Time-Based Uni-Directional Attestation
draft-birkholz-tuda-00
The information below is for an old version of the document.
Document | Type |
This is an older version of an Internet-Draft whose latest revision state is "Replaced".
|
|
---|---|---|---|
Authors | Andreas Fuchs , Henk Birkholz , Ira McDonald , Carsten Bormann | ||
Last updated | 2015-10-19 | ||
Replaced by | draft-birkholz-i2nsf-tuda | ||
RFC stream | (None) | ||
Formats | |||
Additional resources | |||
Stream | Stream state | (No stream defined) | |
Consensus boilerplate | Unknown | ||
RFC Editor Note | (None) | ||
IESG | IESG state | I-D Exists | |
Telechat date | (None) | ||
Responsible AD | (None) | ||
Send notices to | (None) |
draft-birkholz-tuda-00
Network Working Group A. Fuchs Internet-Draft H. Birkholz Intended status: Informational Fraunhofer SIT Expires: April 21, 2016 I. McDonald High North Inc C. Bormann Universitaet Bremen TZI October 19, 2015 Time-Based Uni-Directional Attestation draft-birkholz-tuda-00 Abstract This memo documents the method and bindings used to conduct time- based unidirectional attestation between distinguishable endpoints over the network. Status of This Memo This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet- Drafts is at http://datatracker.ietf.org/drafts/current/. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." This Internet-Draft will expire on April 21, 2016. Copyright Notice Copyright (c) 2015 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of Fuchs, et al. Expires April 21, 2016 [Page 1] Internet-Draft tuda October 2015 the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License. Table of Contents 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 1.1. Terminology . . . . . . . . . . . . . . . . . . . . . . . 3 2. Time-Based Uni-Directional Attestation . . . . . . . . . . . 4 2.1. Attestation Element Update Cycles . . . . . . . . . . . . 6 3. Realisation Approaches . . . . . . . . . . . . . . . . . . . 8 3.1. SNMP . . . . . . . . . . . . . . . . . . . . . . . . . . 8 3.2. REST . . . . . . . . . . . . . . . . . . . . . . . . . . 11 4. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 11 5. Security Considerations . . . . . . . . . . . . . . . . . . . 11 6. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 11 7. Change Log . . . . . . . . . . . . . . . . . . . . . . . . . 11 8. Contributors . . . . . . . . . . . . . . . . . . . . . . . . 12 9. Informative References . . . . . . . . . . . . . . . . . . . 12 Appendix A. Realization with TPM 1.2 functions . . . . . . . . . 14 A.1. TPM Functions . . . . . . . . . . . . . . . . . . . . . . 14 A.1.1. Tick-Session and Tick-Stamp . . . . . . . . . . . . . 14 A.1.2. Platform Configuration Registers (PCRs) . . . . . . . 15 A.1.3. PCR restricted Keys . . . . . . . . . . . . . . . . . 15 A.1.4. CertifyInfo . . . . . . . . . . . . . . . . . . . . . 15 A.2. Protocol and Procedure . . . . . . . . . . . . . . . . . 16 A.2.1. AIK and AIK Certificate . . . . . . . . . . . . . . . 16 A.2.2. Synchronization Token . . . . . . . . . . . . . . . . 17 A.2.3. RestrictionInfo . . . . . . . . . . . . . . . . . . . 19 A.2.4. Measurement Log . . . . . . . . . . . . . . . . . . . 21 A.2.5. Implicit Attestation . . . . . . . . . . . . . . . . 22 A.2.6. Attestation Verification Approach . . . . . . . . . . 23 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 25 1. Introduction In many contexts and scenarios it is not feasible to deploy bi- directional protocols, due to constraints in the underlying communication schemes. Furthermore, many communication schemes do not have a notion of connection, which disallows the usage of connection context related state information. These constraints may make it impossible to deploy challenge-response based schemes to achieve freshness of messages in security protocols. Examples of these constrained environments include broadcast and multicast schemes such as automotive IEEE802.1p as well as communication models that do not maintain connection state over time, such as REST [REST] and SNMP [RFC3411]. Fuchs, et al. Expires April 21, 2016 [Page 2] Internet-Draft tuda