Desktop version

Home arrow Computer Science arrow A Practical Guide to TPM 2.0

A short course of lectures
«A Practical Guide to TPM 2.0»





Execution EnvironmentThree Persistent HierarchiesDecrypt/Encrypt LimitationsMicrosoft SimulatorKey ActivationBound vs. UnboundDebug Trace AnalysisTSS.netCommand Execution FunctionsNV PasswordExample 2: An Enterprise IT Organization with Windows TPM 2.0 Enabled SystemsStarting the PolicyDuplication AttributesWave Systems Embassy SuiteRandom Number GeneratorData DetailsExtended Authorization (EA) PoliciesThe NS bitEphemeral HierarchyEncryptionDevice DriverExisting Applications That Use TPMsGuidelines for TPM2_StartAuthSession Handles and ParametersWhy Extended Authorization?Scenarios for Using TPM 1.2Quick Key Loading (new in 2.0)Applications That Should Use the TPM but Don'tLocking Firmware in an Embedded System, but Allowing for UpgradesStructure with UnionPersistent HierarchiesNonpersistent EntitiesTPM Manufacturer ProvisioningPlatform OEM ProvisioningPCRs: State of the MachineExample 5: A Policy for Flexible PCRsDecrypt/Encrypt SetupAudit DataNew Manageability Solutions in TPM 2.0Platform Configuration RegistersStorage HierarchySymmetric and Asymmetric Keys AttributesDeprovisioningMore Complex ErrorsPCR Quote in DetailApplication Interfaces Used to Talk to TPMsPrivacy EnablementPolicy Authorization Time IntervalsHMAC and Policy Sessions: DifferencesAuditing TPM CommandsCommand Context Allocation FunctionsSystem API Test CodeSystem APITABAlgorithm Agility (New in 2.0)Using an HMAC Session to Send Multiple Commands (Rolling Nonces)History of the TPMTPM Internal SlotsTPM Software StackHow to Find Information in the SpecificationPassword Authorization LifecycleSymmetric-Key ModesNumber of PCRsNV IndexesMultiple Varieties of AuthenticationTAB and the Resource Manager: A High-Level DescriptionStrategies for Ramping Up on TPM 2.0Attacks on the Algorithm ItselfEnd User ProvisioningTCTIInternal State of the TPM (Boot Counter and Timers)Commonly Used Sections of the SpecificationAuthorizationMicrosoft BitLockerSimple Code ExampleStartup InitializationHome RoleEntity NamesAudit CommandsCalculating the Strength of Algorithms by TypePassword Authorization SessionSystem-Wide SecurityStartup and ShutdownResource Manager OperationsThe Platform Crypto ProviderExclusive AuditDuplicationCommand AuditMultifactor AuthenticationSession-Related DefinitionsExample 4: A Policy Good for One Boot CycleNV IndicesAudit LogWhy AuditApplications That Use TPMsPlatform NV EnableDebug ProcessPutting It All TogetherDavePolicy AuthorizationTSS 2.0Starting HMAC and Policy SessionsHow TPM 2.0 Developed from TPM 1.2ProvisioningTPM Context-Management FeaturesNV Ordinary IndexPlatform Configuration RegistersTPM2_StartAuthSession CommandBuilding the Entity's Policy DigestAltering or Creating an Entity That Requires HMAC AuthorizationWrong TypePCR ValueKey Trees: Keeping Keys in a Tree with the Same Algorithm SetLocality of CommandHistory of TPM 2.0 Specification DevelopmentStarting the Real Policy SessionKDF: Key Derivation FunctionDefinitions of the Major Fields of the Response Byte StreamEndorsement HierarchyHow Extended Authorization WorksAudit TypesNV Index Handle ValuesCommand Authorization StructuresUnderstudy RoleEndiannessMaking a Compound PolicyGeneral DefinitionsIntel TXT Platform ComponentsHow Does EA Work?Context Management vs. LoadingSolving Bigger Problems with the TPM 2.0Intel® Trusted Execution Technology (Intel® TXT)The Three TechnologiesPlatform HierarchyCommand-Based AssertionsAsymmetric KeysTPM2B_XXX StructuresCode Example: Password SessionKey Types and AttributesKey GenerationWhat Do Encrypt/Decrypt Sessions Do?Internal Value of an NV RAM LocationPractical Use CasesECDSA Asymmetric-Key Algorithm to Use Elliptic Curves for SignaturesRelationship to TPMs: Notation SyntaxPolicy Authorization LifecycleKey GeneratorInterruptsWorld SwitchingSome TermsSimple Assertions and Multifactor AssertionsObjectsHMAC Session SecurityThe ProblemBad SizeOffice RolePlatform Security Technologies That Use TPM 2.0HMAC: Message Authentication Code: Table DecorationsCommon BugsState DiagramsTPM Access Broker (TAB)Creating an HMAC SessionPassword, HMAC, and Policy Sessions: What Are They?PCR Authorization and PolicyDefinitions of the Major Fields of the Command Byte StreamKey CommandsSetting Up the TPMTrustZone Is an Architectural FeatureKeysIdentificationSession AuditRemote Provisioning of PCs with IDevIDs Using the EKNV Counter IndexCreating the Entity to Use the Policy