1

As you may know, the TPM (Trusted Platform Module), which resides on the LPC bus, allows the storage and retrieval of encryption keys and certificates securely.

Within this Trusted Computing concept, however, is it actually secure? (Base-line question, please keep reading)

I have found that TPM 1.1 transmits encryption keys and certificates over the LPC bus in plain text. (1)

Is this true for recent versions of TPMs (1.2, 2.0)? If not, how is it that they've mitigated this issue? I see no way for this to be feasibly fixed.

Thank you.

1: "The authors (Schellekens et al.) of [an LPC MITM attack with a TPM] passively analyzed the communication of version 1.1 TPMs with the remaining platform and observed that certain operations like unsealing used to transmit TPM protected secrets in plain over the LPC bus." ~ A Hijacker’s Guide to the LPC Bus, page 186

Improve this question
2
  • I don't have time to read the spec right now but it should be pretty easy to use something like Diffie-Helman to exchange key information securely over an open bus.
    – Igor Skochinsky ♦
    Jul 1, 2017 at 7:32
  • usenix.org/system/files/conference/nsdi14/nsdi14-paper-chen.pdf --- According to this 2014 paper, the TPM doesn't support key exchange protocols ("Because TPMs lack the functionality of a key exchange protocol (e.g., Diffie-Hellman)," page 189, right-hand side). I'll keep reading documentation on TPM 1.2/2.0 and I'll put in an answer with what I've found, if no one else has came up with one by that time. One would think they'd need a PKI for something like the Diffie-Hellman exchange, in order to validate the identity of devices; weird that they didn't consider that :P
    – Alpha
    Jul 1, 2017 at 18:03

1 Answer 1

Reset to default
2

As far as I know, TPM 1.2 has something called Transport Protection/Security to establish a secure channel with the TPM but it's difficult to find documentation on it. It is most probably some variant on key exchange.

Now of course a secure channel is useless per-se because you can still swap the TPM with a tempered oned. Thus a TPM comes with what is called the endorsement key. The idea is that each TPM chip has a private key burned by the manufacturer and never released. When the machine is assembled, the manufacturer will typically burn some kind of signature for this specific TPM in the OTP part of the CPU. That way the CPU can send a challenge to the TPM to make sure it is legitimate. That together with the secure channel reduces the hardware attack surface a lot (but not completely). Note that there are all kinds of issues with the endorsement key, such as how to do you know the manufacturer did not give the key to the NSA behind your back.

It should be noted that there is trend to put the TPM directly into the CPU/PCH which makes it much harder to temper with. Another common thing is to the implement the TPM in software (fTPM) in a secure environment (such as TEE) based on SGX (x86) or TrustZone (ARM) for example.

Improve this answer
5
  • Awesome post Amaury! I'm still searching for the answer, but would you know if the CPU's identity is verified as well?
    – Alpha
    Sep 26, 2017 at 16:04
  • My understanding that verifying the CPU is not part of the security model of the TPM. It is the other way around: the TPM is there to ensure that the CPU can boot securely if it wants to. Nothing prevents you from removing the TPM from the board and connecting to another CPU. But the point is that the keys never leave the TPM, thus it is not possible to extract them that way (unless you design so very clever hardware attack against the TPM).
    – Amaury Pouly
    Sep 26, 2017 at 19:11
  • If the TPM is on the motherboard and manufactured by Gigabyte or ASUS or MSI for example, how can the CPU which is manufactured by Intel or AMD contain a signature for the unique key each motherboard has?
    – conio
    Sep 27, 2017 at 0:39
  • This is not done for generic motherboards. But if you buy for example a Surface, at manufacturing time Microsoft puts the TPM signature in the CPU (I guess in some fuse array or nonvolatile memory). In a somewhat similar but different way, Apple puts the fingerprint chip signature in the CPU. That way if you swap out the TPM or the fingerprint sensor, the device will refuse to boot. Note that in any case, this is not automatic, there has to be code to check that and most PCs do not aim at that level of security anyway. All of this only makes sense if you have a completely secure boot chain.
    – Amaury Pouly
    Sep 27, 2017 at 12:58
  • That's too bad. Sounds like it could be easily solved if the CPU manufacturer also manufactured the TPM (and then could put a unique signature inside the CPU), and the consumer would install the TPM inside a "TPM socket" like the CPU socket, but that's basically a lame way to do what you mentioned - on-die TPM. So I guess that's the future...
    – conio
    Sep 27, 2017 at 18:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.