Re: [Rats] TPM1.2 Quote1 vs Quote2

[Guy Fedorkow <[e-mail]>]

Hi Eric,
  I'm in favor of removing support for Quote1, although I think keeping Quote2 for TPM1.2 in the model is still important.
  Thanks
/guy




Juniper Business Use Only
From: Eric Voit (evoit) <[e-mail]>
Sent: Monday, December 7, 2020 7:09 PM
To: Laffey, Tom (HPE Aruba) <[e-mail]>; Kenneth Goldman <[e-mail]>; Guy Fedorkow <[e-mail]>
Cc: Bill Sulzen (bsulzen) <[e-mail]>; Graeme Proudler <[e-mail]>; [e-mail]
Subject: RE: TPM1.2 Quote1 vs Quote2

I have removed all the structures needed to support just TPM1.2 Quote1 from the YANG model.   There was a significant reduction in YANG model size, which is goodness.

Does anyone have an issue if I post a new version of Charra which only supports Quote2?   The proposed model is attached.  And the tree is below.

Eric

module: ietf-tpm-remote-attestation
  +--rw rats-support-structures
     +--rw compute-nodes!
     |  +--ro compute-node* [node-id]
     |     +--ro node-id                string
     |     +--ro node-physical-index?   int32 {ietfhw:entity-mib}?
     |     +--ro node-name?             string
     |     +--ro node-location?         string
     +--rw tpms
     |  +--rw tpm* [tpm-name]
     |     +--rw tpm-name                string
    |     +--ro hardware-based?         boolean
     |     +--ro tpm-physical-index?     int32 {ietfhw:entity-mib}?
     |     +--ro tpm-path?               string
     |     +--ro compute-node            compute-node-ref
     |     +--ro tpm-manufacturer?       string
     |     +--rw tpm-firmware-version    identityref
     |     +--rw TPM12-hash-algo?        identityref
     |     +--rw TPM12-pcrs*             pcr
     |     +--rw tpm20-pcr-bank* [TPM20-hash-algo]
     |     |  +--rw TPM20-hash-algo    identityref
     |     |  +--rw pcr-index*         tpm:pcr
     |     +--ro tpm-status              enumeration
     |     +--rw certificates
     |        +--rw certificate* [certificate-name]
     |           +--rw certificate-name            string
     |           +--rw certificate-keystore-ref?   leafref
     |           +--rw certificate-type?           enumeration
     +--rw attester-supported-algos
        +--rw tpm12-asymmetric-signing*   identityref {taa:TPM12}?
        +--rw tpm12-hash*                 identityref {taa:TPM12}?
        +--rw tpm20-asymmetric-signing*   identityref {taa:TPM20}?
        +--rw tpm20-hash*                 identityref {taa:TPM20}?

  rpcs:
    +---x tpm12-challenge-response-attestation {taa:TPM12}?
    |  +---w input
    |  |  +---w tpm12-attestation-challenge
    |  |     +---w pcr-index*          pcr
    |  |     +---w nonce-value         binary
    |  |     +---w certificate-name*   certificate-name-ref
    |  +--ro output
    |     +--ro tpm12-attestation-response* []
    |        +--ro certificate-name?      certificate-name-ref
    |        +--ro up-time?               uint32
    |        +--ro node-id?               string
    |        +--ro node-physical-index?   int32 {ietfhw:entity-mib}?
    |        +--ro locality-at-release?   uint8
    |        +--ro TPM_PCR_COMPOSITE* []
    |        |  +--ro pcr-index*         pcr
    |        |  +--ro value-size?        uint32
    |        |  +--ro tpm12-pcr-value*   binary
    |        +--ro signature-size?        uint32
    |        +--ro signature?             binary
    +---x tpm20-challenge-response-attestation {taa:TPM20}?
    |  +---w input
    |  |  +---w tpm20-attestation-challenge
    |  |     +---w nonce-value            binary
   |  |     +---w tpm20-pcr-selection* []
    |  |     |  +---w TPM20-hash-algo?   identityref
    |  |     |  +---w pcr-index*         tpm:pcr
    |  |     +---w certificate-name*      certificate-name-ref
    |  +--ro output
    |     +--ro tpm20-attestation-response* []
    |        +--ro certificate-name?      certificate-name-ref
    |        +--ro TPMS_QUOTE_INFO        binary
    |        +--ro quote-signature?       binary
    |        +--ro up-time?               uint32
    |        +--ro node-id?               string
    |        +--ro node-physical-index?   int32 {ietfhw:entity-mib}?
    |        +--ro unsigned-pcr-values* []
    |           +--ro TPM20-hash-algo?   identityref
    |           +--ro pcr-values* [pcr-index]
    |              +--ro pcr-index    pcr
    |              +--ro pcr-value?   binary
    +---x log-retrieval
       +---w input
       |  +---w log-selector* []
       |  |  +---w tpm-name*                  string
       |  |  +---w (index-type)?
       |  |  |  +--:(last-entry)
       |  |  |  |  +---w last-entry-value?    binary
       |  |  |  +--:(index)
       |  |  |  |  +---w last-index-number?   uint64
       |  |  |  +--:(timestamp)
       |  |  |     +---w timestamp?           yang:date-and-time
       |  |  +---w log-entry-quantity?        uint16
       |  +---w log-type        identityref
       +--ro output
          +--ro system-event-logs
             +--ro node-data* []
                +--ro tpm-name?     string
                +--ro up-time?      uint32
                +--ro log-result
                   +--ro (attested_event_log_type)
                      +--:(bios)
                      |  +--ro bios-event-logs
                      |     +--ro bios-event-entry* [event-number]
                      |        +--ro event-number    uint32
                      |        +--ro event-type?     uint32
                      |        +--ro pcr-index?      pcr
                      |        +--ro digest-list* []
                      |        |  +--ro hash-algo?   identityref
                      |        |  +--ro digest*      binary
                      |        +--ro event-size?     uint32
                      |        +--ro event-data*     uint8
                      +--:(ima)
                      |  +--ro ima-event-logs
                      |     +--ro ima-event-entry* [event-number]
                      |        +--ro event-number               uint64
                      |        +--ro ima-template?              string
                      |        +--ro filename-hint?             string
                      |        +--ro filedata-hash?             binary
                      |        +--ro filedata-hash-algorithm?   string
                      |        +--ro template-hash-algorithm?   string
                      |        +--ro template-hash?             binary
                      |        +--ro pcr-index?                 pcr
                      |        +--ro signature?                 binary
                      +--:(netequip_boot)
                         +--ro boot-event-logs
                            +--ro boot-event-entry* [event-number]
                               +--ro event-number               uint64
                               +--ro filename-hint?             string
                               +--ro filedata-hash?             binary
                               +--ro filedata-hash-algorithm?   string
                               +--ro file-version?              string
                               +--ro file-type?                 string
                               +--ro pcr-index?                 pcr