October 2015 The protocols usually employed - such as the Platform Trust Service (PTS) Protocol [PTS] - for Remote Attestations using the Trusted Platform Module (TPM) as specified by the Trusted Computing Group (TCG) are based upon the TPM_Quote() function. It consists of the sending of a nonce-challenge that is then used within TPM_Quote()'s signature to prove the freshness of the Attestation response. This scheme requires bi-directional communication. This specification describes a new scheme for Remote Attestations based upon a combination of TPM_CertifyInfo() and TPM_TickStampBlob() to implement a time-based attestation scheme. The approach is based upon the work described in [MTAF] and [SFKE2008]. The freshness properties of a challenge-response based protocol define the time- frame between the transmission of the nonce and the reception of the response as the point in time of attestation. Given the time-based attestation scheme, the point in time of attestation lies within the time-frame given by the accuracy of the time-synchronization and the drift of clocks. If the point in time is within the range of the typical round-trip of a challenge response attestation, the freshness property of TUDA is equivalent to that of classic challenge response attestation. Even if the typical round-trip time is exceeded slightly, the TUDA attestation statements provide sufficiently fresh proofs for most scenarios. In contrast to classical attestations, TUDA attestations can serve as proof of integrity in audit logs with point in time guarantees. Also, it can be used via uni-directional and connection-less communication channels. Appendix A contains a realization of TUDA using TPM 1.2 primitives. TODO: TPM 2.0 follows next year. 1.1. Terminology This specification makes use of the terminology defined in [RFC4949]. This specification uses CDDL as defined in [I-D.greevenbosch-appsawg-cbor-cddl]. The specific data structures defined by this specification for use by other specifications are: tuda = [TUDA-Synctoken, TUDA-Verifytoken, TUDA-RestrictionInfo, TUDA-Cert, TUDA-Measurement-Log] Common types used in these are: Cert = bytes ; an X.509 certificate PCR-Hash = Hash Hash = bytes Fuchs, et al. Expires April 21, 2016 [Page 3] Internet-Draft tuda October 2015 The roles used in this document are: Attestee: the endpoint that is the subject of the attestation to another endpoint. Verifier: the endpoint that consumes the attestation of another endpoint. TSA: Time Stamp Authority [RFC3161]. TSA-CA: a Certificate Authority, that provides the certificate for the TSA. AIK-CA: The Attestation Identity Key (AIK) is a special key type used within TPMs for identity-related operations (such as TPM_Certify or TPM_Quote). Such an AIK can be established in many ways, using either a combination of TPM_MakeIdentity and TPM_ActivateIdentity with a so-called PrivacyCA [AIK-Enrollment] or by means of TPM_CreateWrapKey, readout in a secure environment and regular certification by a custom CA similar to IDevIDs or LDevIDs in [IEEE802.1AR]. AIK-CA is a placeholder for any CA and AIK-Cert is a placeholder for the corresponding Certificate, depending on what protocol was used. The specific protocols are out of scope for this document. 2. Time-Based Uni-Directional Attestation A Time-Based Uni-Directional Attestation (TUDA) consists of the following four elements in order to gain assurance of the Attestee's platform configuration at a certain point in time. o TSA Certificate The certificate of the Time Stamp Authority that is used in a subsequent synchronization protocol token. This certificate is signed by the TSA-CA. o Synchronization Token The reference for Attestations are the Tick-Sessions of the TPM. In order to put Attestations into relation with a Real Time Clock (RTC), it is necessary to provide a cryptographic synchronization between the tick session and the RTC. To do so, a synchronization protocol is run with a Time Stamp Authority (TSA). o Restriction Info Fuchs, et al. Expires April 21, 2016 [Page 4] Internet-Draft tuda October 2015 The attestation relies on the capability of the TPM to