David Wooten
Partner Architect
Microsoft Corp.
david.wooten@microsoft.com
October 25, 2013

Copyright 2013 Trusted Computing Group1•TPM 2.0 Motivations
Motivations•

Key Hierarchies•

Authorizations•

Miscellaneous

October 25, 2013

Copyright 2013 Trusted Computing Group2••Had toTPM 1.2 uses SHA1 and RSA 2048 as the only fully-supported
algorithms••

SHA1 is no longer considered adequate

RSA is not being recommended for security strengths above 112 bits
Key bits / bit ofRSA Key Size in Bits
Security Strength in Bits
security strength1024

80 (12.5)2048112 (18.3)

3072

SECRET

128 (24)

7680

TOP SECRET

192 (40)

From SP800-57, Table 2

October 25, 2013

Copyright 2013 Trusted Computing Group3

•

Cryptographic signing – for PCR attestation key association•

NV memory – to store an Endorsement Key (EK), SRK, and an EKcertificate•

Key exchange – for certificates from a CA•

Authorization – key usage or unseal•

Key hierarchy – for multiple AIK•

All of these features are supported in TPM 2.0 but in an algorithm agileway

October 25, 2013

Copyright 2013 Trusted Computing Group4••••••••••••

Want to put other platform stuff in the TPM NV (like TXT-related data)
Want a way for the platform manufacturer to use the TPM even if thesystem owner turns the TPM off
Want more monotonic counters
Do not want any monotonic counters
Fix PCR brittlenessFix authorization “substitution” problem
Want a PCR for …
Want complex, multi-factor authorization
Want simple authorization
Want to be able to replace the EK
Want to prevent the EK from being replaced
Want to support other algorithms
my government’sfavorite algorithms
favorite algorithmsOctober 25, 2013

Copyright 2013 Trusted Computing Group

5

•
•

Key Hierarchies••

October 25, 2013

Copyright 2013 Trusted Computing Group6

•Need an EK for identification of the TPM•

Easy when everyone is happy using the same algorithm•

When we need different algorithms, the problem for the TPM
manufacturer gets much harder••

Each key-pair takes up NV memory

What key pair(s) does the TPM vendor install?

October 25, 2013

Copyright 2013 Trusted Computing Group7••

Use one master seed value (Primary Seed) and use KDF togenerate any number of (a)symmetric keys
Allows the asymmetric key derivation to be reproducible•KDF is deterministic•••

When called with the same parameters, the same key is generated
Use Primary Seed and a caller-provided key parameters as inputs to a
standard KDF

The asymmetric keys become ‘aliases’ of the Primary Seed•••

Now TPM may have as many EKs as necessary …
… at the same constant priceLet customer decide which one they want to use

October 25, 2013

Copyright 2013 Trusted Computing Group8

The Primary Seed

KDF is one-way
function (diode)

The EK is derived
from the PS and thekey parameters

October 25, 2013

EKCopyright 2013 Trusted Computing Group9Usually Primary Objects
do not leave the TPM
and are created eachtime they are needed

Any number or types ofkeys may be createdfrom the Primary Seed

RSA

But they can leave TPM inan encrypted context blob

ECCAES

These are all reproducible “aliases”
for the Primary Seed and are called
Primary Keys or Primary Objects
October 25, 2013

Copyright 2013 Trusted Computing Group10•

TPM manufacturer••••Is allowed to inject a primary seedGenerates EKs for various markets and certifies them

TPM is shipped without EK installed

User creates EK using the same template as TPM vendor• Same parameters yield the same key••

User will have an EK that the TPM vendor have certified
User could tell the TPM to make the key persistent••Store in NV

This process is enabled, but NOT mandated, by the spec

October 25, 2013

Copyright 2013 Trusted Computing Group11•A TPM can have from one to three hierarchies••••

Storage hierarchy for general purpose use by the OS (on behalf of the varioususers)
Endorsement hierarchy for TPM identification

Each hierarchy has separate resources•••••

Platform hierarchy for use by the BIOS/SMM/UEFI

A primary seed
An enable flag
An authorization value (authValue)

An authorization policy (authPolicy)

When the enable for the hierarchy is CLEAR, neither the authValue nor theauthPolicy for that hierarchy can be used

October 25, 2013

Copyright 2013 Trusted Computing Group12

PLATFORM

STORAGEENDORSEMENT

To support these three hierarchies, the only persistent storage requiredin the TPM are the three, Primary Seeds – 256-/512-bits each

October 25, 2013

Copyright 2013 Trusted Computing Group13

•

Hierarchies have different lifetimes•••

Storage Primary Seed (SPS) changes when system owner changes
Endorsement hierarchy is created by the TPM vendor and may or may
not change over the lifetime of the TPM••••

Determined by when their Primary Seed changes.

