Subject: [Rats] TPM background for RIV

From: Guy Fedorkow <[email-masked]>
Date: Tue, 25 Aug 2020 19:16:05 +0000

A recent reviewer of the RIV document (that would be a RIViewer) pointed out
that the doc assumes that the fundamental behavior of a TPM for attestation
is already well known by the reader.  Of course that may not be the case.

  Rather than add more tutorial material to be body of the document, I'd
like to suggest adding the following subsection to the existing appendices,
with cross references in a couple places in the doc.

  Let me know if this looks like it would be helpful to new readers.

  Thanks

/guy

*Appendix

**Using a TPM for Attestation

  The Trusted Platform Module and surrounding ecosystem provide three
interlocking capabilities to enable secure collection of evidence from a
remote device, Platform Configuration Registers (PCRs), a Quote mechanism,
and a standardized Event Log.

  Each TPM has at least sixteen PCRs, each one large enough to hold one hash
value (SHA-1, SHA-256, and other algorithms can be used for this hashing
depending on TPM version).  PCRs can't be accessed directly from outside the
chip, but the TPM interface provides a way to "extend" a new security
measurement hash into any PCR, a process by which the existing value in the
PCR is hashed with the new security measurement hash, and the result placed
back into the same PCR.  The result is a composite fingerprint of all the
security measurements extended into each PCR since the system was reset.

  Every time a PCR is extended, an entry should be added to the
corresponding Event Log.  Logs contain the security measurement hash plus
informative fields offering hints as to what event it was that generated the
security measurement.  The Event Log itself is protected against accidental
manipulation, but it is implicitly tamper-evident - any verification process
can read the security measurement hash from the log events, compute the
composite value and compare that to what ended up in the PCR.   If there's a
discrepancy, the logs do not provide an accurate view of what was placed
into the PCR.

  The TPM provides another mechanism called a Quote that can read the
current value of the PCRs and package them into a data structure signed by
an Attestation Key (which is private key that is known only to the TPM).

The Verifier uses the Quote and Log together.  The Quote, containing the
composite hash of the complete sequence of security measurement hashes, is
used to verify the integrity of the Event Log.  Each hash in the validated
Quote can then be compared to corresponding expected values in the set of
Reference Integrity Measurements to validate overall system integrity.

  Information about PCRs and Quotes can be found in {{TPM1.2}} and
{{TPM2.0}}.  Although there are several log formats, an example can be found
in {{XX}}

Juniper Business Use Only

---

From: Dave Thaler <[email-masked]>
Date: Tue, 25 Aug 2020 20:52:15 +0000

That looks like a great improvement to me.

Dave

From: RATS <[email-masked]> On Behalf Of Guy Fedorkow
Sent: Tuesday, August 25, 2020 12:16 PM
To: [email-masked]
Cc: Jessica Fitzgerald-McKay ([email-masked]) <[email-masked]>; Eric Voit (evoit) <[email-masked]>
Subject: [Rats] TPM background for RIV

A recent reviewer of the RIV document (that would be a RIViewer) pointed out that the doc assumes that the fundamental behavior of a TPM for attestation is already well known by the reader.  Of course that may not be the case.
  Rather than add more tutorial material to be body of the document, I'd like to suggest adding the following subsection to the existing appendices, with cross references in a couple places in the doc.
  Let me know if this looks like it would be helpful to new readers.
  Thanks
/guy

*Appendix

  The Trusted Platform Module and surrounding ecosystem provide three interlocking capabilities to enable secure collection of evidence from a remote device, Platform Configuration Registers (PCRs), a Quote mechanism, and a standardized Event Log.

  Each TPM has at least sixteen PCRs, each one large enough to hold one hash value (SHA-1, SHA-256, and other algorithms can be used for this hashing depending on TPM version).  PCRs can't be accessed directly from outside the chip, but the TPM interface provides a way to "extend" a new security measurement hash into any PCR, a process by which the existing value in the PCR is hashed with the new security measurement hash, and the result placed back into the same PCR.  The result is a composite fingerprint of all the security measurements extended into each PCR since the system was reset.

  Every time a PCR is extended, an entry should be added to the corresponding Event Log.  Logs contain the security measurement hash plus informative fields offering hints as to what event it was that generated the security measurement.  The Event Log itself is protected against accidental manipulation, but it is implicitly tamper-evident - any verification process can read the security measurement hash from the log events, compute the composite value and compare that to what ended up in the PCR.   If there's a discrepancy, the logs do not provide an accurate view of what was placed into the PCR.

