May 2022 - tpm2 - Ml01.01.Org

by Benjamin Berg

Hi, I was wondering if someone has ideas about integrating the TPM with Fingerprint readers. Recently I started looking into supporting Secure Device Connection Protocol (SDCP, [1]) in libfprint. The general idea is to verify that the Fingerprint reader can be trusted, but I initially also imagined that further use-cases like unsealing data in a TPM may be possible (e.g. to retrieve disk encryption keys). However, looking into it more, my current conclusion is that there is little to no advantage to use the TPM. At least not unless one also has a trusted (userspace) program which is capable of signing TPM authorizations. One could easily offload the required parts into a small helper, but that may require ensuring it runs in a trusted execution environment. Microsoft seems to run relevant parts as trustlets that are walled off from the rest of the system. That seems sensible to me, but it also means requiring all the infrastructure for execution and signing and I doubt that is feasible currently. Right now I'll probably go the way of not using the TPM at all. But I am really not an expert for this. So should someone see scenarios where a TPM is actually helpful in this context, then I would like to hear about them. Benjamin PS: A quick summary of how SDCP works: * Device has a private ECC key that signs the firmware and ephemeral keys during boot (and is inaccessible afterwards) * A certificate proofs that this key was provisioned in factory * Device builds a shared secret with the host (s) * Device sends id, HMAC_SHA256(s, "identify" || nonce || id) when the finger "id" was presented. * The HMAC proofs knowledge of the shared secret and authorizes the print. [1] https://github.com/microsoft/SecureDeviceConnectionProtocol/wiki/Secure-D...

5 days, 18 hours

4
6
0 / 0

[RC] tpm2-pytss 1.0.0-rc1

by Roberts, William C

Hello, I am pleased to announce the release of the tpm2-pytss (python bindings and utilities) version 1.0.0 RC 1 with the following CHANGELOG over RC0: ## [1.0.0-rc1] - 2022-01-10 ### Fixed: - Misspellings in Code on things like RuntimeError. - Fix documentation of ESAPI methods and exceptions. - Double ESAPI.Close call resulting in "Esys_Finalize() Finalizing NULL context." - type hint for verify_signature was an int, should be a str. - Parent cdata memory being freed when no parent reference. This causes sub-field references to parent cdata to be invalid. - in util method unwrap, fix variable `encdupsens` does not exist, it is `decsens` instead. ### Changed: - Renamed ESAPI.set_auth to ESAPI.tr_set_auth for consistenency. - Use None over 0 for default auth_handle. ### Added: - Check for bad type enum type in ESAPI.load_blob. - Support for deprecation of `TPM2_RH_PW` in tpm2-tss with proper TPM2_RS_PW attribute. The release can be found here: - https://pypi.org/project/tpm2-pytss/1.0.0rc1/ Sorry for the long delay on this RC period, we wanted to make sure we got as much bugs and broken things before the 1.0 release to help minimize breaking changes in the future. Thanks, Bill

6 days, 1 hour

2
3
0 / 0

Calculating name of created AK- server side

by kuba.michal.n＠gmail.com

Hello! I would like to know if it is possible to calculate name of AK generated by host on a remote server? I have read about remote attestation. To ensure the AK matches EK we have to make credential using name of the AK. To achieve this we have to either: a) calculate name of the AK on server b) receive name of the AK from host and believe it's a name for a proper AK Am I missing something? I have searched for explanation in docs posted on TCG's site, but I just can't find anything useful for nameAlg. I would be thankful for any help or advice :D

1 week, 2 days

4
8
2 / 0

[RELEASE CANDIDATE] tpm2-pytss 1.1.0-rc0

by Roberts, William C

Hello, I would like to announce the release of tpm2-pytss version 1.1.0-rc0 which can be found on pypi at: - https://pypi.org/project/tpm2-pytss/1.1.0rc0/ With the following CHANGELOG: ## 1.1.0-rc0 - 2022-03-14 ### Fixed - Spelling of "Enhanced" in CHANGELOG for 1.0.0 release. - Ensure that TPM2_GENERATED.VALUE is encoded the same way as other constants. - Add support to unmarshal simple TPM2B types (such as TPM2B_ATTEST and TPM2B_NAME) directly using the unmarshal method ### Changed - Drop pkgconfig from runtime dependencies, thus no longer need dev packages of built bindings at runtime. - NOTE: Version information is cached, a change in the TSS libraries requires a rebuild of the bindings. ### Added - Support session contexts from tpm2-tools as well as function to marshal context to tpm2-tools format. - Support two new encoding/decoding classes to go to/from hex or json representation of objects. - Support for creating EK from templates and optionally NV index based templates. - Binding to `Esys_TR_GetTpmHandle` as `ESAPI` method `tr_get_tpm_handle`. Thanks, Bill

