add integrity and security to TPM2 transactions
Subsystems (7)
James Bottomley
maintainerv5 cover add integrity and security to TPM2 transactions
The interest in securing the TPM against interposers, both active and passive has risen to fever pitch with the demonstration of key recovery against windows bitlocker:
https://dolosgroup.io/blog/2021/7/9/from-stolen-laptop-to-inside-the-company-network
And subsequently the same attack being successful against all the Linux TPM based security solutions:
https://www.secura.com/blog/tpm-sniffing-attacks-against-non-bitlocker-targets
The attacks fall into two categories:
1. Passive Interposers, which sit on the bus and merely observe
2. Active Interposers, which try to manipulate TPM transactions on the bus using man in the middle and packet stealing to create TPM state the interposer owner desires.
Our broadest interposer target is the use of TPM_RS_PW for password authorization which sends the actual password to the TPM without any obfuscation and effectively hands it to any interposer. The way to fix this is to use real sessions for HMAC capabilities to ensure integrity and to use parameter and response encryption to ensure confidentiality of the data flowing over the TPM bus. HMAC sessions by agreeing a challenge with the TPM and then giving a response which is a HMAC of the password and the challenge, so the application proves knowledge of the password to the TPM without ever transmitting the password itself. Using HMAC sessions when sending commands to the TPM also provides some measure of protection against active interposers, since the interposer can't interfere with or delete a HMAC'd command (because they can't manufacture a response with the correct HMAC).
To protect TPM transactions where there isn't a shared secret (i.e. the command is something like a PCR extension which doesn't involve a TPM object with a password) we have to do a bit more work to set up sessions with a passed in encrypted secret (called a salt) to act in place of the shared secret in the HMAC. This secret salt is effectively a random number encrypted to a public key of the TPM. The final piece of the puzzle is using parameter input and response return encryption, so any interposer can't see the data passing from the application to the TPM and vice versa.
The most insidious interposer attack of all is a reset attack: since the interposer has access to the TPM bus, it can assert the TPM reset line any time it wants. When a TPM resets it mostly comes back in the same state except that all the PCRs are reset to their initial values. Controlling the reset line allows the interposer to change the PCR state after the fact by resetting the TPM and then replaying PCR extends to get the PCRs into a valid state to release secrets, so even if an attack event was recorded, the record is erased. This reset attack violates the fundamental princible of non-repudiability of TPM logs. Defeating the reset attack involves tying all TPM operations within the kernel to a property which will change detectably if the TPM is reset. For that reason, we tie all TPM sessions to the null hierarchy we obtain at start of day and whose seed changes on every reset. If an active interposer asserts a TPM reset, the new null primary won't match the kernel's stored one and all TPM operations will start failing because of HMAC mismatches in the sessions. So if the kernel TPM code keeps operating, it guarantees that a reset hasn't occurred.
The final part of the puzzle is that the machine owner must have a fixed idea of the EK of their TPM and should have certified this with the TPM manufacturer. On every boot, the certified EK public key should be used to do a make credential/activate credential attestation key insertion and then the null key certified with the attestation key. We can follow a trust on first use model where an OS installation will extract and verify a public EK and save it to a read only file.
This patch series adds a simple API which can ensure the above properties as a layered addition to the existing TPM handling code. This series now includes protections for PCR extend, getting random numbers from the TPM and data sealing and unsealing. It therefore eliminates all uses of TPM2_RS_PW in the kernel and adds encryption protection to sensitive data flowing into and out of the TPM. The first four patches add more sophisticated buffer handling to the TPM which is needed to build the more complex encryption and authentication based commands. Patch 6 adds all the generic cryptography primitives and patches 7-9 use them in critical TPM operations where we want to avoid or detect interposers. Patch 10 exports the name of the null key we used for boot/run time verification and patch 11 documents the security guarantees and expectations.
This was originally sent over four years ago, with the last iteration being:
https://lore.kernel.org/linux-integrity/[email protected]/
I'm dusting it off now because various forces at Microsoft and Google via the Open Compute Platform are making a lot of noise about interposers and we in the linux kernel look critically lacking in that regard, particularly for TPM trusted keys.
---
v2 fixes the problems smatch reported and adds more explanation about the code motion in the first few patches
v3 rebases the encryption to be against Ard's new library function, the aescfb addition of which appears as patch 1.
v4 refreshes Ard's patch, adds kernel doc (including a new patch to add it to the moved tpm-buf functions) updates and rewords some commit logs
v5: update to proposed tpm-buf implementation (for ease of use all precursor patches are part of this series, so the actual session HMAC and encryption begins at patch 10) and add review feedback
James
---
Ard Biesheuvel (1):
crypto: lib - implement library version of AES in CFB mode
James Bottomley (9):
tpm: Move buffer handling from static inlines to real functions
tpm: add buffer function to point to returned parameters
tpm: export the context save and load commands
tpm: Add full HMAC and encrypt/decrypt session handling code
tpm: add hmac checks to tpm2_pcr_extend()
tpm: add session encryption protection to tpm2_get_random()
KEYS: trusted: Add session encryption protection to the seal/unseal
path
tpm: add the null key name as a sysfs export
Documentation: add tpm-security.rst
Jarkko Sakkinen (7):
tpm: Remove unused tpm_buf_tag()
tpm: Remove tpm_send()
tpm: Update struct tpm_buf documentation comments
tpm: Store the length of the tpm_buf data separately.
tpm: TPM2B formatted buffers
tpm: Add tpm_buf_read_{u8,u16,u32}
KEYS: trusted: tpm2: Use struct tpm_buf for sized buffers
Documentation/security/tpm/tpm-security.rst | 216 ++++ drivers/char/tpm/Kconfig | 14 + drivers/char/tpm/Makefile | 2 + drivers/char/tpm/tpm-buf.c | 251 ++++ drivers/char/tpm/tpm-chip.c | 3 + drivers/char/tpm/tpm-interface.c | 26 +- drivers/char/tpm/tpm-sysfs.c | 18 + drivers/char/tpm/tpm.h | 14 + drivers/char/tpm/tpm2-cmd.c | 53 +- drivers/char/tpm/tpm2-sessions.c | 1176 +++++++++++++++++++ drivers/char/tpm/tpm2-space.c | 8 +- include/crypto/aes.h | 5 + include/keys/trusted_tpm.h | 2 - include/linux/tpm.h | 294 +++-- lib/crypto/Kconfig | 5 + lib/crypto/Makefile | 3 + lib/crypto/aescfb.c | 257 ++++ security/keys/trusted-keys/trusted_tpm1.c | 23 +- security/keys/trusted-keys/trusted_tpm2.c | 136 ++- 19 files changed, 2312 insertions(+), 194 deletions(-) create mode 100644 Documentation/security/tpm/tpm-security.rst create mode 100644 drivers/char/tpm/tpm-buf.c create mode 100644 drivers/char/tpm/tpm2-sessions.c create mode 100644 lib/crypto/aescfb.c
Signature · 1 line
2.35.3
James Bottomley
maintainerPATCH v5 1/17 tpm: Remove unused tpm_buf_tag()
From: Jarkko Sakkinen <[email protected]>
The helper function has no call sites. Thus, remove it.
--- include/linux/tpm.h | 7 ------- 1 file changed, 7 deletions(-)
include/linux/tpm.h +0 -7
@@ -358,13 +358,6 @@ static inline u32 tpm_buf_length(struct tpm_buf *buf)return be32_to_cpu (head->length); } -static inline u16 tpm_buf_tag (struct tpm_buf *buf) -{ -struct tpm_header *head = (struct tpm_header *)buf->data; - -return be16_to_cpu (head->tag); -} -static inline void tpm_buf_append (struct tpm_buf *buf,const unsigned char *new_data,unsigned int new_len)
Signature · 1 line
2.35.3
James Bottomley
maintainerPATCH v5 2/17 tpm: Remove tpm_send()
In reply to James BottomleyFrom: Jarkko Sakkinen <[email protected]>
Open code the last remaining call site for tpm_send().
--- drivers/char/tpm/tpm-interface.c | 25 ----------------------- include/linux/tpm.h | 5 ----- security/keys/trusted-keys/trusted_tpm1.c | 14 +++++++++++-- 3 files changed, 12 insertions(+), 32 deletions(-)
drivers/char/tpm/tpm-interface.c +0 -25
@@ -342,31 +342,6 @@ int tpm_pcr_extend(struct tpm_chip *chip, u32 pcr_idx, }EXPORT_SYMBOL_GPL (tpm_pcr_extend); -/** -* tpm_send - send a TPM command -* @chip: a &struct tpm_chip instance, %NULL for the default chip -* @cmd: a TPM command buffer -* @buflen: the length of the TPM command buffer -* -* Return: same as with tpm_transmit_cmd() -*/ -int tpm_send (struct tpm_chip *chip,void *cmd,size_t buflen) -{ -struct tpm_buf buf; -int rc; - - chip =tpm_find_get_ops (chip); -if (!chip) -return -ENODEV ; - - buf.data = cmd; - rc =tpm_transmit_cmd (chip, &buf,0 ,"attempting to a send a command" ); - -tpm_put_ops (chip); -return rc; -} -EXPORT_SYMBOL_GPL (tpm_send); -int tpm_auto_startup (struct tpm_chip *chip) {int rc;
include/linux/tpm.h +0 -5
@@ -422,7 +422,6 @@ extern int tpm_pcr_read(struct tpm_chip *chip, u32 pcr_idx, struct tpm_digest *digest);extern int tpm_pcr_extend (struct tpm_chip *chip,u32 pcr_idx,struct tpm_digest *digests); -extern int tpm_send (struct tpm_chip *chip,void *cmd,size_t buflen);extern int tpm_get_random (struct tpm_chip *chip,u8 *data,size_t max);extern struct tpm_chip *tpm_default_chip (void );void tpm2_flush_context (struct tpm_chip *chip,u32 handle);
@@ -443,10 +442,6 @@ static inline int tpm_pcr_extend(struct tpm_chip *chip, u32 pcr_idx,return -ENODEV ; } -static inline int tpm_send (struct tpm_chip *chip,void *cmd,size_t buflen) -{ -return -ENODEV ; -}static inline int tpm_get_random (struct tpm_chip *chip,u8 *data,size_t max) {return -ENODEV ;
security/keys/trusted-keys/trusted_tpm1.c +12 -2
@@ -356,17 +356,27 @@ static int TSS_checkhmac2(unsigned char *buffer,*/ int trusted_tpm_send (unsigned char *cmd,size_t buflen) { +struct tpm_buf buf;int rc;if (!chip)return -ENODEV ; + rc =tpm_try_get_ops (chip); +if (rc) +return rc; + + buf.flags =0 ; + buf.data = cmd;dump_tpm_buf (cmd); - rc =tpm_send (chip, cmd, buflen); + rc =tpm_transmit_cmd (chip, &buf,4 ,"sending data" );dump_tpm_buf (cmd); +if (rc >0 ) -/* Can't return positive return codes values to keyctl */ +/* TPM error */ rc = -EPERM ; + +tpm_put_ops (chip);return rc; }EXPORT_SYMBOL_GPL (trusted_tpm_send);
Signature · 1 line
2.35.3
James Bottomley
maintainerPATCH v5 3/17 tpm: Move buffer handling from static inlines to real functions
In reply to James Bottomleyseparate out the tpm_buf_... handling functions from static inlines in tpm.h and move them to their own tpm-buf.c file. This is a precursor to adding new functions for other TPM type handling because the amount of code will grow from the current 70 lines in tpm.h to about 200 lines when the additions are done. 200 lines of inline functions is a bit too much to keep in a header file.