  The TPM provides another mechanism called a Quote that can read the current value of the PCRs and package them into a data structure signed by an Attestation Key (which is private key that is known only to the TPM).

The Verifier uses the Quote and Log together.  The Quote, containing the composite hash of the complete sequence of security measurement hashes, is used to verify the integrity of the Event Log.  Each hash in the validated Quote can then be compared to corresponding expected values in the set of Reference Integrity Measurements to validate overall system integrity.

  Information about PCRs and Quotes can be found in {{TPM1.2}} and {{TPM2.0}}.  Although there are several log formats, an example can be found in {{XX}}

---

From: Kathleen Moriarty <[email-masked]>
Date: Tue, 25 Aug 2020 17:00:46 -0400

To me as well.  Which reference can I use to look at the formats for TPM
attestations?

Thanks,
Kathleen

On Tue, Aug 25, 2020 at 4:53 PM Dave Thaler <dthaler=
[email-masked]> wrote:

> *From:* RATS <[email-masked]> *On Behalf Of * Guy Fedorkow
> *Sent:* Tuesday, August 25, 2020 12:16 PM
> *To:* [email-masked]
> *Cc:* Jessica Fitzgerald-McKay ([email-masked]) <jmfmckay@gmail..com>;
> Eric Voit (evoit) <[email-masked]>
> *Subject:* [Rats] TPM background for RIV
>
>
>
> A recent reviewer of the RIV document (that would be a RIViewer) pointed
> out that the doc assumes that the fundamental behavior of a TPM for
> attestation is already well known by the reader.  Of course that may not be
> the case.
>
>   Rather than add more tutorial material to be body of the document, I’d
>   Each TPM has at least sixteen PCRs, each one large enough to hold one
> hash value (SHA-1, SHA-256, and other algorithms can be used for this
> hashing depending on TPM version).  PCRs can’t be accessed directly from
> outside the chip, but the TPM interface provides a way to “extend” a new
> security measurement hash into any PCR, a process by which the existing
> value in the PCR is hashed with the new security measurement hash, and the
> result placed back into the same PCR.  The result is a composite
> fingerprint of all the security measurements extended into each PCR since
> the system was reset.
>
>
>
> informative fields offering hints as to what event it was that generated
> the security measurement.  The Event Log itself is protected against
> accidental manipulation, but it is implicitly tamper-evident – any
> verification process can read the security measurement hash from the log
> events, compute the composite value and compare that to what ended up in
> the PCR.   If there’s a discrepancy, the logs do not provide an accurate
> view of what was placed into the PCR.
>
>
>
> {{TPM2.0}}.  Although there are several log formats, an example can be
> found in {{XX}}
>
>
>
>
>
> _______________________________________________
> RATS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/rats
>

-- 

Best regards,
Kathleen

---

From: Ira McDonald <[email-masked]>
Date: Tue, 25 Aug 2020 17:04:07 -0400

Hi Guy,

Thanks for this excellent proposed text.

Small note:  Although you say each TPM has at least 16 PCRs, in fact the
TPM 2.0 Mobile Common Profile
(2015) only requires the implementation of one SHA-256 bank of 8 PCRs (a
SHA-1 bank is prohibited here).
That design choice was made to avoid the squabbles over the inconsistent
usage of PCR8 through PCR15
across various TPM 2.0 profiles.

Cheers,
- Ira (editor of TPM 2.0 Mobile Common Profile)

*Ira McDonald (Musician / Software Architect)Co-Chair - TCG Trusted
Mobility Solutions WG*

*Co-Chair - TCG Metadata Access Protocol SG*

*Chair - Linux Foundation Open Printing WGSecretary - IEEE-ISTO Printer
Working GroupCo-Chair - IEEE-ISTO PWG Internet Printing Protocol WGIETF
Designated Expert - IPP & Printer MIBBlue Roof Music / High North
Inchttp://sites.google.com/site/blueroofmusic
<http://sites.google.com/site/blueroofmusic>http://sites.google.com/site/highnorthinc
<http://sites.google.com/site/highnorthinc>mailto: [email-masked]
<[email-masked]>(permanent) PO Box 221  Grand Marais, MI 49839
906-494-2434*

---

From: Michael Richardson <[email-masked]>
Date: Tue, 25 Aug 2020 18:29:25 -0400

> across various TPM 2.0 profiles.

