe4f28ef86db6bc72649214ab2e4b51/pkg/securekit-disk/opt/securekit/sbin/disk-init#L82-L86 Here's one example of sealing and unsealing. This method seems (probably?) to prevent the sniffing attack, which was a vulnerability of Bitlocker in the past. But isn't a MITM attack possible in the process of creating an encrypted session? I am not familiar with the process of establishing a session, However, it seems that MITM can be prevented only by using a session key encrypted with the EK of the TPM, or by signing the asymmetric key with the EK to derive the key, when creating a session. Is MITM not considered in TPM? Or is there another way? Regards,
attachment.htm
(text/html, 1.1 KB)
<html><head></head><body><p style="margin-top: 0px;" dir="ltr">Hello,</p> <p dir="ltr">Does anyone know about this issue?</p> <p dir="ltr">https://github.com/jc-lab/securekit/blob/466abe16bfe4f28ef86db6bc72649214ab2e4b51/pkg/securekit-disk/opt/securekit/sbin/disk-init#L82-L86</p> <p dir="ltr">Here's one example of sealing and unsealing.<br> This method seems (probably?) to prevent the sniffing attack, which was a vulnerability of Bitlocker in the past.</p> <p dir="ltr">But isn't a MITM attack possible in the process of creating an encrypted session?</p> <p dir="ltr">I am not familiar with the process of establishing a session,<br> However, it seems that MITM can be prevented only by using a session key encrypted with the EK of the TPM, or by signing the asymmetric key with the EK to derive the key, when creating a session.</p> <p dir="ltr">Is MITM not considered in TPM? Or is there another way?<br></p> <p dir="ltr">Regards,</p> <div><br><br><br><img src="https://mail.zeronsoftn.com/mthumbnail/fcd01b64-f9d3-45bf-9e41-358205c84055.png" style="max-height: 32px"></div></body></html>