--- drivers/char/tpm/Makefile | 1 + drivers/char/tpm/tpm-buf.c | 87 ++++++++++++++++++++++++++++++++++++++ include/linux/tpm.h | 80 ++++------------------------------- 3 files changed, 97 insertions(+), 71 deletions(-) create mode 100644 drivers/char/tpm/tpm-buf.c
drivers/char/tpm/Makefile +1 -0
@@ -15,6 +15,7 @@ tpm-y += tpm-sysfs.o tpm-y += eventlog/common.o tpm-y += eventlog/tpm1.o tpm-y += eventlog/tpm2.o +tpm-y += tpm-buf.o tpm-$(CONFIG_ACPI) += tpm_ppi.o eventlog/acpi.o tpm-$(CONFIG_EFI) += eventlog/efi.o
drivers/char/tpm/tpm-buf.c new file +87 -0
87 lines not on this page · raw message
include/linux/tpm.h +9 -71
86 lines not on this page · raw message
Signature · 1 line
2.35.3
James Bottomley
maintainerPATCH v5 4/17 tpm: Update struct tpm_buf documentation comments
In reply to James BottomleyFrom: Jarkko Sakkinen <[email protected]>
Remove deprecated portions and document enum values.
--- include/linux/tpm.h | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-)
include/linux/tpm.h +4 -5
@@ -297,15 +297,14 @@ struct tpm_header { }; } __packed; -/* A string buffer type for constructing TPM commands. This is based on the -* ideas of string buffer code in security/keys/trusted.h but is heap based -* in order to keep the stack usage minimal. -*/ -enum tpm_buf_flags { +/* the capacity exceeded: */ TPM_BUF_OVERFLOW =BIT (0 ), }; +/* +* A string buffer type for constructing TPM commands. +*/ struct tpm_buf {unsigned int flags;u8 *data;
Signature · 1 line
2.35.3
James Bottomley
maintainerPATCH v5 5/17 tpm: Store the length of the tpm_buf data separately.
In reply to James BottomleyFrom: Jarkko Sakkinen <[email protected]>
TPM2B buffers, or sized buffers, have a two byte header, which contains the length of the payload as a 16-bit big-endian number, without counting in the space taken by the header. This differs from encoding in the TPM header where the length includes also the bytes taken by the header.
Unbound the length of a tpm_buf from the value stored to the TPM command header. A separate encoding and decoding step so that different buffer types can be supported, with variant header format and length encoding.
--- drivers/char/tpm/tpm-buf.c | 48 +++++++++++++++++------ drivers/char/tpm/tpm-interface.c | 1 + include/keys/trusted_tpm.h | 2 - include/linux/tpm.h | 6 +-- security/keys/trusted-keys/trusted_tpm1.c | 9 +++-- 5 files changed, 46 insertions(+), 20 deletions(-)
drivers/char/tpm/tpm-buf.c +37 -11
@@ -3,25 +3,44 @@* Handling of TPM command and other buffers. */ +#include <linux/tpm_command.h> #include <linux/module.h> #include <linux/tpm.h> +/** +* tpm_buf_init() - Allocate and initialize a TPM command +* @buf: A &tpm_buf +* @tag: TPM_TAG_RQU_COMMAND, TPM2_ST_NO_SESSIONS or TPM2_ST_SESSIONS +* @ordinal: A command ordinal +* +* Return: 0 or -ENOMEM +*/ int tpm_buf_init (struct tpm_buf *buf,u16 tag,u32 ordinal) { buf->data = (u8 *)__get_free_page (GFP_KERNEL );if (!buf->data)return -ENOMEM ; - buf->flags =0 ;tpm_buf_reset (buf, tag, ordinal);return 0 ; }EXPORT_SYMBOL_GPL (tpm_buf_init); +/** +* tpm_buf_reset() - Initialize a TPM command +* @buf: A &tpm_buf +* @tag: TPM_TAG_RQU_COMMAND, TPM2_ST_NO_SESSIONS or TPM2_ST_SESSIONS +* @ordinal: A command ordinal +*/ void tpm_buf_reset (struct tpm_buf *buf,u16 tag,u32 ordinal) {struct tpm_header *head = (struct tpm_header *)buf->data; +WARN_ON (tag !=TPM_TAG_RQU_COMMAND && tag !=TPM2_ST_NO_SESSIONS && + tag !=TPM2_ST_SESSIONS && tag !=0 ); + + buf->flags =0 ; + buf->length =sizeof (*head); head->tag =cpu_to_be16 (tag); head->length =cpu_to_be32 (sizeof (*head)); head->ordinal =cpu_to_be32 (ordinal);
@@ -34,33 +53,40 @@ void tpm_buf_destroy(struct tpm_buf *buf) }EXPORT_SYMBOL_GPL (tpm_buf_destroy); +/** +* tpm_buf_length() - Return the number of bytes consumed by the data +* +* Return: The number of bytes consumed by the buffer +*/ u32 tpm_buf_length (struct tpm_buf *buf) { -struct tpm_header *head = (struct tpm_header *)buf->data; - -return be32_to_cpu (head->length); +return buf->length; }EXPORT_SYMBOL_GPL (tpm_buf_length); -void tpm_buf_append (struct tpm_buf *buf, -const unsigned char *new_data, -unsigned int new_len) +/** +* tpm_buf_append() - Append data to an initialized buffer +* @buf: A &tpm_buf +* @new_data: A data blob +* @new_length: Size of the appended data +*/ +void tpm_buf_append (struct tpm_buf *buf,const u8 *new_data,u16 new_length) {struct tpm_header *head = (struct tpm_header *)buf->data; -u32 len =tpm_buf_length (buf);/* Return silently if overflow has already happened. */ if (buf->flags &TPM_BUF_OVERFLOW )return ; -if ((len + new_len) >PAGE_SIZE ) { +if ((buf->length + new_length) >PAGE_SIZE ) {WARN (1 ,"tpm_buf: overflow\n" ); buf->flags |=TPM_BUF_OVERFLOW ;return ; } -memcpy (&buf->data[len], new_data, new_len); - head->length =cpu_to_be32 (len + new_len); +memcpy (&buf->data[buf->length], new_data, new_length); + buf->length += new_length; + head->length =cpu_to_be32 (buf->length); }EXPORT_SYMBOL_GPL (tpm_buf_append);
drivers/char/tpm/tpm-interface.c +1 -0
@@ -232,6 +232,7 @@ ssize_t tpm_transmit_cmd(struct tpm_chip *chip, struct tpm_buf *buf,if (len < min_rsp_body_length +TPM_HEADER_SIZE )return -EFAULT ; + buf->length = len;return 0 ; }EXPORT_SYMBOL_GPL (tpm_transmit_cmd);
include/keys/trusted_tpm.h +0 -2
@@ -6,8 +6,6 @@#include <linux/tpm_command.h> /* implementation specific TPM constants */ -#define MAX_BUF_SIZE 1024 -#define TPM_GETRANDOM_SIZE 14#define TPM_SIZE_OFFSET 2#define TPM_RETURN_OFFSET 6#define TPM_DATA_OFFSET 10
include/linux/tpm.h +3 -3
@@ -306,7 +306,8 @@ enum tpm_buf_flags {* A string buffer type for constructing TPM commands. */ struct tpm_buf { -unsigned int flags; +u32 flags; +u32 length;u8 *data; };
@@ -329,8 +330,7 @@ int tpm_buf_init(struct tpm_buf *buf, u16 tag, u32 ordinal);void tpm_buf_reset (struct tpm_buf *buf,u16 tag,u32 ordinal);void tpm_buf_destroy (struct tpm_buf *buf);u32 tpm_buf_length (struct tpm_buf *buf); -void tpm_buf_append (struct tpm_buf *buf,const unsigned char *new_data, -unsigned int new_len); +void tpm_buf_append (struct tpm_buf *buf,const u8 *new_data,u16 new_length);void tpm_buf_append_u8 (struct tpm_buf *buf,const u8 value);void tpm_buf_append_u16 (struct tpm_buf *buf,const u16 value);void tpm_buf_append_u32 (struct tpm_buf *buf,const u32 value);
security/keys/trusted-keys/trusted_tpm1.c +5 -4
@@ -367,6 +367,7 @@ int trusted_tpm_send(unsigned char *cmd, size_t buflen)return rc; buf.flags =0 ; + buf.length = buflen; buf.data = cmd;dump_tpm_buf (cmd); rc =tpm_transmit_cmd (chip, &buf,4 ,"sending data" );
@@ -417,7 +418,7 @@ static int osap(struct tpm_buf *tb, struct osapsess *s,tpm_buf_append_u32 (tb, handle);tpm_buf_append (tb, ononce,TPM_NONCE_SIZE ); - ret =trusted_tpm_send (tb->data,MAX_BUF_SIZE ); + ret =trusted_tpm_send (tb->data, tb->length);if (ret <0 )return ret;
@@ -441,7 +442,7 @@ int oiap(struct tpm_buf *tb, uint32_t *handle, unsigned char *nonce)return -ENODEV ;tpm_buf_reset (tb,TPM_TAG_RQU_COMMAND ,TPM_ORD_OIAP ); - ret =trusted_tpm_send (tb->data,MAX_BUF_SIZE ); + ret =trusted_tpm_send (tb->data, tb->length);if (ret <0 )return ret;
@@ -553,7 +554,7 @@ static int tpm_seal(struct tpm_buf *tb, uint16_t keytype,tpm_buf_append_u8 (tb, cont);tpm_buf_append (tb, td->pubauth,SHA1_DIGEST_SIZE ); - ret =trusted_tpm_send (tb->data,MAX_BUF_SIZE ); + ret =trusted_tpm_send (tb->data, tb->length);if (ret <0 ) goto out;
@@ -644,7 +645,7 @@ static int tpm_unseal(struct tpm_buf *tb,tpm_buf_append_u8 (tb, cont);tpm_buf_append (tb, authdata2,SHA1_DIGEST_SIZE ); - ret =trusted_tpm_send (tb->data,MAX_BUF_SIZE ); + ret =trusted_tpm_send (tb->data, tb->length);if (ret <0 ) {pr_info ("authhmac failed (%d)\n" , ret);return ret;
Signature · 1 line
2.35.3
James Bottomley
maintainerPATCH v5 6/17 tpm: TPM2B formatted buffers
In reply to James BottomleyFrom: Jarkko Sakkinen <[email protected]>
Declare tpm_buf_init_sized() and tpm_buf_reset_sized() for creating TPM2B formatted buffers. These buffers are also known as sized buffers in the specifications and literature.
