Trusted Platform Module: Difference between revisions

Revision as of 08:27, 6 January 2025

Revision as of 12:17, 6 January 2025

Line 86:

=== Platform integrity ===

[[File:TPM 2.0 implementation on Linux screenshot.png|thumb|upright=1.2|Screenshot of <code>tpm2-software</code> showing the reading of Platform Configuration Registers (PCR), the getrandom result taken from TPM device, and TPM version (2.0)]]

The primary scope of TPM is to ensure the [[data integrity|integrity]] of a platform during boot time. In this context, "integrity" means "behaves as intended", and a "platform" is any computer device regardless of its [[operating system]]. This is to ensure that the [[boot process]] starts from a trusted combination of hardware and software, and continues until the operating system has fully booted and [[Application software|applications]] are running.

Line 99 ⟶ 98:

=== Disk encryption ===

[[Full disk encryption]] utilities, such as [[dm-crypt]], can use this technology to protect the keys used to encrypt the computer's storage devices and provide integrity [[authentication]] for a trusted boot pathway that includes firmware and the [[boot sector]].<ref>{{cite web|url=https://www.techsectora.com/2021/02/tpm-header-what-is-it-and-why-is-it-used.html?m=1|title=TPM Encryption | access-date=March 29, 2021|archive-date=June 28, 2021|archive-url=https://web.archive.org/web/20210628045716/https://www.techsectora.com/2021/02/tpm-header-what-is-it-and-why-is-it-used.html?m=1 | url-status=live}}</ref>

===Other uses and concerns===

Any application can use a TPM chip for:

* [[Digital rights management|Digital rights management (DRM)]]

* [[Windows Defender]]

* Windows Domain logon<ref>{{cite web|url=https://docs.microsoft.com/en-us/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-get-started#step-3-enroll-for-the-certificate-on-the-tpm-virtual-smart-card | title=Get Started with Virtual Smart Cards: Walkthrough Guide|access-date=December 23, 2020 | archive-date=March 24, 2021|archive-url=https://web.archive.org/web/20210324164541/https://docs.microsoft.com/en-us/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-get-started#step-3-enroll-for-the-certificate-on-the-tpm-virtual-smart-card | url-status=live}}</ref>

* Protection and enforcement of [[software license]]s

* Prevention of [[cheating in online games]]<ref name=":2">{{cite book | title = Autonomic and Trusted Computing: 4th International Conference | publisher = ATC | year = 2007 | isbn = 9783540735465 }}</ref>

Other uses exist, some of which give rise to [[privacy]] concerns. The "physical presence" feature of TPM addresses some of these concerns by requiring [[BIOS]]/[[UEFI]]-level confirmation for operations such as activating, deactivating, clearing or changing ownership of TPM by someone who is physically present at the console of the machine.<ref name="TCPA">{{cite book | title= Trusted computing platforms: TCPA technology in context|first1= Siani|last1= Pearson|first2= Boris|last2= Balacheff | publisher= Prentice Hall | year= 2002 | isbn= 9780130092205}}</ref><ref name = "SetPhysicalPresenceRequest">{{cite web | url= http://msdn.microsoft.com/en-us/library/aa376478(VS.85).aspx | title= SetPhysicalPresenceRequest Method of the Win32_Tpm Class | publisher= [[Microsoft]] | access-date= June 12, 2009 | archive-date= May 19, 2009 | archive-url= https://web.archive.org/web/20090519204808/http://msdn.microsoft.com/en-us/library/aa376478(VS.85).aspx | url-status= live }}</ref>

=== By organizations ===

The [[United States Department of Defense]] (DoD) specifies that "new computer assets (e.g., server, desktop, laptop, thin client, tablet, smartphone, personal digital assistant, mobile phone) procured to support DoD will include a TPM version 1.2 or higher where required by [[Defense Information Systems Agency]] (DISA) [[Security Technical Implementation Guide]]s (STIGs) and where such technology is available." The DoD anticipates that TPM is to be used for device identification, authentication, encryption, and device integrity verification.<ref>{{cite book |title=Instruction 8500.01 |date=14 March 2014 | publisher=US Department of Defense | page=43 }}</ref>

== Implementations ==

[[File:TPM Asus.jpg|thumb|right|Trusted Platform Module installed on a mainboard]]

