Dear viewer, these subtitles were generated by a machine via the service Trint and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/1329 Thanks!
Talk is hacking with
TPM.
Don't ask what you can do for.
Ms. Ask for the TPM can do
for you.
And it's a kind of introduction
into TPM and what you can do with it.
And your guest
host is under.
Yes.
And here he is.
Give a big applause, please.
Thanks.
Hi, everyone.
Simon Dress.
I'll be presenting some stuff on TPM.
Does my guitar handle and also my getup
namespace. We can find
some of the stuff or see what I'm working
on. And the most
important resource for everything I'm
talking about is this wobbling.
But you're going to see it in the conclusions
at the end again.
So who am I?
Some disclosure.
I'm actually working on TPM.
I'm being paid to work on TPM or
I found someone willing to pay me to work
on this stuff.
And I'm also a member of the Trusted
Computing Group, this industry
consortium, doing all the specification
stuff.
However, I started
working with TPM about like 13
years ago when I was the one point two
times. At that point, I was
trying to get things working for me.
And it didn't work out too
nice because the software was kind of,
you know, not too well maintained and
the API was some kinds of a little
hideous to work with.
And so about five years ago, when
the and while the the
call for participants for working on it,
he has us to came up.
I well basically jumped
into the rabbit hole right away of
what specification writing,
negotiating and what not.
And TCG and also implementing this stuff
and maintaining the stuff on GitHub later
on becomes and
the results of this endeavor want to
present to you.
So I'm gonna go through some some
very minimal introductions to what teams
are and then we're going to
jump right in to those two topics
of credential protection and
some some early boot protections.
And then just some minor information on
how you can get started.
Work on this yourself.
And here comes the fun part.
So for your amusement and my
personal adrenaline rush at
late at night, I opted to go for
some live demos.
So what I'm gonna be doing is I'll be
going ahead and copying all this stuff,
switching over into my trusted worth
virtual machine here.
And of course, it doesn't work right
away. So.
Yeah, I should have unlocked sudo first.
Yeah. So I'll be doing some live demos
every now and then.
Please don't dust the Wi-Fi
here. Otherwise, the presentation will.
Get to a halt very quickly, okay.
What are TPM?
TPM is basically a security chip that
soldered onto your main board.
And thanks to Microsoft
for giving TPM to mostly all of us
basically for cheap, because
thanks to the Microsoft logo program,
every consumer, laptop, desktop, whatever
nowadays has a TPM more
or less. So
why not make use of them?
They are pretty high security
security chips, I would say.
There's like some assurance from come
criteria certification which you can
trust must not trust me
trust.
But every evidence counts, I guess.
Of course there was some some TPM
that failed.
And
Tanya and David just talked
about it about two hours ago or three
hours ago. So it was very interesting.
And what it's capable of.
It's capable of doing crypto, which
is what we're going to be talking about.
It's capable of doing some storage
and it's capable of recording booth hash
values.
And that's basically all it can do.
So it's a completely passive device.
That's the most important part here.
And on the right hand side, there you see
some old one point two versions of a TPM.
Nowadays, the CHIP package is actually a
lot smaller.
Our TPM is dangerous.
I think we've hurt talks in the past
at the Congress
for both arguing for both sides.
Keep Dems reputation.
When it first got into the market, was
this. These are these nasty evil
DRM devices.
They're going to remote control our
pieces.
As I said, they are completely passive.
And what type games are in reality?
First of all, they are an embedded
smartcard.
So you have some kind of secure element
in your P.C.
that you can leverage.
And then there is this whole integrity
reporting and attestation capabilities
that go a little more into detail
on later.
But don't just take my word for
it. Take Richard Stallman
or Kanu for new foundations, word for it,
because they concluded that the
trusted platform module available for PCs
is not dangerous and there is no reason
not to include one in a computer or
support in your system software.
So I would call that
Stallman approved and
therefore why
not just go ahead and use it?
Right. But let's get into
the meat of it.
Credential protection.
Who in here is using public
key cryptography in one way or another?
And yeah, I'm basically expecting all
hands to raise.