3 weeks, 3 days

4
3
0 / 0

Virtualbox ubuntu 22.04 guest with tpm_server

by dawn.howe＠alten.com

I am developing a c++ application for a dell server running ubuntu 22.04. The application needs to store private keys and use them to decrypt files. Before working on target hardware, I'm trying to get a virtualbox environment set up to use a simulated TPM2. Before writing the C++ application I'd like to get some command line tools working. I have struggled for a week following instructions I've found (for example: https://tpm2-tools.readthedocs.io/en/latest/INSTALL/, https://francislampayan.medium.com/how-to-setup-tpm-simulator-in-ubuntu-2..., etc). I am trying to use IBM's SWTPM2, but have not had any luck. Virtualbox 6.1.30 Windows 10 host Ubuntu 22.04 server guest TPM SERVER SIMULATOR First, I'm installing tpm_server. Since ubuntu 22.04 uses openssl3.0, I cannot use v1661, but instead am getting the latest version from the "next" branch: $ git clone https://git.code.sf.net/p/ibmswtpm2/tpm2 ibmswtpm2-tpm2 $ cd ibmswtpm2-tpm/src $ make TPM2 - ABRMD $ git clone https://github.com/tpm2-software/tpm2-abrmd.git $ cd tpm2-abrmd $ ./bootstrap $ ./configure \ --with-dbuspolicydir=/etc/dbus-1/system.d \ --with-systemdsystemunitdir=/usr/lib/systemd/system \ --libdir=/usr/lib64 --prefix=/usr $ make -j5 $ sudo make install TPM2 - tss $ git clone https://github.com/tpm2-software/tpm2-tss.git $ cd tpm2-tss $ ./bootstrap $ ./configure $ make $ sudo make install $ sudo ldconfig TPM2 - tools $ git clone https://github.com/tpm2-software/tpm2-tools.git $ cd tpm2-tools $ ./bootstrap $ ./configure --prefix=/usr $ make -j5 $ sudo make install I'm just starting things on the command line, before makin them services. In one window I start the TPM simulator: $ tpm2_server In another window I start the ABRMD: sudo -u tss tpm2-abrmd --tcti="libtss2-tcti-mssim.so.0:host=127.0.0.1,port=2321" I see this in the window that started the TPM server: LIBRARY_COMPATIBILITY_CHECK is ON Starting ACT thread... TPM command server listening on port 2321 Platform server listening on port 2322 Command IPv4 client accepted Platform IPv4 client accepted Then I try to run a command line tool: tpm2_pcrread ERROR:tcti:src/tss2-tcti/tcti-device.c:452:Tss2_Tcti_Device_Init() Failed to open specified TCTI device file /dev/tpmrm0: No such file or directory ERROR:tcti:src/tss2-tcti/tctildr-dl.c:170:tcti_from_file() Could not initialize TCTI file: libtss2-tcti-device.so.0 ERROR:tcti:src/tss2-tcti/tcti-device.c:452:Tss2_Tcti_Device_Init() Failed to open specified TCTI device file /dev/tpm0: No such file or directory ERROR:tcti:src/tss2-tcti/tctildr-dl.c:170:tcti_from_file() Could not initialize TCTI file: libtss2-tcti-device.so.0 And I get no output. I feel like I'm not configuring the TSS correctly. Can anyone give me insight on how to run this? Should I be using a different simulator? I haven't found any good instructions for how to run https://github.com/stefanberger/swtpm in a virtualbox guest.

1 month

3
8
0 / 0

Can't se't signature algorithm when using tpm2_import

by rodolphe.averty＠free.fr

1 month

4
4
0 / 0

TPM2 ESPI development for Windows

by Daniel Wang

Hi all, I'm developing an application for both Linux and Windows 10 using TPM 2.0 EAPI. I've finished the implementation on Linux using TPM2-TSS and TPM2-tool (for provisioning). How can I achieve the same thing on Windows 10? I found TSS.MSR from Microsoft research but it is much less mature and its C implementation is a fork for TPM2-TSS older version. I tried to compile TPM2-TSS on Windows 10 but have be able to make it work, also based on the README, it seems only SAPI is working on Windows 10. Does Windows 10 has its own EAPI implementation? If so how can I link to that library? Thank you for your help!

1 month

1
0
0 / 0

Evil Eye Charms Bracelet Jewelry

by lorojewellry＠gmail.com

It's been said that the Evil Eye has the power to protect its wearer from negative energy. It is believed that it wards off the evil eye, envy, and jealousy. This Evil Eye Charms Bracelet Jewelry is perfect for those who want to keep their family and friends close to them and ward off the evil eye. It is a one-size-fits-all and can be worn by both men and women. https://lorojewelry.com/product/evil-eye-charms-bracelet-jewelry/

1 month

1
0
0 / 0

tpm2_import is modifying the keyid of my private key

by rodolphe.averty＠free.fr

1 month, 1 week

3
2
0 / 0

Hash sequence duplication without ContextSave/ContextLoad

by Petr Gotthard

Hello, I need to duplicate a hash sequence. This is to implement TPM-based version of OpenSSL's EVP_MD_CTX_dup. Background: EVP_MD_CTX_dup can be used to duplicate the message digest state. This is useful [...] if large amounts of data are to be hashed which only differ in the last few bytes. So far I am using ContextSave/ContextLoad, but Windows is blocking these TPM commands. https://docs.microsoft.com/en-us/windows/win32/tbs/command-blocking Is there some other way to duplicate a TPM hash sequence, please? Petr

1 month, 1 week

1
0
0 / 0

2022

2021

2020

2019

2018

2017

tpm2 May 2022