operate on restricted keys. Whenever the PCR values for the machine to be attested change, a new restricted key is created that can only be operated as long as the PCRs remain in their current state. In order to prove to the Verifier that this restricted temporary key actually has these properties and also to provide the PCR value that it is restricted, the TPM command TPM_CertifyInfo is used. It creates a signed certificate using the AIK about the newly created restricted key. o Measurement Log Similarly to regular attestations, the Verifier needs a way to reconstruct the PCRs' values in order to estimate the trustworthiness of the device. As such, a list of those elements that were extended into the PCRs is reported. Note though that for certain environments, this step may be optional if a list of valid PCR configurations exists and no measurement log is required. o Implicit Attestation The actual attestation is then based upon a TPM_TickStampBlob operation using the restricted temporary key that was certified in the steps above. The TPM_TickStampBlob is executed and thereby provides evidence that at this point in time (with respect to the TPM internal tick-session) a certain configuration existed (namely the PCR values associated with the restricted key). Together with the synchronization token this tick-related timing can then be related to the real-time clock. These elements could be sent en bloc, but it is recommended to retrieve them separately to save bandwidth, since each of these elements has different update cycles. Furthermore, in some scenarios it might be feasible not to store all elements on the Attestee end device, but instead they will be retrieved from another location or pre-deployed to the Verifier. It may even be feasible to only store public keys at the Verifier and skip all certificate provisioning completely in order to save bandwidth and computation time for certificate verification. When mapped to TPM1.2 (see Appendix A), one additional item is added to these five: o AIK Certificate ([AIK-Credential], [AIK-Enrollment]; see Appendix A.2.1). Fuchs, et al. Expires April 21, 2016 [Page 5] Internet-Draft tuda October 2015 A certificate about the Attestation Identity Key (AIK) used. This may or may not also be an [IEEE802.1AR] IDevID or LDevID, depending on their setting of the identity property. 2.1. Attestation Element Update Cycles An endpoint can be in various states and have various information associated with it during its life-cycle. For TUDA, a subset of the states (which includes associated information), that an endpoint and its TPM can be in, is important to the attestation process. o Some states are persistent, even after reboot. This includes certificates that are associated with the endpoint itself or with services it relies on. o Some states are more volatile and change at the beginning of each boot cycle. This includes the TPM-internal Tick-Session which provides the basis for the synchronization token and implicit attestation. o Some states are even more volatile and change during an uptime cycle (the period of time an endpoint is powered on, starting with its boot). This includes the content of PCR registers of a TPM and thereby also the PCR-restricted keys used during attestation. Depending on this lifetime of state, data has to be transported over the wire, or not. E.g. information that does not change due to a reboot typically has to be transported only once between the Attestee and the Verifier. There are three kind of events that require a renewed attestation: o The Attestee completes a boot-cycle o A relevant PCR changes o Too much time has passed since the last attestation statement Attestee Verifier | | Boot | | | Create Sync-Token | | | Create Restricted Key | Certify Restricted Key | | | | AIK-Cert ---------------------------------------------> | Fuchs, et al. Expires April 21, 2016 [Page 6] Internet-Draft tuda October 2015 | Sync-Token -------------------------------------------> | | Certify-Info -----------------------------------------> | | Measurement Log --------------------------------------> | | Attestation ------------------------------------------> | | Verify Attestation | | | <Time Passed> | | | | Attestation ------------------------------------------> | | Verify Attestation | | | <Time Passed> | | | PCR-Change | | | Create Restricted Key | Certify Restricted Key | | | | Certify-Info -----------------------------------------> | | Measurement Log --------------------------------------> | | Attestation ------------------------------------------> | | Verify Attestation | | Boot | | | Create Sync-Token | | | Create Restricted Key | Certify Restricted Key | | | | Sync-Token -------------------------------------------> | | Certify-Info -----------------------------------------> | | Measurement Log --------------------------------------> | | Attestation ------------------------------------------> | | Verify Attestation | | | <Time Passed> | | | | Attestation ------------------------------------------> | | Verify Attestation | | Figure 1: Example sequence of events Fuchs, et al. Expires April 21, 2016 [Page 7] Internet-Draft tuda October 2015 3. Realisation Approaches 3.1. SNMP An SNMP MIB should be defined that encodes each of the five TUDA data items as a table with each row containing a single read-only columnar SNMP object of datatype OCTET-STRING. The values of the set of rows in each table could be concatenated to reconstitute each CBOR encoded data item. The Verifier could retrieve the values for each of these CBOR data items by using SNMP GetNext requests to "walk" each table. The Verifier could then decode each of the CBOR encoded data items according to their CDDL definitions. Design Ideas: (1) Over time, attestation values will age and become outside the time window (i.e., no longer fresh attestations). Using a primary table index of a cycle counter object could disambiguate the transition from one attestation cycle to the next. (2) Over time, the measurement log information (for example) may grow quite large. To allow for more efficient data access using SNMP Get or GetBulk requests, two helper objects could be defined to point at the first and last active row in each table. (3) Notifications could be used to indicate to a Verifier that a new cycle has occurred (i.e., the synchronization data, measurement log, etc. have been updated by deleting old table rows and adding new rows). The notification should include the cycle counter object. A partial sketch of the proposed SNMP MIB follows: TUDA-V1-ATTESTATION-MIB DEFINITIONS ::= BEGIN IMPORTS MODULE-IDENTITY, OBJECT-TYPE, Integer32, Counter32, enterprises FROM SNMPv2-SMI; -- RFC 2578 -- SNMP macros, datatypes, and the "enterprises" root OID tudaV1MIB MODULE-IDENTITY LAST-UPDATED "201510180000Z" -- October 18, 2015 ORGANIZATION "Fraunhofer SIT" CONTACT-INFO "Andreas Fuchs Fraunhofer Institute for Secure Information Technology Email: andreas.fuchs@sit.fraunhofer.de Fuchs, et al. Expires April 21, 2016 [Page 8] Internet-Draft tuda October 2015 Henk Birkholz Fraunhofer Institute for Secure Information Technology Email: henk.birkholz@sit.fraunhofer.de Ira E McDonald High North Inc Email: blueroofmusic@gmail.com Carsten Bormann Universitaet Bremen TZI Email: cabo@tzi.org" DESCRIPTION "The MIB module for monitoring of time-based unidirectional attestation information from a network endpoint system, based on the Trusted Computing Group TPM 1.2 definition. Copyright (C) Fraunhofer Institute for Secure Information Technology (2015)." REVISION "201510180000Z" -- October 18, 2015 DESCRIPTION "Initial version, published as draft-birkholz-tuda-00." ::= { enterprises fraunhofersit(21616) mibs(1) tudaV1MIB(1) } tudaV1MIBNotifications OBJECT IDENTIFIER ::= { tudaV1MIB 0 } tudaV1MIBObjects OBJECT IDENTIFIER ::= { tudaV1MIB 1 } tudaV1MIBConformance OBJECT IDENTIFIER ::= { tudaV1MIB 2 } tudaV1General OBJECT IDENTIFIER ::= { tudaV1MIBObjects 1 } tudaV1GeneralCycles OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "Count of TUDA attestation cycles that have occurred. DEFVAL intentionally omitted - counter object." ::= { tudaV1GeneralCycles } tudaV1SyncToken OBJECT IDENTIFIER ::= { tudaV1MIBObjects 2 } tudaV1SyncTokenFirst OBJECT-TYPE