--- drivers/char/tpm/tpm-buf.c | 38 +++++++++++++++++++++++++++++++++++--- include/linux/tpm.h | 4 ++++ 2 files changed, 39 insertions(+), 3 deletions(-)
drivers/char/tpm/tpm-buf.c +35 -3
@@ -47,6 +47,36 @@ void tpm_buf_reset(struct tpm_buf *buf, u16 tag, u32 ordinal) }EXPORT_SYMBOL_GPL (tpm_buf_reset); +/** +* tpm_buf_init_sized() - Allocate and initialize a sized (TPM2B) buffer +* @buf: A @tpm_buf +* +* Return: 0 or -ENOMEM +*/ +int tpm_buf_init_sized (struct tpm_buf *buf) +{ + buf->data = (u8 *)__get_free_page (GFP_KERNEL ); +if (!buf->data) +return -ENOMEM ; + +tpm_buf_reset_sized (buf); +return 0 ; +} +EXPORT_SYMBOL_GPL (tpm_buf_init_sized); + +/** +* tpm_buf_reset_sized() - Initialize a sized buffer +* @buf: A &tpm_buf +*/ +void tpm_buf_reset_sized (struct tpm_buf *buf) +{ + buf->flags =TPM_BUF_TPM2B ; + buf->length =2 ; + buf->data[0 ] =0 ; + buf->data[1 ] =0 ; +} +EXPORT_SYMBOL_GPL (tpm_buf_reset_sized); +void tpm_buf_destroy (struct tpm_buf *buf) {free_page ((unsigned long )buf->data);
@@ -72,8 +102,6 @@ EXPORT_SYMBOL_GPL(tpm_buf_length);*/ void tpm_buf_append (struct tpm_buf *buf,const u8 *new_data,u16 new_length) { -struct tpm_header *head = (struct tpm_header *)buf->data; -/* Return silently if overflow has already happened. */ if (buf->flags &TPM_BUF_OVERFLOW )return ;
@@ -86,7 +114,11 @@ void tpm_buf_append(struct tpm_buf *buf, const u8 *new_data, u16 new_length)memcpy (&buf->data[buf->length], new_data, new_length); buf->length += new_length; - head->length =cpu_to_be32 (buf->length); + +if (buf->flags &TPM_BUF_TPM2B ) + ((__be16 *)buf->data)[0 ] =cpu_to_be16 (buf->length -2 ); +else + ((struct tpm_header *)buf->data)->length =cpu_to_be32 (buf->length); }EXPORT_SYMBOL_GPL (tpm_buf_append);
include/linux/tpm.h +4 -0
@@ -300,6 +300,8 @@ struct tpm_header {enum tpm_buf_flags {/* the capacity exceeded: */ TPM_BUF_OVERFLOW =BIT (0 ), +/* TPM2B format: */ +TPM_BUF_TPM2B =BIT (1 ), };/*
@@ -328,6 +330,8 @@ struct tpm2_hash {int tpm_buf_init (struct tpm_buf *buf,u16 tag,u32 ordinal);void tpm_buf_reset (struct tpm_buf *buf,u16 tag,u32 ordinal); +int tpm_buf_init_sized (struct tpm_buf *buf); +void tpm_buf_reset_sized (struct tpm_buf *buf);void tpm_buf_destroy (struct tpm_buf *buf);u32 tpm_buf_length (struct tpm_buf *buf);void tpm_buf_append (struct tpm_buf *buf,const u8 *new_data,u16 new_length);
Signature · 1 line
2.35.3
James Bottomley
maintainerPATCH v5 7/17 tpm: Add tpm_buf_read_{u8,u16,u32}
In reply to James BottomleyFrom: Jarkko Sakkinen <[email protected]>
Declare reader functions for the instances of struct tpm_buf. If the read goes out of boundary, TPM_BUF_BOUNDARY_ERROR is set, and subsequent read will do nothing.
--- drivers/char/tpm/tpm-buf.c | 79 +++++++++++++++++++++++++++++++++++++- include/linux/tpm.h | 5 +++ 2 files changed, 83 insertions(+), 1 deletion(-)
drivers/char/tpm/tpm-buf.c +78 -1
@@ -107,7 +107,7 @@ void tpm_buf_append(struct tpm_buf *buf, const u8 *new_data, u16 new_length)return ;if ((buf->length + new_length) >PAGE_SIZE ) { -WARN (1 ,"tpm_buf: overflow\n" ); +WARN (1 ,"tpm_buf: write overflow\n" ); buf->flags |=TPM_BUF_OVERFLOW ;return ; }
@@ -143,3 +143,80 @@ void tpm_buf_append_u32(struct tpm_buf *buf, const u32 value)tpm_buf_append (buf, (u8 *)&value2,4 ); }EXPORT_SYMBOL_GPL (tpm_buf_append_u32); + +/** +* tpm_buf_read() - Read from a TPM buffer +* @buf: &tpm_buf instance +* @offset: offset within the buffer +* @count: the number of bytes to read +* @output: the output buffer +*/ +static void tpm_buf_read (struct tpm_buf *buf,off_t *offset,size_t count,void *output) +{ +off_t next_offset; + +/* Return silently if overflow has already happened. */ +if (buf->flags &TPM_BUF_BOUNDARY_ERROR ) +return ; + + next_offset = *offset + count; +if (next_offset > buf->length) { +WARN (1 ,"tpm_buf: read out of boundary\n" ); + buf->flags |=TPM_BUF_BOUNDARY_ERROR ; +return ; + } + +memcpy (output, &buf->data[*offset], count); + *offset = next_offset; +} + +/** +* tpm_buf_read_u8() - Read 8-bit word from a TPM buffer +* @buf: &tpm_buf instance +* @offset: offset within the buffer +* +* Return: next 8-bit word +*/ +u8 tpm_buf_read_u8 (struct tpm_buf *buf,off_t *offset) +{ +u8 value; + +tpm_buf_read (buf, offset,sizeof (value), &value); + +return value; +} +EXPORT_SYMBOL_GPL (tpm_buf_read_u8); + +/** +* tpm_buf_read_u16() - Read 16-bit word from a TPM buffer +* @buf: &tpm_buf instance +* @offset: offset within the buffer +* +* Return: next 16-bit word +*/ +u16 tpm_buf_read_u16 (struct tpm_buf *buf,off_t *offset) +{ +u16 value; + +tpm_buf_read (buf, offset,sizeof (value), &value); + +return be16_to_cpu (value); +} +EXPORT_SYMBOL_GPL (tpm_buf_read_u16); + +/** +* tpm_buf_read_u32() - Read 32-bit word from a TPM buffer +* @buf: &tpm_buf instance +* @offset: offset within the buffer +* +* Return: next 32-bit word +*/ +u32 tpm_buf_read_u32 (struct tpm_buf *buf,off_t *offset) +{ +u32 value; + +tpm_buf_read (buf, offset,sizeof (value), &value); + +return be32_to_cpu (value); +} +EXPORT_SYMBOL_GPL (tpm_buf_read_u32);
include/linux/tpm.h +5 -0
@@ -302,6 +302,8 @@ enum tpm_buf_flags {TPM_BUF_OVERFLOW =BIT (0 ),/* TPM2B format: */ TPM_BUF_TPM2B =BIT (1 ), +/* read out of boundary: */ + TPM_BUF_BOUNDARY_ERROR = BIT(2), };/*
@@ -338,6 +340,9 @@ void tpm_buf_append(struct tpm_buf *buf, const u8 *new_data, u16 new_length);void tpm_buf_append_u8 (struct tpm_buf *buf,const u8 value);void tpm_buf_append_u16 (struct tpm_buf *buf,const u16 value);void tpm_buf_append_u32 (struct tpm_buf *buf,const u32 value); +u8 tpm_buf_read_u8 (struct tpm_buf *buf,off_t *offset); +u16 tpm_buf_read_u16 (struct tpm_buf *buf,off_t *offset); +u32 tpm_buf_read_u32 (struct tpm_buf *buf,off_t *offset);/* * Check if TPM device is in the firmware upgrade mode.
Signature · 1 line
2.35.3
James Bottomley
maintainerPATCH v5 8/17 KEYS: trusted: tpm2: Use struct tpm_buf for sized buffers
In reply to James BottomleyFrom: Jarkko Sakkinen <[email protected]>
Take advantage of the new sized buffer (TPM2B) mode of struct tpm_buf in tpm2_seal_trusted(). This allows to add robustness to the command construction without requiring to calculate buffer sizes manually.