Who is using a smart card or a you'll
be key or a TPM to predict their
credentials?
Okay.
And who is optimized this process
by just leaving the smart card in there
or cutting parts of the smart card
out and wrapping this with taser
or using a unique nano?
Okay. Those are only very few
for you, few.
Basically, this is the same
assurance level of the day that the TPM
is gonna give you as well.
And for others.
Well, smart cards.
You can use the TPM instead to be more
convenient.
All of you who are not using smart cards
but public key crypto.
You should maybe consider using a TPM
because you've got one already and you're
paid for it. So why not use it?
All right. What's the security
idea of predicting credentials
that comes with smart cards?
A.P. Ms.
Similarly.
Basically, we want a.
Divide down or authentication
approach or authentication
guarantees into a proof of possession
and approve of knowledge.
So we have two factors that are
required or requested from us in
order to authenticate the
proof of knowledge is pretty
straightforward. It's entering a
password, entering a pin to unlock us my
card, what not.
And the proof of possession is the.
The second factor.
Well, what does this actually mean?
Well, what you need in order to
create a proof of possession is you need
something that does not duplicate all or
not colonial.
So that's the primary feature of what the
smartcard gives you.
What, for example, a soft
token or a public key
hanging around on your own?
Your heart just doesn't give you
because you can just see it.
Software, a
soft token file and bring
it to a different computer and have it
run simultaneously on multiple computers.
So by having something that's
non duplicate, will you
have something that can be in the
possession of only one person at a single
time and therefore you gain this
extra security and this
becomes especially important on every
kind of hacker. Congress luck here
or black hat or what not?
Because people around those conferences
seem to be very good at recording
passwords from looking at you typing them
into a keyboard.
So this is definitely
a good argument to have the second
factor.
So the proof of possession can,
which is usually I like your smart card
or your UBC Nano can
be basically translated
into, well, we have a proof of possession
of my laptop that contains a TPM.
So only if somebody has access to this
laptop and knowledge of the pin.
Those two factors allow them to
authenticate in my name or in
the name of this credential.
Typically the question is, but what if
you're hacked? Well, this is a problem
for every kind of proof of possession
means it's the same.
If you have a smartcard in
your and your smart card reader slot
for the time that somebody
is able to control your system.
They are able to more or less
use your credential as well.
But there's two differences.
It's temporally bound to the
amount of time that your hacked.
So if you clean up your system, you can
continue working normally again
afterwards.
And there's the second thing
there is no chance for an attack such as
Heartbleed, where people would
because not every not every exploit
is capable of gaining like full
privileges. Sometimes exploits like
Heartbleed are only able to dump certain
memory pages out where
maybe your key was living and then
you're screwed.
You don't have that problem is the key is
not known to the computer, to
the CPE you never stored in RAM or on
disk.
All right, demo time.
How can you actually implement or
how can you make use of these credential
protections?
The simplest way to do so is with
the TPM to TSX
engine
from the TPM to software project.
I probably should have mentioned that
here. So that was
one of the softwares that
we installed earlier.
And actually, they did install.
That's very nice.
All right.
In order to use that,
all you need is these, I don't
know, three commands.
And therefore, I just want to show them
to you real quick, by the way.
No.
I'm not using a TPM simulator, I just
wanted to show that I'm using an actual
hardware TPM.
I just forwarded it to the retro machine
for fun and glory.
All right.
Virtual desktops, twittering.
All right.
So what we're going to do first is
we are realizing
now it's working.
We are generating a key using that for
the TPM and
the next command is then we're gonna
generate a self signed certificate.
And as you can see, for those of you
who've worked with open houses in the
past, the first command is a custom
command of the software.
The second command is just a regular open
SSL. Create a self signed certificate
command with some mentioning
of the engine and mentioning that we have
a key form that comes
from the engine and that's basically it.
So we're gonna go ahead and take that
posted in here as well.
Now with from Austria.
Now what?
Who cares?
All right.
And now we have curl,
and Curl is actually capable
of
connecting us.
Well, come on.
I should have brought a mouse.