SYNTAX Integer32 (0..2147483647) MAX-ACCESS read-only STATUS current Fuchs, et al. Expires April 21, 2016 [Page 9] Internet-Draft tuda October 2015 DESCRIPTION "Low-order index of first active row of TUDA sync token data." DEFVAL { 0 } ::= { tudaV1SyncToken 2 } tudaV1SyncTokenLast OBJECT-TYPE SYNTAX Integer32 (0..2147483647) MAX-ACCESS read-only STATUS current DESCRIPTION "Low-order index of last active row of TUDA sync token data." DEFVAL { 0 } ::= { tudaV1SyncToken 3 } tudaV1SyncTokenTable OBJECT-TYPE SYNTAX SEQUENCE OF TudaV1SyncTokenEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "A table for the TUDA synchronization token data." ::= { tudaV1SyncToken 1 } tudaV1SyncTokenEntry OBJECT-TYPE SYNTAX TudaV1SyncTokenEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "An entry for one chunk of TUDA synchronization token data." INDEX { tudaV1GeneralCycles, tudaV1SyncTokenIndex } ::= { tudaV1SyncTokenTable 1 } TudaV1SyncTokenEntry ::= SEQUENCE { tudaV1SyncTokenIndex Integer32, tudaV1SyncTokenData OCTET STRING } tudaV1SyncTokenIndex OBJECT-TYPE SYNTAX Integer32 (1..2147483647) MAX-ACCESS not-accessible STATUS current DESCRIPTION "Low-order index of this synchronization token entry. DEFVAL intentionally omitted - index object." ::= { tudaV1SyncTokenEntry 1 } tudaV1SyncTokenData OBJECT-TYPE Fuchs, et al. Expires April 21, 2016 [Page 10] Internet-Draft tuda October 2015 SYNTAX OCTET STRING (SIZE(0..1024)) MAX-ACCESS read-only STATUS current DESCRIPTION "A CBOR encoded chunk of the synchronization token data." DEFVAL { "" } ::= { tudaV1SyncTokenEntry 2 } tudaV1AIKCert OBJECT IDENTIFIER ::= { tudaV1MIBObjects 3 } tudaV1AIKCertTable OBJECT-TYPE SYNTAX SEQUENCE OF TudaV1AIKCertEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "A table for the TUDA AIK certificate data." ::= { tudaV1AIKCert 1 } -- etc. for remaining CBOR data items for TUDA END 3.2. REST Each of the five data items is defined as a media type (Section 4). Representations of resources for each of these media types can be retrieved from URIs that are defined by the respective servers [RFC7320]. As can be derived from the URI, the actual retrieval is via one of the HTTPs ([RFC7230], [RFC7540]) or CoAP [RFC7252]. How a client obtains these URIs is dependent on the application; e.g., CoRE Web links [RFC6690] can be used to obtain the relevant URIs from the self-description of a server, or they could be prescribed by a RESTCONF data model [I-D.ietf-netconf-restconf]. 4. IANA Considerations This memo includes a request to IANA. TBD 5. Security Considerations There are Security Considerations. TBD 6. Acknowledgements 7. Change Log (This section to be removed by the RFC editor.) Changes from version 00 to version 01: Fuchs, et al. Expires April 21, 2016 [Page 11] Internet-Draft tuda October 2015 TBD with 01 8. Contributors TBD 9. Informative References [AIK-Credential] "TCG Credential Profile", 2007, <http://www.trustedcomputinggroup.org/files/ temp/642686EC-1D09-3519-AD58BB4C50BD5028/ IWG%20Credential_Profiles_V1_R1_14.pdf>. [AIK-Enrollment] TCG Infrastructure Working Group, "A CMC Profile for AIK Certificate Enrollment", 2011, <https://www.trustedcomputinggroup.org/files/ resource_files/738DF0BB-1A4B-B294-D0AF6AF9CC023163/ IWG_CMC_Profile_Cert_Enrollment_v1_r7.pdf>. [I-D.greevenbosch-appsawg-cbor-cddl] Vigano, C. and H. Birkholz, "CBOR data definition language (CDDL): a notational convention to express CBOR data structures", draft-greevenbosch-appsawg-cbor-cddl-07 (work in progress), October 2015. [I-D.ietf-netconf-restconf] Bierman, A., Bjorklund, M., and K. Watsen, "RESTCONF Protocol", draft-ietf-netconf-restconf-08 (work in progress), October 2015. [IEEE802.1AR] IEEE Computer Society, "IEEE Standard for Local and metropolitan area networks -- Secure Device Identity", IEEE Std 802.1AR, 2009. [MTAF] Fuchs, A., "Improving Scalability for Remote Attestation", Master Thesis (Diplomarbeit), Technische Universitaet Darmstadt, Germany, 2008. [PTS] "TCG Attestation PTS Protocol Binding to TNC IF-M", 2011, <http://www.trustedcomputinggroup.org/files/ resource_files/508E7E89-1A4B-B294-D06395D5FD7EC4E7/ IFM_PTS_v1_0_r28.pdf>. Fuchs, et al. Expires April 21, 2016 [Page 12] Internet-Draft tuda October 2015 [REST] Fielding, R., "Architectural Styles and the Design of Network-based Software Architectures", Ph.D. Dissertation, University of California, Irvine, 2000, <http://www.ics.uci.edu/~fielding/pubs/dissertation/ fielding_dissertation.pdf>. [RFC3161] Adams, C., Cain, P., Pinkas, D., and R. Zuccherato, "Internet X.509 Public Key Infrastructure Time-Stamp Protocol (TSP)", RFC 3161, DOI 10.17487/RFC3161, August 2001, <http://www.rfc-editor.org/info/rfc3161>. [RFC3411] Harrington, D., Presuhn, R., and B. Wijnen, "An Architecture for Describing Simple Network Management Protocol (SNMP) Management Frameworks", STD 62, RFC 3411, DOI 10.17487/RFC3411, December 2002, <http://www.rfc-editor.org/info/rfc3411>. [RFC4949] Shirey, R., "Internet Security Glossary, Version 2", FYI 36, RFC 4949, DOI 10.17487/RFC4949, August 2007, <http://www.rfc-editor.org/info/rfc4949>. [RFC6690] Shelby, Z., "Constrained RESTful Environments (CoRE) Link Format", RFC 6690, DOI 10.17487/RFC6690, August 2012, <http://www.rfc-editor.org/info/rfc6690>. [RFC7230] Fielding, R., Ed. and J. Reschke, Ed., "Hypertext Transfer Protocol (HTTP/1.1): Message Syntax and Routing", RFC 7230, DOI 10.17487/RFC7230, June 2014, <http://www.rfc-editor.org/info/rfc7230>. [RFC7252] Shelby, Z., Hartke, K., and C. Bormann, "The Constrained Application Protocol (CoAP)", RFC 7252, DOI 10.17487/ RFC7252, June 2014, <http://www.rfc-editor.org/info/rfc7252>. [RFC7320] Nottingham, M., "URI Design and Ownership", BCP 190, RFC 7320, DOI 10.17487/RFC7320, July 2014, <http://www.rfc-editor.org/info/rfc7320>. [RFC7540] Belshe, M., Peon, R., and M. Thomson, Ed., "Hypertext Transfer Protocol Version 2 (HTTP/2)", RFC 7540, DOI 10.17487/RFC7540, May 2015, <http://www.rfc-editor.org/info/rfc7540>. Fuchs, et al. Expires April 21, 2016 [Page 13] Internet-Draft tuda October 2015 [SFKE2008] Stumpf, F., Fuchs, A., Katzenbeisser, S., and C. Eckert, "Improving the scalability of platform attestation", ACM Proceedings of the 3rd ACM workshop on Scalable trusted computing, page 1-10, 2008. [TPM12] "Information technology -- Trusted Platform Module -- Part 1: Overview", ISO/IEC 11889-1, 2009. Appendix A. Realization with TPM 1.2 functions A.1. TPM Functions The following TPM structures, resources and functions are used within this approach. They are based upon the TPM 1.2 specification [TPM12]. A.1.1. Tick-Session and Tick-Stamp On every boot, the TPM initializes a new Tick-Session. Such a tick- session consists of a nonce that is randomly created upon each boot to identify the current boot-cycle - the phase between boot-time of the device and shutdown or power-off - and prevent replaying of old tick-session values. The TPM uses its internal entropy source that guarantees virtually no collisions of the nonce values between two of such boot cycles. It further includes an internal timer that is being initialize to Zero on each reboot. From this point on, the TPM increments this timer continuously based upon its internal secure clocking information until the device is powered down or set to sleep. By its hardware design, the TPM will detect attacks on any of those properties. The TPM offers the function TPM_TickStampBlob, which allows the TPM to create a signature over the current tick-session and two externally provided input values. These input values are designed to serve as a nonce and as payload data to be included in a TickStampBlob: TickstampBlob := sig(TPM-key, currentTicks || nonce || externalData). As a result, one is able to proof that at a certain point in time (relative to the tick-session) after the provisioning of a certain nonce, some certain externalData was known and provided to the TPM. If an approach however requires no input values or only one input value (such as the use in this document) the input values can be set to well-known value. The convention used within TCG specifications Fuchs, et al. Expires April 21, 2016 [Page 14] Internet-Draft tuda October 2015 and within this document is to use twenty bytes of zero