Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

TPM–Fail: TPM Meets Timing and Lattice Attacks

tpm.fail

Post reply on HN
Print view View original

21–30 of 33 posts

Re: TPM–Fail: TPM Meets Timing and Lattice Attacks

#21

Post by xyzzyz »

matthewaveryusa wrote: post #17
xyzzyz wrote: post #15

Earlier quoted context omitted.

If you look at IBM's TPM 2.0 implementation[1], you can see that they don't use any well tested libraries for crypto primitives, but rather uses what looks like home-cooked crypto implementation. Microsoft, on the other hand, seems to support OpenSSL and wolfSSL in their simulator[2]. [1] - http://ibmswtpm.sourceforge.net/ibmswtpm2.html [2] - https://github.com/microsoft/ms-tpm-20-ref

IBM's implementation is really scary. I read through the codebase and my WTF meter went through the roof. It looks like the codebase of some evil genius that invented a world of coding practices of his own.

You’ll find it interesting then that this codebase is mostly consisting of reference implementation. These WTF practices are straight from TPM 2.0 standard. See https://trustedcomputinggroup.org/wp-content/uploads/TPM-Rev...

Re: TPM–Fail: TPM Meets Timing and Lattice Attacks

#22

Post by xyzzyz »

wolf550e wrote: post #16
xyzzyz wrote: post #15

Earlier quoted context omitted.

If you look at IBM's TPM 2.0 implementation[1], you can see that they don't use any well tested libraries for crypto primitives, but rather uses what looks like home-cooked crypto implementation. Microsoft, on the other hand, seems to support OpenSSL and wolfSSL in their simulator[2]. [1] - http://ibmswtpm.sourceforge.net/ibmswtpm2.html [2] - https://github.com/microsoft/ms-tpm-20-ref

You're not supposed to use the IBM TPM emulator for anything except developing software that talks to a real TPM without using a real TPM.

Sure, but what exactly do you think real TPM manufacturers are putting inside them? They must run some crypto code, do you think they won’t just reuse IBMs emulator? Or that they will come up with something more secure?

Re: TPM–Fail: TPM Meets Timing and Lattice Attacks

#23

Post by wolf550e »

xyzzyz wrote: post #22
wolf550e wrote: post #16

Earlier quoted context omitted.

You're not supposed to use the IBM TPM emulator for anything except developing software that talks to a real TPM without using a real TPM.

Sure, but what exactly do you think real TPM manufacturers are putting inside them? They must run some crypto code, do you think they won’t just reuse IBMs emulator? Or that they will come up with something more secure?

I hope that's what happens, yes.

Re: TPM–Fail: TPM Meets Timing and Lattice Attacks

#26

Post by devnullbyte »

xyzzyz wrote: post #15
locacorten wrote: post #10

I have not read the paper, and I could be wrong. However, these appear to be attacks against the crypto implemented inside a TPM/fTPM. The reference implementation of TPM 2.0 leaves the choice of the crypto library up to the platform vendor. If my suspicions are correct, it sounds like some of the platform vendors decided to use crypto libraries vulnerable to timing attacks. Hmmm...

If you look at IBM's TPM 2.0 implementation[1], you can see that they don't use any well tested libraries for crypto primitives, but rather uses what looks like home-cooked crypto implementation. Microsoft, on the other hand, seems to support OpenSSL and wolfSSL in their simulator[2]. [1] - http://ibmswtpm.sourceforge.net/ibmswtpm2.html [2] - https://github.com/microsoft/ms-tpm-20-ref

The researchers used the intel tpm2-tss stack.

Re: TPM–Fail: TPM Meets Timing and Lattice Attacks

#27

Post by devnullbyte »

nosuchgroup wrote: post #25

The PoC mentioned in the ZDNet article ( https://www.zdnet.com/article/tpm-fail-vulnerabilities-impac... ) seems to be out... https://github.com/VernamGroup/TPM-Fail/

That code is nonsense. It's a perl script that messes around with cowsay and does not make a single tpm command.

Re: TPM–Fail: TPM Meets Timing and Lattice Attacks

#29

Post by brohee »

rocqua wrote: post #24

Are there many uses of signing with a TPM on consumer hardware? I can see the issue with servers, but not much else.

https://docs.microsoft.com/en-us/windows/security/informatio...

It's used to store th private key of user certificates, but those are PIN protected presumably. But a key that isn't supposed to be extractible may well be so.

Post reply on HN