Dear viewer, these subtitles were generated by a machine via the service YouTube and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/2028 Thanks!
so
[Music]
[Laughter]
all right
our next talk is um tpm the
um explosion our speaker is daniel he's
very much a software enthusiast and a
software developer he
um is involved with
operating system development and in
particular with various um distributions
and will tell us how
how the different tpm ideas increased in
the last 20 years how it gained more
complexity
and
basically um
what these other was about this year
were 40 windows 11 start
thank you daniel
welcome thank you for the quick
introduction
um so you might have seen me before
i have talked about a few other related
topics to tpm
if you are not familiar with that term i
will be given a bit of an explanation
later on here
um i also talked about something called
me or management engine a controversial
topic
that is something from intel and today
we're going to also reference a few
vendors here and companies that you may
know very well
and i'm trying to be as neutral as
possible here really just evaluating
from outside
so the agenda for today i will give a
bit of an introduction to what the topic
actually is and what i'm going to cover
we're going to look at the history of
the so-called tpm
and then we will see
what the development of the
specifications looked like because it
wasn't just
one thing invented at one point in time
but it's being revised over and over
and then we will see about
standardization and about projects all
around the tpm and eventually come to a
bit of a discussion
also involving windows 11 which is how
many people get to know the term tpm
after all
so
just to introduce me very quickly
even though we had a small introduction
already yes i have very many different
backgrounds and i'm also
involved in very many different fields
one of the strong ones are currently
being firmware development
and that's where i also run into tpms
and
not just because of the windows 11 topic
but also because friends of mine are
involved with the development around
tpms and firmware i started to look into
that and i even did so years ago
so
i found a book it's called a practical
guide to tpm 2.0
and it's giving us a bit of a problem
statement which i'm going to cite here
and it's saying that hardware security
is not an easy topic to begin with
which i frankly agree with
and it doesn't help to have a
specification that is hard to understand
a good starting place to understand this
technology is the history of its
development
but let's look at the current state
first and then go back in time
this is a report from microsoft from
this very year
stating that more than 80 of enterprises
have experienced at least one firmware
attack in the past two years
and how tpms are related with firmware
at large is something we're going to
look
a bit into in detail later
so let's see about the history
and first let's see
what actually is a tpm now
there is a definition or
a bit of a vague definition actually
given in that book that i already
touched a bit
and they're saying a trusted platform
module that's what it's short for also
known as a tpm is a cryptographic
co-processor that is present on most
commercial pcs and servers
now the problem is we're defining
something but many people don't really
know most of these uh terms which are
being introduced at the same time here
one of them being a platform
one being trusted what does it mean
specifically it's something that we talk
about sometimes when we talk about
people and how they are in a
relationship with each other
trust is a very strong statement about
the relationship
and now we're talking about processors
and even co-processors here we're
talking about cryptography
and those are all very very large topics
for themselves
i don't want to go too much into detail
uh but please be aware that everything
we're talking about here
is not really easily defined just
as the statement we had before
so i tried to find a more general
description and that's also what i put
in the abstract the general idea of a
tpm is to have an isolated or
constrained environment to offload trust
establishment in a larger computing
environment
i'm not exactly sure if that's even more
or less understandable
but i'm trying to be a bit more
general here
so
yeah we're talking about isolation
that's one concept and we're talking
about constraints
and keep that in mind for
everything that is coming now
now people may say well this is
something that we have also heard but
as a bit of a different concept
or maybe an
overlapping concept in a way
so still having the same idea here
we're talking about something people
call it trusted execution environment an
environment that is specifically made
for
computations which are sensitive
an environment where you could store
something like key material for example
for encryption
and there are many more different use
cases
so
these are the two concepts tpm and tee
the tpm there is an image here in the
left hand side that you can also find on
wikipedia
that is
basically like
a high-level perspective on tpms and
their main functionalities
it's talking about the cryptography uh
as we already saw in the previous
definition a processor so people may
know processors mainly from just doing
computations the so-called cpu that you
have in most machines
which is really just doing computations