DigestDictionary Attack Lockout ResetNoncePermanent EntitiesHMAC Authorization LifecycleWillPCR AlgorithmsCryptographic AttacksCommon Structure ConstructsLast ResortAdministrator RoleTPM on an AMD PlatformAuthorization RolesNon-Brittle PCRs (New in 2.0)Command and Response Authorization Area DetailsNV WrittenConsiderations in Creating PoliciesExample 1: Smart card and PasswordSpecial Error CodesActivating a CredentialPersistent EntitiesSymmetric Key PrimitivesContext ManagementBasic Security ConceptsSome DefinitionsNavigating the SpecificationPasswords (Plaintext and HMAC) of the ObjectTPM 2.0 Library Specification: The PartsResource ManagerNV NamesSecuring a Server's LogonSimple Assertion PoliciesChanging a Password Authorization for an Already Created EntityKey HierarchyPersistence of KeysCertificationSecure Hash (or Digest)Technique 3Creating PoliciesSecurity DefinitionsHash ExtendLow-Level Application DebuggingBuilding the Simulator from Source CodeECC Asymmetric-Key AlgorithmUsing a Policy to Authorize a CommandIdentifying Resources by Name (New in 2.0)KenPCRsPublic Key CertificationCommand Authorization AreaCommand Preparation FunctionsCertified PoliciesImplementation of TrustZonePerforming the Action That Requires AuthorizationRestricted Signing KeyHistory of Development of the TPM Specification from 1.1b to 1.2Rocks to Avoid When Developing TPM ApplicationsIf the Policy Is CompoundExample: A Policy for Work or Home ComputersUsing an HMAC Session to Authorize a Single CommandSending Policy Commands to Fulfill the PolicyHigh-Level DescriptionCryptographic PrimitivesProtection TargetSample CodeSession and Authorization: Compared and ContrastedHierarchiesWhy a TPM?Satisfying a PolicyKeys UnraveledPCR CommandsExample 3: A PC state, a Password, and a FingerprintThe Stack: a High-Level ViewTPM Administration and WMISalted vs. UnsaltedPolicies and PasswordsSymmetric-Encryption KeyKey DestructionExample 2: A Policy for a Key Used Only for Signing with a PasswordPrimary Keys and SeedsResource ManagerSKINITEnd User RoleFeature APIResponse Authorization StructuresBrute ForceNULL HierarchyTechnique 1Session VariationsPlatform Configuration Registers (PCRs)Other TPM 2.0 SpecificationsPolicyPrivacyPasswords of a Different ObjectPassword Authorization: The Simplest AuthorizationPCR AttributesFlexible (Wild Card) PolicyHardware Validated BootTSS.netTransforming the Approved Policy in the Flexible PolicyGetting Started in Part 3: the CommandsHMAC PrimitivesBuilding Applications for TPM 1.2Restricted Decryption KeyKey StorageHigh-Level DescriptionManagement of Objects, Sessions, and SequencesNULL HierarchyFlexible Management (New in 2.0)Nonvolatile IndexesAuthorizations and SessionsCryptographic FamiliesExample 6: A Policy for Group AdmissionKey DestructionIf the Policy Is Flexible (Uses a Wild Card)Python ScriptSetting Up the Software StackThe MonitorECDH Asymmetric-Key Algorithm to Use Elliptic Curves to Pass KeysSpecial Rules Related to Power and Shutdown EventsPseudocode FlowKey CacheDebugging High-level ApplicationsSatisfying the Approved PolicyStartup, Shutdown, and ProvisioningExample 7: A Policy for NV RAM between 1 and 100Setting Up a Binary Version of the SimulatorDecrypt/Encrypt SessionsHMAC AuthorizationKey DistributionState of the External Device (GPS, Fingerprint Reader, and So On)Missing ObjectsReserved HandlesDebuggingARM® TrustZone®Creating a Password Authorized EntityAuthentication or Authorization TicketIntel TXT Boot SequenceTPM Context-Management CommandsNVRAM StorageUsing a Password AuthorizationMultifactor AuthenticationTSS.Net and TSS.C++PCRs for AttestationUse Cases for Session VariationsHow TPM 2.0 Devices Are UsedCanonicalizationAMD Secure Technology™Enhanced Authorization (New in 2.0)HMAC and Policy Session Code ExampleAnalyze the Error CodeRandom Number GeneratorSeparate CommandsTesting the SimulatorSession Key and HMAC Key DetailsRSA for Digital SignaturesVirtual Smart CardKey AuthorizationIBM File and Folder EncryptionTypical BugsPCRs for AuthorizationKey ManagementScenarios for Using Additional TPM 2.0 CapabilitiesExample 1: Simple Key ManagementDisabled FunctionRSA for Key EncryptionDigital Signatures (such as Smart Cards)Technique 2Data BackupsRunning the SimulatorSeparation of PrivilegeRSA Asymmetric-Key AlgorithmQuick Tutorial on TPM 2.0Other Privacy ConsiderationsTPM EntitiesSystem API Test CodeCompound Policies: Using Logical OR in a PolicyCombined Authorization LifecycleDigest Primitives
 
Found a mistake? Please highlight the word and press Shift + Enter