[tpm2] Re: How can I prevent MITM attacks for unsealing?
Roberts, William C <william.c.roberts at intel.com> Mon, 24 Oct 2022 17:32:16 +0000
| Newsgroups | dev.linux.lists.tpm2 |
|---|---|
| Message-ID | <SN6PR11MB343793B30F914D1C4D11D625B82E9@SN6PR11MB3437.namprd11.prod.outlook.com> |
The TPM2_Cerify command can certify that another key is the TPM based on a key you trust, like the EK.
Bill
________________________________
From: joseph(a)zeronsoftn.com <joseph(a)zeronsoftn.com>
Sent: Friday, October 21, 2022 11:23 PM
To: Roberts, William C <william.c.roberts(a)intel.com>
Cc: tpm2(a)lists.01.org <tpm2(a)lists.01.org>
Subject: Re[5]: [tpm2] How can I prevent MITM attacks for unsealing?
Serialized primary.handle has a Public Key.
Is there a way to verify whether this public key is a key created by the TPM through the TPM's EK?
If this is possible, it will not be possible to protect against MITM in general, but if you have the CA of specific TPM manufacturers safely or remotely verify it, can be defend against MITM.
토요일, 22 10월 2022, 02:43오전 +09:00 발신 "Roberts, William C" william.c.roberts(a)intel.com<mailto:william.c.roberts(a)intel.com>:
On Mon, 2022-10-10 at 18:07 +0300, joseph(a)zeronsoftn.com<mailto:joseph(a)zeronsoftn.com> wrote:
>
> Here is the commands I tried:
> https://gist.github.com/jclab-joseph/d1d6d9bbbd32c0fe200cc7725bcf0d86
> A session was established via a serialized persistent handle.
> This seems to be able to prevent MITM in the session connection
> process.
>
> But, assume that an attacker can modify the filesystem.
> If the primary.handle can be replaced with the attacker's key, the
> session will be successfully established.
> And I suspect that plaintext can be exposed if unsealed through the
> session.
>
> Wouldn't validation be needed between the connected session and
> seal.ctx?
If the attacker can modify the primary.handle, which is verifying the
encrypted session, then yes you need something else. You could add a
bind key with a password and have the user enter the password and thus
nothing for the attacker to attack that is stored on disk.
>
> 화요일, 04 10월 2022, 00:54오전 +09:00 발신 "Roberts, William C"
> william.c.roberts(a)intel.com:
>
> > On Mon, 2022-10-03 at 18:01 +0300, joseph(a)zeronsoftn.com<mailto:joseph(a)zeronsoftn.com> wrote:
> > > Hello,
> > >
> > > Does anyone know about this issue?
> > >
> > >
> > https://github.com/jc-lab/securekit/blob/466abe16bfe4f28ef86db6bc72649214ab2e4b51/pkg/securekit-disk/opt/securekit/sbin/disk-init#L82-L86
> > >
> > > Here's one example of sealing and unsealing.
> > > This method seems (probably?) to prevent the sniffing attack,
> > which
> > > was a vulnerability of Bitlocker in the past.
> > >
> > > But isn't a MITM attack possible in the process of creating an
> > > encrypted session?
> > So just to unpack the commands here for discussion I copied that
> > code
> > block:
> >
> > tpm2_createprimary -Q -C o -c tpm-primary.ctx
> > tpm2_load -Q -C tpm-primary.ctx -u ${p1_dir}/seal.pub -r
> > ${p1_dir}/seal.priv -c tpm-seal.ctx
> > tpm2_startauthsession -Q --hmac-session -c tpm-primary.ctx -S
> > session.ctx
> > tpm2_unseal -Q -p pcr:${tpm_seal_pcr_policy} -c tpm-seal.ctx -o
> > ${output}
> > cleanupSession
> >
> > The issue here is that the key created by the tpm2_createprimary
> > command doesn't have provenance, so it's just be trusted implicitly
> > even through it could be attacker controlled. If the attacker was
> > controlling the primary object, they could just forward the
> > commands
> > unencrypted to the TPM and get the unseal to release them the key
> > in
> > the clear.
> >
> > >
> > > I am not familiar with the process of establishing a session,
> > > However, it seems that MITM can be prevented only by using a
> > session
> > > key encrypted with the EK of the TPM, or by signing the
> > asymmetric
> > > key with the EK to derive the key, when creating a session.