but this here is a more special purpose
processor
so it's not about
general computations but it's really
tailored towards cryptography
so it knows very specific things like
random number generation for example
which is a very very important thing in
cryptography
um as i already said
it's also made for restoring key
material that is in the so-called
persistent memory here sometimes you
also hear a slightly different term
that's called nv
non-volatile memory
but it's basically the same thing so the
idea is that you can store information
and the third one is the versatile
memory and that's something which is
giving us lots of new opportunities
which we're going to touch a bit later
on
now there are many implementations of
the so-called tpm which are in actual
hardware
but there are also other implementations
as part of a so-called trusted execution
environment there is implementations
from amd and intel which are what most
people know from the processors in their
machines
but there is also something from arm
that you
mainly see in phones but it's also
coming in other places now
there is now a new isa called risk 5. if
you haven't heard about it never mind
right now
but what i'm saying is that the concept
is being transferred
and it's
across platforms
so
now let's come back to the definition of
a tpm and let's find a new one i hope
this one is slightly better
so i'm now saying that a tpm is a
hardware security module and i'm
emphasizing hardware a bit
and it's designed for providing an
environment for trusted computing
but of course there are some remarks
here because hardware can also be
emulated and so can a tpm that can even
be simulated so if you want to play
around with one
there is some implementation from google
that you can test in your web browser
just to get an understanding of the
concept behind it click around and so on
okay but
that's not the history where did we come
from even before
this day like
30 years ago or even earlier we already
had some co-processors in the ibm
mainframes
they already had very interesting ideas
around computing back then
and they were mainly focused on business
so if you
know the abbreviation i think ibm was
actually short for international
business machines
so they were selling hardware for
computation
it was meant for different customers
and they well
also had to think about trust
establishment at that point
and then there were also the so-called
smart cards that's what many people have
in their hands these days be it for
public transport like in this image here
for example
but it can also be for different other
purposes like authentication at a
machine
it can be the card that you use for
banking and so on
and that brings us to an interesting
topic and that's safety
and the safety question is
often something like is it safe to enter
a password on a given machine here like
this laptop that i have right before me
it is my own laptop i usually keep my
eyes on it so i can pretty much assume
that it's a safe device to enter my
credentials into like when i browse the
web i go to some website i need to log
in i enter a password
but how can i be sure
that there is not something extra in my
hardware
or in my operating system or even below
my operating system between the hardware
and the operating system
that is sniffing the passwords that i'm
entering
so we need to look at all the different
layers
we have applications like web browsers
for example we have very good protection
measures for those we have malware
scanners we can sign applications
so that we know that we can trust them
we have the operating system secured
pretty much
there are different kernel protection
mechanisms in all the major operating
systems at this point in time
but there could be more protection from
firmware
and that is part of
what a tpm can cover
the firmware itself
again is actually also just software
right so that can be protected again uh
by a lower level and that would be the
hardware level
and that's the hardest one
so hardware is something that is not
very easy to change you can throw out a
laptop and get a new one but it's uh for
most people quite expensive
and there have been cases already and
it's been shown a few times
where people were able to put something
in hardware called an implant
which was not easy to detect
of course also not easy to do either so
it's not something that everyone could
just do right away but it's definitely
possible
so here's the big problem
what we can do is we can make devices
very very secure
but the problem is we have general
purpose devices and they're meant to be
connected to each other
like through the internet where
basically everyone is connected and all
the devices
we have the plugability so we can put
add-ons on the machines that we have
like extra graphics cards for example
we can customize the machines we can
change settings
and we have the extensibility so
basically we can write our own
applications or download and install
applications and stuff like that
so we're talking about something that is
very very volatile by nature
and well
there was this piece of news i think it
was also this year
where there was a mouse driver
that was capable of giving you root
access or administrator access as it's
called on windows
well
we had all the measures here right so
the driver was probably signed by
microsoft so it was installed it was
trusted the operating itself
the operating system itself seemed all