{{Infobox software

| name = TPM 2.0 Reference Implementation

| logo =

| screenshot =

| screenshot size =

| caption =

| developer = [[Microsoft]]

| released =

| latest release version =

| latest release date =

| repo = {{URL|https://github.com/Microsoft/ms-tpm-20-ref}}

| programming language = [[C (programming language)|C]], [[C++]]

| operating system =

| language =

| genre = TPM implementation

| license = [[BSD License]]

| website = {{URL|https://trustedcomputinggroup.org/tpm-library-specification}}

}}

=== Laptops and notebooks ===

In 2006 new [[laptop]]s began being sold with a built-in TPM chip. In the future, this concept could be co-located on an existing [[motherboard]] chip in computers, or any other device where the TPM facilities could be employed, such as a [[cellphone]]. On a PC, either the [[Low Pin Count]] (LPC) bus or the [[Serial Peripheral Interface]] (SPI) bus is used to connect to the TPM chip.

Line 148 ⟶ 115:

=== Open source ===

{{Infobox software

The official TCG reference implementation of the TPM 2.0 Specification has been developed by [[Microsoft]]. It is licensed under [[BSD License]] and the [[source code]] is available on [[GitHub]].<ref>{{Cite web |url=https://github.com/Microsoft/ms-tpm-20-ref |title=GitHub - microsoft/ms-tpm-20-ref: Reference implementation of the TCG Trusted Platform Module 2.0 specification. |publisher=GitHub |access-date=April 5, 2020 |archive-date=October 27, 2020 |archive-url=https://web.archive.org/web/20201027190036/https://github.com/microsoft/ms-tpm-20-ref |url-status=live }}</ref>

| name = TPM 2.0 Reference Implementation

| logo =

| screenshot = =

| screenshot size = =

| caption = =

| developer = [[Microsoft]]

| released = =

| latest release version =

| latest release date = =

| repo = {{URL|https://github.com/Microsoft/ms-tpm-20-ref}}

| programming language = [[C (programming language)|C]], [[C++]]

| operating system = =

| language = =

| genre = TPM implementation

| license = [[BSD License]]

| website = {{URL|https://trustedcomputinggroup.org/tpm-library-specification}}

}}The official TCG reference implementation of the TPM 2.0 Specification has been developed by [[Microsoft]]. It is licensed under [[BSD License]] and the [[source code]] is available on [[GitHub]].<ref>{{Cite web |url=https://github.com/Microsoft/ms-tpm-20-ref |title=GitHub - microsoft/ms-tpm-20-ref: Reference implementation of the TCG Trusted Platform Module 2.0 specification. |publisher=GitHub |access-date=April 5, 2020 |archive-date=October 27, 2020 |archive-url=https://web.archive.org/web/20201027190036/https://github.com/microsoft/ms-tpm-20-ref |url-status=live }}</ref>

In 2018 [[Intel]] open-sourced its Trusted Platform Module 2.0 (TPM2) software stack with support for Linux and Microsoft Windows.<ref>{{Cite web |url=https://www.phoronix.com/scan.php?page=news_item&px=Intel-New-Open-Source-TPM2 |title=Intel Open-Sources New TPM2 Software Stack - Phoronix |access-date=April 5, 2020 |archive-date=August 10, 2020 |archive-url=https://web.archive.org/web/20200810025300/https://www.phoronix.com/scan.php?page=news_item&px=Intel-New-Open-Source-TPM2 |url-status=live }}</ref> The source code is hosted on GitHub and licensed under [[BSD License]].<ref>{{Cite web |url=https://github.com/tpm2-software |title=Linux TPM2 & TSS2 Software |website=[[GitHub]] |access-date=April 5, 2020 |archive-date=July 9, 2020 |archive-url=https://web.archive.org/web/20200709134944/https://github.com/tpm2-software |url-status=live }}</ref><ref>{{Cite web |url=https://software.intel.com/en-us/blogs/2018/08/29/tpm2-software-stack-open-source |title=The TPM2 Software Stack: Introducing a Major Open Source Release Intel Software |access-date=April 5, 2020 |archive-date=April 9, 2020 |archive-url=https://web.archive.org/web/20200409075120/https://software.intel.com/en-us/blogs/2018/08/29/tpm2-software-stack-open-source |url-status=live }}</ref>

