Secure Data Encryption on board without TPM support ( AM62P)
Dear CIP Development Team,
I am currently working on enabling encrypted storage for the TI's AM62P platform, which, as per current hardware capabilities, does not include TPM support.
To address this, I have implemented a working initramfs-crypt-hook-nontpm (link provided at the end) solution that removes TPM dependencies. It utilizes a keyfile embedded directly into the initramfs for unlocking encrypted partitions during boot. The initramfs itself is considered secure as it is protected by verified boot (Secure Boot is enabled on the platform).
I would like to know if this is an acceptable and secure approach from the CIP security perspective for boards without TPM support. Additionally, are there any recommended alternatives or best practices for strengthening this method in scenarios where TPM support is not available?
Looking forward to your guidance.
Patch for
initramfs-crypt-hook-nontpm
recipes-initramfs/initramfs-crypt-hook-nontpm * main * 22CSB0C01_AYUSH GUPTA / am62x-security-features * GitLab<https://gitlab.com/ag22csb0c01/am62x-security-features/-/tree/main/recipes-initramfs/initramfs-crypt-hook-nontpm?ref_type=heads>
Best regards,
Ayush Gupta
Texas Instruments
Hi Ayush,
Quoted 9 lines · Ayush via lists.cip- project.org
Dear CIP Development Team,
I am currently working on enabling encrypted storage for the TI’s AM62P platform, which, as per current hardware capabilities, does not include TPM support.
Quoted 6 lines
To address this, I have implemented a working initramfs-crypt-hook- nontpm (link provided at the end) solution that removes TPM dependencies. It utilizes a keyfile embedded directly into the initramfs for unlocking encrypted partitions during boot. The initramfs itself is considered secure as it is protected by verified boot (Secure Boot is enabled on the platform).
Since the initramfs itself is not encrypted, anyone who has access to the storage device containing the initramfs (or UKI, ...) can extract the keyfile, and thus, can decrypt your partitions.
Quoted 6 lines
I would like to know if this is an acceptable and secure approach from the CIP security perspective for boards without TPM support. Additionally, are there any recommended alternatives or best practices for strengthening this method in scenarios where TPM support is not available?
If you need security for devices without TPM you either need a third party device to store the key (or an encrypted version of the key) securely (e.g. HSM) or you need some (human) interaction on boot. Storing the key on the device does not provide the protection you intended to have.
Quoted 8 lines
Looking forward to your guidance.
Patch for
initramfs-crypt-hook-nontpm recipes-initramfs/initramfs-crypt-hook-nontpm · main · 22CSB0C01_AYUSH GUPTA / am62x-security-features · GitLab
Please post patches using git format-patch and git send-email as proposed here [1]
BR Alexander
Quoted 6 lines
Best regards,
Ayush Gupta
Texas Instruments
Quoted 11 lines
-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group. View/Reply Online (#18961):
https://lists.cip-project.org/g/cip-dev/message/18961
Mute This Topic: https://lists.cip-project.org/mt/113433531/8886423
Group Owner: [email protected] Unsubscribe:
https://lists.cip-project.org/g/cip-dev/unsub [[email protected]
]
-=-=-=-=-=-=-=-=-=-=-=-
[1]:
https://gitlab.com/cip-project/cip-core/isar-cip-core/-/blob/master/CONTRIBUTING.md?ref_type=heads
Hi Ayush,
Quoted 6 lines · Ayush
Dear CIP Development Team,
I am currently working on enabling encrypted storage for the TI’s AM62P platform, which, as per current hardware capabilities, does not include TPM support.
Quoted 6 lines
To address this, I have implemented a working initramfs-crypt-hook- nontpm (link provided at the end) solution that removes TPM dependencies. It utilizes a keyfile embedded directly into the initramfs for unlocking encrypted partitions during boot. The initramfs itself is considered secure as it is protected by verified boot (Secure Boot is enabled on the platform).
That should be integrity protected but no longer secret, no? Physical attackers should then be able to retrieve the initramfs from the device and, thus, also read out the data encryption key. From there on...
Quoted 9 lines
I would like to know if this is an acceptable and secure approach from the CIP security perspective for boards without TPM support. Additionally, are there any recommended alternatives or best practices for strengthening this method in scenarios where TPM support is not available?
Looking forward to your guidance.
Did you already study how we are exploiting fTPM on the AM65x?
https://github.com/siemens/meta-iot2050/
Jan
Signature · 2 lines
Siemens AG, Foundational Technologies Linux Expert Center
Quoted 16 lines · Jan Kiszka
Hi Ayush,
Quoted 6 lines · Ayush
Dear CIP Development Team,
I am currently working on enabling encrypted storage for the TI’s AM62P platform, which, as per current hardware capabilities, does not include TPM support.
Quoted 6 lines
To address this, I have implemented a working initramfs-crypt-hook- nontpm (link provided at the end) solution that removes TPM dependencies. It utilizes a keyfile embedded directly into the initramfs for unlocking encrypted partitions during boot. The initramfs itself is considered secure as it is protected by verified boot (Secure Boot is enabled on the platform).
Quoted 3 lines
That should be integrity protected but no longer secret, no? Physical attackers should then be able to retrieve the initramfs from the device and, thus, also read out the data encryption key. From there on...
You are absolutely right- the keyfile can be extracted by a physical attackers as it is not encrypted. We should find a more secure key. Thanks for highlighting the issue.
Quoted 7 lines
Quoted 7 lines
I would like to know if this is an acceptable and secure approach from the CIP security perspective for boards without TPM support. Additionally, are there any recommended alternatives or best practices for strengthening this method in scenarios where TPM support is not available?
Quoted 8 lines
Quoted 2 lines
Looking forward to your guidance.
Did you already study how we are exploiting fTPM on the AM65x?
https://github.com/siemens/meta-iot2050/Jan
Not explored this fully - but will check this out also. Me and the team are also trying something more on that. We will reach out to you if we need any further clarifications.
Again thanks for suggesting this repo!
Ayush