Re: [Rats] TPM1.2 Quote1 vs Quote2

["Eric Voit (evoit)" <[e-mail]>]

Thanks Guy,

 

A change request which pulls out TPM1.2 Quote1 from the YANG model has been
posted at:

https://github.com/ietf-rats-wg/basic-yang-module/pull/24

(Of course Quote2 remains.)

 

I just re-read the TCG's TPM1.2 commands, rev116.   And based on the pull
request, below is what I think the YANG structure should include.  (This
will mirror what is currently done with the TPM2 structures.)

 

    +---x tpm12-challenge-response-attestation {taa:TPM12}?

       +--ro output

          +--ro tpm12-attestation-response* []

             +--ro certificate-name?      certificate-name-ref

             +--ro up-time?               uint32

             +--ro TPM_QUOTE2

 

Thoughts on why these simplifications have been proposed are as follows:

 

(1) Added "TPM_QUOTE2" structure, with a reference to TPM Main Part 3
Commands, Section 16.5.  (We might as well send the whole thing coming out
as the TPM_RESULT as there is not a significant savings in bytes from fields
which will never change.)

 

(2) Removed: "version", "locality-at-release" and "TPM_PCR_COMPOSITE",
"signature-size", and "signature".  These are all elements already contained
within TPM_QUOTE2.  And we have to parse that TPM1.2 provided structure
anyway to verify the enclosed signature.  This way we are not redundantly
transporting and exposing these elements.  Nor will YANG being seen as
trying to redefine them.

 

(3) Removed: "node-id" & "node-physical-index" as these can be acquired from
YANG datastore read against "compute-nodes" using "certificate-name".

 

If there are no objections, I believe this can be merged. It would still be
great to see if a TPM1.2 expert can validate the thinking here. 

 

Eric

 

From: Guy Fedorkow <[e-mail]> 
Sent: Wednesday, December 9, 2020 12:03 PM
To: Eric Voit (evoit) <[e-mail]>
Cc: [e-mail]; [e-mail]; Laffey, Tom (HPE Aruba)
<[e-mail]>
Subject: RE: TPM1.2 Quote1 vs Quote2

 

Hi Eric,

  I'm in favor of removing support for Quote1, although I think keeping
Quote2 for TPM1.2 in the model is still important.

  Thanks

/guy

 

 

 

Juniper Business Use Only

From: Eric Voit (evoit) <[e-mail] <mailto:[e-mail]> > 
Sent: Monday, December 7, 2020 7:09 PM
To: Laffey, Tom (HPE Aruba) <[e-mail] <mailto:[e-mail]>
>; Kenneth Goldman <[e-mail] <mailto:[e-mail]> >; Guy
Fedorkow <[e-mail] <mailto:[e-mail]> >
Cc: Bill Sulzen (bsulzen) <[e-mail] <mailto:[e-mail]> >;
Graeme Proudler <[e-mail]
<mailto:[e-mail]> >; [e-mail]
<mailto:[e-mail]> 
Subject: RE: TPM1.2 Quote1 vs Quote2

 

I have removed all the structures needed to support just TPM1.2 Quote1 from
the YANG model.   There was a significant reduction in YANG model size,
which is goodness.  

 

Does anyone have an issue if I post a new version of Charra which only
supports Quote2?   The proposed model is attached.  And the tree is below.


Eric 

 

module: ietf-tpm-remote-attestation

  +--rw rats-support-structures

     +--rw compute-nodes!

     |  +--ro compute-node* [node-id]

     |     +--ro node-id                string

     |     +--ro node-physical-index?   int32 {ietfhw:entity-mib}?

     |     +--ro node-name?             string

     |     +--ro node-location?         string

     +--rw tpms

     |  +--rw tpm* [tpm-name]

     |     +--rw tpm-name                string

    |     +--ro hardware-based?         boolean

     |     +--ro tpm-physical-index?     int32 {ietfhw:entity-mib}?

     |     +--ro tpm-path?               string

     |     +--ro compute-node            compute-node-ref

     |     +--ro tpm-manufacturer?       string

     |     +--rw tpm-firmware-version    identityref

     |     +--rw TPM12-hash-algo?        identityref

     |     +--rw TPM12-pcrs*             pcr

     |     +--rw tpm20-pcr-bank* [TPM20-hash-algo]

     |     |  +--rw TPM20-hash-algo    identityref

     |     |  +--rw pcr-index*         tpm:pcr

     |     +--ro tpm-status              enumeration

     |     +--rw certificates

     |        +--rw certificate* [certificate-name]

     |           +--rw certificate-name            string

     |           +--rw certificate-keystore-ref?   leafref

     |           +--rw certificate-type?           enumeration

     +--rw attester-supported-algos

        +--rw tpm12-asymmetric-signing*   identityref {taa:TPM12}?

