Re: [Rats] TPM background for RIV

[Ira McDonald <[e-mail]>]

Hi Ian,

No, the TPM 2.0 Library standard (the base standard) does not specify the
size
(number of PCRs) or number of banks (different hash algorithms) for PCRs.

That's only specified in specific profiles.  And it's definitely not the
same across
all TCG profiles.

Cheers,
- Ira


*Ira McDonald (Musician / Software Architect)Co-Chair - TCG Trusted
Mobility Solutions WG*

*Co-Chair - TCG Metadata Access Protocol SG*








*Chair - Linux Foundation Open Printing WGSecretary - IEEE-ISTO Printer
Working GroupCo-Chair - IEEE-ISTO PWG Internet Printing Protocol WGIETF
Designated Expert - IPP & Printer MIBBlue Roof Music / High North
Inchttp://sites.google.com/site/blueroofmusic
<http://sites.google.com/site/blueroofmusic>http://sites.google.com/site/highnorthinc
<http://sites.google.com/site/highnorthinc>mailto: [e-mail]
<[e-mail]>(permanent) PO Box 221  Grand Marais, MI 49839
906-494-2434*


On Wed, Aug 26, 2020 at 3:07 AM Oliver, Ian (Nokia - FI/Espoo) <
[e-mail]> wrote:

> Doesn't the TPM 2 standard state PCRs 0 through to 23 with two banks being
> provided SHA1 and SHA256 (at particular handles 0x4......?)
>
> It is the boot specification - at least for x86 - that states PCRs 0-7 are
> utilised for specific purposes, ie: CRTM, BIOS, configuration, boot loader,
> LCP and manufacturer defined.
>
> At least on some of our UEFI machines I see 8, 9 and 10 being used.
>
> 11 is the default for Linux IMA and 17 and 18 for Intel DRTM measurements
>
> There are restrictions due to locality, so at least on a PC, PCRS 16 and
> 23 are available to userland modification.
>
> Ian
>
> --
>
> Dr. Ian Oliver
>
> Cybersecurity Research
>
> Distinguished Member of Technical Staff
>
> Nokia Bell Labs
>
> [phone]
>
> ------------------------------
> *From:* Michael Richardson <[e-mail]>
> *Sent:* 26 August 2020 01:29
> *To:* Ira McDonald <[e-mail]>; [e-mail] <[e-mail]
> >
> *Subject:* Re: [Rats] TPM background for RIV
>
> Ira McDonald <[e-mail]> wrote:
>     > Small note:  Although you say each TPM has at least 16 PCRs, in fact
> the
>     > TPM 2.0 Mobile Common Profile
>     > (2015) only requires the implementation of one SHA-256 bank of 8
> PCRs (a
>     > SHA-1 bank is prohibited here).
>     > That design choice was made to avoid the squabbles over the
> inconsistent
>     > usage of PCR8 through PCR15
>     > across various TPM 2.0 profiles.
>
> I just want to understand.
> TPM 2 mobile, only requires PCR0-7.  It doesn't forbid PCR8->15 though?
> Do devices tend to implement them all?  Or?
>
> So what do the profiles do now?
>
> What is the impact on RIV?
>
> --
> ]               Never tell me the odds!                 | ipv6 mesh
> networks [
> ]   Michael Richardson, Sandelman Software Works        |    IoT
> architect   [
> ]     [e-mail]  http://www.sandelman.ca/        |   ruby on
> rails    [
>
>
>