Line 161 ⟶ 145:

The [[Trusted Computing Group]] (TCG) has faced resistance to the deployment of this technology in some areas, where some authors see possible uses not specifically related to [[Trusted Computing]], which may raise privacy concerns. The concerns include the abuse of remote validation of software decides what software is allowed to run and possible ways to follow actions taken by the user being recorded in a database, in a manner that is completely undetectable to the user.<ref>{{cite web | first = Richard Matthew | last = Stallman | url = https://www.gnu.org/philosophy/can-you-trust.html | title = Project GNU | publisher = Free Software Foundation | access-date = 21 July 2016 | archive-date = 29 June 2011 | archive-url = https://web.archive.org/web/20110629082333/http://www.gnu.org/philosophy/can-you-trust.html | url-status = live }}</ref>

The [[TrueCrypt]] disk encryption utility, as well as its derivative [[VeraCrypt]], do not support TPM. The original TrueCrypt developers were of the opinion that the exclusive purpose of the TPM is "to protect against attacks that require the attacker to have administrator privileges, or physical access to the computer". The attacker who has physical or administrative access to a computer can circumvent TPM, e.g., by installing a hardware [[keystroke logger]], by resetting TPM, or by capturing memory contents and retrieving TPM-issued keys. The condemning text goes so far as to claim that TPM is entirely redundant.<ref>{{Cite web |title=TrueCrypt User Guide |url=https://www.grc.com/misc/truecrypt/TrueCrypt%20User%20Guide.pdf |website=truecrypt.org |publisher=TrueCrypt Foundation |via=grc.com |date=7 February 2012 |page=129 }}</ref> The VeraCrypt publisher has reproduced the original allegation with no changes other than replacing "TrueCrypt" with "VeraCrypt".<ref>{{cite web | url=https://www.veracrypt.fr/en/FAQ.html |title =FAQ |website=veracrypt.fr |publisher=IDRIX | date=2 July 2017 }}</ref> The author is right that, after achieving either unrestricted physical access or administrative privileges, it is only a matter of time before other security measures in place are bypassed.<ref>{{Cite web |last=Culp |first=Scott |date=2000 |title=Ten Immutable Laws Of Security (Version 2.0) |url=https://technet.microsoft.com/en-us/library/hh278941.aspx |url-status=dead |archive-url=https://web.archive.org/web/20151209191417/https://technet.microsoft.com/en-us/library/hh278941.aspx |archive-date=9 December 2015 |access-date= |website=[[TechNet Magazine]] |publisher=[[Microsoft]] |via=[[Microsoft TechNet]]}}</ref><ref>{{Cite web |last=Johansson |first=Jesper M. |date=October 2008 |title=Security Watch Revisiting the 10 Immutable Laws of Security, Part 1 |url=https://technet.microsoft.com/en-us/library/2008.10.securitywatch.aspx |url-status=dead |archive-url=https://web.archive.org/web/20170410043155/https://technet.microsoft.com/en-us/library/2008.10.securitywatch.aspx |archive-date=10 April 2017 |access-date= |website=[[TechNet Magazine]] |publisher=[[Microsoft]] |via=[[Microsoft TechNet]]}}</ref> However, stopping an attacker in possession of administrative privileges has never been one of the goals of TPM (see {{Section link||Uses}} for details), and TPM can [[cold boot attack|stop some physical tampering]].<ref name=":0" /><ref name=":1" /><ref name=":2">{{cite book |title=Autonomic and Trusted Computing: 4th International Conference |publisher=ATC |year=2007 |isbn=9783540735465}}</ref><ref name="TCPA">{{cite book |last1=Pearson |first1=Siani |title=Trusted computing platforms: TCPA technology in context |last2=Balacheff |first2=Boris |publisher=Prentice Hall |year=2002 |isbn=9780130092205}}</ref><ref name="SetPhysicalPresenceRequest">{{cite web |title=SetPhysicalPresenceRequest Method of the Win32_Tpm Class |url=http://msdn.microsoft.com/en-us/library/aa376478(VS.85).aspx |url-status=live |archive-url=https://web.archive.org/web/20090519204808/http://msdn.microsoft.com/en-us/library/aa376478(VS.85).aspx |archive-date=May 19, 2009 |access-date=June 12, 2009 |publisher=[[Microsoft]]}}</ref>

