A Practical Guide to TPM 2.0: Using the New Trusted Platform Module in the New Age of Security Will Arthur & David Challener

A Practical Guide to TPM 2.0: Using the New Trusted Platform Module in the New Age of Security Will Arthur & David Challener

by Will Arthur, David Challener, Kenneth Goldman
Released January 2015
Publisher(s): Apress
ISBN: 9781430265849

Read it now on the O’Reilly learning platform with a 10-day free trial.

O’Reilly members get unlimited access to books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.

Start your free trial

Book description

A Practical Guide to TPM 2.0: Using the Trusted Platform Module in the New Age of Security is a straight-forward primer for developers. It shows security and TPM concepts, demonstrating their use in real applications that the reader can try out.

Simply put, this book is designed to empower and excite the programming community to go out and do cool things with the TPM. The approach is to ramp the reader up quickly and keep their interest.A Practical Guide to TPM 2.0: Using the Trusted Platform Module in the New Age of Security explains security concepts, describes the TPM 2.0 architecture, and provides code and pseudo-code examples in parallel, from very simple concepts and code to highly complex concepts and pseudo-code.

The book includes instructions for the available execution environments and real code examples to get readers up and talking to the TPM quickly. The authors then help the users expand on that with pseudo-code descriptions of useful applications using the TPM.