One OEM said they’d like to change the Endorsement Primary Seed (EPS)
when the system comes back for refurbishment
Other OEM said they want to change the EPS when hell freezes overThe command to change the EPS requires platformAuth so the OEM getsto decide when/if the EPS ever changes

Platform Primary Seed (PPS) is installed by the OEM when theplatform is manufactured

October 25, 2013

Copyright 2013 Trusted Computing Group14

As with TPM 1.2, thesensitive portion of the“child” key is only decrypted
when the key is loaded intothe TPM

PrimaryStorage
KeyRSA

October 25, 2013

ECCAES

Copyright 2013 Trusted Computing Group15

•

In TPM 1.2, the “child” keys were encrypted using the asymmetricparent key.

••

In TPM 2.0, the parent has an additional seed value that is used togenerate the symmetric keys used to protect the child keys

••
•

•

Every key load was an asymmetric key operationEncryption and HMAC keys
Each set of keys is unique to the child
Loading a child is a pair of symmetric operations (HMAC and decrypt)

In TPM 2.0, the asymmetric part of a storage key used for secretsharing•••

Key import
Activating an identity
Starting an authorization session

October 25, 2013

Copyright 2013 Trusted Computing Group16

•Each Primary Seed has a command to cause it to change:•••••

TPM2_ChangeEPS() – Endorsement Primary Seed
TPM2_ChangePPS() – Platform Primary Seed

The seeds are changed, not left at zero••

TPM2_Clear() – Storage Primary Seed

Not safe to leave seeds in a state that would cause two TPMs to generate
the same keys

The commands that change the seeds, also flush from TPM memory
any loaded Objects in the associated hierarchy
Also removes from TPM NV any persistent Objects and Indices thatbelong to that hierarchy

October 25, 2013

Copyright 2013 Trusted Computing Group17•••

Authorizations•October 25, 2013

Copyright 2013 Trusted Computing Group18•••

TPM 1.2 has only 3 authorization elements••••••••••

Authorization value
PCR state“Locality” – hardware privilege level
8 total combinations of these simple elements

TPM 2.0 has 12 authorization elements… so far
Authorization value
Locality
Asymmetric signature
Symmetric shared secretTime Limited
Specific Command•
•
•
•
•
•

PCR State“Physical Presence”
Specific objects
Duplication

NV Written
Contents of NVAuthorization elements can be combined using logical constructs(AND / OR) to give fine-grained access control over TPM 2.0 keys
and data•Objects have an authorization value (authValue) and my have anauthorization policy. (authPolicy)••

authValue is in the sensitive area in an object and can be changed
authPolicy is in the public part of the object and cannot be changed•••

Its like the PCRinfo of a TPM 1.2 key

When authorizing using the authValue, can use an HMAC session orprovide the authValue as a clear-text password
When authorizing using an authPolicy, the TPM compares anaccumulated policy hash against the authPolicy of the object••Similar to how a TPM 1.2 creates a digest of selected PCR andcompares the digest to the value in the object’s PCRinfo
Difference is, the digest is an accumulation of extend values based on
satisfying policy commands.

October 25, 2013

Copyright 2013 Trusted Computing Group20

•

Use TPM2_StartAuthSession()

••

•
•
•

This command is a bit of a combination of TPM_OIAP, TPM_OSAP, and
TPM_EstablishTransportSession.
Indicate if the session is going to be used for HMAC or policyauthorizations

For an authorization using the authValue, use an HMAC like theOIAP or OSAPFor policy authorizations, build the policyHash in the session byexecuting specific policy commands
When the proper sequence of policy commands has been executed,
the policyHash accumulated in the session context will match theauthPolicy of an object

October 25, 2013

Copyright 2013 Trusted Computing Group21

•

Want to mimic the use of PCR for authorization and also provide anauthorization secret•

Need to know what value to use for the authPolicy of the object•Start a “trial” policy session••

TPM2_StartAuthSession(sessionType == TPM_SE_TRIAL)

Execute TPM2_PolicyPCR() with the handle of the trial policy
session as policySession

October 25, 2013

Copyright 2013 Trusted Computing Group22•

TPM2_PolicyPCR() causes the TPM to update the policyDigest

policyDigestnew ≔ H(policyDigestold || TPM_CC_PolicyPCR || pcrs || digestTPM)
Table 121 — TPM2_PolicyPCR CommandTypeName

TPMI_ST_COMMAND_TAG tag
UINT32
TPM_CC

commandSize
commandCode

TPMI_SH_POLICY

policySession

TPM2B_DIGEST

pcrDigestTPML_PCR_SELECTION

pcrs

October 25, 2013

Description
TPM_ST_SESSIONS if an audit or encryptedsession
ispresent;
otherwise,
TPM_ST_NO_SESSIONSTPM_CC_PolicyPCR

handle for the policy session being extended
Auth Index: None
expected digest value of the selected PCR using
the hash algorithm of the session; may be zero
lengththe PCR to include in the check digest

Copyright 2013 Trusted Computing Group23

•

TPM updates the policyDigest
policyDigestnew ≔ Hi(policyDigestold || TPM_CC_PolicyAuthValue)