So Curl is capable of
making use of to
open us all engines and
don't get irritated
by the dash dash insecure gear that
I'm running a an engine server
right now on the host system
from the virtual machine.
Now I'm using Curl to authenticate
using client certificate
authentication.
We are told us and I guess everybody
knows what that means to talk to
the engine.
And as you can see is
the website.
And first time I execute
the command, I couldn't quite believe it
because it was so fast and I thought
I made a mistake or something.
So just to verify to all
of you,
I'll be enabling trace logging.
And then we see that we have a bunch of
communication happening with a TPM.
So we actually are using the TPM
to do client side authentication to the
server.
Thanks.
Next thing.
So this is what so first of all, why I'm
doing this. I'm, of course, doing this to
scratch my own interests.
So I want to be using
TPM as at home maybe for
like simple bash script based
stuff.
And whenever you're doing a bash script,
you don't want to put your passwords in
there, because when you push them to get
up, other people will download them and
use your passwords.
Yes. So that's
another advantage of these.
And the second thing I want to be doing
at home. I have some Web server facing
the Internet. That's basically a reverse
proxy on engine X that forwards
stuff to almost distant and auto print
and whatnot.
And I want to enable this
thing to store its credentials
safely and securely as well.
So the next and the next half, it doesn't
ruin everything for me.
And for engine
X, it's actually pretty simple to do
that.
If we look unto these sides enabled
here, it's basically just the
default side.
We see that we had to post in
the US a certificate under the SS
certificate key.
You can use this keyword engine.
So hopefully you never stole your key and
a file called Engine because that's gonna
be a problem.
And we point to the TPM Twitty as
s engine.
And because of some hideous
bug in engine
X that people on the Engine X forum have
been talking about but
didn't find a good solution to fix it.
We also have to specify the engine a
second time over here.
So once we have all of that, we can
just.
Restart.
We can just restart engine X
and this time we're gonna turn it around,
so I'm gonna go ahead and take
my trust to a Web server
on the host system.
Try to connect to that thing
and.
Yeah. Because it's a service and
certificate, of course.
We don't trust you right away.
But we just used the
TPM in order to authenticate that here.
That's connection from the server side as
well. So we've both sites that we can now
start scripting.
Go.
All right, so that's the
easiest way to get started when you're
trying to integrate PMS into any of your
daily bash routines or whatnot.
The next a little more complex
way to do things is peak.
AC is eleven. So Peak AC is 11.
Is this standardized API by
the open group?
That
is what Firefox uses in order to talk
to smart cards, for example.
And of course, we're also working
on or the this
like this community is also working on
something for that.
We even have a maintainer sitting here in
the room
calling you out there.
All right. And we're currently in the
wondered oh, our C zero face
for this thing, which is also the reason
why there is some
weirdness that this is the setup
tools don't install whenever
you call, make, install.
So if you're trying to, like rerun this
stuff from home based
on these slides, note that this
is a path into the checked
out. Good repository for the TPM
to Pete tool.
And the only thing that actually gets
installed is the library that Pixie
has. Eleven libraries that's later on
used.
So anyways, we're taking these few
commands here.
And basically what we're doing is we're
initializing first of all, we're setting
some python past stuff and stuff like
that.
We're pointing to storing the
database under and under home.
We're initializing the database adding
a token which is basically creating a new
smart card out of nothing.
And then we're adding a key.
All right.
Let's see, is that running as well?
Looks good.
And there we have it.
We just generated the smartcard with this
random what not smart card idea
that you don't really have to care about.
Well, what the cool thing is about this
and why while I'm actually going into
this problem as I want to use that in
order to authenticate the SS H
because I don't know how many of
you are using SS H client
authentication using public keys.
That's basically almost everyone.
That's cool.
Heck, Congress.
So.
And who of you is not protecting
their key with a password, but using
an empty password for that?
All right. For all of you, this might be
interesting.
So we're gonna do is we're gonna call S
H Ki Jen and what is, uh, what
is going to be doing is it's gonna
just
generate an S H key and you're probably
all seeing this.
So I'm going ahead and copying
this and going
into my host machine.
And here I'm gonna
edit the authorized keys and
I'll add this key.
