* [tpmdd-devel] [PATCH v6 2/2] tpm: enhance TPM 2.0 PCR extend to,support multiple banks
@ 2017-01-25 22:11 ` Ken Goldman
0 siblings, 0 replies; 4+ messages in thread
From: Ken Goldman @ 2017-01-25 22:11 UTC (permalink / raw)
To: linux-kernel, linux-security-module, tpmdd-devel
> The current TPM 2.0 device driver extends only the SHA1 PCR bank
> but the TCG Specification[1] recommends extending all active PCR
> banks, to prevent malicious users from setting unused PCR banks with
> fake measurements and quoting them.
>
> The existing in-kernel interface(tpm_pcr_extend()) expects only a
> SHA1 digest. To extend all active PCR banks with differing
> digest sizes, the SHA1 digest is padded with trailing 0's as needed.
>
> This patch reuses the defined digest sizes from the crypto subsystem,
> adding a dependency on CRYPTO_HASH_INFO module.
>
> [1] TPM 2.0 Specification referred here is "TCG PC Client Specific
> Platform Firmware Profile for TPM 2.0"
Tested-by: Kenneth Goldman <kgold@linux.vnet.ibm.com>
I obtained an IMA event log from a Power platform, along with the PCR 10
value from both the SHA-1 and SHA-256 banks of its Nuvoton TPM 2.0. I
independently validated that the event log matches the TPM PCR values.
^ permalink raw reply [flat|nested] 4+ messages in thread
* [PATCH v6 2/2] tpm: enhance TPM 2.0 PCR extend to, support multiple banks
@ 2017-01-25 22:11 ` Ken Goldman
0 siblings, 0 replies; 4+ messages in thread
From: Ken Goldman @ 2017-01-25 22:11 UTC (permalink / raw)
To: linux-kernel-u79uwXL29TY76Z2rM5mHXA,
linux-security-module-u79uwXL29TY76Z2rM5mHXA,
tpmdd-devel-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f
> The current TPM 2.0 device driver extends only the SHA1 PCR bank
> but the TCG Specification[1] recommends extending all active PCR
> banks, to prevent malicious users from setting unused PCR banks with
> fake measurements and quoting them.
>
> The existing in-kernel interface(tpm_pcr_extend()) expects only a
> SHA1 digest. To extend all active PCR banks with differing
> digest sizes, the SHA1 digest is padded with trailing 0's as needed.
>
> This patch reuses the defined digest sizes from the crypto subsystem,
> adding a dependency on CRYPTO_HASH_INFO module.
>
> [1] TPM 2.0 Specification referred here is "TCG PC Client Specific
> Platform Firmware Profile for TPM 2.0"
Tested-by: Kenneth Goldman <kgold-23VcF4HTsmIX0ybBhKVfKdBPR1lH4CV8@public.gmane.org>
I obtained an IMA event log from a Power platform, along with the PCR 10
value from both the SHA-1 and SHA-256 banks of its Nuvoton TPM 2.0. I
independently validated that the event log matches the TPM PCR values.
------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, SlashDot.org! http://sdm.link/slashdot
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [tpmdd-devel] [PATCH v6 2/2] tpm: enhance TPM 2.0 PCR extend to, support multiple banks
@ 2017-01-30 10:01 ` Nayna
0 siblings, 0 replies; 4+ messages in thread
From: Nayna @ 2017-01-30 10:01 UTC (permalink / raw)
To: Ken Goldman; +Cc: linux-kernel, linux-security-module, tpmdd-devel
On 01/26/2017 03:41 AM, Ken Goldman wrote:
>> The current TPM 2.0 device driver extends only the SHA1 PCR bank
>> but the TCG Specification[1] recommends extending all active PCR
>> banks, to prevent malicious users from setting unused PCR banks with
>> fake measurements and quoting them.
>>
>> The existing in-kernel interface(tpm_pcr_extend()) expects only a
>> SHA1 digest. To extend all active PCR banks with differing
>> digest sizes, the SHA1 digest is padded with trailing 0's as needed.
>>
>> This patch reuses the defined digest sizes from the crypto subsystem,
>> adding a dependency on CRYPTO_HASH_INFO module.
>>
>> [1] TPM 2.0 Specification referred here is "TCG PC Client Specific
>> Platform Firmware Profile for TPM 2.0"
>
> Tested-by: Kenneth Goldman <kgold@linux.vnet.ibm.com>
>
> I obtained an IMA event log from a Power platform, along with the PCR 10
> value from both the SHA-1 and SHA-256 banks of its Nuvoton TPM 2.0. I
> independently validated that the event log matches the TPM PCR values.
Thank You Ken !!
Thanks & Regards,
- Nayna
>
>
> ------------------------------------------------------------------------------
> Check out the vibrant tech community on one of the world's most
> engaging tech sites, SlashDot.org! http://sdm.link/slashdot
> _______________________________________________
> tpmdd-devel mailing list
> tpmdd-devel@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/tpmdd-devel
>
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH v6 2/2] tpm: enhance TPM 2.0 PCR extend to, support multiple banks
@ 2017-01-30 10:01 ` Nayna
0 siblings, 0 replies; 4+ messages in thread
From: Nayna @ 2017-01-30 10:01 UTC (permalink / raw)
To: Ken Goldman
Cc: linux-security-module-u79uwXL29TY76Z2rM5mHXA,
tpmdd-devel-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f,
linux-kernel-u79uwXL29TY76Z2rM5mHXA
On 01/26/2017 03:41 AM, Ken Goldman wrote:
>> The current TPM 2.0 device driver extends only the SHA1 PCR bank
>> but the TCG Specification[1] recommends extending all active PCR
>> banks, to prevent malicious users from setting unused PCR banks with
>> fake measurements and quoting them.
>>
>> The existing in-kernel interface(tpm_pcr_extend()) expects only a
>> SHA1 digest. To extend all active PCR banks with differing
>> digest sizes, the SHA1 digest is padded with trailing 0's as needed.
>>
>> This patch reuses the defined digest sizes from the crypto subsystem,
>> adding a dependency on CRYPTO_HASH_INFO module.
>>
>> [1] TPM 2.0 Specification referred here is "TCG PC Client Specific
>> Platform Firmware Profile for TPM 2.0"
>
> Tested-by: Kenneth Goldman <kgold-23VcF4HTsmIX0ybBhKVfKdBPR1lH4CV8@public.gmane.org>
>
> I obtained an IMA event log from a Power platform, along with the PCR 10
> value from both the SHA-1 and SHA-256 banks of its Nuvoton TPM 2.0. I
> independently validated that the event log matches the TPM PCR values.
Thank You Ken !!
Thanks & Regards,
- Nayna
>
>
> ------------------------------------------------------------------------------
> Check out the vibrant tech community on one of the world's most
> engaging tech sites, SlashDot.org! http://sdm.link/slashdot
> _______________________________________________
> tpmdd-devel mailing list
> tpmdd-devel-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org
> https://lists.sourceforge.net/lists/listinfo/tpmdd-devel
>
------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, SlashDot.org! http://sdm.link/slashdot
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2017-01-30 10:02 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2017-01-25 22:11 [tpmdd-devel] [PATCH v6 2/2] tpm: enhance TPM 2.0 PCR extend to,support multiple banks Ken Goldman
2017-01-25 22:11 ` [PATCH v6 2/2] tpm: enhance TPM 2.0 PCR extend to, support " Ken Goldman
2017-01-30 10:01 ` [tpmdd-devel] " Nayna
2017-01-30 10:01 ` Nayna
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.