Rafal Wojtczuk and Joanna Rutkowska - Black Hat
Rafal Wojtczuk and Joanna Rutkowska - Black Hat Rafal Wojtczuk and Joanna Rutkowska - Black Hat
PCR “extend” operation PCRN+1 = SHA-1 (PCRN + Value) A single PCR can be extended multiple times It is computationally infeasible to set PCR to a specified value (ext(A), ext(B)) ≠ (ext(B), ext(A))
TPM: Seal/Unseal Operation 0x12345678abcdef01 PCR 17 secret (key) sealing 0x22443dd937495955 PCR 18 TPM 0xaaa9244ff3445574 PCR 19 secret (key) unsealing
- Page 1: Attacking Intel ® Trusted Executio
- Page 4 and 5: Intel ® Trusted Execution Technolo
- Page 6 and 7: TPM 1.2 Passive I/O device (master-
- Page 10 and 11: TPM seal/unseal example # echo 'Sec
- Page 12 and 13: Both seal/unseal and quote operatio
- Page 14 and 15: BIOS ROM BIOS FLASH BOOT LOADER OS
- Page 16 and 17: Example #1: Disk Encryption Disk en
- Page 18 and 19: So, a malware can sniff it…
- Page 20 and 21: Example #2: User’s Picture Test :
- Page 22 and 23: Problems with SRTM
- Page 24 and 25: Dynamic Root of Trust Measurement (
- Page 26 and 27: A VMM we want to load (Currently un
- Page 28 and 29: TXT bottom line TXT late launch can
- Page 30 and 31: GRUB (1 st stage) GRUB (2 nd stage)
- Page 32: First we start “trusted” Xen (b
- Page 36 and 37: Thanks to tboot only when the trust
- Page 38: Tboot Demo #1: sealing to a trusted
- Page 42 and 43: SENTER is not obligatory!!! TXT and
- Page 44 and 45: Why would a user or an attacker be
- Page 46 and 47: AMD Presidio AMD’s technology sim
- Page 48 and 49: SRTM/DRTM (launch-time protection)
- Page 50 and 51: TXT: exciting new technology with g
- Page 52 and 53: Q: What is more privileged than a k
- Page 54 and 55: Introducing “Ring -2” SMM can a
- Page 56 and 57: SMM vs. TXT?
TPM: Seal/Unseal Operation<br />
0x12345678abcdef01<br />
PCR 17<br />
secret (key)<br />
sealing<br />
0x22443dd937495955<br />
PCR 18<br />
TPM<br />
0xaaa9244ff3445574<br />
PCR 19<br />
secret (key)<br />
unsealing
Change language