okay
but
yeah that wasn't really everything
so there can still be loopholes
everywhere now this is a sort of
software bug that we're not going to
cover here
but always be aware that every extension
every modification that we do to
machines can make them insecure again
but what is a platform anyway
this image here is coming from a
specification that we're going to look a
bit closer
so
yeah so the tcg is looking at a
motherboard so that's what we see here
in the picture zoomed in where you have
many different hardware components
there are so called embedded devices
that's the different controllers that
you have directly on the board which are
talking to other peripherals
there is a usb controller for example
there is the user output and input of
course like we have mouse and keyboard
and so on
and then you have the processor or
processors if you will because there can
be very many of them and that is where
the firmware is stored
and
where the tpm is actually part of the
surface now
so the tpm can be just alongside the cpu
as we saw in an earlier definition a
co-processor
that can also be connected somehow
from the outside
so the tcg the trusted computing group
that's what it's short for they're
publishing standards and specifications
for a secure computing
and they're actually the the ones who
define the so-called tpm so be aware
that it's actually
more of a like product name or marketing
term if you will it's not something that
is too formal it's it's formal of course
as an industry thing
and now let's refresh the security goals
again because when we talk about
security we talk about very many
different
applications one core thing is
confidentiality so we want to keep data
secure from other people looking at it
we want integrity that means that we
don't want people to be able to
manipulate data without being detected
and we want authenticity so we want to
be able to validate the data indeed
comes from the source it's claiming to
come from
and that's what all those specifications
and a lot insecurity is
basically based on
so
that was the first iteration when you
see this uh fancy number here the tpm
1.1 b
it's a 1.0 but you can already see some
new ones here right so it wasn't really
like
done in a day or something but it was
conceptualized over time and revised and
reviewed again
and they came up with the first features
one of them is so-called pcrs platform
configuration registers a bit of an
elaboration we'll be following later
device health attestation that means you
can verify that a device is indeed in
its secure state as you want it to be
they established pka
a public
key infrastructure
that means that you have multiple
parties being involved so that you can
do verification on different layers and
also authentication
it was supposed to prevent well not from
physical attacks that was left to
manufacturers
um
but it was meant to protect data in
general so it was widely deployed at
some point in 2005.
remember this year for the next slides
there were some issues with that
one of them was the api wasn't really
100 specified so there were different
implementations and they were not really
compatible with each other
the pinots for the hardware were also
slightly different from vendor to vendor
keep that in mind also
you could
well just brute force a key password so
the problem is
we still need to rely on
some
easy mechanisms for people to unlock
things like key source and so on so
that's where we use passwords
but that's something that can always
make a system very insecure very easily
like when people
use fancy simple passwords like well
just password as the password for
example
there were privacy issues
so keys were not necessarily anonymous
there were endorsement keys they are
part of the concept of device health
and well
they put them on external storages and
the problem is if you do that in
like a large company where you know
there is idea administrators who buy
lots of machines usually they will just
wipe the hard drives install a new
operating system and so on
but that hard drive they had well it was
storing the keys so they actually lost
the key here so they had to learn how to
not do that
and there was a dual ownership issue so
these it admins
were one party administering a machine
and that was then the actual user so you
know someone in a company like a
secretary for example
okay so that was a bit of an
entertainment um and that's one
thing that people in security always
keep in mind the solutions that we come
up with they are never complete they
always work in progress just by nature
because we always find new issues
so they came up with something new dpm
1.2 brought a lot of improvements the
software interface was now standardized
so
now we could actually have something
like compatibility in software right
um there was mostly a standard package
pin out so if you remember the previous
one
we're still not like 100 percent
compatible here right so you can use two
different tpms from different vendors
and they will have different pins on
hardware
the dictionary attack problem so
guessing passwords that was
solved a bit it was improved but it
wasn't really solved yet
um and then there were a lot of other
new improvements
and i'm going to skip a bit through here
now
the release was in 2005
back then when tpm 1.1b was established
but 2005 also brought some other news
the sha-1
algorithm that was used for hashing