--- security/keys/trusted-keys/trusted_tpm2.c | 54 +++++++++++++---------- 1 file changed, 31 insertions(+), 23 deletions(-)
security/keys/trusted-keys/trusted_tpm2.c +31 -23
@@ -228,8 +228,9 @@ int tpm2_seal_trusted(struct tpm_chip *chip,struct trusted_key_payload *payload, struct trusted_key_options *options) { + off_t offset = TPM_HEADER_SIZE; +struct tpm_buf buf, sized;int blob_len =0 ; -struct tpm_buf buf;u32 hash;u32 flags;int i;
@@ -258,6 +259,14 @@ int tpm2_seal_trusted(struct tpm_chip *chip,return rc; } + rc =tpm_buf_init_sized (&sized); +if (rc) { +tpm_buf_destroy (&buf); +tpm_put_ops (chip); +return rc; + } + +tpm_buf_reset (&buf,TPM2_ST_SESSIONS ,TPM2_CC_CREATE );tpm_buf_append_u32 (&buf, options->keyhandle); tpm2_buf_append_auth(&buf, TPM2_RS_PW, NULL /* nonce */, 0,
@@ -266,36 +275,36 @@ int tpm2_seal_trusted(struct tpm_chip *chip, TPM_DIGEST_SIZE);/* sensitive */ -tpm_buf_append_u16 (&buf,4 + options->blobauth_len + payload->key_len); +tpm_buf_append_u16 (&sized, options->blobauth_len); -tpm_buf_append_u16 (&buf, options->blobauth_len);if (options->blobauth_len) -tpm_buf_append (&buf, options->blobauth, options->blobauth_len); +tpm_buf_append (&sized, options->blobauth, options->blobauth_len); -tpm_buf_append_u16 (&buf, payload->key_len); -tpm_buf_append (&buf, payload->key, payload->key_len); +tpm_buf_append_u16 (&sized, payload->key_len); +tpm_buf_append (&sized, payload->key, payload->key_len); +tpm_buf_append (&buf, sized.data, sized.length);/* public */ -tpm_buf_append_u16 (&buf,14 + options->policydigest_len); -tpm_buf_append_u16 (&buf,TPM_ALG_KEYEDHASH ); -tpm_buf_append_u16 (&buf, hash); +tpm_buf_reset_sized (&sized); +tpm_buf_append_u16 (&sized,TPM_ALG_KEYEDHASH ); +tpm_buf_append_u16 (&sized, hash);/* key properties */ flags =0 ; flags |= options->policydigest_len ?0 :TPM2_OA_USER_WITH_AUTH ; - flags |= payload->migratable ?0 : (TPM2_OA_FIXED_TPM | -TPM2_OA_FIXED_PARENT ); -tpm_buf_append_u32 (&buf, flags); + flags |= payload->migratable ?0 : (TPM2_OA_FIXED_TPM |TPM2_OA_FIXED_PARENT ); +tpm_buf_append_u32 (&sized, flags);/* policy */ -tpm_buf_append_u16 (&buf, options->policydigest_len); +tpm_buf_append_u16 (&sized, options->policydigest_len);if (options->policydigest_len) -tpm_buf_append (&buf, options->policydigest, - options->policydigest_len); +tpm_buf_append (&sized, options->policydigest, options->policydigest_len);/* public parameters */ -tpm_buf_append_u16 (&buf,TPM_ALG_NULL ); -tpm_buf_append_u16 (&buf,0 ); +tpm_buf_append_u16 (&sized,TPM_ALG_NULL ); +tpm_buf_append_u16 (&sized,0 ); + +tpm_buf_append (&buf, sized.data, sized.length);/* outside info */ tpm_buf_append_u16 (&buf,0 );
@@ -312,21 +321,20 @@ int tpm2_seal_trusted(struct tpm_chip *chip,if (rc) goto out; - blob_len =be32_to_cpup ((__be32 *) &buf.data[TPM_HEADER_SIZE ]); -if (blob_len >MAX_BLOB_SIZE ) { + blob_len =tpm_buf_read_u32 (&buf, &offset); +if (blob_len >MAX_BLOB_SIZE || buf.flags &TPM_BUF_BOUNDARY_ERROR ) { rc = -E2BIG ; goto out; } -if (tpm_buf_length (&buf) <TPM_HEADER_SIZE +4 + blob_len) { +if (buf.length - offset < blob_len) { rc = -EFAULT ; goto out; } - blob_len =tpm2_key_encode (payload, options, - &buf.data[TPM_HEADER_SIZE +4 ], - blob_len); + blob_len =tpm2_key_encode (payload, options, &buf.data[offset], blob_len); out: +tpm_buf_destroy (&sized);tpm_buf_destroy (&buf);if (rc >0 ) {
Signature · 1 line
2.35.3
James Bottomley
maintainerPATCH v5 9/17 crypto: lib - implement library version of AES in CFB mode
In reply to James BottomleyFrom: Ard Biesheuvel <[email protected]>
Implement AES in CFB mode using the existing, mostly constant-time generic AES library implementation. This will be used by the TPM code to encrypt communications with TPM hardware, which is often a discrete component connected using sniffable wires or traces.
While a CFB template does exist, using a skcipher is a major pain for non-performance critical synchronous crypto where the algorithm is known at compile time and the data is in contiguous buffers with valid kernel virtual addresses.
--- include/crypto/aes.h | 5 + lib/crypto/Kconfig | 5 + lib/crypto/Makefile | 3 + lib/crypto/aescfb.c | 257 +++++++++++++++++++++++++++++++++++++++++++ 4 files changed, 270 insertions(+) create mode 100644 lib/crypto/aescfb.c
include/crypto/aes.h +5 -0
@@ -87,4 +87,9 @@ void aes_decrypt(const struct crypto_aes_ctx *ctx, u8 *out, const u8 *in);extern const u8 crypto_aes_sbox[];extern const u8 crypto_aes_inv_sbox[]; +void aescfb_encrypt (const struct crypto_aes_ctx *ctx,u8 *dst,const u8 *src, +int len,const u8 iv[AES_BLOCK_SIZE ]); +void aescfb_decrypt (const struct crypto_aes_ctx *ctx,u8 *dst,const u8 *src, +int len,const u8 iv[AES_BLOCK_SIZE ]); +#endif
lib/crypto/Kconfig +5 -0
@@ -8,6 +8,11 @@ config CRYPTO_LIB_UTILS config CRYPTO_LIB_AES tristate +config CRYPTO_LIB_AESCFB + tristate + select CRYPTO_LIB_AES + select CRYPTO_LIB_UTILS + config CRYPTO_LIB_AESGCM tristate select CRYPTO_LIB_AES
lib/crypto/Makefile +3 -0
@@ -10,6 +10,9 @@ obj-$(CONFIG_CRYPTO_LIB_CHACHA_GENERIC) += libchacha.o obj-$(CONFIG_CRYPTO_LIB_AES) += libaes.o libaes-y := aes.o +obj-$(CONFIG_CRYPTO_LIB_AESCFB) += libaescfb.o +libaescfb-y := aescfb.o + obj-$(CONFIG_CRYPTO_LIB_AESGCM) += libaesgcm.o libaesgcm-y := aesgcm.o
lib/crypto/aescfb.c new file +257 -0
257 lines not on this page · raw message
Signature · 1 line
2.35.3
James Bottomley
maintainerPATCH v5 10/17 tpm: add buffer function to point to returned parameters
In reply to James BottomleyReplace all instances of &buf.data[TPM_HEADER_SIZE] with a new function tpm_buf_parameters() because encryption sessions change where the return parameters are located in the buffer since if a return session is present they're 4 bytes beyond the header with those 4 bytes giving the parameter length. If there is no return session, then they're in the usual place immediately after the header.
---
v4: add kdoc
v5: update kdoc add review
--- drivers/char/tpm/tpm-buf.c | 28 ++++++++++++++++++++++++++++ include/linux/tpm.h | 2 ++ 2 files changed, 30 insertions(+)
drivers/char/tpm/tpm-buf.c +28 -0
@@ -220,3 +220,31 @@ u32 tpm_buf_read_u32(struct tpm_buf *buf, off_t *offset)return be32_to_cpu (value); }EXPORT_SYMBOL_GPL (tpm_buf_read_u32); + +static u16 tpm_buf_tag (struct tpm_buf *buf) +{ +struct tpm_header *head = (struct tpm_header *)buf->data; + +return be16_to_cpu (head->tag); +} + +/** +* tpm_buf_parameters - return the TPM response parameters area of the tpm_buf +* @buf: tpm_buf to use +* +* Where the parameters are located depends on the tag of a TPM +* command (it's immediately after the header for TPM_ST_NO_SESSIONS +* or 4 bytes after for TPM_ST_SESSIONS). Evaluate this and return a +* pointer to the first byte of the parameters area. +* +* @return: pointer to parameters area +*/ +u8 *tpm_buf_parameters (struct tpm_buf *buf) +{ +int offset =TPM_HEADER_SIZE ; + +if (tpm_buf_tag (buf) ==TPM2_ST_SESSIONS ) + offset +=4 ; + +return &buf->data[offset]; +}
include/linux/tpm.h +2 -0
@@ -344,6 +344,8 @@ u8 tpm_buf_read_u8(struct tpm_buf *buf, off_t *offset);u16 tpm_buf_read_u16 (struct tpm_buf *buf,off_t *offset);u32 tpm_buf_read_u32 (struct tpm_buf *buf,off_t *offset); +u8 *tpm_buf_parameters (struct tpm_buf *buf); +/* * Check if TPM device is in the firmware upgrade mode. */
Signature · 1 line
2.35.3
James Bottomley
maintainerPATCH v5 11/17 tpm: export the context save and load commands
In reply to James BottomleyThe TPM2 session HMAC and encryption handling code needs to save and restore a single volatile context for the elliptic curve version of the NULL seed, so export the APIs which do this for internal use.