Table of contents

  1. Cover
  2. Title
  3. Copyright
  4. About ApressOpen
  5. Dedication
  6. Contents at a Glance
  7. Contents
  8. About the Authors
  9. About the Technical Reviewers
  10. Acknowledgments
  11. Introduction
  12. Chapter 1: History of the TPM
    1. Why a TPM?
    2. History of Development of the TPM Specification from 1.1b to 1.2
    3. How TPM 2.0 Developed from TPM 1.2
    4. History of TPM 2.0 Specification Development
    5. Summary
  13. Chapter 2: Basic Security Concepts
    1. Cryptographic Attacks
      1. Brute Force
      2. Attacks on the Algorithm Itself
    2. Security Definitions
    3. Cryptographic Families
      1. Secure Hash (or Digest)
      2. Hash Extend
      3. HMAC: Message Authentication Code
      4. KDF: Key Derivation Function
      5. Authentication or Authorization Ticket
      6. Symmetric-Encryption Key
      7. Nonce
      8. Asymmetric Keys
    4. Public Key Certification
    5. Summary
  14. Chapter 3: Quick Tutorial on TPM 2.0
    1. Scenarios for Using TPM 1.2
      1. Identification
      2. Encryption
      3. Key Storage
      4. Random Number Generator
      5. NVRAM Storage
      6. Platform Configuration Registers
      7. Privacy Enablement
    2. Scenarios for Using Additional TPM 2.0 Capabilities
      1. Algorithm Agility (New in 2.0)
      2. Enhanced Authorization (New in 2.0)
      3. Quick Key Loading (new in 2.0)
      4. Non-Brittle PCRs (New in 2.0)
      5. Flexible Management (New in 2.0)
      6. Identifying Resources by Name (New in 2.0)
    3. Summary
  15. Chapter 4: Existing Applications That Use TPMs
    1. Application Interfaces Used to Talk to TPMs
    2. TPM Administration and WMI
      1. The Platform Crypto Provider
      2. Virtual Smart Card
    3. Applications That Use TPMs
    4. Applications That Should Use the TPM but Don’t
    5. Building Applications for TPM 1.2
    6. TSS.Net and TSS.C++
    7. Wave Systems Embassy Suite
    8. Rocks to Avoid When Developing TPM Applications
      1. Microsoft BitLocker
      2. IBM File and Folder Encryption
    9. New Manageability Solutions in TPM 2.0
    10. Summary
  16. Chapter 5: Navigating the Specification
    1. TPM 2.0 Library Specification: The Parts
    2. Some Definitions
      1. General Definitions
      2. Definitions of the Major Fields of the Command Byte Stream
      3. Definitions of the Major Fields of the Response Byte Stream
    3. Getting Started in Part 3: the Commands
    4. Data Details
      1. Common Structure Constructs
      2. Structure with Union
      3. Canonicalization
      4. Endianness
    5. Part 2: Notation Syntax
    6. Part 3: Table Decorations
    7. Commonly Used Sections of the Specification
    8. How to Find Information in the Specification
    9. Strategies for Ramping Up on TPM 2.0
      1. Will
      2. Ken
      3. Dave
    10. Other TPM 2.0 Specifications
    11. Summary
  17. Chapter 6: Execution Environment
    1. Setting Up the TPM
      1. Microsoft Simulator
      2. Building the Simulator from Source Code
      3. Setting Up a Binary Version of the Simulator
      4. Running the Simulator
      5. Testing the Simulator
    2. Setting Up the Software Stack
      1. TSS 2.0
      2. TSS.net
    3. Summary
  18. Chapter 7: TPM Software Stack
    1. The Stack: a High-Level View
    2. Feature API
    3. System API
      1. Command Context Allocation Functions
      2. Command Preparation Functions
      3. Command Execution Functions
      4. Command Completion Functions
      5. Simple Code Example
      6. System API Test Code
    4. TCTI
    5. TPM Access Broker (TAB)
    6. Resource Manager
    7. Device Driver
    8. Summary
  19. Chapter 8: TPM Entities
    1. Permanent Entities
      1. Persistent Hierarchies
      2. Ephemeral Hierarchy
      3. Dictionary Attack Lockout Reset
      4. Platform Configuration Registers (PCRs)
      5. Reserved Handles
      6. Password Authorization Session
      7. Platform NV Enable
    2. Nonvolatile Indexes
    3. Objects
    4. Nonpersistent Entities
    5. Persistent Entities
    6. Entity Names
    7. Summary
  20. Chapter 9: Hierarchies
    1. Three Persistent Hierarchies
      1. Platform Hierarchy
      2. Storage Hierarchy
      3. Endorsement Hierarchy
    2. Privacy
      1. Activating a Credential
      2. Other Privacy Considerations
    3. NULL Hierarchy
    4. Cryptographic Primitives
      1. Random Number Generator
      2. Digest Primitives
      3. HMAC Primitives
      4. RSA Primitives
      5. Symmetric Key Primitives
    5. Summary
  21. Chapter 10: Keys
    1. Key Commands
    2. Key Generator
    3. Primary Keys and Seeds
    4. Persistence of Keys
    5. Key Cache
    6. Key Authorization
    7. Key Destruction
    8. Key Hierarchy
    9. Key Types and Attributes
      1. Symmetric and Asymmetric Keys Attributes
      2. Duplication Attributes
      3. Restricted Signing Key
      4. Restricted Decryption Key
    10. Context Management vs. Loading
    11. NULL Hierarchy
    12. Certification
    13. Keys Unraveled
    14. Summary
  22. Chapter 11: NV Indexes
    1. NV Ordinary Index
      1. NV Counter Index
      2. NV Bit Field Index
      3. NV Extend Index
      4. Hybrid Index
      5. NV Access Controls
      6. NV Written
      7. NV Index Handle Values
      8. NV Names
      9. NV Password
    2. Separate Commands
    3. Summary
  23. Chapter 12: Platform Configuration Registers
    1. PCR Value
      1. Number of PCRs
      2. PCR Commands