> >
> > You just need a way to ensure provenance. Another way is to load an
> > established key to the TPM and start the authsession with that. If
> > you're using a persistent key you need to verify the name after
> > establishing the session or use something like a serialized ESYS_TR
> > which will do the name checking automatically. If you load a key
> > blob
> > to the TPM that you control, ESAPI will have the checks in place to
> > make sure you don't get duped.
> >
> > >
> > > Is MITM not considered in TPM? Or is there another way?
> >
> > It is considered in the TPM and is discussed in the architecture
> > document. Theirs a few ways you can securely set up an encrypted
> > session, either with EK and associated Certificate or through other
> > keys like the SRK. The big thing is, you have to do it in a way
> > where
> > the attacker can not MiTM the session establishment, which boils
> > down
> > to using a known key.
> >
> > >
> > > Regards,
> > >
> > >
> > >
> > >
> > >
> > > _______________________________________________
> > > tpm2 mailing list -- tpm2(a)lists.01.org<mailto:tpm2(a)lists.01.org>
> > > To unsubscribe send an email to tpm2-leave(a)lists.01.org<mailto:tpm2-leave(a)lists.01.org>
> > > %(web_page_url)slistinfo%(cgiext)s/%(_internal_name)s
>
>
>
[https://mail.zeronsoftn.com/mthumbnail/7b26b6d8-279b-4527-bfcd-9c3fb591e46c.png]
attachment.htm
(text/html, 7.7 KB)
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=ks_c_5601-1987">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="elementToProof">
The TPM2_Cerify command can certify that another key is the TPM based on a key you trust, like the EK.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="elementToProof">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="elementToProof">
Bill</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> [email protected] <[email protected]><br>
<b>Sent:</b> Friday, October 21, 2022 11:23 PM<br>
<b>To:</b> Roberts, William C <[email protected]><br>
<b>Cc:</b> [email protected] <[email protected]><br>
<b>Subject:</b> Re[5]: [tpm2] How can I prevent MITM attacks for unsealing?</font>
<div> </div>
</div>
<div>
<p dir="ltr" style="margin-top:0px">Serialized primary.handle has a Public Key.<br>
Is there a way to verify whether this public key is a key created by the TPM through the TPM's EK?</p>
<p dir="ltr">If this is possible, it will not be possible to protect against MITM in general, but if you have the CA of specific TPM manufacturers safely or remotely verify it, can be defend against MITM.</p>
Åä¿äÀÏ, 22 10¿ù 2022, 02:43¿ÀÀü +09:00 ¹ß½Å "Roberts, William C" <a href="mailto:[email protected]">
[email protected]</a>:<br>
<br>
<blockquote id="x_mail-app-auto-quote" style="border-left:1px solid #FC2C38; margin:0px 0px 0px 10px; padding:0px 0px 0px 10px">
<div class="x_js-helper x_js-readmsg-msg"><style type="text/css">
<!--
-->
</style>
<div><base href="https://e-aj.my.com/">
<div id="x_style_16663741830000011029_BODY">On Mon, 2022-10-10 at 18:07 +0300, <a href="mailto:[email protected]">
[email protected]</a> wrote:<br>
> <br>
> Here is the commands I tried:<br>
> <a href="https://gist.github.com/jclab-joseph/d1d6d9bbbd32c0fe200cc7725bcf0d86" target="_blank">
https://gist.github.com/jclab-joseph/d1d6d9bbbd32c0fe200cc7725bcf0d86</a><br>
> A session was established via a serialized persistent handle.<br>
> This seems to be able to prevent MITM in the session connection<br>
> process.<br>
> <br>
> But, assume that an attacker can modify the filesystem.<br>
> If the primary.handle can be replaced with the attacker's key, the<br>
> session will be successfully established.<br>
> And I suspect that plaintext can be exposed if unsealed through the<br>
> session.<br>
> <br>
> Wouldn't validation be needed between the connected session and<br>
> seal.ctx?<br>
If the attacker can modify the primary.handle, which is verifying the<br>
encrypted session, then yes you need something else. You could add a<br>