---
v5: add review
--- drivers/char/tpm/tpm.h | 4 ++++ drivers/char/tpm/tpm2-space.c | 8 ++++---- 2 files changed, 8 insertions(+), 4 deletions(-)
drivers/char/tpm/tpm.h +4 -0
@@ -312,6 +312,10 @@ int tpm2_commit_space(struct tpm_chip *chip, struct tpm_space *space, void *buf, size_t *bufsiz);int tpm_devs_add (struct tpm_chip *chip);void tpm_devs_remove (struct tpm_chip *chip); +int tpm2_save_context (struct tpm_chip *chip,u32 handle,u8 *buf, +unsigned int buf_size,unsigned int *offset); +int tpm2_load_context (struct tpm_chip *chip,u8 *buf, +unsigned int *offset,u32 *handle);void tpm_bios_log_setup (struct tpm_chip *chip);void tpm_bios_log_teardown (struct tpm_chip *chip);
drivers/char/tpm/tpm2-space.c +4 -4
@@ -68,8 +68,8 @@ void tpm2_del_space(struct tpm_chip *chip, struct tpm_space *space)kfree (space->session_buf); } -static int tpm2_load_context (struct tpm_chip *chip,u8 *buf, -unsigned int *offset,u32 *handle) +int tpm2_load_context (struct tpm_chip *chip,u8 *buf, +unsigned int *offset,u32 *handle) {struct tpm_buf tbuf;struct tpm2_context *ctx;
@@ -119,8 +119,8 @@ static int tpm2_load_context(struct tpm_chip *chip, u8 *buf,return 0 ; } -static int tpm2_save_context (struct tpm_chip *chip,u32 handle,u8 *buf, -unsigned int buf_size,unsigned int *offset) +int tpm2_save_context (struct tpm_chip *chip,u32 handle,u8 *buf, +unsigned int buf_size,unsigned int *offset) {struct tpm_buf tbuf;unsigned int body_size;
Signature · 1 line
2.35.3
James Bottomley
maintainerPATCH v5 12/17 tpm: Add full HMAC and encrypt/decrypt session handling code
In reply to James BottomleyAdd session based HMAC authentication plus parameter decryption and response encryption using AES. The basic design is to segregate all the nasty crypto, hash and hmac code into tpm2-sessions.c and export a usable API. The API first of all starts off by gaining a session with
tpm2_start_auth_session()
which initiates a session with the TPM and allocates an opaque tpm2_auth structure to handle the session parameters. The design is that session use will be single threaded from start to finish under the ops lock, so the tpm2_auth structure is stored in struct tpm2_chip. Then the use is simply:
* tpm_buf_append_name() in place of the tpm_buf_append_u32 for the handles
* tpm_buf_append_hmac_session() where tpm2_append_auth() would go
* tpm_buf_fill_hmac_session() called after the entire command buffer is finished but before tpm_transmit_cmd() is called which computes the correct HMAC and places it in the command at the correct location.
Finally, after tpm_transmit_cmd() is called, tpm_buf_check_hmac_response() is called to check that the returned HMAC matched and collect the new state for the next use of the session, if any.
The features of the session is controlled by the session attributes set in tpm_buf_append_hmac_session(). If TPM2_SA_CONTINUE_SESSION is not specified, the session will be flushed and the tpm2_auth structure freed in tpm_buf_check_hmac_response(); otherwise the session may be used again. Parameter encryption is specified by or'ing the flag TPM2_SA_DECRYPT and response encryption by or'ing the flag TPM2_SA_ENCRYPT. the various encryptions will be taken care of by tpm_buf_fill_hmac_session() and tpm_buf_check_hmac_response() respectively.
To get all of this to work securely, the Kernel needs a primary key to encrypt the session salt to, so an EC key from the NULL seed is derived and its context saved in the tpm_chip structure. The context is loaded on demand into an available volatile handle when tpm_start_auth_session() is called, but is flushed before that function exits to conserve handles.
Doing the encryption and HMAC adds some overhead both in the TPM handling and in the host side cryptography needed to set up the requests and verify the responses. A config option, TPM_BUS_SECURITY, is added which eliminates the use of sessions and thus the extra overhead when set to 'N'.
---
v2: fix memory leaks from smatch; adjust for name hash size
v3: make tpm2_make_null_primary static
v4: use crypto library functions
v5: kdoc fix, Kconfig help update, abstract out mso
--- drivers/char/tpm/Kconfig | 14 + drivers/char/tpm/Makefile | 1 + drivers/char/tpm/tpm-buf.c | 1 + drivers/char/tpm/tpm-chip.c | 3 + drivers/char/tpm/tpm.h | 10 + drivers/char/tpm/tpm2-cmd.c | 5 + drivers/char/tpm/tpm2-sessions.c | 1176 ++++++++++++++++++++++++++++++ include/linux/tpm.h | 180 +++++ 8 files changed, 1390 insertions(+) create mode 100644 drivers/char/tpm/tpm2-sessions.c
drivers/char/tpm/Kconfig +14 -0
@@ -27,6 +27,20 @@ menuconfig TCG_TPM if TCG_TPM +config TPM_BUS_SECURITY + bool "Use encrypted and HMACd transactions on the TPM bus" + default y + select CRYPTO_ECDH + select CRYPTO_LIB_AESCFB + select CRYPTO_LIB_SHA256 + help + Setting this causes us to deploy a scheme which uses request + and response HMACs in addition to encryption for + communicating with the TPM to prevent or detect bus snooping + and interposer attacks (see tpm-security.rst). Saying Y + here adds some encryption overhead to all kernel to TPM + transactions. + config HW_RANDOM_TPM bool "TPM HW Random Number Generator support" depends on TCG_TPM && HW_RANDOM && !(TCG_TPM=y && HW_RANDOM=m)
drivers/char/tpm/Makefile +1 -0
@@ -17,6 +17,7 @@ tpm-y += eventlog/tpm1.o tpm-y += eventlog/tpm2.o tpm-y += tpm-buf.o +tpm-$(CONFIG_TPM_BUS_SECURITY) += tpm2-sessions.o tpm-$(CONFIG_ACPI) += tpm_ppi.o eventlog/acpi.o tpm-$(CONFIG_EFI) += eventlog/efi.o tpm-$(CONFIG_OF) += eventlog/of.o
drivers/char/tpm/tpm-buf.c +1 -0
@@ -44,6 +44,7 @@ void tpm_buf_reset(struct tpm_buf *buf, u16 tag, u32 ordinal) head->tag =cpu_to_be16 (tag); head->length =cpu_to_be32 (sizeof (*head)); head->ordinal =cpu_to_be32 (ordinal); + buf->handles =0 ; }EXPORT_SYMBOL_GPL (tpm_buf_reset);
drivers/char/tpm/tpm-chip.c +3 -0
@@ -275,6 +275,9 @@ static void tpm_dev_release(struct device *dev)kfree (chip->work_space.context_buf);kfree (chip->work_space.session_buf);kfree (chip->allocated_banks); +#ifdef CONFIG_TPM_BUS_SECURITY +kfree (chip->auth); +#endif kfree (chip); }
drivers/char/tpm/tpm.h +10 -0
@@ -321,4 +321,14 @@ void tpm_bios_log_setup(struct tpm_chip *chip);void tpm_bios_log_teardown (struct tpm_chip *chip);int tpm_dev_common_init (void );void tpm_dev_common_exit (void ); + +#ifdef CONFIG_TPM_BUS_SECURITY +int tpm2_sessions_init (struct tpm_chip *chip); +#else +static inline int tpm2_sessions_init (struct tpm_chip *chip) +{ +return 0 ; +} +#endif +#endif
drivers/char/tpm/tpm2-cmd.c +5 -0
@@ -759,6 +759,11 @@ int tpm2_auto_startup(struct tpm_chip *chip) rc =0 ; } +if (rc) + goto out; + + rc =tpm2_sessions_init (chip); + out:/* * Infineon TPM in field upgrade mode will return no data for the number
drivers/char/tpm/tpm2-sessions.c new file +1176 -0
1,176 lines not on this page · raw message
include/linux/tpm.h +180 -0
263 lines not on this page · raw message
Signature · 1 line
2.35.3
Jarkko Sakkinen
maintainerRe: [PATCH v5 12/17] tpm: Add full HMAC and encrypt/decrypt session handling code
Quoted 16 lines · James Bottomley
Add session based HMAC authentication plus parameter decryption and response encryption using AES. The basic design is to segregate all the nasty crypto, hash and hmac code into
tpm2-sessions.cand export a usable API. The API first of all starts off by gaining a session with
tpm2_start_auth_session()which initiates a session with the TPM and allocates an opaque
tpm2_authstructure to handle the session parameters. The design is that session use will be single threaded from start to finish under the ops lock, so thetpm2_authstructure is stored in structtpm2_chip. Then the use is simply:*
tpm_buf_append_name()in place of thetpm_buf_append_u32for the handles
Quoted 6 lines
*
tpm_buf_append_hmac_session()wheretpm2_append_auth()would go*
tpm_buf_fill_hmac_session()called after the entire command buffer is finished but beforetpm_transmit_cmd()is called which computes the correct HMAC and places it in the command at the correct location.
Split each exported function into a separate patches. This too big chunk of diff to be reviawable, i.e. it is impossible to give reviewed-by in this form. I think I've commented this also throughout the series, and it has not been changed.
There needs to be a patch per each exported API function so that they can be looked into detail. This patch does not align with submission guidelines in the form it is either.
I can give only one half review right now, which "yes wee need this" but cannot give any rational feedback whether it is in the form we would like it to be.
BR, Jarkko
James Bottomley
maintainerRe: [PATCH v5 12/17] tpm: Add full HMAC and encrypt/decrypt session handling code
Quoted 27 lines · Jarkko Sakkinen
Quoted 17 lines · James Bottomley
Add session based HMAC authentication plus parameter decryption and response encryption using AES. The basic design is to segregate all the nasty crypto, hash and hmac code into
tpm2-sessions.cand export a usable API. The API first of all starts off by gaining a session with
tpm2_start_auth_session()which initiates a session with the TPM and allocates an opaque
tpm2_authstructure to handle the session parameters. The design is that session use will be single threaded from start to finish under the ops lock, so thetpm2_authstructure is stored in structtpm2_chip. Then the use is simply:*
tpm_buf_append_name()in place of thetpm_buf_append_u32for the handlesQuoted 8 lines
*
tpm_buf_append_hmac_session()wheretpm2_append_auth()would go*
tpm_buf_fill_hmac_session()called after the entire command buffer
is finished but beforetpm_transmit_cmd()is called which computes
the correct HMAC and places it in the command at the correct location.
Quoted 4 lines
Split each exported function into a separate patches. This too big chunk of diff to be reviawable, i.e. it is impossible to give reviewed-by in this form. I think I've commented this also throughout the series, and it has not been changed.
Um, you mean you mentioned it once and I explained that the API is unitary so logically it does belong in one patch and you didn't mention it again?
Quoted 3 lines
There needs to be a patch per each exported API function so that they can be looked into detail. This patch does not align with submission guidelines in the form it is either.
There's no length limit on patch sizes, just the recommendation to keep the changes logical. One patch per API is actually illogical and contrary to the guide because the APIs come in sets, so you'd miss the logical reviewability with that split. I suppose what I could do is split it into three logically complete API sets: 1) primary creation;
2) session start/end 3) rest of the session HMAC helpers. That would give three patches of 400-600 lines each.
