TPM–Fail: TPM Meets Timing and Lattice Attacks

Post by [deleted] » Wed, Nov 13, 2019, 4:06 PM UTC

devnullbyte wrote: post #27

nosuchgroup wrote: post #25

The PoC mentioned in the ZDNet article ( https://www.zdnet.com/article/tpm-fail-vulnerabilities-impac... ) seems to be out... https://github.com/VernamGroup/TPM-Fail/

That code is nonsense. It's a perl script that messes around with cowsay and does not make a single tpm command.

Post by wolf550e » Thu, Nov 14, 2019, 8:41 PM UTC

devnullbyte wrote: post #26

xyzzyz wrote: post #15

Earlier quoted context omitted.

If you look at IBM's TPM 2.0 implementation[1], you can see that they don't use any well tested libraries for crypto primitives, but rather uses what looks like home-cooked crypto implementation. Microsoft, on the other hand, seems to support OpenSSL and wolfSSL in their simulator[2]. [1] - http://ibmswtpm.sourceforge.net/ibmswtpm2.html [2] - https://github.com/microsoft/ms-tpm-20-ref

The researchers used the intel tpm2-tss stack.