was then already facing its first
attacks
now the problem is in this specification
well we have a fixed algorithm which is
already not a good choice but back then
we didn't really have much to choose
from
okay so people had to come up with new
concepts
um here here is an example image that's
one of the tpm 1.2 chips that i found on
one of my machines
and i bought it used i think it was from
about 10 years ago
so yeah we're still a bit stuck with
that you can still buy machines today
with these sort of chips
now the next big step was cpm 2.0
there came new solutions
and one key thing was flexibility with
the algorithm so in cryptography
what you can now do on tpms is you can
use different hash algorithms
but you can also
use different algorithms for
the actual computations so previously
there was just rsa and now you could
also use other ones
so
the other key idea was to have a
compilable specification and that's why
microsoft took the opportunity to write
an emulator at the same time so if in
doubt you could always look at the
emulator as a reference implementation
if something was ambiguous in the specs
there were now multiple key hierarchies
so they were also growing over time so
the tpm could have more and more
purposes
okay
so there is this reference
implementation also from microsoft that
you can still find on github today and
that is still being maintained
great now we have a specification
we talked about the so-called platform
configuration registers
and this graphic here is again
coming from the specification documents
those
registers are being connected to the
different components that we have in
firmware
and also
in part the hardware so at some point
the hardware is
starting a machine right it's loading
its first programs and executing them
that's what we usually call the firmware
and there are so many components in this
firmware
that we can
well at best do something like hashing
each and every piece and storing some
information
and that is what the platform
configuration registers are for
so these different components are stored
well they are hash and then the hashes
are being stored in different registers
some are in the same register and you
may now wonder how
there is something you can say like an
update mechanism so you can store
multiple hashes in the same register and
then eventually read them back from a
log
now because this is a bit hard to
understand there is also a table also in
the specifications which is listing the
components and the specific register
they belong to
and what you can also see here is a
strong relationship with the idea of
uefi which is a firmware interface
standard
that has also been developed over the
years and also being revised over time
and it's also still an active
development by the ufi forum
so the relationship is as follows or one
relationship is as follows
in tpms we have the so-called pcrs
that we just saw that's where we store
the hashes of the platform state that's
where you know we basically store the
current health state
and in uefi there is something called
the platform configuration database
that's where the settings are being
stored like when you enter a firmware
menu on your machine
then you have different settings that
you can change there
that is sort inside database and that
can
that can influence the boot flow
right so that's where the pcrs may
change over time
okay great now we have a specification
but a specification is really just a
start
we also need to standardize
on top of that
there are different projects
so
one thing to look at is the boot flow
that i already teased a bit
and the boot flow is basically like this
there is some root component that starts
and it's loading the next one executing
that loading the next one executing that
and so on
and if you implement it properly with
the tpm
then you would do the very same step for
the whole chain each component will
always
take a hash of the next component stored
in the tpm and then hand over the
computation and the chain will continue
until you end up in the operating system
so around this boot integrity there are
lots of additional specifications now on
top of the simple tpm specification
and all of that is also coming from tcg
the trusted computing group
and it's still being extended over time
so if you look at
the link here for example february 20
that's 2020 this year
uh when this very end of the client
platform firmware integrity measurement
specification came out
okay it's a bit of a big term anyway it
comprises basically
all the different parts of the foamer
boot flow
and it's being split up again into
several other sub manuals if you will
okay that's great we have lots of more
specifications and standards now
um
and now other parties are looking at
that one of them is being governments
and larger institutes like the nist the
national institute for standards and
technology
they release a special publication
it's called the platform former
resiliency guidelines
those guidelines are all around the boot
flow
they're meant to define how you can
actually secure your well what people
know as bios or what is implemented in
uefi these days
um there is a reference implementation
from nsa or well let's say some
something to get you started with it's
called hirs
those integrity at runtime and startup
tool
that is also something to look into it
gives you
the idea of validation policies
okay
we have hardware