James
Jarkko Sakkinen
maintainerRe: [PATCH v5 12/17] tpm: Add full HMAC and encrypt/decrypt session handling code
Quoted 41 lines · James Bottomley
Quoted 27 lines · Jarkko Sakkinen
Quoted 17 lines · James Bottomley
Add session based HMAC authentication plus parameter decryption and response encryption using AES. The basic design is to segregate all the nasty crypto, hash and hmac code into
tpm2-sessions.cand export a usable API. The API first of all starts off by gaining a session with
tpm2_start_auth_session()which initiates a session with the TPM and allocates an opaque
tpm2_authstructure to handle the session parameters. The design is that session use will be single threaded from start to finish under the ops lock, so thetpm2_authstructure is stored in structtpm2_chip. Then the use is simply:*
tpm_buf_append_name()in place of thetpm_buf_append_u32for the handlesQuoted 8 lines
*
tpm_buf_append_hmac_session()wheretpm2_append_auth()would go*
tpm_buf_fill_hmac_session()called after the entire command buffer
is finished but beforetpm_transmit_cmd()is called which computes
the correct HMAC and places it in the command at the correct location.Quoted 4 lines
Split each exported function into a separate patches. This too big chunk of diff to be reviawable, i.e. it is impossible to give reviewed-by in this form. I think I've commented this also throughout the series, and it has not been changed.
Um, you mean you mentioned it once and I explained that the API is unitary so logically it does belong in one patch and you didn't mention it again?
Quoted 3 lines
There needs to be a patch per each exported API function so that they can be looked into detail. This patch does not align with submission guidelines in the form it is either.
Quoted 7 lines
There's no length limit on patch sizes, just the recommendation to keep the changes logical. One patch per API is actually illogical and contrary to the guide because the APIs come in sets, so you'd miss the logical reviewability with that split. I suppose what I could do is split it into three logically complete API sets: 1) primary creation;
2) session start/end 3) rest of the session HMAC helpers. That would give three patches of 400-600 lines each.
That would be good enough.
I've now also verified that call chains look to go through with bpftrace. I have full green flag for including from blackbox testing perspective, the feature has (in my opinion) correct design and also since distributions are gaining TPN sealed encryption this sorts that orthogonally. So in that sense as long as the code changes will become clean enough this is definitely something that we want to Linux (just saying this that polishing work does not go down the drain).
I mean with this, it closes how things are sealed e.g. in modern Mac's, at least to the level that the computer is still open for the owner :-)
Quoted 2 lines
James
BR, Jarkko
James Bottomley
maintainerPATCH v5 13/17 tpm: add hmac checks to tpm2_pcr_extend()
In reply to James Bottomleytpm2_pcr_extend() is used by trusted keys to extend a PCR to prevent a key from being re-loaded until the next reboot. To use this functionality securely, that extend must be protected by a session hmac. This patch adds HMAC protection so tampering with the tpm2_pcr_extend() command in flight is detected.
--- drivers/char/tpm/tpm2-cmd.c | 27 ++++++++++----------------- 1 file changed, 10 insertions(+), 17 deletions(-)
drivers/char/tpm/tpm2-cmd.c +10 -17
@@ -216,13 +216,6 @@ int tpm2_pcr_read(struct tpm_chip *chip, u32 pcr_idx,return rc; } -struct tpm2_null_auth_area { -__be32 handle; -__be16 nonce_size; -u8 attributes; -__be16 auth_size; -} __packed; -/** * tpm2_pcr_extend() - extend a PCR value *
@@ -236,24 +229,22 @@ int tpm2_pcr_extend(struct tpm_chip *chip, u32 pcr_idx, struct tpm_digest *digests) {struct tpm_buf buf; -struct tpm2_null_auth_area auth_area;int rc;int i; - rc =tpm_buf_init (&buf,TPM2_ST_SESSIONS ,TPM2_CC_PCR_EXTEND ); + rc =tpm2_start_auth_session (chip);if (rc)return rc; -tpm_buf_append_u32 (&buf, pcr_idx); + rc =tpm_buf_init (&buf,TPM2_ST_SESSIONS ,TPM2_CC_PCR_EXTEND ); +if (rc) { +tpm2_end_auth_session (chip); +return rc; + } - auth_area.handle =cpu_to_be32 (TPM2_RS_PW ); - auth_area.nonce_size =0 ; - auth_area.attributes =0 ; - auth_area.auth_size =0 ; +tpm_buf_append_name (chip, &buf, pcr_idx,NULL ); +tpm_buf_append_hmac_session (chip, &buf,0 ,NULL ,0 ); -tpm_buf_append_u32 (&buf,sizeof (struct tpm2_null_auth_area )); -tpm_buf_append (&buf, (const unsigned char *)&auth_area, -sizeof (auth_area));tpm_buf_append_u32 (&buf, chip->nr_allocated_banks);for (i =0 ; i < chip->nr_allocated_banks; i++) {
@@ -262,7 +253,9 @@ int tpm2_pcr_extend(struct tpm_chip *chip, u32 pcr_idx, chip->allocated_banks[i].digest_size); } +tpm_buf_fill_hmac_session (chip, &buf); rc =tpm_transmit_cmd (chip, &buf,0 ,"attempting extend a PCR value" ); + rc =tpm_buf_check_hmac_response (chip, &buf, rc);tpm_buf_destroy (&buf);
Signature · 1 line
2.35.3
James Bottomley
maintainerPATCH v5 14/17 tpm: add session encryption protection to tpm2_get_random()
In reply to James BottomleyIf some entity is snooping the TPM bus, they can see the random numbers we're extracting from the TPM and do prediction attacks against their consumers. Foil this attack by using response encryption to prevent the attacker from seeing the random sequence.
--- drivers/char/tpm/tpm2-cmd.c | 21 +++++++++++++++++---- 1 file changed, 17 insertions(+), 4 deletions(-)
drivers/char/tpm/tpm2-cmd.c +17 -4
@@ -292,25 +292,35 @@ int tpm2_get_random(struct tpm_chip *chip, u8 *dest, size_t max)if (!num_bytes || max >TPM_MAX_RNG_DATA )return -EINVAL ; - err =tpm_buf_init (&buf,0 ,0 ); + err =tpm2_start_auth_session (chip);if (err)return err; + err =tpm_buf_init (&buf,0 ,0 ); +if (err) { +tpm2_end_auth_session (chip); +return err; + } + do { - tpm_buf_reset(&buf, TPM2_ST_NO_SESSIONS, TPM2_CC_GET_RANDOM); + tpm_buf_reset(&buf, TPM2_ST_SESSIONS, TPM2_CC_GET_RANDOM); + tpm_buf_append_hmac_session_opt(chip, &buf, TPM2_SA_ENCRYPT + | TPM2_SA_CONTINUE_SESSION, + NULL, 0); tpm_buf_append_u16(&buf, num_bytes); + tpm_buf_fill_hmac_session(chip, &buf); err = tpm_transmit_cmd(chip, &buf, offsetof(struct tpm2_get_random_out, buffer), "attempting get random"); + err = tpm_buf_check_hmac_response(chip, &buf, err); if (err) { if (err > 0) err = -EIO; goto out; } - out = (struct tpm2_get_random_out *) - &buf.data[TPM_HEADER_SIZE]; + out = (struct tpm2_get_random_out *)tpm_buf_parameters(&buf); recd = min_t(u32, be16_to_cpu(out->size), num_bytes); if (tpm_buf_length(&buf) < TPM_HEADER_SIZE +
@@ -327,9 +337,12 @@ int tpm2_get_random(struct tpm_chip *chip, u8 *dest, size_t max) }while (retries-- && total < max);tpm_buf_destroy (&buf); +tpm2_end_auth_session (chip); +return total ? total : -EIO ; out:tpm_buf_destroy (&buf); +tpm2_end_auth_session (chip);return err; }
Signature · 1 line
2.35.3
James Bottomley
maintainerPATCH v5 15/17 KEYS: trusted: Add session encryption protection to the seal/unseal path
In reply to James BottomleyIf some entity is snooping the TPM bus, the can see the data going in to be sealed and the data coming out as it is unsealed. Add parameter and response encryption to these cases to ensure that no secrets are leaked even if the bus is snooped.
As part of doing this conversion it was discovered that policy sessions can't work with HMAC protected authority because of missing pieces (the tpm Nonce). I've added code to work the same way as before, which will result in potential authority exposure (while still adding security for the command and the returned blob), and a fixme to redo the API to get rid of this security hole.