That's all.
And going back to the virtual machine.
Oh yeah.
Virtual desktop inside of a virtual
desktop.
I put on my right.
All right. And then we can log in using
as H.
And
this should also be working now.
And here we asked for the pin for the
smart card that I originally called
label, which probably can find
a better name for that.
And now I'm in.
So it's working as well.
But to make things even cooler,
what else do we use as a stage for?
Well, we use it, or at least I use
it.
Forget get together with SDH.
So we'll go ahead, take
this key again and
we're gonna head over to get up.
And this is my GitHub account.
Now it gets interesting.
So I'm adding this as a turkey.
And yes, I'm storing passwords.
They don't have climbed out and declined
cert authentication with us for that.
So the thing we're doing here is
basically I'm creating this
awesome Shell script that contains off an
SS agent location with the.
It's eleven library and
then we're exporting that under the get
on those classes each environment
variable, which means that instead of
this h
get just gonna be calling our new
H thing.
And this then translates to the
two invoking the P cases eleven
provider.
So
let's go ahead and clone.
And here we have the TPM
invocation again.
And a lot more TPM and vacation.
And we are.
And we can now even go ahead
and check out the brand.
I think I've used this in my tests.
I'm just gonna call it
now.
No.
Of course.
Check out the new branch.
Good. Push origin.
And it's pushed and you can just go
ahead. Go to my namespace on GitHub and
you should be seeing this awesome TPM
authenticated brand push over there.
All right.
As I said, this is RC 0.
Hopefully there's gonna be a few hiccups
and bugs that we're gonna fix before the
final release, but
looks kind of usable, I would say.
All right. Coming to the next thing,
which is highly work in progress.
So basically this
is about bit locker for Linux.
And I've written this.
I don't know. I think more than a year
ago and there was a merch request
on the crypt set up upstream and
all were basically re architecting the
whole thing. But I just thought for
fun and glory what I would bring this
work that I did back in the days.
So what this is doing
so for Lux and
Crypt Setup, the idea is you have
a volume key that the whole volume is
encrypted with and then you have multiple
key slots that are stored in the Lux
header of the partition where this
volume key is encrypted, usually
with a key that
is derived from the password you're
entering.
And this then looks like
the thing we see here in the middle where
we have key slot zero of this type and
whatnot. And so what I did back
then was I extend that these.
Yeah. This is based on.
So if you're using Lux at least in
a new on disk form and you have to use
on your petition headers which is
kind of awesome actually to extend
made my life a lot easier at the time.
So we have there a key slot.
So something like that.
And what we do is we
take the volume key and we use one
of the Ms.
Nonvolatile memory spaces and
we just store the volume key directly in
there. And so there's
nothing else we need to do.
And then what we do on for the
on this format, for the Lux headers,
we're just storing some metadata.
For example,
what the envy index number is that we
store the stuff under.
All right. So demo time again.
And.
So this is the crypt at up branch that I
checked out and we'll be
compiling this life.
In the meantime, maybe one more note,
so the operating system or running
there in the virtual machine is just a
standard open to installation.
And I just
chose disk encryption and EL VM
during the open to whatever
set up.
Wizard and
however, unfortunately, that's still
using the luxe one on this
schoolmate.
So what you have to do from the install
media if you want to do that is you have
to call this crypt set up convert
that converts the lux one to Lux to
format header and
then you should be ready to go.
All right. So yeah, we
compiled. We installed.
Now we're updating the inner drama for
us, just replacing
Crypt stuff. Who doesn't do that all the
time?
And the next
commander we're running.
And you will see that the only difference
in the command is we're adding a dash
dash TPM here, which
calls all to using a TPM
slot for that.
And we're entering an existing password.
We're entering a new password.
And this new password is then used for
the TPM to authenticate.
And
we only have five minutes, so I'll just
skip right ahead.
So this is now all set up.
And on the next reboot, the system is
going to ask me
for the TPM based password.
And now let's let's let's
let's see at this.
So what we see here is this second piece
thought just now of TPM to type.
All right.
One more thing I want to present for
early boot is integrity.