I just want to understand.
TPM 2 mobile, only requires PCR0-7.  It doesn't forbid PCR8->15 though?
Do devices tend to implement them all?  Or?

So what do the profiles do now?

What is the impact on RIV?

--
]               Never tell me the odds!                 | ipv6 mesh networks [
]   Michael Richardson, Sandelman Software Works        |    IoT architect   [
]     [email-masked]  http://www.sandelman.ca/        |   ruby on rails    [

---

From: Ira McDonald <[email-masked]>
Date: Wed, 26 Aug 2020 01:07:02 -0400

Hi Michael,

Sorry for the confusion.

No, the MCP doesn't forbid PCR8-PCR15, but it doesn't prescribe
their usage either.  No impact on RIV for network equipment.  I was
merely noting that TPM 2.0 Library is largely silent on specifics of
PCR usage.  And there is presently no TPM 2.0 profile for network
equipment.

Cheers,
- Ira

---

From: "Oliver, Ian (Nokia - FI/Espoo)" <[email-masked]>
Date: Wed, 26 Aug 2020 07:07:08 +0000

Doesn't the TPM 2 standard state PCRs 0 through to 23 with two banks being provided SHA1 and SHA256 (at particular handles 0x4......?)

It is the boot specification - at least for x86 - that states PCRs 0-7 are utilised for specific purposes, ie: CRTM, BIOS, configuration, boot loader, LCP and manufacturer defined.

At least on some of our UEFI machines I see 8, 9 and 10 being used.

11 is the default for Linux IMA and 17 and 18 for Intel DRTM measurements

There are restrictions due to locality, so at least on a PC, PCRS 16 and 23 are available to userland modification.

Ian

--

Dr. Ian Oliver

Cybersecurity Research

Distinguished Member of Technical Staff

Nokia Bell Labs

+358 50 483 6237

________________________________
From: Michael Richardson <[email-masked]>
Sent: 26 August 2020 01:29
To: Ira McDonald <[email-masked]>; [email-masked] <[email-masked]>
Subject: Re: [Rats] TPM background for RIV

---

From: Ira McDonald <[email-masked]>
Date: Wed, 26 Aug 2020 07:00:45 -0400

Hi Ian,

No, the TPM 2.0 Library standard (the base standard) does not specify the
size
(number of PCRs) or number of banks (different hash algorithms) for PCRs.

That's only specified in specific profiles.  And it's definitely not the
same across
all TCG profiles.

Cheers,
- Ira

On Wed, Aug 26, 2020 at 3:07 AM Oliver, Ian (Nokia - FI/Espoo) <
[email-masked]> wrote:

> Doesn't the TPM 2 standard state PCRs 0 through to 23 with two banks being
> provided SHA1 and SHA256 (at particular handles 0x4......?)
>
> It is the boot specification - at least for x86 - that states PCRs 0-7 are
> utilised for specific purposes, ie: CRTM, BIOS, configuration, boot loader,
> LCP and manufacturer defined.
>
> There are restrictions due to locality, so at least on a PC, PCRS 16 and
> 23 are available to userland modification.
>
> Ian
>
> --
>
> Dr. Ian Oliver
>
> Cybersecurity Research
>
> ------------------------------
> *From:* Michael Richardson <[email-masked]>
> *Sent:* 26 August 2020 01:29
> *To:* Ira McDonald <[email-masked]>; [email-masked] <[email-masked]
> >
> *Subject:* Re: [Rats] TPM background for RIV
>

---

From: Michael Richardson <[email-masked]>
Date: Wed, 26 Aug 2020 10:11:06 -0400

> PCR usage.  And there is presently no TPM 2.0 profile for network

So, could RIV be that profile?

--
Michael Richardson <[email-masked]>, Sandelman Software Works
 -= IPv6 IoT consulting =-

---

From: Ira McDonald <[email-masked]>
Date: Wed, 26 Aug 2020 10:22:14 -0400

Hi Michael,

The TCG Network Equipment WG could develop a TCG-approved TPM 2.0
profile for network equipment.  The IETF RATS RIV spec could not be that
official profile, under TCG rules.  It's also not structured in the proforma
structure of a TCG profile.  For an example of that structure, see:

https://trustedcomputinggroup.org/wp-content/uploads/TPM_2.0_Mobile_Common_Profile_v2r31_FINAL.pdf

Cheers,
- Ira