[Rats] TPM background for RIV

[Guy Fedorkow <[e-mail]>]

A recent reviewer of the RIV document (that would be a RIViewer) pointed out
that the doc assumes that the fundamental behavior of a TPM for attestation
is already well known by the reader.  Of course that may not be the case.

  Rather than add more tutorial material to be body of the document, I'd
like to suggest adding the following subsection to the existing appendices,
with cross references in a couple places in the doc.

  Let me know if this looks like it would be helpful to new readers.

  Thanks

/guy

 

  

 

*Appendix

 

**Using a TPM for Attestation

 

  The Trusted Platform Module and surrounding ecosystem provide three
interlocking capabilities to enable secure collection of evidence from a
remote device, Platform Configuration Registers (PCRs), a Quote mechanism,
and a standardized Event Log.

 

  Each TPM has at least sixteen PCRs, each one large enough to hold one hash
value (SHA-1, SHA-256, and other algorithms can be used for this hashing
depending on TPM version).  PCRs can't be accessed directly from outside the
chip, but the TPM interface provides a way to "extend" a new security
measurement hash into any PCR, a process by which the existing value in the
PCR is hashed with the new security measurement hash, and the result placed
back into the same PCR.  The result is a composite fingerprint of all the
security measurements extended into each PCR since the system was reset.

 

  Every time a PCR is extended, an entry should be added to the
corresponding Event Log.  Logs contain the security measurement hash plus
informative fields offering hints as to what event it was that generated the
security measurement.  The Event Log itself is protected against accidental
manipulation, but it is implicitly tamper-evident - any verification process
can read the security measurement hash from the log events, compute the
composite value and compare that to what ended up in the PCR.   If there's a
discrepancy, the logs do not provide an accurate view of what was placed
into the PCR.

 

  The TPM provides another mechanism called a Quote that can read the
current value of the PCRs and package them into a data structure signed by
an Attestation Key (which is private key that is known only to the TPM).

 

The Verifier uses the Quote and Log together.  The Quote, containing the
composite hash of the complete sequence of security measurement hashes, is
used to verify the integrity of the Event Log.  Each hash in the validated
Quote can then be compared to corresponding expected values in the set of
Reference Integrity Measurements to validate overall system integrity.

 

  Information about PCRs and Quotes can be found in {{TPM1.2}} and
{{TPM2.0}}.  Although there are several log formats, an example can be found
in {{XX}}

 


Juniper Business Use Only