h'0000000000000000000000000000000000000000' as well-known value. A.1.2. Platform Configuration Registers (PCRs) The TPM is a secure cryptoprocessor that provides the ability to store measurements and metrics about an endpoint's configuration and state in a secure, tamper-proof environment. Each of these security relevant metrics can be stored in a volatile Platform Configuration Register (PCR) inside the TPM. These measurements can be conducted at any point in time, ranging from an initial BIOS boot-up sequence to measurements taken after hundreds of hours of uptime. The initial measurement is triggered by the Platforms so-called pre- BIOS or ROM-code. It will conduct a measurement of the first loadable pieces of code; i.e.\ the BIOS. The BIOS will in turn measure its Option ROMs and the BootLoader, which measures the OS- Kernel, which in turn measures its applications. This describes a so-called measurement chain. This typically gets recorded in a so- called measurement log, such that the values of the PCRs can be reconstructed from the individual measurements for validation. Via its PCRs, a TPM provides a Root of Trust that can, for example, support secure boot or remote attestation. The attestation of an endpoint's identity or security posture is based on the content of an TPM's PCRs (platform integrity measurements). A.1.3. PCR restricted Keys Every key inside the TPM can be restricted in such a way that it can only be used if a certain set of PCRs are in a predetermined state. For key creation the desired state for PCRs are defined via the PCRInfo field inside the keyInfo parameter. Whenever an operation using this key is performed, the TPM first checks whether the PCRs are in the correct state. Otherwise the operation is denied by the TPM. A.1.4. CertifyInfo The TPM offers a command to certify the properties of a key by means of a signature using another key. This includes especially the keyInfo which in turn includes the PCRInfo information used during key creation. This way, a third party can be assured about the fact that a key is only usable if the PCRs are in a certain state. Fuchs, et al. Expires April 21, 2016 [Page 15] Internet-Draft tuda October 2015 A.2. Protocol and Procedure A.2.1. AIK and AIK Certificate Attestations are based upon a cryptographic signature performed by the TPM using a so-called Attestation Identity Key (AIK). An AIK has the properties that it cannot be exported from a TPM and is used for attestations. Trust in the AIK is established by an X.509 Certificate emitted by a Certificate Authority. The AIK certificate is either provided directly or via a so-called PrivacyCA [AIK-Enrollment]. This element consists of the AIK certificate that includes the AIK's public key used during verification as well as the certificate chain up to the Root CA for validation of the AIK certificate itself. TUDA-Cert = [AIK-Cert, TSA-Cert]; maybe split into two for SNMP AIK-Cert = Cert TSA-Cert = Cert Figure 2: TUDA-Cert element in CDDL The TSA-Cert is a standard certificate of the TSA. The AIK-Cert may be provisioned in a secure environment using standard means or it may follow the PrivacyCA protocols. Figure 3 gives a rough sketch of this protocol. See [AIK-Enrollment] for more information. The X.509 Certificate is built from the AIK public key and the corresponding PKCS #7 certificate chain, as shown in Figure 3. Required TPM functions: Fuchs, et al. Expires April 21, 2016 [Page 16] Internet-Draft tuda October 2015 | create_AIK_Cert(...) = { | AIK = TPM_MakeIdentity() | IdReq = CollateIdentityRequest(AIK,EK) | IdRes = Call(AIK-CA, IdReq) | AIK-Cert = TPM_ActivateIdentity(AIK, IdRes) | } | | /* Alternative */ | | create_AIK_Cert(...) = { | AIK = TPM_CreateWrapKey(Identity) | AIK-Cert = Call(AIK-CA, AIK.pubkey) | } Figure 3: Creating the TUDA-Cert element A.2.2. Synchronization Token The reference for Attestations are the Tick-Sessions of the TPM. In order to put Attestations into relation with a Real Time Clock (RTC), it is necessary to provide a cryptographic synchronization between the tick session and the RTC. To do so, a synchronization protocol is run with a