      3. PCRs for Authorization
    2. PCRs for Attestation
      1. PCR Quote in Detail
      2. PCR Attributes
      3. PCR Authorization and Policy
      4. PCR Algorithms
    3. Summary
  24. Chapter 13: Authorizations and Sessions
    1. Session-Related Definitions
    2. Password, HMAC, and Policy Sessions: What Are They?
    3. Session and Authorization: Compared and Contrasted
    4. Authorization Roles
    5. Command and Response Authorization Area Details
      1. Command Authorization Area
      2. Command Authorization Structures
      3. Response Authorization Structures
    6. Password Authorization: The Simplest Authorization
      1. Password Authorization Lifecycle
      2. Creating a Password Authorized Entity
      3. Changing a Password Authorization for an Already Created Entity
      4. Using a Password Authorization
      5. Code Example: Password Session
    7. Starting HMAC and Policy Sessions
      1. TPM2_StartAuthSession Command
      2. Session Key and HMAC Key Details
      3. Guidelines for TPM2_StartAuthSession Handles and Parameters
      4. Session Variations
    8. HMAC and Policy Sessions: Differences
    9. HMAC Authorization
      1. HMAC Authorization Lifecycle
      2. HMAC and Policy Session Code Example
      3. Using an HMAC Session to Send Multiple Commands (Rolling Nonces)
      4. HMAC Session Security
      5. HMAC Session Data Structure
    10. Policy Authorization
      1. How Does EA Work?
      2. Policy Authorization Time Intervals
      3. Policy Authorization Lifecycle
    11. Combined Authorization Lifecycle
    12. Summary
  25. Chapter 14: Extended Authorization (EA) Policies
    1. Policies and Passwords
    2. Why Extended Authorization?
      1. Multiple Varieties of Authentication
      2. Multifactor Authentication
    3. How Extended Authorization Works
    4. Creating Policies
      1. Simple Assertion Policies
    5. Command-Based Assertions
    6. Multifactor Authentication
      1. Example 1: Smart card and Password
    7. Compound Policies: Using Logical OR in a Policy
      1. Making a Compound Policy
      2. Example: A Policy for Work or Home Computers
    8. Considerations in Creating Policies
      1. End User Role
      2. Administrator Role
      3. Understudy Role
      4. Office Role
      5. Home Role
    9. Using a Policy to Authorize a Command
      1. Starting the Policy
      2. Satisfying a Policy
      3. If the Policy Is Compound
      4. If the Policy Is Flexible (Uses a Wild Card)
    10. Certified Policies
    11. Summary
  26. Chapter 15: Key Management
    1. Key Generation
      1. Templates
    2. Key Trees: Keeping Keys in a Tree with the Same Algorithm Set
    3. Duplication
    4. Key Distribution
    5. Key Activation
    6. Key Destruction
    7. Putting It All Together
      1. Example 1: Simple Key Management
      2. Example 2: An Enterprise IT Organization with Windows TPM 2.0 Enabled Systems
    8. Summary
  27. Chapter 16: Auditing TPM Commands
    1. Why Audit
    2. Audit Commands
    3. Audit Types
      1. Command Audit
      2. Session Audit
    4. Audit Log
    5. Audit Data
    6. Exclusive Audit
    7. Summary
  28. Chapter 17: Decrypt/Encrypt Sessions
    1. What Do Encrypt/Decrypt Sessions Do?
    2. Practical Use Cases
    3. Decrypt/Encrypt Limitations
    4. Decrypt/Encrypt Setup
      1. Pseudocode Flow
      2. Sample Code
    5. Summary
  29. Chapter 18: Context Management
    1. TAB and the Resource Manager: A High-Level Description
      1. TAB
      2. Resource Manager
      3. Resource Manager Operations
    2. Management of Objects, Sessions, and Sequences
      1. TPM Context-Management Features
      2. Special Rules Related to Power and Shutdown Events
      3. State Diagrams
    3. Summary
  30. Chapter 19: Startup, Shutdown, and Provisioning
    1. Startup and Shutdown
      1. Startup Initialization
    2. Provisioning
      1. TPM Manufacturer Provisioning
      2. Platform OEM Provisioning
      3. End User Provisioning
      4. Deprovisioning
    3. Summary
  31. Chapter 20: Debugging
    1. Low-Level Application Debugging
      1. The Problem
      2. Analyze the Error Code
      3. Debug Trace Analysis
      4. More Complex Errors
      5. Last Resort
    2. Common Bugs
    3. Debugging High-level Applications
      1. Debug Process
      2. Typical Bugs
    4. Summary
  32. Chapter 21: Solving Bigger Problems with the TPM 2.0
    1. Remote Provisioning of PCs with IDevIDs Using the EK
      1. Technique 1
      2. Technique 2
      3. Technique 3
    2. Data Backups
    3. Separation of Privilege
    4. Securing a Server’s Logon
    5. Locking Firmware in an Embedded System, but Allowing for Upgrades
    6. Summary
  33. Chapter 22: Platform Security Technologies That Use TPM 2.0
    1. The Three Technologies
      1. Some Terms
    2. Intel® Trusted Execution Technology (Intel® TXT)
      1. High-Level Description
      2. How TPM 2.0 Devices Are Used
    3. ARM® TrustZone®
      1. High-Level Description
      2. Implementation of TrustZone
    4. AMD Secure Technology™
      1. Hardware Validated Boot
      2. TPM on an AMD Platform
      3. SKINIT
    5. Summary
  34. Index

Product information

  • Title: A Practical Guide to TPM 2.0: Using the New Trusted Platform Module in the New Age of Security Will Arthur & David Challener
  • Author(s): Will Arthur, David Challener, Kenneth Goldman
  • Release date: January 2015
  • Publisher(s): Apress
  • ISBN: 9781430265849