Hacker News Reader

Comment by codedokode | Hacker News Reader

I read a little about BitLocker. It seems to store the encryption key in TPM and acquire it automatically after boot. I wonder, can encryption key be extracted by inserting a rogue PCIe card and reading it from memory, or by inserting a rogue DDR memory card with a backdoor to read the key from it, or by sniffing CPU - TPM bus?

View on HN

Sniffing the TPM's been available for quite some time, actually - and quite cheap!

https://pulsesecurity.co.nz/articles/TPM-sniffing

The best way would be to arguably keep the key completely off the TPM and use remote attestation. There's some preboot products out there like WinMagic SecureDoc* that use a little Linux partition, spin up just enough to get a network connection up to a remote server, provide authentication services, and then send the Bitlocker key down, unlock the partition, and chainload onwards to Windows.

* I acquired an enterprise device on eBay and was VERY surprised to find this product on it as the preboot protector. Zero way to crack in from my end, so I applaud it. There's even some MFA solutions they offer around this! https://winmagic.com/en/solutions/mfa-windows-login/

Something I've never understood about TPM attestation, is what happens if you plug the TPM into a microcontroller and give it all the same measurements that it would normally receive during a normal boot? Would that let you spoof attestations?

Yes, you should be able to. In essence, the state of the TPM is represented in the values of the PCRs (Platform Configuration Registers). Those are hash-extended through the boot process.

You can create a key or similar attribute which has an unlock policy based on those PCR values. If you play back the log of PCR write events from first principles (the log can be captured for debug purposes), you'll put the TPM into the same state and should be able to use anything protected by the respective policy.

For attestation, I presume you're thinking about sending an attested PCR quote - in that case, the TPM uses a non-extractable key to sign the current PCR states. As you can put the PCRs into the "correct" state, you'd be able to get a signed attestation the system is in that state.

TPM-only saves you against someone pulling your drive. Probably more than enough for a USB drive. Enable startup PIN if you’re worried about someone grabbing the whole laptop.

I think it does not make much sense to protect the USB drive, as you won't be able to access it from another computer which is what USB drives are for. It makes sense to protect interval drives, but it is unlikely that someone would remove the drives and leave an expensive laptop to the owner.

I think of TPM-only more like a privacy lock than a deadbolt.

An encrypted external drive though works like a safe. Put things in there you want to keep safe but don’t need every day. Air gapped while not in use makes it even more safe.

I'm asking about TPM attestation in general, not Bitlocker

Yes.

Some modern CPUs have moved the TPM inside the CPU itself. But traditionally, TPMs were attached via the LPC (low pin-count) bus, and you could absolutely sniff them or de-solder them and arbitrarily MiTM.

yes sniffing is possible, for now im waiting for some pluton variant to start making its way into the chip and die stream.

the concept is to shield the TPM its bus, and any keys whith the CPU chip.

Current TPMs already have the ability to encrypted the comms to the CPU. Motherboard manufacturers just don't bother implementing it.

Pluton is about physically placing the TPM behind the CPU die, its more than a SoC it eliminates the possibility of getting to the TPM at all, you wont be able to drill into the chip to access bus lines without mangleing the whole thing.

no sniffing would be possible after Pluton chips, even if you could decrypt.

but as i said, for now you can still sniff.

Oh yes but you shouldn't have to be able to do that. If the TPM2 spec were properly implemented.

Physical hardening and protocol hardening are complementary features, not alternatives. It's better to have both in case one of them has a flaw.

Ps I'm not very sold on having this stuff in the CPU, there's so much industry focus on giving up control to big tech. I don't want to get to the situation we already have on mobile where having root on my own system is considered a bad thing. I trust myself one hell of a lot more than Google or Microsoft.

Reply on news.ycombinator.com