---
v2: fix unseal with policy and password
v3: fix session memory leak
--- security/keys/trusted-keys/trusted_tpm2.c | 88 ++++++++++++++++------- 1 file changed, 61 insertions(+), 27 deletions(-)
security/keys/trusted-keys/trusted_tpm2.c +61 -27
@@ -253,26 +253,26 @@ int tpm2_seal_trusted(struct tpm_chip *chip,if (rc)return rc; + rc =tpm2_start_auth_session (chip); +if (rc) + goto out_put; + rc =tpm_buf_init (&buf,TPM2_ST_SESSIONS ,TPM2_CC_CREATE );if (rc) { -tpm_put_ops (chip); -return rc; +tpm2_end_auth_session (chip); + goto out_put; } rc =tpm_buf_init_sized (&sized);if (rc) {tpm_buf_destroy (&buf); -tpm_put_ops (chip); -return rc; +tpm2_end_auth_session (chip); + goto out_put; } -tpm_buf_reset (&buf,TPM2_ST_SESSIONS ,TPM2_CC_CREATE ); -tpm_buf_append_u32 (&buf, options->keyhandle); -tpm2_buf_append_auth (&buf,TPM2_RS_PW , -NULL /* nonce */ ,0 , -0 /* session_attributes */ , - options->keyauth/* hmac */ , -TPM_DIGEST_SIZE ); +tpm_buf_append_name (chip, &buf, options->keyhandle,NULL ); +tpm_buf_append_hmac_session (chip, &buf,TPM2_SA_DECRYPT , + options->keyauth,TPM_DIGEST_SIZE );/* sensitive */ tpm_buf_append_u16 (&sized, options->blobauth_len);
@@ -314,10 +314,13 @@ int tpm2_seal_trusted(struct tpm_chip *chip,if (buf.flags &TPM_BUF_OVERFLOW ) { rc = -E2BIG ; +tpm2_end_auth_session (chip); goto out; } +tpm_buf_fill_hmac_session (chip, &buf); rc =tpm_transmit_cmd (chip, &buf,4 ,"sealing data" ); + rc =tpm_buf_check_hmac_response (chip, &buf, rc);if (rc) goto out;
@@ -348,6 +351,7 @@ int tpm2_seal_trusted(struct tpm_chip *chip,else payload->blob_len = blob_len; +out_put:tpm_put_ops (chip);return rc; }
@@ -417,25 +421,31 @@ static int tpm2_load_cmd(struct tpm_chip *chip,if (blob_len > payload->blob_len)return -E2BIG ; - rc =tpm_buf_init (&buf,TPM2_ST_SESSIONS ,TPM2_CC_LOAD ); + rc =tpm2_start_auth_session (chip);if (rc)return rc; -tpm_buf_append_u32 (&buf, options->keyhandle); -tpm2_buf_append_auth (&buf,TPM2_RS_PW , -NULL /* nonce */ ,0 , -0 /* session_attributes */ , - options->keyauth/* hmac */ , -TPM_DIGEST_SIZE ); + rc =tpm_buf_init (&buf,TPM2_ST_SESSIONS ,TPM2_CC_LOAD ); +if (rc) { +tpm2_end_auth_session (chip); +return rc; + } + +tpm_buf_append_name (chip, &buf, options->keyhandle,NULL ); +tpm_buf_append_hmac_session (chip, &buf,0 , options->keyauth, +TPM_DIGEST_SIZE );tpm_buf_append (&buf, blob, blob_len);if (buf.flags &TPM_BUF_OVERFLOW ) { rc = -E2BIG ; +tpm2_end_auth_session (chip); goto out; } +tpm_buf_fill_hmac_session (chip, &buf); rc =tpm_transmit_cmd (chip, &buf,4 ,"loading blob" ); + rc =tpm_buf_check_hmac_response (chip, &buf, rc);if (!rc) *blob_handle =be32_to_cpup ( (__be32 *) &buf.data[TPM_HEADER_SIZE ]);
@@ -473,20 +483,44 @@ static int tpm2_unseal_cmd(struct tpm_chip *chip,u8 *data;int rc; - rc =tpm_buf_init (&buf,TPM2_ST_SESSIONS ,TPM2_CC_UNSEAL ); + rc =tpm2_start_auth_session (chip);if (rc)return rc; -tpm_buf_append_u32 (&buf, blob_handle); -tpm2_buf_append_auth (&buf, - options->policyhandle ? - options->policyhandle :TPM2_RS_PW , -NULL /* nonce */ ,0 , -TPM2_SA_CONTINUE_SESSION , - options->blobauth/* hmac */ , - options->blobauth_len); + rc =tpm_buf_init (&buf,TPM2_ST_SESSIONS ,TPM2_CC_UNSEAL ); +if (rc) { +tpm2_end_auth_session (chip); +return rc; + } + +tpm_buf_append_name (chip, &buf, blob_handle,NULL ); + +if (!options->policyhandle) { +tpm_buf_append_hmac_session (chip, &buf,TPM2_SA_ENCRYPT , + options->blobauth, + options->blobauth_len); + }else { +/* +* FIXME: The policy session was generated outside the +* kernel so we don't known the nonce and thus can't +* calculate a HMAC on it. Therefore, the user can +* only really use TPM2_PolicyPassword and we must +* send down the plain text password, which could be +* intercepted. We can still encrypt the returned +* key, but that's small comfort since the interposer +* could repeat our actions with the exfiltrated +* password. +*/ +tpm2_buf_append_auth (&buf, options->policyhandle, +NULL /* nonce */ ,0 ,0 , + options->blobauth, options->blobauth_len); +tpm_buf_append_hmac_session_opt (chip, &buf,TPM2_SA_ENCRYPT , +NULL ,0 ); + } +tpm_buf_fill_hmac_session (chip, &buf); rc =tpm_transmit_cmd (chip, &buf,6 ,"unsealing" ); + rc =tpm_buf_check_hmac_response (chip, &buf, rc);if (rc >0 ) rc = -EPERM ;
Signature · 1 line
2.35.3
James Bottomley
maintainerPATCH v5 16/17 tpm: add the null key name as a sysfs export
In reply to James BottomleyThis is the last component of encrypted tpm2 session handling that allows us to verify from userspace that the key derived from the NULL seed genuinely belongs to the TPM and has not been spoofed.
The procedure for doing this involves creating an attestation identity key (which requires verification of the TPM EK certificate) and then using that AIK to sign a certification of the Elliptic Curve key over the NULL seed. Userspace must create this EC Key using the parameters prescribed in TCG TPM v2.0 Provisioning Guidance for the SRK ECC; if this is done correctly the names will match and the TPM can then run a TPM2_Certify operation on this derived primary key using the newly created AIK.
--- drivers/char/tpm/tpm-sysfs.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+)
drivers/char/tpm/tpm-sysfs.c +18 -0
@@ -309,6 +309,21 @@ static ssize_t tpm_version_major_show(struct device *dev, }static DEVICE_ATTR_RO (tpm_version_major); +#ifdef CONFIG_TPM_BUS_SECURITY +static ssize_t null_name_show (struct device *dev,struct device_attribute *attr, +char *buf) +{ +struct tpm_chip *chip =to_tpm_chip (dev); +int size =TPM2_NAME_SIZE ; + +bin2hex (buf, chip->tpmkeyname, size); + size *=2 ; + buf[size++] ='\n' ; +return size; +} +static DEVICE_ATTR_RO (null_name); +#endif +static struct attribute *tpm1_dev_attrs[] = { &dev_attr_pubek.attr, &dev_attr_pcrs.attr,
@@ -326,6 +341,9 @@ static struct attribute *tpm1_dev_attrs[] = {static struct attribute *tpm2_dev_attrs[] = { &dev_attr_tpm_version_major.attr, +#ifdef CONFIG_TPM_BUS_SECURITY + &dev_attr_null_name.attr, +#endifNULL };
Signature · 1 line
2.35.3
Re: [PATCH v5 16/17] tpm: add the null key name as a sysfs export
Quoted 24 lines · James Bottomley
This is the last component of encrypted tpm2 session handling that allows us to verify from userspace that the key derived from the NULL seed genuinely belongs to the TPM and has not been spoofed.
The procedure for doing this involves creating an attestation identity key (which requires verification of the TPM EK certificate) and then using that AIK to sign a certification of the Elliptic Curve key over the NULL seed. Userspace must create this EC Key using the parameters prescribed in TCG TPM v2.0 Provisioning Guidance for the SRK ECC; if this is done correctly the names will match and the TPM can then run a
TPM2_Certifyoperation on this derived primary key using the newly created AIK.Signed-off-by James Bottomley <[email protected]>--- drivers/char/tpm/tpm-sysfs.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+)drivers/char/tpm/tpm-sysfs.c +0
-0@@ -309,6 +309,21 @@ static ssize_t tpm_version_major_show(struct device *dev, }
drivers/char/tpm/tpm-sysfs.c static ssize_t tpm_version_major_show(struct device *dev, · line 319
Quoted 10 lines
drivers/char/tpm/tpm-sysfs.c +8
-0static DEVICE_ATTR_RO (tpm_version_major); +#ifdef CONFIG_TPM_BUS_SECURITY +static ssize_t null_name_show (struct device *dev,struct device_attribute *attr, +char *buf) +{ +struct tpm_chip *chip =to_tpm_chip (dev); +int size =TPM2_NAME_SIZE ; + +bin2hex (buf, chip->tpmkeyname, size);
"tpmkeyname" is not very descriptive name.
Why not chip->null_name?
Quoted 11 lines
drivers/char/tpm/tpm-sysfs.c +7
-0+ size *=2 ; + buf[size++] ='\n' ; +return size; +} +static DEVICE_ATTR_RO (null_name); +#endif +static struct attribute *tpm1_dev_attrs[] = { &dev_attr_pubek.attr, &dev_attr_pcrs.attr,
drivers/char/tpm/tpm-sysfs.c static struct attribute *tpm1_dev_attrs[] = { · line 349
Quoted 9 lines
drivers/char/tpm/tpm-sysfs.c +3
-0@@ -326,6 +341,9 @@ static struct attribute *tpm1_dev_attrs[] = {static struct attribute *tpm2_dev_attrs[] = { &dev_attr_tpm_version_major.attr, +#ifdef CONFIG_TPM_BUS_SECURITY + &dev_attr_null_name.attr, +#endifNULL };
I'm able to verify this in QEMU:
# cat /sys/class/tpm/tpm0/null_name 000b66ec5f9ad1fa46c01707c5a8e67745147695901310e80438ff8f1b66dcf84bf2
I used swtpm in tis mode.
It is not possible to give tested-by to earlier patches before there's some split to smaller pieces.
BR, Jarkko
Jarkko Sakkinen
maintainerRe: [PATCH v5 16/17] tpm: add the null key name as a sysfs export
In reply to James BottomleyQuoted 23 lines · James Bottomley
This is the last component of encrypted tpm2 session handling that allows us to verify from userspace that the key derived from the NULL seed genuinely belongs to the TPM and has not been spoofed.
The procedure for doing this involves creating an attestation identity key (which requires verification of the TPM EK certificate) and then using that AIK to sign a certification of the Elliptic Curve key over the NULL seed. Userspace must create this EC Key using the parameters prescribed in TCG TPM v2.0 Provisioning Guidance for the SRK ECC; if this is done correctly the names will match and the TPM can then run a
TPM2_Certifyoperation on this derived primary key using the newly created AIK.Signed-off-by James Bottomley <[email protected]>--- drivers/char/tpm/tpm-sysfs.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+)drivers/char/tpm/tpm-sysfs.c +0
-0
drivers/char/tpm/tpm-sysfs.c static ssize_t tpm_version_major_show(struct device *dev, · line 312
Quoted 4 lines
drivers/char/tpm/tpm-sysfs.c +1
-0@@ -309,6 +309,21 @@ static ssize_t tpm_version_major_show(struct device *dev, }static DEVICE_ATTR_RO (tpm_version_major); +#ifdef CONFIG_TPM_BUS_SECURITY
After considering options TCG_TPM2_HMAC would be both dead obvious, i.e. you cannot get it wrong and along the lines of existing config flags.