Checking this based on what Miss Yuko
talked about at the CDC as 32
C three.
And this is the link to his
talk. You should definitely go watch it.
So this is about verifying the
integrity of your early boot by
sharing a secret between your TPM and
your smartphone.
And yeah, I'm just.
I just did a reemployment Haitian.
I'm gonna showcase that as well.
So in preparation for that, it's time
for all of you to get
out your smartphones and open your free
OTP app or your Google
Google Authenticator so you can verify
that everything works as
intended.
And this one I actually pretty compiled,
by the way. If there's somebody in the
audience who is good at GTA, hey, Guido
Design, please come talk to me after
because that was my attempt at doing
this.
All right. We're gonna be protecting.
By binding through to peace Yas 0
through 7 and this is gonna
basically validate on each boot
that these PCR values
were the same that they are right now
when we are trusting the system.
So that means if you have a kernel update
or you update you in it already
afterwards, there's gonna be different
PCR values.
So you will have to go through this
process again.
So everybody has scanned this hopefully
into their free OTP or
Google Authenticator.
Then we can go ahead and we can actually
start rebooting the
system.
And hopefully this works now
because the most complicated part about
all of these demos was actual actually
mode setting for Plymouth between
grub and plumbers.
Believe it or not.
All right. And there is this number which
is very large and on the screen.
So it was 8 2 8 6 8
8. Was that correct?
Awesome. Applause.
Applause.
And the second thing I'm doing now is
instead of the highly secure
password. Andreas, I'm typing in 1, 2,
3, 4.
You have to believe me, which is the TPM
password.
And it's actually booting through using
the TPM here, which is.
Come on. There it is.
So that also worked with Lux.
All right.
I hope this gave you some some
impressions of what you can do with
PMS today already.
If you want to get started, joining the
effort, joining to hack on stuff.
This Web site up there is like our
community page.
Well, we have a get her
so you can come talk to us.
Talk to me. Talk to the other devils.
You can have a look at those two header
files, which are the most important ones
right now. So the happy is rather new.
We just released it or just merged
it into master.
I think one week ago.
So go ahead.
Have a look at that. Tested thoroughly.
Have a look at the
at the tools.
The all the tools that start with TPM to
underscore basically 1 2 1 murals
of ISP or users and
all tools prefix TSX
to underscore our 1 to 1 flappy mappings.
And here's one more protip.
When you're developing and
something randomly fails, all of a sudden
it's usually has to do with TPM resource
exhaustion and this
command down there frees up the TPM and
final RAM again so you can continue
working.
All right.
Thank you.
Yes. And it's Question
Time.
We have questions from the Internet
and we asked questions here in Clark.
And
look at it.
You two have the same shirt
and very nice shirt, recent extension.
So maybe we start with
number four, please.
OK, so let's say you
have your encryption keys in the TPM
and your federal government is somehow
influencing the event after TPM.
So there could be maybe some way to
get the encryption keys.
So this is not a good approach.
So it would be nicer to enter your party,
your big fat man's heart to get your
keys. And they are ex auto of some
other kids that are in the TPM.
And so you need to have both, too.
So it could decrypt your look stuff.
So this should be bait like this.
So you could not that say, uh,
say the person tortured the person
and try to decrypt the
data on another computer because it has a
different TPM profile to secret.
So you should have you two factor
authentication not having the keys
in the TPM because I would not trust it.
OK. Depending on your paranoia level.
But that's definitely a nice idea.
Thank you.
Only having questions, please.
No comments.
No questions.
That's the rule
number two.
I have to use windows, which is encrypted
to Pit Locker and no second petition.
How likely is it to
accidentally destroy any credentials
for Pit Locker when working with these
tools?
Well, that highly depends on which tools
are using for which purpose.
The tools that I used here
and everything that I showed does not
install president keys.
I think actually P.K.
says 11 is installing a persistent Q So
that drained some of your resources and
also the crypt set up stuff and
the TTP stuff consume some envy space.
And depending on how much of the
team's resources Windows wants
to claim for itself, you could run into
a resource exhaustion there.
