Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Remote Attestation

liamcvw.com

Post reply on HN
Print view View original

81–90 of 113 posts

Re: Remote Attestation

#81

Post by lachiflippi »

madduci wrote: post #59

The German Healthcare System is moving to the TelematikInfrastruktur 2.0, which has foundations in Zero Trust security, which includes also remote attestation and proof with TPM. I had made a dummy client as example and I must say that on development perspectives, it is wild. There are some Go libraries, which support only RSA instead of EC for TPM Keys, on the C++ side you get most of results in Windows through the…

> you get most of results in Windows through the CryptoProvider

Isn't that what you want on that platform? ADCS even supports issuing remote-attested TPM certs via EK, no need to reinvent the wheel.

> on Linux and Mac exists own OS solutions/access.

I'm not sure what the story is on MacOS, but on Linux the options are definitely lacking. From what I can tell, tpm2-openssl is the most mature solution, but that doesn't support binding to PCRs at all, and validating EK signatures on the server side is left as an exercise to the reader.

> Implementing it isn't trivial at all, otherwise you would already seen (not vibe-coded) open source implementions spawning on GitHub.

If I had to guess, I'd say another issue is that TPM remote attestation is seen as an "enterprise" feature. Open source projects like smallstep support it, but only via their paid enterprise offerings.

Re: Remote Attestation

#82

Post by mike_hearn »

whiatp wrote: post #72
crote wrote: post #67

Earlier quoted context omitted.

Don't most (all?) modern CPUs have an embedded TPM? Plug-in TPMs were indeed a thing early on, but I thought that was a thing of the past by now. You can't exactly get in between the CPU and another part of the same CPU. Also, isn't the EK (and therefore its cert) unique per-device, allowing you to tell it apart? The fact that the manufacturer used the same upstream key to sign both certs doesn't matter, just like a…

Yeah, if the CPU has a an embedded TPM that would be way better than the external ones. I'll admit that my experience comes from somewhat dated hardware. The point I was making was about registering new EKs/certs into your set of trusted servers. While you can tell the TPMs apart from each other, knowing the EK/cert belongs to your hardware's TPM vs someone else's is the tricky part.

TPMs were moved into the Northbridge (I think) many years ago, at least on Intel systems.

PC hardware still isn't tamper resistant though. Memory may be encrypted but its contents can be tampered with in other ways. Only SGX made a serious attempt to be tamper resistant, although Intel eventually sacrificed that to boost performance.

Re: Remote Attestation

#83

Post by zb3 »

what wrote: post #35
zb3 wrote: post #12

Earlier quoted context omitted.

Out of curiosity, do you like ads? I assume you don't.. so how would you react if Apple followed Google and prohibited ad blocking apps + removed that capability from web browsers? I'd not be able to put up with that, but more importantly, I'd not want to be in the position where I can't even protest anything because there's no alternative to switch to..

When did google prohibit ad blocking in their browser?

The moment they decided not to add extension support to their mobile browser.

I'm not talking about desktop because this is not where remote attestation is used by them.

Re: Remote Attestation

#84

Post by zb3 »

jeroenhd wrote: post #68
zb3 wrote: post #2

It would be a nice addition if big tech didn't abuse this to shove user-hostile software into devices which the user has paid for (like smartphones).. thanks to this attitude, whenever I see "remote attestation" I associate this with "hostile".. > Using a TPM, we can remotely, cryptographically prove a couple of things: Unless there are exploits..

The user is choosing to use apps that do remote attestation against the user's will. You can live a perfectly normal life without apps. It's quite annoying that I can't watch full-quality Netflix or use Google Pay on my rooted smartphone, but I'll survive. TPM's, just like Secure Boot for that matter, can be an amazing security boon if used right. The APIs have been there for ages but only companies like Apple, Googl…

> You can live a perfectly normal life without apps.

This is getting outdated extremely fast.. Have you heard about at least:

- banking apps being required to do transfers (web login is "insecure")

- government apps in Italy/Brazil enforcing Play Integrity?

- EUDI/age verification, where even EU apps are enforcing Play Integrity?