From: Eric Voit (evoit)
Sent: Tuesday, November 24, 2020 5:17 PM
To: Laffey, Tom (HPE Aruba) <[e-mail]<mailto:[e-mail]>>; Kenneth Goldman <[e-mail]<mailto:[e-mail]>>; Guy Fedorkow <[e-mail]<mailto:[e-mail]>>
Cc: Bill Sulzen (bsulzen) <[e-mail]<mailto:[e-mail]>>; Graeme Proudler <[e-mail]<mailto:[e-mail]>>; [e-mail]<mailto:[e-mail]>
Subject: RE: TPM1.2 Quote1 vs Quote2

Agree we cannot abandon TPM1.2.   We will have router equipment which does this in place for many years.   Also my understanding is that Cisco is good with just supporting Quote2.

Eric

From: Laffey, Tom (HPE Aruba) <[e-mail]<mailto:[e-mail]>>
Sent: Tuesday, November 24, 2020 5:14 PM
To: Kenneth Goldman <[e-mail]<mailto:[e-mail]>>; Guy Fedorkow <[e-mail]<mailto:[e-mail]>>
Cc: Bill Sulzen (bsulzen) <[e-mail]<mailto:[e-mail]>>; Eric Voit (evoit) <[e-mail]<mailto:[e-mail]>>; Graeme Proudler <[e-mail]<mailto:[e-mail]>>; [e-mail]<mailto:[e-mail]>
Subject: RE: TPM1.2 Quote1 vs Quote2

I don't think we can abandon TPM 1.2 just yet. Products in production with TPM 1.2 today will have to be supported for some more years to come. But yes, "not recommended for new designs" as they say.

Tom

From: Kenneth Goldman <[e-mail]<mailto:[e-mail]>>
Sent: Tuesday, November 24, 2020 2:06 PM
To: Guy Fedorkow <[e-mail]<mailto:[e-mail]>>
Cc: Bill Sulzen (bsulzen) <[e-mail]<mailto:[e-mail]>>; Eric Voit (evoit) <[e-mail]<mailto:[e-mail]>>; Graeme Proudler <[e-mail]<mailto:[e-mail]>>; [e-mail]<mailto:[e-mail]>; Laffey, Tom (HPE Aruba) <[e-mail]<mailto:[e-mail]>>
Subject: RE: TPM1.2 Quote1 vs Quote2



--
Ken Goldman [e-mail]<mailto:[e-mail]>
914-945-2415 (862-2415)


[Inactive hide details for Guy Fedorkow ---11/24/2020 04:57:28 PM---Ken, which volume has the informative section?  I could not]Guy Fedorkow ---11/24/2020 04:57:28 PM---Ken, which volume has the informative section? I could not miss reading it! As Tom asked, it's soun

From: Guy Fedorkow <[e-mail]<mailto:[e-mail]>>
To: Kenneth Goldman <[e-mail]<mailto:[e-mail]>>
Cc: "Bill Sulzen (bsulzen)" <[e-mail]<mailto:[e-mail]>>, "Eric Voit (evoit)" <[e-mail]<mailto:[e-mail]>>, Graeme Proudler <[e-mail]<mailto:[e-mail]>>, "[e-mail]<mailto:[e-mail]>" <[e-mail]<mailto:[e-mail]>>, "Laffey, Tom (HPE Aruba)" <[e-mail]<mailto:[e-mail]>>
Date: 11/24/2020 04:57 PM
Subject: [EXTERNAL] RE: TPM1.2 Quote1 vs Quote2

________________________________

Ken, which volume has the informative section? I could not miss reading it!

Part 3 under the quote2 command.

As Tom asked, it's sounding like quote1 is there for compatibility, and Quote2 is what someone should use going forward.

Going forward, use TPM 2.0. TPM 1.2 is really end of life. I with I could drop it from the IBM TSS, since it's just adds test time.