Table 145 — TPM2_PolicyGetDigest CommandTypeNameTPMI_ST_COMMAND_TAG tag

UINT32
TPM_CC

commandSize
commandCode

TPMI_SH_POLICY

policySession

October 25, 2013

Description
TPM_ST_SESSIONS if an audit session ispresent; otherwise, TPM_ST_NO_SESSIONSTPM_CC_PolicyAuthValue
handle for the policy session being extended
Auth Index: None

Copyright 2013 Trusted Computing Group24

•

Read the computed policyDigest ( TPM2_PolicyGetDigest()) anduse that as the authPolicy of the created object
Table 184 — Definition of TPMT_PUBLIC Structure
Parameter
typenameAlg

Type
TPMI_ALG_PUBLIC+TPMI_ALG_HASHobjectAttributes

TPMA_OBJECT

authPolicy

TPM2B_DIGEST

Description“algorithm” associated with this object
algorithm used for computing the Name of the object
NOTE The "+" indicates that the instance of a
TPMT_PUBLIC may have a "+" to indicate thatthe nameAlg may be TPM_ALG_NULL.
attributes that, along with type, determine themanipulations of this object
optional policy for using this key
The policy is computed using the nameAlg of theobject.

[type]parameters TPMU_PUBLIC_PARMS[type]unique
TPMU_PUBLIC_ID

NOTE Shall be the Empty Buffer if no authorizationpolicy is present.
the algorithm or structure details
the unique identifier of the structure
For an asymmetric key, this would be the public key.

October 25, 2013

Copyright 2013 Trusted Computing Group25

•To use the policy do it all over again, but this time for real•••••

TPM2_StartAuthSession(sessionType == TPM_SE_POLICY)
TPM2_PolicyPCR()
TPM2_PolicyAuthValue()If the PCR have the desired value, then the policyDigest will havethe same value as the authPolicy of the object

Use the policy session as the authorization session to use the object

October 25, 2013

Copyright 2013 Trusted Computing Group26

•
•
•

•

Miscellaneous

October 25, 2013

Copyright 2013 Trusted Computing Group27

••

TPM 1.2 has no notion of time
TPM 2.0 has two time values that advance as long as the TPM ispowered•••

Timer – reset on each TPM Reset

Clock – reset on each TPM Clear

Time values periodically saved to NV memory•

No less often that 212 seconds (~68 minutes)

October 25, 2013

Copyright 2013 Trusted Computing Group28

••

TPM 1.2 has an NV Index that has no special capabilities other thanauthorized access for read or write
TPM 2.0 adds function-specific Index types:

••
•

•

Extend – works like a PCR

Bits – SET but not CLEAR for revocation
Counter – replaces the monotonic counter in 1.2

TPM 2.0 has “orderly” Indexes•

RAM-backed so that they can be updated at high frequency without
danger of NV wear out

October 25, 2013

Copyright 2013 Trusted Computing Group29

•

TPM 1.2 has special purpose signing keys, such as AIK•

TPM 2.0 signing keys can be used more generally••An unrestricted key will sign anything
A restricted key will only sign a digest done by the TPM•••An internally-generated data structure has a special value as it firstbytes
When TPM does a hash of externally-provided data, it will verify thatthe first bytes don’t have this special value

Among other things, this lets the TPM sign a PKCS#10 certificate
request with a key that is used for attestation

October 25, 2013

Copyright 2013 Trusted Computing Group30

•

TPM 1.2 certificate protocol (TPM_ActivateIdentity()) would only
work with restricted set of keys•

•EK, SRK, and an AIK that is a child of the SRK

TPM 2.0 is more generalized•••

The decryption can be done by any key and not just the EK
The “credentialed” key can be any key and not just an AIK

Let’s any decryption key with a certificate be used to associate acredential with any other key.

October 25, 2013

Copyright 2013 Trusted Computing Group31

•

In TPM 1.2, there were several commands relating to migration•••••••••••

TPM_CreateMigratinoBlob
TPM_ConvertMigrationBlob

TPM_AuthorizeMigrationKey
TPM_MIgrateKey
TPM_CMK_SetRestrictions
TPM_CMK_AppoveMA
TPM_CMK_CreateKey

TPM_CMK_CreateTicket
TPM_CMK_CreateBlob
TPM_CMK_ConvertMigration

In TPM 2.0, there are two commands for duplication••

TPM2_Duplicate
TPM2_Import

October 25, 2013

Copyright 2013 Trusted Computing Group32

••

TPM 2.0 development was necessitated by choice of TPM 1.2
cryptographic functions
Engineers took the opportunity to do a major overhaul of the TPM
2.0 architecture to:••

Reduce the chances that TPM 3.0 will be need because of cryptographicissuesUsed the 10 years of experience with TPM 1.2 to indicate what extra
functions should be added and what functions should be removed

October 25, 2013

Copyright 2013 Trusted Computing Group33

October 25, 2013

Copyright 2013 Trusted Computing Group34

October 25, 2013

Copyright 2013 Trusted Computing Group35