Re: Remote Attestation

#87

Post by mapkkk »

whiatp wrote: post #61

Something worth calling out is that, as far as I've seen, most server TPM implementations are not great against physical access attacks. If servers might be physically compromised (eg. you are leaving a server unsupervised in a colo) shenanigans are still possible. The TPMs are on separate chips from the main processor. If something were to man-in-the-middle the communications with the TPM, the hash digests can be "c…

There's support for encrypted communication with TPMs, but if I remember correctly this is almost never enabled by default.

Re: Remote Attestation

#88

Post by jcgl »

lachiflippi wrote: post #81
madduci wrote: post #59

The German Healthcare System is moving to the TelematikInfrastruktur 2.0, which has foundations in Zero Trust security, which includes also remote attestation and proof with TPM. I had made a dummy client as example and I must say that on development perspectives, it is wild. There are some Go libraries, which support only RSA instead of EC for TPM Keys, on the C++ side you get most of results in Windows through the…

> you get most of results in Windows through the CryptoProvider Isn't that what you want on that platform? ADCS even supports issuing remote-attested TPM certs via EK, no need to reinvent the wheel. > on Linux and Mac exists own OS solutions/access. I'm not sure what the story is on MacOS, but on Linux the options are definitely lacking. From what I can tell, tpm2-openssl is the most mature solution, but that doesn't…

> Isn't that what you want on that platform? ADCS even supports issuing remote-attested TPM certs via EK, no need to reinvent the wheel.

This is really cool. Did not know about it: https://learn.microsoft.com/en-us/windows-server/identity/ad...

Re: Remote Attestation

#89

Post by Gigachad »

realusername wrote: post #71
Gigachad wrote: post #20

Earlier quoted context omitted.

The iPhone is actually working really well. There has never been a widespread malware attack on the iphone. Only highly targeted attacks on individuals. And Apple even has an answer for this as well with Lockdown mode which renders all of those previous exploits impossible. There's also Memory Integrity Enforcement on the iPhone 17 chips which makes all memory exploits detectable by the OS so it can trigger a reboot…

> There has never been a widespread malware attack on the iphone I had a calendar malware that I had to remove from my sister's iphone just last year. There's been also (and still exists) fake apps pushed with appstore ads, not sure if you count this or not.

By malware I meant something that broke the sandbox and gained deep access to the system. Ad ware and slop is a problem and I guess could count under the malware umbrella but it’s much less worrying than an exploit being able to read data from other apps.

Re: Remote Attestation

#90

Post by gspr »

solenoid0937 wrote: post #49
gspr wrote: post #44

Earlier quoted context omitted.

> (Make claim that something is "critical".) > (Get challenged on that.) > omg you don't know anything, being without the thing is primitive and everyone sophisticated uses it. You can see how you can be accused of not actually presenting any arguments here, right? If you're gonna appeal to authority, at least back that appeal up with something .

My comment is fine. Appeals to authority are not inherently bad when the person doesn't know what they're talking about. Again, your doctor is more of an authority than you on medicine. It'd be hubris to think you'd understand the field better, no matter how smart you are. It's not my job to write an essay in the comments about why mutual authn with RA is desirable in corporate networks, and why the complaints about…

> Again, your doctor is more of an authority than you on medicine. It'd be hubris to think you'd understand the field better, no matter how smart you are.

You are talking to strangers on the internet. When I go see my doctor, I initiate a conversation with a certified professional subjected to serious state scrutiny. I'd indeed do well to take their medical advice to heart. Nothing similar applies to reading your comments.

Moreover, part of the reason that I do trust the doctor is that I know that their claims can be challenged and that the claims will withstand that challenge (this is in part ensured by certification and regulatory bodies, and in part by the medical community). You seem not to want to respond to such a challenge.

Here's another doctor-based analogy: Suppose my doctor suggests I suffer from a specific medical condition. Even though I know that they are the professional, it wouldn't be insane for me to voice a concern I have that the condition does not seem to fit what I'm experiencing. That's not even really a challenge to their authority – it might just be a way for me to try to understand. Now, if the doctor responds to that concern by angrily tapping his diploma saying "you know nothing, I'm the professional, bow before me you moron!", I think I'd be wise to change doctors.

Post reply on HN