there is an attempt being made by lpn
plant
they they're trying to make a universal
tpm
because as stupid as it sounds
even these days we don't have a
standardized hardware interface even
with tpm 2.0 you can still you know you
can buy a motherboard from let's say
asus and then you want to put a tpm on
it let's say from msi it won't fit
will have a different pin out and it may
even be a different pitch so it can be
like two and
whatever 2.5 millimeters
so what lpm plant is doing
they're documenting
and they're putting out an open source
implementation
and they're also selling hardware along
with that
there is the open titan project
that's also a security processor and
that's being made at google
well in cooperation with a company
called low risk
that's an open source hardware
implementation of a so-called root of
trust
and that's a term that you may also hear
very often with tpms just means that
that's where you establish your
blue chain security basically
there are command line interfaces and
different libraries
very public and well known as the tpm2
tools that's what many people are using
currently
and then there is also other
implementations like nine elements cyber
security's tpm tool
um that's something i also started to
look into
and they also made a larger suite called
the converge security suite
okay i thought these were great tools
and if you remember my introduction from
last year
i'm working on firmware tooling so what
i wanted to do is
i wanted to be able to display what the
tpm is actually doing
and so i made a log viewer
this can now show you what happened
during the boot flow the command line
interfaces can do the same thing but i
want to go a bit beyond that and one
thing that you can already see here it's
coming from a tpm 2.0 so you can have
different hashes from different hash
algorithms in this case here it's sha 1
and sha 2 5 6.
another project of mine that i just
vaguely started so far
microsoft has a hypervisor called
hyper-v
so i'm starting project hyperx i'm
taking the firmware for that hypervisor
i'm trying to emulate that in qmu and if
you look at the screenshot here
it didn't really work well at the first
time
so yeah it just errored somewhere
and now the question is so can i do
something to be really able to emulate
that in the qmu emulator and does it
actually want to talk to some sort of
tpm on the host machine
if anyone's interested
please feel free to contact me and let's
have a look at that
now let's conclude a bit with a
discussion
so there is one issue that is management
the management issue is the following if
you are administrating lots of machines
in a large company like an enterprise
with i don't know a thousand people in a
building a thousand people in another
building and so on and now you have lots
of tpm's deployed along
and what you want to be able to is you
want to be able to keep things updated
now there will always be issues like
these here
where an issue is not just in the
software or the operating system that is
you know updated through the regular
routines
but actually in the firmware there was
one issue that was with i think it was
surface laptops uh the issue was called
cart blanche
well
they forgot to implement the hashing
so or well at least in a bunch of places
so when the machine was booting up in
that case the measurements that were
supposed to be made were not
right so that gave us room for being
able to compromise those machines in a
way
now there is a write-up on that and i
put the link here to archive work just
in case
things may get lost from from the
original place
there was another issue
that was with tpms made by infineon
and they were having a bit of an issue
in the key generator
roka here that's for return of
coppersmith attack a famous
mathematician who also did a lot in
crypto
and well
the issue here is if you have
only a key size that is well half of the
desired key size well then frankly you
are able to restore the entire key
that's like the brief summary but it's
an issue that was still in software well
in this case firmware so it could still
be fixed
but be aware if you need to manage
machines then these are the sorts of
issues you need to be able to deal with
there are some solutions to some
shortcomings so if you have a real
hardware issue and you cannot do
anything but swap out the module
be aware there is something in the
hardware that is called the so-called
mask chrome that is like
hard-coded
programs which are really part of the
actual hardware module you can get rid
of those they're just fixed so in that
case if you have pin compatibility if
you can swap out a module
you win
if you don't have these properties oh
bad luck
another thing is availability
so
for cryptography keys it's always
important not to just have the data and
the key somewhere but also to have a
backup of those keys and the more you
have those keys stored in like
you know a hidden place like in for more
or in a hardware module then the harder
it is to recover those
so the best thing to do is to have a
backup
and that backup has to be a
well at least the same level of security
as the original copy
if you make it less secure if you for
example don't encrypt your backup at all
well then you're not winning much
because a potential attacker would just
take the unencrypted backup rate
so those are things to be kept in mind
and that's when
now microsoft said okay we want to