        +--rw tpm12-hash*                 identityref {taa:TPM12}?

        +--rw tpm20-asymmetric-signing*   identityref {taa:TPM20}?

        +--rw tpm20-hash*                 identityref {taa:TPM20}?

 

  rpcs:

    +---x tpm12-challenge-response-attestation {taa:TPM12}?

    |  +---w input

    |  |  +---w tpm12-attestation-challenge

    |  |     +---w pcr-index*          pcr

    |  |     +---w nonce-value         binary

    |  |     +---w certificate-name*   certificate-name-ref

    |  +--ro output

    |     +--ro tpm12-attestation-response* []

    |        +--ro certificate-name?      certificate-name-ref

    |        +--ro up-time?               uint32

    |        +--ro node-id?               string

    |        +--ro node-physical-index?   int32 {ietfhw:entity-mib}?

    |        +--ro locality-at-release?   uint8

    |        +--ro TPM_PCR_COMPOSITE* []

    |        |  +--ro pcr-index*         pcr

    |        |  +--ro value-size?        uint32

    |        |  +--ro tpm12-pcr-value*   binary

    |        +--ro signature-size?        uint32

    |        +--ro signature?             binary

    +---x tpm20-challenge-response-attestation {taa:TPM20}?

    |  +---w input

    |  |  +---w tpm20-attestation-challenge

    |  |     +---w nonce-value            binary

   |  |     +---w tpm20-pcr-selection* []

    |  |     |  +---w TPM20-hash-algo?   identityref

    |  |     |  +---w pcr-index*         tpm:pcr

    |  |     +---w certificate-name*      certificate-name-ref

    |  +--ro output

    |     +--ro tpm20-attestation-response* []

    |        +--ro certificate-name?      certificate-name-ref

    |        +--ro TPMS_QUOTE_INFO        binary

    |        +--ro quote-signature?       binary

    |        +--ro up-time?               uint32

    |        +--ro node-id?               string

    |        +--ro node-physical-index?   int32 {ietfhw:entity-mib}?

    |        +--ro unsigned-pcr-values* []

    |           +--ro TPM20-hash-algo?   identityref

    |           +--ro pcr-values* [pcr-index]

    |              +--ro pcr-index    pcr

    |              +--ro pcr-value?   binary

    +---x log-retrieval

       +---w input

       |  +---w log-selector* []

       |  |  +---w tpm-name*                  string

       |  |  +---w (index-type)?

       |  |  |  +--:(last-entry)

       |  |  |  |  +---w last-entry-value?    binary

       |  |  |  +--:(index)

       |  |  |  |  +---w last-index-number?   uint64

       |  |  |  +--:(timestamp)

       |  |  |     +---w timestamp?           yang:date-and-time

       |  |  +---w log-entry-quantity?        uint16

       |  +---w log-type        identityref

       +--ro output

          +--ro system-event-logs

             +--ro node-data* []

                +--ro tpm-name?     string

                +--ro up-time?      uint32

                +--ro log-result

                   +--ro (attested_event_log_type)

                      +--:(bios)

                      |  +--ro bios-event-logs

                      |     +--ro bios-event-entry* [event-number]

                      |        +--ro event-number    uint32

                      |        +--ro event-type?     uint32

                      |        +--ro pcr-index?      pcr

                      |        +--ro digest-list* []

                      |        |  +--ro hash-algo?   identityref

                      |        |  +--ro digest*      binary

                      |        +--ro event-size?     uint32

                      |        +--ro event-data*     uint8

                      +--:(ima)

                      |  +--ro ima-event-logs

                      |     +--ro ima-event-entry* [event-number]

                      |        +--ro event-number               uint64

                      |        +--ro ima-template?              string

                      |        +--ro filename-hint?             string

                      |        +--ro filedata-hash?             binary

                      |        +--ro filedata-hash-algorithm?   string

                      |        +--ro template-hash-algorithm?   string

                      |        +--ro template-hash?             binary

                      |        +--ro pcr-index?                 pcr

                      |        +--ro signature?                 binary

                      +--:(netequip_boot)

