Slide 1
Slide 1 text
Remote Attestation in
MicroOS
A tale of TPMs, measurements and
Keylime
openSUSE Conference
[email protected]
oSC22 @openSUSE
Slide 2
Slide 2 text
The wonderful world of TPMs
Slide 3
Slide 3 text
Introduction to TPM
●
Trusted Platform Modules are here since
2009, or on other forms since the 90s
●
Cryptographic co-processor
– Already present in server, desktops, tables and
phones in one version or another (v1.2, v2.0)
– Algorithm independent (v2.0)
Slide 4
Slide 4 text
Introduction to TPM (2)
●
Super cheap (AKA slow)
●
Inside motherboard, CPU or firmware
(UEFI)
– Not a goal: Immune to physical attacks (leave
to manufactures. Differentiation)
– Goal: Safe from software attacks
Slide 5
Slide 5 text
No content
Slide 6
Slide 6 text
TPM features
●
Identification of devices
– Endorsement key (EK) generate multiple
attestation keys (AK)
– VPN / SSH authorization
Slide 7
Slide 7 text
TPM features (2)
●
Secure generation of keys (RSA / EC since
v2.0) and RNG
– File / disk encryption
Slide 8
Slide 8 text
TPM features (3)
●
Secure storage of keys
– Private key never leaves the TPM (encrypted
blobs)
Slide 9
Slide 9 text
TPM features (4)
●
NVRAM storage
– Survives reboot (to use keys required early in
the boot process)
– Because TPM cannot access anything
external, NVRAM can be used as a local
storage for symmetric encryption
Slide 10
Slide 10 text
Main feature
●
Measured boot (device-health attestation)
●
[24 x N] Platform Configuration Registers (PCR)
– Cleared after a reset cycle (or under demand) to a
good known value (0x00...0, 0x11...1)
– Cannot be written with a specific value, only
extended: PCR ← Hash(PCR || Value)
Slide 11
Slide 11 text
Main feature (2)
●
One stage in the boot chain measure the
next stage before delegating, and extend
one PCR
– TPM cannot access the system, so is the
application who does the extension
– It is registered in the event log
Slide 12
Slide 12 text
Main feature (3)
●
Request to the TPM a signed “quote”
– Current values of the PCRs
Slide 13
Slide 13 text
PCR extension
Slide 14
Slide 14 text
Why is it safe?
●
If we know the final value of a PCR, we
cannot calculate the hash that will
replicate the final value after the extension
●
We cannot spoof the quote, as it is signed
by a key (AK) where the private part never
leaves the TPM (but can be removed)
Slide 15
Slide 15 text
Why is it safe? (2)
●
A nonce is required to avoid reuse of old
quotes.
●
The only assumption done is that we must
trust the TPM certificate (that is why the
TPM is also known as a root of trust)
Slide 16
Slide 16 text
TPM Software Stack (TSS)
Slide 17
Slide 17 text
TPM tools in the secret API
● tpm2 / tss binaries for almost 140
commands (a-la busybox)
●
Full PoC for remote attestation (check
tpm2-software.github.com)
Slide 18
Slide 18 text
TPM tools in the secret API (2)
●
Under active development. Many changes,
the current version (v5.2) is not backward
compatible
●
Excellent for prototypes, and even full
projects (Keylime)
Slide 19
Slide 19 text
Remote Attestation with Keylime
Slide 20
Slide 20 text
Keylime features
●
Remote attestation
– Measured boot
– Runtime execution (IMA / EVM)
●
Encrypted payload
Slide 21
Slide 21 text
Keylime features (2)
●
Revocation framework with user defined
plugins
●
Rest API for different clients (Python, Rust)
●
Integrated in MicroOS (YaST role)
Slide 22
Slide 22 text
Keylime architecture
Slide 23
Slide 23 text
Keylime uses
●
Check if a set of PCRs have a golden value
●
Validate the measured boot event log
(recreate and compare)
●
Use an user-defined policy to validate the
event log (Python plugin)
Slide 24
Slide 24 text
Keylime uses (2)
●
Generate good hashes for binaries and use
IMA + TPM to monitor them
●
Deliver encrypted payload to all the agents
●
Trigger actions (Python) when a node gets
revoked
Slide 25
Slide 25 text
YaST system role
Slide 26
Slide 26 text
Demo
Slide 27
Slide 27 text
Next steps
Slide 28
Slide 28 text
Still in the TODO
●
Signed white list for IMA hashes
– Patch in createrepo_c, maybe in OBS
●
IMA policy based on SELinux to filter what
to track