bind key with a password and have the user enter the password and thus<br>
nothing for the attacker to attack that is stored on disk.<br>
<br>
> <br>
> È¿äÀÏ, 04 10¿ù 2022, 00:54¿ÀÀü +09:00 ¹ß½Å "Roberts, William C" <br>
> [email protected]:<br>
> <br>
> > On Mon, 2022-10-03 at 18:01 +0300, <a href="mailto:[email protected]">[email protected]</a> wrote:<br>
> > > Hello,<br>
> > > <br>
> > > Does anyone know about this issue?<br>
> > > <br>
> > > <br>
> > <a href="https://github.com/jc-lab/securekit/blob/466abe16bfe4f28ef86db6bc72649214ab2e4b51/pkg/securekit-disk/opt/securekit/sbin/disk-init#L82-L86" target="_blank">
https://github.com/jc-lab/securekit/blob/466abe16bfe4f28ef86db6bc72649214ab2e4b51/pkg/securekit-disk/opt/securekit/sbin/disk-init#L82-L86</a><br>
> > > <br>
> > > Here's one example of sealing and unsealing.<br>
> > > This method seems (probably?) to prevent the sniffing attack,<br>
> > which<br>
> > > was a vulnerability of Bitlocker in the past.<br>
> > > <br>
> > > But isn't a MITM attack possible in the process of creating an<br>
> > > encrypted session?<br>
> > So just to unpack the commands here for discussion I copied that<br>
> > code<br>
> > block:<br>
> > <br>
> > tpm2_createprimary -Q -C o -c tpm-primary.ctx<br>
> > tpm2_load -Q -C tpm-primary.ctx -u ${p1_dir}/seal.pub -r<br>
> > ${p1_dir}/seal.priv -c tpm-seal.ctx<br>
> > tpm2_startauthsession -Q --hmac-session -c tpm-primary.ctx -S<br>
> > session.ctx<br>
> > tpm2_unseal -Q -p pcr:${tpm_seal_pcr_policy} -c tpm-seal.ctx -o<br>
> > ${output}<br>
> > cleanupSession<br>
> > <br>
> > The issue here is that the key created by the tpm2_createprimary<br>
> > command doesn't have provenance, so it's just be trusted implicitly<br>
> > even through it could be attacker controlled. If the attacker was<br>
> > controlling the primary object, they could just forward the<br>
> > commands<br>
> > unencrypted to the TPM and get the unseal to release them the key<br>
> > in<br>
> > the clear.<br>
> > <br>
> > > <br>
> > > I am not familiar with the process of establishing a session,<br>
> > > However, it seems that MITM can be prevented only by using a<br>
> > session<br>
> > > key encrypted with the EK of the TPM, or by signing the<br>
> > asymmetric<br>
> > > key with the EK to derive the key, when creating a session.<br>
> > <br>
> > You just need a way to ensure provenance. Another way is to load an<br>
> > established key to the TPM and start the authsession with that. If<br>
> > you're using a persistent key you need to verify the name after<br>
> > establishing the session or use something like a serialized ESYS_TR<br>
> > which will do the name checking automatically. If you load a key<br>
> > blob<br>
> > to the TPM that you control, ESAPI will have the checks in place to<br>
> > make sure you don't get duped.<br>
> > <br>
> > > <br>
> > > Is MITM not considered in TPM? Or is there another way?<br>
> > <br>
> > It is considered in the TPM and is discussed in the architecture<br>
> > document. Theirs a few ways you can securely set up an encrypted<br>
> > session, either with EK and associated Certificate or through other<br>
> > keys like the SRK. The big thing is, you have to do it in a way<br>
> > where<br>
> > the attacker can not MiTM the session establishment, which boils<br>
> > down<br>
> > to using a known key.<br>
> > <br>
> > > <br>
> > > Regards,<br>
> > > <br>
> > > <br>
> > > <br>
> > > <br>
> > > <br>
> > > _______________________________________________<br>
> > > tpm2 mailing list -- <a href="mailto:[email protected]">[email protected]</a><br>
> > > To unsubscribe send an email to <a href="mailto:[email protected]">[email protected]</a><br>
> > > %(web_page_url)slistinfo%(cgiext)s/%(_internal_name)s<br>
> <br>
> <br>
> <br>
</div>
<base href="https://e-aj.my.com/"></div>
</div>
</blockquote>
<div><br>
<br>
<br>
<img style="max-height:32px" src="https://mail.zeronsoftn.com/mthumbnail/7b26b6d8-279b-4527-bfcd-9c3fb591e46c.png"></div>
</div>
</body>
</html>