                         +--ro boot-event-logs

                            +--ro boot-event-entry* [event-number]

                               +--ro event-number               uint64

                               +--ro filename-hint?             string

                               +--ro filedata-hash?             binary

                               +--ro filedata-hash-algorithm?   string

                               +--ro file-version?              string

                               +--ro file-type?                 string

                               +--ro pcr-index?                 pcr

 

From: Eric Voit (evoit) 
Sent: Tuesday, November 24, 2020 5:17 PM
To: Laffey, Tom (HPE Aruba) <[e-mail] <mailto:[e-mail]>
>; Kenneth Goldman <[e-mail] <mailto:[e-mail]> >; Guy
Fedorkow <[e-mail] <mailto:[e-mail]> >
Cc: Bill Sulzen (bsulzen) <[e-mail] <mailto:[e-mail]> >;
Graeme Proudler <[e-mail]
<mailto:[e-mail]> >; [e-mail]
<mailto:[e-mail]> 
Subject: RE: TPM1.2 Quote1 vs Quote2

 

Agree we cannot abandon TPM1.2.   We will have router equipment which does
this in place for many years.   Also my understanding is that Cisco is good
with just supporting Quote2.

 

Eric

 

From: Laffey, Tom (HPE Aruba) <[e-mail]
<mailto:[e-mail]> > 
Sent: Tuesday, November 24, 2020 5:14 PM
To: Kenneth Goldman <[e-mail] <mailto:[e-mail]> >; Guy
Fedorkow <[e-mail] <mailto:[e-mail]> >
Cc: Bill Sulzen (bsulzen) <[e-mail] <mailto:[e-mail]> >;
Eric Voit (evoit) <[e-mail] <mailto:[e-mail]> >; Graeme
Proudler <[e-mail] <mailto:[e-mail]> >;
[e-mail] <mailto:[e-mail]> 
Subject: RE: TPM1.2 Quote1 vs Quote2

 

I don't think we can abandon TPM 1.2 just yet. Products in production with
TPM 1.2 today will have to be supported for some more years to come. But
yes, "not recommended for new designs" as they say.

 

Tom

 

From: Kenneth Goldman <[e-mail] <mailto:[e-mail]> > 
Sent: Tuesday, November 24, 2020 2:06 PM
To: Guy Fedorkow <[e-mail] <mailto:[e-mail]> >
Cc: Bill Sulzen (bsulzen) <[e-mail] <mailto:[e-mail]> >;
Eric Voit (evoit) <[e-mail] <mailto:[e-mail]> >; Graeme
Proudler <[e-mail] <mailto:[e-mail]> >;
[e-mail] <mailto:[e-mail]> ; Laffey, Tom (HPE
Aruba) <[e-mail] <mailto:[e-mail]> >
Subject: RE: TPM1.2 Quote1 vs Quote2

 



--
Ken Goldman  <mailto:[e-mail]> [e-mail] 
914-945-2415 (862-2415)


Guy Fedorkow ---11/24/2020 04:57:28 PM---Ken, which volume has the
informative section? I could not miss reading it! As Tom asked, it's soun

From: Guy Fedorkow < <mailto:[e-mail]> [e-mail]>
To: Kenneth Goldman < <mailto:[e-mail]> [e-mail]>
Cc: "Bill Sulzen (bsulzen)" < <mailto:[e-mail]> [e-mail]>,
"Eric Voit (evoit)" < <mailto:[e-mail]> [e-mail]>, Graeme
Proudler < <mailto:[e-mail]> [e-mail]>, "
<mailto:[e-mail]> [e-mail]" <
<mailto:[e-mail]> [e-mail]>, "Laffey, Tom (HPE
Aruba)" < <mailto:[e-mail]> [e-mail]>
Date: 11/24/2020 04:57 PM
Subject: [EXTERNAL] RE: TPM1.2 Quote1 vs Quote2

  _____  


Ken, which volume has the informative section? I could not miss reading it!

Part 3 under the quote2 command.

As Tom asked, it's sounding like quote1 is there for compatibility, and
Quote2 is what someone should use going forward.

Going forward, use TPM 2.0. TPM 1.2 is really end of life. I with I could
drop it from the IBM TSS, since it's just adds test time.