Lines Matching full:tpm

3 TPM Security
7 use of the TPM reasonably robust in the face of external snooping and
9 in the literature).  The current security document is for TPM 2.0.
14 The TPM is usually a discrete chip attached to a PC via some type of
16 PTT, which is a software TPM running inside a software environment
19 hardware TPM, which is the use case discussed here.
24 The current state of the art for snooping the `TPM Genie`_ hardware
27 successfully demonstrated against the `Windows Bitlocker TPM`_ system.
28 Most recently the same `attack against TPM based Linux disk
32 evaporate.  However, the goal of this document is to protect TPM
37 Unfortunately, most of the TPM functionality, including the hardware
44 Since the attacker can send their own commands to the TPM, they can
55 2. At some point in time the attacker could reset the TPM, clearing
57    effectively overwrite the boot time measurements the TPM has
64 on some sort of mechanism for protection which would change over TPM
70 Certain information passing in and out of the TPM, such as key sealing
76 Establishing Initial Trust with the TPM
92 it and secondly, the null seed changes across TPM resets, meaning if
94 salted with the derived key will fail if the TPM is reset and the seed
100 However, the TPM has a key certification mechanism (using the EK
107 TPM transactions since start of day were secure and if it doesn't, you
114 In the current null primary scenario, the TPM must be completely
131 All TPM commands the kernel uses allow sessions.  HMAC sessions may be
140 volatile TPM handle) and keeps it around in a saved context stored in
141 tpm_chip for every in-kernel use of the TPM.  Currently, because of a
158 Every TPM comes shipped with a couple of X.509 certificates for the
172 this is done, an attestation key (AK) is generated within the TPM and
174 TPM2_MakeCredential.  The TPM then runs TPM2_ActivateCredential which
175 will only recover the secret if the binding between the TPM, the EK
184 attestation is done by the TPM owner who thus has access to only the
191 the encrypted parameter and thus the TPM will not be able to perform
194 copy of the private key only for the certified TPM.  This key is now
195 loaded into the TPM and the Storage primary flushed (to free up space
199 outlined in the `TCG TPM v2.0 Provisioning Guidance`_; the name of
202 /sys/class/tpm/tpm0/null_name.  If the names do not match, the TPM is
209 that TPM integrity and privacy was preserved across the entire boot
212 .. _TPM Genie: https://www.nccgroup.trust/globalassets/about-us/us/documents/tpm-genie.pdf
213 .. _Windows Bitlocker TPM: https://dolosgroup.io/blog/2021/7/9/from-stolen-laptop-to-inside-the-com…
214 .. _attack against TPM based Linux disk encryption: https://www.secura.com/blog/tpm-sniffing-attack…
215 …l Profile: https://trustedcomputinggroup.org/resource/tcg-ek-credential-profile-for-tpm-family-2-0/
216 .. _TCG TPM v2.0 Provisioning Guidance: https://trustedcomputinggroup.org/resource/tcg-tpm-v2-0-pro…