[PATCH v4 0/7] add integrity and security to TPM2 transactions

[James Bottomley]

On Wed, 2018-10-24 at 03:06 +0300, Jarkko Sakkinen wrote:
> On Mon, 22 Oct 2018, Ken Goldman wrote:
> > Does this design assume that there was at time zero no monitoring?
> > This would permit some shared secret to be established.
> > 
> > Or does it assume that the interception may have been present from
> > the first boot?  If so, how is the first shared secret established.
> > Salting using the EK is the usual method, but this requires walking
> > the EK certificate chain and embedding the TPM vendor CA
> > certificates in the kernel.
> 
> Kernel gets the public portion EK and uses its own key pair in its
> own end so everything should be good, right?

Only if we pass it in.  The kernel can't run an X509 proof on the EK
certificate, which is how you verify the EK:  Usually the X509 cert is
RSA, and for speed and efficiency we're salting with Elliptic Curve
keys, so we'd have to derive the RSA EK primary (which can take up to
60 seconds), verify the same public key as the cert and then chain up
to the manufacturer. Then we'd have to use the RSA keys (so a lot more
code) because we can't trust the TPM not to lie about the RSA public
key but then substitute it's own EC primary. We really don't want to be
trying to do all that on boot.

James