But other than that, there's there is no
keys that these tools or the demos
I showed would be deleting.
So you can just go ahead and use
those.
Okay. Thank you.
Maybe we'll have a question from the
Internet. Yes. Signal engine.
Yeah. Other hardware tokens like Uber
Key, for example, they might have a
button that you need to press in order
to have some kind of proof of presence
so that software cannot use it in the
background without you knowing it.
How to do that with the TPM?
Currently not.
But I am hoping or I have been hoping
for a TPM with an embedded LCD
for 10 years now.
More will more likely.
Maybe we'll see some GPI.
Oh, and able to TPM at some point in the
future.
And depending on what we can do with
those, we might be able to include this
or similar features
in there.
But so far I think
there's only been research prototypes.
I have once implemented a TPM online
cortex. I'm sorry myself
in order to demonstrate that the
usefulness of GPI all coming right out
of the TPM.
But I would need to be developed first.
Okay. Thank you.
And number five, please.
Yeah. Hi.
Can you implement?
Did you ever sort of second factor
or if you do two and
half years. Do you plan to do it?
Yes and no. You can
implement parts of Fido
using a VPN, which is the basic crypto
operation. However, Fido also includes
custom data form ups that are usually
also handled in the Fido token
where you have some counters
that you're incrementing something like
that which the TPM does not store
internally because the TPM doesn't know
about vital data structures and vise
versa.
However, for Fido too, I think there was
this TPM attestation
mode, but that
would need to be implemented by someone.
So if you want to start
working on that, please come talk to
me or I'll gladly
be of help.
So there's a lot to do.
And yes.
So if any of you are searching for
something to do, you can just
go ahead and look at this
getup i o community page.
If you go to the software,
tap at the top and you scroll down,
there is a list of programs.
So we start with programs that already
have TPM support them that we have an
even longer list of programs that we wish
had TPM support.
So. There's also other things like
vibe off and or what, crypto okay,
I or what not?
Well, I would love to see more TPM
support or even as simple as G.P.S..
Yeah, okay.
Number two, please.
I mean, how many
different keys or smart
cards can you story in a TPM?
Is it just one or can you save more
in there?
The nice thing is that the
principal concept of a TPM is that the
TPM store is only very few keys.
Usually it's just one in this case,
and all the other keys are then encrypted
with this key and stored on disk on
hard disk. So with us, Casey,
11 that we have here.
You can have as many keys of
you have hard disk space available
or as many keys as askew.
Light will allow you to store it in a
database with reasonable search terms.
I would say thank
you.
Number four, please.
Hi. Thank you for the presentation.
I have a question related to
kernel upgrades.
If I upgrade my kernel,
is there a way I can measure what the
kernel will be
on the next boot and tell my
JPM that just resealed the
currently sealed keys with
the future PCR values that
it should expect on the next boot?
In theory, absolutely.
Yes, that's totally simple.
So a researcher will tell you this is not
a challenge.
The engineer is gonna tell you, well,
this was kind of a problem.
And the problem
is that you somehow need to know the
reference values beforehand
and then you have to recalculate the
whole measurement chain that went into
that. And so this is a
question of reference,
reference, integrity, measurement,
distribution, that there was
also a track at the Lenox Promise
conference tackling this problem.
So this is mainly an infrastructure
problem rather
than an actual problem of
the TPM or
the TPM based software.
Okay. Thank you.
So we just have one more minute.
I'm very sorry. We can't take any
questions more in the room, but I'll have
one last question from the Internet.
Yeah. If I don't trust the TPM and my
machine. Can I just sold it in a
different one from a more trustworthy
winder? Are they compatible in that
sense?
Yes. As far as I know, they have a
compatible pin out and a compatible
SBI protocol.
And that's the nice thing
about standardization is that they
are compatible.
So sure.
Go ahead.
Except for maybe into PTT
FTB MS. That run and the management
engine.
Those of course if you sold those out
you won't have any IO anymore.
Okay. Thank you so much.
If you want to get in touch with Andreas,
go to the website.
You've seen it before.
And thank you for now.
And maybe another applause for one.
I.