mandate all of these things for the
windows 11 operating system
they wanted to have all the features
that we got through tpm 2.0
and they even released a very nice and
funny video about that
this screenshot here is from said very
video they were basically explaining
also a lot of these things that i just
explained here
but the news came so the question was of
course why did we actually have this
mandate now out of a sudden for like
every installation of windows 11
well the operating system does need a
trust anchor
we already said that well if you don't
have it at runtime if the operating
system cannot rely on the firmware then
well
you are missing the protection from the
lower layers right so in that sense it
makes a lot of sense and we don't
actually need to discuss anything here
we already set that as a precondition
the thing is
as widely deployed as tpm 2.0 maybe not
everyone does have it so some people
like in the photo i showed earlier
still have an older one a tpm 1.2
they well
are still able to opt out right so they
can choose during the installation of
windows 11
they can set some registry key
and well then they can still install the
operating system but still microsoft is
suggesting very strongly
to have the tpm 2.0 module to back you
up
and i would well recommend the same
thing from my site as well and even if
you're using other operating systems
it's still a very good idea
now the issue is it's still a bit of a
young field
so
maybe this also gives you some
motivation to look further into it
especially if you are also interested in
firmware and low-level stuff
and eventually
there is this bit of a discussion of who
can actually trust a tpm and a tee
because it can have
many many different uh parties relying
on it
we already talked a lot about the
operating system and we talked about
applications right we talked about users
you know people operating in the
machines but there are also other
parties
for example if you want to watch a video
and it's protected by something called
drm
then well
the owner of that
does not want you to be able to copy
what you're seeing they only want to
allow you to see it maybe only once even
that is something that can also be
backed by a tpm or a trusted execution
environment
then in the online gaming world
anti-cheat can also be
backed by these implementations
especially the trusted execution
environment
as well as vendor secrets so for example
in
camera firmware these days
the firmware itself might be encrypted
and it might rely on a trusted execution
environment to only unlock for very
specific computations
and do so without anyone able to
interfere
okay so yeah there are quite some
problems uh there is a lot of marketing
involved here and there are lots of
close components that we cannot really
look at
uh those are things
uh that are being found over time
and because there is a lot of confusion
around this i hope i could give a bit of
an insight with this talk here
and well
eventually i want to conclude i want to
show you a bit um
well a bit of a rundown
so
how is foam were made anyway
there are many parties involved
so it's not like the components are
closed but there are many many different
parties implementing things
there is the manufacturers of the
machines there is the manufacturers of
the operating systems and all the
different parts and components that are
also part of the machines that can be
involved here
and well some of them can even be just
unknown third parties that you never
would actively run into
on the dasher.com website there is also
a bit of an introduction to that
now at this point i want to stop here
here are some references in addition
some advanced topics if you look at the
slides again later on you can skim
through and watch these websites here a
bit more closely
some of them are around practicalities
and possible issues that have been found
and now i would like to open the room
for a few questions if there are any
uh indeed there are two questions from
the rsc network well the first one is
how do these chips communicate with the
processor is that itcs at spi jtag or
something proprietary which is here
yep okay so yeah jtag is
actually meant for testing and debugging
so that's hopefully not what
any company is using as an interface
here so there are different
implementations some are using the spi
interface
that is a current trend i would say some
are based on i squared c and the older
ones were using the lpc interface the
low pin count bus
but that's only for the dedicated
hardware so if you have a co-processor
that is part of a package
it might be a totally different
proprietary bus which
um i don't officially know about or
cannot tell you about
thank you
the second question is is there an
operating system api that an application
could use for instance to create or use
an rsa key pair
yes
so yeah i already mentioned a few tools
the command line tools tpm tools 2 for
example and also tpm tool i strongly
suggest looking into those and there are
also libraries written in golang
which are also able to do this
thanks a lot and thank you very much for
your talk um yeah thank you a lot for
having me
and um if you had issues following the
stream
you can also follow the stream on either
twitch or youtube if these happen to be
more stable at wherever you're located
um the next talk on this stage will be
the in german the increasing motors
thanks again daniel
thank you
[Music]