On Wed, 2018-10-24 at 03:06 +0300, Jarkko Sakkinen wrote: > On Mon, 22 Oct 2018, Ken Goldman wrote: > > Does this design assume that there was at time zero no monitoring? > > This would permit some shared secret to be established. > > > > Or does it assume that the interception may have been present from > > the first boot? If so, how is the first shared secret established. > > Salting using the EK is the usual method, but this requires walking > > the EK certificate chain and embedding the TPM vendor CA > > certificates in the kernel. > > Kernel gets the public portion EK and uses its own key pair in its > own end so everything should be good, right? Only if we pass it in. The kernel can't run an X509 proof on the EK certificate, which is how you verify the EK: Usually the X509 cert is RSA, and for speed and efficiency we're salting with Elliptic Curve keys, so we'd have to derive the RSA EK primary (which can take up to 60 seconds), verify the same public key as the cert and then chain up to the manufacturer. Then we'd have to use the RSA keys (so a lot more code) because we can't trust the TPM not to lie about the RSA public key but then substitute it's own EC primary. We really don't want to be trying to do all that on boot. James