In 2015 [[Richard Stallman]] suggested to replace the term "Trusted computing" with the term "Treacherous computing" due to the danger that the computer can be made to systematically disobey its owner if the cryptographical keys are kept secret from them. He also considers that TPMs available for PCs in 2015 are not currently{{clarify timeframe|date=December 2022}} dangerous and that there is no reason '''not''' to include one in a computer or support it in software due to failed attempts from the industry to use that technology for [[Digital rights management|DRM]], but that the TPM2 released in 2022 is precisely the "[[Trusted Computing|treacherous computing]]" threat he had warned of.<ref>{{Cite web|title=Can You Trust Your Computer? - GNU Project - Free Software Foundation|url=https://www.gnu.org/philosophy/can-you-trust.en.html|access-date=2023-09-06|website=www.gnu.org}}</ref>

Line 186 ⟶ 170:

Main [[tboot|Trusted Boot (tboot)]] distributions before November 2017 are affected by a dynamic root of trust for measurement (DRTM) attack {{CVE|2017-16837}}, which affects computers running on [[Trusted Execution Technology|Intel's Trusted eXecution Technology (TXT)]] for the boot-up routine.<ref name=Bleeping />

In October 2017, it was reported that a code library developed by [[Infineon Technologies|Infineon]], which had been in widespread use in its TPMs, contained a vulnerability, known as [[ROCA vulnerability|ROCA]], which generated weak [[RSA (cryptosystem)|RSA]] key pairs that allowed private keys to be inferred from [[public key cryptography|public keys]]. As a result, all systems depending upon the privacy of such weak keys are vulnerable to compromise, such as [[identity theft]] or spoofing.<ref name="ars20171016">{{cite web |last1=Goodin |first1=Dan |date=October 16, 2017 |title=Millions of high-security crypto keys crippled by newly discovered flaw |url=https://arstechnica.com/information-technology/2017/10/crypto-failure-cripples-millions-of-high-security-keys-750k-estonian-ids/ |publisherurl-status=live Ars Technica|archive-url=https://web.archive.org/web/20181019012939/https://arstechnica.com/information-technology/2017/10/crypto-failure-cripples-millions-of-high-security-keys-750k-estonian-ids/ |archive-date=October 1619, 20172018 |access-date=October 18, 2017 |archive-datepublisher=OctoberArs 19Technica}}</ref> Cryptosystems that store encryption keys directly in the TPM without [[Blinding (cryptography)|blinding]] could be at particular risk to these types of attacks, 2018as passwords and other factors would be meaningless if the attacks can extract encryption secrets.<ref>{{Cite web |title=Can the NSA Break Microsoft's BitLocker? – Schneier on Security |url=https://www.schneier.com/blog/archives/2015/03/can_the_nsa_bre_1.html |url-status=live |archive-url=https://web.archive.org/web/2018101901293920170810210547/https://arstechnicawww.schneier.com/information-technologyblog/2017archives/102015/crypto03/can_the_nsa_bre_1.html |archive-failuredate=August 10, 2017 |access-cripplesdate=August 10, 2017 |website=www.schneier.com}}</ref> Infineon has released firmware updates for its TPMs to manufacturers who have used them.<ref>{{Cite web |title="TPM Update -millions Infineon Technologies" |url=https://www.infineon.com/cms/en/product/promopages/tpm-of-high-security-keys-750k-estonian-idsupdate/ |url-status=live |archive-url=https://web.archive.org/web/20210205072055/https://www.infineon.com/cms/en/product/promopages/tpm-update/ |archive-date=February 5, 2021 |access-date=March 19, 2021}}</ref>