Quoted 18 lines
drivers/char/tpm/tpm-sysfs.c +14
-0+static ssize_t null_name_show (struct device *dev,struct device_attribute *attr, +char *buf) +{ +struct tpm_chip *chip =to_tpm_chip (dev); +int size =TPM2_NAME_SIZE ; + +bin2hex (buf, chip->tpmkeyname, size); + size *=2 ; + buf[size++] ='\n' ; +return size; +} +static DEVICE_ATTR_RO (null_name); +#endif +static struct attribute *tpm1_dev_attrs[] = { &dev_attr_pubek.attr, &dev_attr_pcrs.attr,
drivers/char/tpm/tpm-sysfs.c static struct attribute *tpm1_dev_attrs[] = { · line 349
Quoted 9 lines
drivers/char/tpm/tpm-sysfs.c +3
-0@@ -326,6 +341,9 @@ static struct attribute *tpm1_dev_attrs[] = {static struct attribute *tpm2_dev_attrs[] = { &dev_attr_tpm_version_major.attr, +#ifdef CONFIG_TPM_BUS_SECURITY + &dev_attr_null_name.attr, +#endifNULL };
Otherwise, LGTM
BR, Jarkko
James Bottomley
maintainerPATCH v5 17/17 Documentation: add tpm-security.rst
In reply to James BottomleyDocument how the new encrypted secure interface for TPM2 works and how security can be assured after boot by certifying the NULL seed.
--- Documentation/security/tpm/tpm-security.rst | 216 ++++++++++++++++++++ 1 file changed, 216 insertions(+) create mode 100644 Documentation/security/tpm/tpm-security.rst
Documentation/security/tpm/tpm-security.rst new file +216 -0
@@ -0,0 +1,216 @@ +.. SPDX-License-Identifier: GPL-2.0-only + +TPM Security +============ + +The object of this document is to describe how we make the kernel's +use of the TPM reasonably robust in the face of external snooping and +packet alteration attacks (called passive and active interposer attack +in the literature). The current security document is for TPM 2.0. + +Introduction +------------ + +The TPM is usually a discrete chip attached to a PC via some type of +low bandwidth bus. There are exceptions to this such as the Intel +PTT, which is a software TPM running inside a software environment +close to the CPU, which are subject to different attacks, but right at +the moment, most hardened security environments require a discrete +hardware TPM, which is the use case discussed here. + +Snooping and Alteration Attacks against the bus +----------------------------------------------- + +The current state of the art for snooping the `TPM Genie`_ hardware +interposer which is a simple external device that can be installed in +a couple of seconds on any system or laptop. Recently attacks were +successfully demonstrated against the `Windows Bitlocker TPM`_ system. +Most recently the same `attack against TPM based Linux disk +encryption`_ schemes. The next phase of research seems to be hacking +existing devices on the bus to act as interposers, so the fact that +the attacker requires physical access for a few seconds might +evaporate. However, the goal of this document is to protect TPM +secrets and integrity as far as we are able in this environment and to +try to insure that if we can't prevent the attack then at least we can +detect it. + +Unfortunately, most of the TPM functionality, including the hardware +reset capability can be controlled by an attacker who has access to +the bus, so we'll discuss some of the disruption possibilities below. + +Measurement (PCR) Integrity +--------------------------- + +Since the attacker can send their own commands to the TPM, they can +send arbitrary PCR extends and thus disrupt the measurement system, +which would be an annoying denial of service attack. However, there +are two, more serious, classes of attack aimed at entities sealed to +trust measurements. + +1. The attacker could intercept all PCR extends coming from the system + and completely substitute their own values, producing a replay of + an untampered state that would cause PCR measurements to attest to + a trusted state and release secrets + +2. At some point in time the attacker could reset the TPM, clearing + the PCRs and then send down their own measurements which would + effectively overwrite the boot time measurements the TPM has + already done. + +The first can be thwarted by always doing HMAC protection of the PCR +extend and read command meaning measurement values cannot be +substituted without producing a detectable HMAC failure in the +response. However, the second can only really be detected by relying +on some sort of mechanism for protection which would change over TPM +reset. + +Secrets Guarding +---------------- + +Certain information passing in and out of the TPM, such as key sealing +and private key import and random number generation, is vulnerable to +interception which HMAC protection alone cannot protect against, so +for these types of command we must also employ request and response +encryption to prevent the loss of secret information. + +Establishing Initial Trust with the TPM +--------------------------------------- + +In order to provide security from the beginning, an initial shared or +asymmetric secret must be established which must also be unknown to +the attacker. The most obvious avenues for this are the endorsement +and storage seeds, which can be used to derive asymmetric keys. +However, using these keys is difficult because the only way to pass +them into the kernel would be on the command line, which requires +extensive support in the boot system, and there's no guarantee that +either hierarchy would not have some type of authorization. + +The mechanism chosen for the Linux Kernel is to derive the primary +elliptic curve key from the null seed using the standard storage seed +parameters. The null seed has two advantages: firstly the hierarchy +physically cannot have an authorization, so we are always able to use +it and secondly, the null seed changes across TPM resets, meaning if +we establish trust on the null seed at start of day, all sessions +salted with the derived key will fail if the TPM is reset and the seed +changes. + +Obviously using the null seed without any other prior shared secrets, +we have to create and read the initial public key which could, of +course, be intercepted and substituted by the bus interposer. +However, the TPM has a key certification mechanism (using the EK +endorsement certificate, creating an attestation identity key and +certifying the null seed primary with that key) which is too complex +to run within the kernel, so we keep a copy of the null primary key +name, which is what is exported via sysfs so user-space can run the +full certification when it boots. The definitive guarantee here is +that if the null primary key certifies correctly, you know all your +TPM transactions since start of day were secure and if it doesn't, you +know there's an interposer on your system (and that any secret used +during boot may have been leaked). + +Stacking Trust +-------------- + +In the current null primary scenario, the TPM must be completely +cleared before handing it on to the next consumer. However the kernel +hands to user-space the name of the derived null seed key which can +then be verified by certification in user-space. Therefore, this chain +of name handoff can be used between the various boot components as +well (via an unspecified mechanism). For instance, grub could use the +null seed scheme for security and hand the name off to the kernel in +the boot area. The kernel could make its own derivation of the key +and the name and know definitively that if they differ from the handed +off version that tampering has occurred. Thus it becomes possible to +chain arbitrary boot components together (UEFI to grub to kernel) via +the name handoff provided each successive component knows how to +collect the name and verifies it against its derived key. + +Session Properties +------------------ + +All TPM commands the kernel uses allow sessions. HMAC sessions may be +used to check the integrity of requests and responses and decrypt and +encrypt flags may be used to shield parameters and responses. The +HMAC and encryption keys are usually derived from the shared +authorization secret, but for a lot of kernel operations that is well +known (and usually empty). Thus, every HMAC session used by the +kernel must be created using the null primary key as the salt key +which thus provides a cryptographic input into the session key +derivation. Thus, the kernel creates the null primary key once (as a +volatile TPM handle) and keeps it around in a saved context stored in +tpm_chip for every in-kernel use of the TPM. Currently, because of a +lack of de-gapping in the in-kernel resource manager, the session must +be created and destroyed for each operation, but, in future, a single +session may also be reused for the in-kernel HMAC, encryption and +decryption sessions. + +Protection Types +---------------- + +For every in-kernel operation we use null primary salted HMAC to +protect the integrity. Additionally, we use parameter encryption to +protect key sealing and parameter decryption to protect key unsealing +and random number generation. + +Null Primary Key Certification in Userspace +=========================================== + +Every TPM comes shipped with a couple of X.509 certificates for the +primary endorsement key. This document assumes that the Elliptic +Curve version of the certificate exists at 01C00002, but will work +equally well with the RSA certificate (at 01C00001). + +The first step in the certification is primary creation using the +template from the `TCG EK Credential Profile`_ which allows comparison +of the generated primary key against the one in the certificate (the +public key must match). Note that generation of the EK primary +requires the EK hierarchy password, but a pre-generated version of the +EC primary should exist at 81010002 and a TPM2_ReadPublic() may be +performed on this without needing the key authority. Next, the +certificate itself must be verified to chain back to the manufacturer +root (which should be published on the manufacturer website). Once +this is done, an attestation key (AK) is generated within the TPM and +it's name and the EK public key can be used to encrypt a secret using +TPM2_MakeCredential. The TPM then runs TPM2_ActivateCredential which +will only recover the secret if the binding between the TPM, the EK +and the AK is true. the generated AK may now be used to run a +certification of the null primary key whose name the kernel has +exported. Since TPM2_MakeCredential/ActivateCredential are somewhat +complicated, a more simplified process involving an externally +generated private key is described below. + +This process is a simplified abbreviation of the usual privacy CA +based attestation process. The assumption here is that the +attestation is done by the TPM owner who thus has access to only the +owner hierarchy. The owner creates an external public/private key +pair (assume elliptic curve in this case) and wraps the private key +for import using an inner wrapping process and parented to the EC +derived storage primary. The TPM2_Import() is done using a parameter +decryption HMAC session salted to the EK primary (which also does not +require the EK key authority) meaning that the inner wrapping key is +the encrypted parameter and thus the TPM will not be able to perform +the import unless is possesses the certified EK so if the command +succeeds and the HMAC verifies on return we know we have a loadable +copy of the private key only for the certified TPM. This key is now +loaded into the TPM and the Storage primary flushed (to free up space +for the null key generation). + +The null EC primary is now generated using the Storage profile +outlined in the `TCG TPM v2.0 Provisioning Guidance`_; the name of +this key (the hash of the public area) is computed and compared to the +null seed name presented by the kernel in +/sys/class/tpm/tpm0/null_name. If the names do not match, the TPM is +compromised. If the names match, the user performs a TPM2_Certify() +using the null primary as the object handle and the loaded private key +as the sign handle and providing randomized qualifying data. The +signature of the returned certifyInfo is verified against the public +part of the loaded private key and the qualifying data checked to +prevent replay. If all of these tests pass, the user is now assured +that TPM integrity and privacy was preserved across the entire boot +sequence of this kernel. + +.. _TPM Genie: https://www.nccgroup.trust/globalassets/about-us/us/documents/tpm-genie.pdf +.. _Windows Bitlocker TPM: https://dolosgroup.io/blog/2021/7/9/from-stolen-laptop-to-inside-the-company-network +.. _attack against TPM based Linux disk encryption: https://www.secura.com/blog/tpm-sniffing-attacks-against-non-bitlocker-targets +.. _TCG EK Credential Profile: https://trustedcomputinggroup.org/resource/tcg-ek-credential-profile-for-tpm-family-2-0/ +.. _TCG TPM v2.0 Provisioning Guidance: https://trustedcomputinggroup.org/resource/tcg-tpm-v2-0-provisioning-guidance/
Signature · 1 line
2.35.3