In 2018, a design flaw in the TPM 2.0 specification for the static root of trust for measurement (SRTM) was reported ({{CVE|2018-6622}}). It allows an adversary to reset and forge platform configuration registers which are designed to securely hold measurements of software that are used for bootstrapping a computer.<ref name=USENIX27>{{cite conference|url=https://www.usenix.org/system/files/conference/usenixsecurity18/sec18-han.pdf|title=A Bad Dream: Subverting Trusted Platform Module While You Are Sleeping| last1=Seunghun| first1=Han| last2=Wook| first2=Shin | last3=Jun-Hyeok | first3=Park | last4=HyoungChun | first4=Kim|date=August 15–17, 2018 | publisher=USENIX Association | ___location=Baltimore, MD, USA|conference=27th USENIX Security Symposium | isbn=9781939133045 | archive-url=https://web.archive.org/web/20180820032203/https://www.usenix.org/system/files/conference/usenixsecurity18/sec18-han.pdf | archive-date=20 August 2018 | url-status=live}}</ref> Fixing it requires hardware-specific firmware patches.<ref name=USENIX27 /> An attacker abuses power interrupts and TPM state restores to trick TPM into thinking that it is running on non-tampered components.<ref name=Bleeping>{{cite web | url=https://www.bleepingcomputer.com/news/security/researchers-detail-two-new-attacks-on-tpm-chips/ | title=Researchers Detail Two New Attacks on TPM Chips | first=Catalin | last=Cimpanu| publisher=Bleeping Computer | date=August 29, 2018|access-date=28 September 2019 | archive-url=https://web.archive.org/web/20181007062452/https://www.bleepingcomputer.com/news/security/researchers-detail-two-new-attacks-on-tpm-chips/|archive-date=7 October 2018|url-status=live}}</ref>

In 2021, the Dolos Group showed an attack on a discrete TPM, where the TPM chip itself had some tamper resistance, but the other endpoints of its communication bus did not. They read a full-disk-encryption key as it was transmitted across the motherboard, and used it to decrypt the laptop's SSD.<ref>{{cite web |url=https://arstechnica.com/gadgets/2021/08/how-to-go-from-stolen-pc-to-network-intrusion-in-30-minutes/ |title=Trusted platform module security defeated in 30 minutes, no soldering required |date=August 3, 2021}}</ref>

=== 2017 weak key generation controversy ===

{{Main|ROCA vulnerability}}

In October 2017, it was reported that a code library developed by [[Infineon Technologies|Infineon]], which had been in widespread use in its TPMs, contained a vulnerability, known as ROCA, which generated weak [[RSA (cryptosystem)|RSA]] key pairs that allowed private keys to be inferred from [[public key cryptography|public keys]]. As a result, all systems depending upon the privacy of such weak keys are vulnerable to compromise, such as [[identity theft]] or spoofing.<ref name="ars20171016">{{cite web |last1=Goodin |first1=Dan |title=Millions of high-security crypto keys crippled by newly discovered flaw |url=https://arstechnica.com/information-technology/2017/10/crypto-failure-cripples-millions-of-high-security-keys-750k-estonian-ids/ |publisher= Ars Technica |date=October 16, 2017 |access-date=October 18, 2017 |archive-date=October 19, 2018 |archive-url=https://web.archive.org/web/20181019012939/https://arstechnica.com/information-technology/2017/10/crypto-failure-cripples-millions-of-high-security-keys-750k-estonian-ids/ |url-status=live }}</ref>

Cryptosystems that store encryption keys directly in the TPM without [[Blinding (cryptography)|blinding]] could be at particular risk to these types of attacks, as passwords and other factors would be meaningless if the attacks can extract encryption secrets.<ref>{{Cite web|url=https://www.schneier.com/blog/archives/2015/03/can_the_nsa_bre_1.html|title=Can the NSA Break Microsoft's BitLocker? – Schneier on Security|website=www.schneier.com|access-date=August 10, 2017|archive-date=August 10, 2017|archive-url=https://web.archive.org/web/20170810210547/https://www.schneier.com/blog/archives/2015/03/can_the_nsa_bre_1.html|url-status=live}}</ref>

Infineon has released firmware updates for its TPMs to manufacturers who have used them.<ref>{{Cite web | url = https://www.infineon.com/cms/en/product/promopages/tpm-update/ | title = "TPM Update - Infineon Technologies" | access-date = March 19, 2021 | archive-date = February 5, 2021 | archive-url = https://web.archive.org/web/20210205072055/https://www.infineon.com/cms/en/product/promopages/tpm-update/ | url-status = live }}</ref>

== Availability ==