Time Stamp Authority (TSA) that consists of three steps: o The TPM creates a TickStampBlob using the AIK o This TickstampBlob is used as nonce to the Timestamp of the TSA o Another TickStampBlob with the AIK is created using the TSA's Timestamp a nonce The first TickStampBlob is called "left" and the second "right" in a reference to their position on a time-axis. These three elements, with the TSA's certificate factored out, form the synchronization token Fuchs, et al. Expires April 21, 2016 [Page 17] Internet-Draft tuda October 2015 TUDA-Synctoken = [ left: TickStampBlob-Output, timestamp: TimeStampToken, right: TickStampBlob-Output, ] TimeStampToken = bytes ; RFC 3161 TickStampBlob-Output = [ currentTicks: TPM-CURRENT-TICKS, sig: bytes, ] TPM-CURRENT-TICKS = [ currentTicks: uint ? ( tickRate: uint tickNonce: TPM-NONCE ) ] ; Note that TickStampBlob-Output "right" can omit the values for ; tickRate and tickNonce since they are the same as in "left" TPM-NONCE = bytes .size 20 Figure 4: TUDA-Sync element in CDDL Required TPM functions: TPM_TickStampBlob: explain various inputs and applications Fuchs, et al. Expires April 21, 2016 [Page 18] Internet-Draft tuda October 2015 | dummyDigest = h'0000000000000000000000000000000000000000' | dummyNonce = dummyDigest | | create_sync_token(AIKHandle, TSA) = { | ts_left = TPM_TickStampBlob( | keyHandle = AIK_Handle, /*TPM_KEY_HANDLE*/ | antiReplay = dummyNonce, /*TPM_NONCE*/ | digestToStamp = dummyDigest /*TPM_DIGEST*/) | | ts = TSA_Timestamp(TSA, nonce = hash(ts_left)) | | ts_right = TPM_TickStampBlob( | keyHandle = AIK_Handle, /*TPM_KEY_HANDLE*/ | antiReplay = dummyNonce, /*TPM_NONCE*/ | digestToStamp = hash(ts)) /*TPM_DIGEST*/ | | TUDA-SyncToken = [[ts_left.ticks, ts_left.sig], ts, | [ts_right.ticks.currentTicks, ts_right.sig]] | /* Note: leave out the nonce and tickRate field for ts_right.ticks */ | } Figure 5: Creating the Sync-Token element A.2.3. RestrictionInfo The attestation relies on the capability of the TPM to operate on restricted keys. Whenever the PCR values for the machine to be attested change, a new restricted key is created that can only be operated as long as the PCRs remain in their current state. In order to prove to the Verifier that this restricted temporary key actually has these properties and also to provide the PCR value that it is restricted, the TPM command TPM_CertifyInfo is used. It creates a signed certificate using the AIK about the newly created restricted key. This token is formed from the list of: o PCR list, o the newly created restricted public key, and o the certificate. TUDA-RestrictionInfo = [Composite, restrictedKey_Pub: Pubkey, TPM-CERTIFY-INFO] Fuchs, et al. Expires April 21, 2016 [Page 19] Internet-Draft tuda October 2015 PCRSelection = bytes .size (2..4) ; used as bit string Composite = [ bitmask: PCRSelection, values: [*PCR-Hash], ] Pubkey = bytes ; do we need to expose structure here? TPM-CERTIFY-INFO = [ ; we don't encode TPM-STRUCT-VER: ; these are 4 bytes always equal to h'01010000' keyUsage: uint, ; 4byte? 2byte? keyFlags: bytes .size 4, ; 4byte authDataUsage: uint, ; 1byte (enum) algorithmParms: TPM-KEY-PARMS, pubkeyDigest: Hash, ; we don't encode TPM-NONCE data, which is 20 bytes, all zero parentPCRStatus: bool, ; no need to encode pcrinfosize pcrinfo: TPM-PCR-INFO, ; we have exactly one ] TPM-PCR-INFO = [ pcrSelection: PCRSelection; /* TPM_PCR_SELECTION */ digestAtRelease: PCR-Hash; /* TPM_COMPOSITE_HASH */ digestAtCreation: PCR-Hash; /* TPM_COMPOSITE_HASH */ ] TPM-KEY-PARMS = [ ; algorithmID: uint, ; <= 4 bytes -- not encoded, constant for TPM1.2 encScheme: uint, ; <= 2 bytes sigScheme: uint, ; <= 2 bytes parms: TPM-RSA-KEY-PARMS, ] TPM-RSA-KEY-PARMS = [ ; "size of the RSA key in bits": keyLength: uint ; "number of prime factors used by this RSA key": numPrimes: uint ; "This SHALL be the size of the exponent": exponentSize: null / uint / biguint ; "If the key is using the default exponent then the exponentSize ; MUST be 0" -> we represent this case as null ] Fuchs, et al. Expires April 21, 2016 [Page 20] Internet-Draft tuda October 2015 Figure 6: TUDA-Key element in CDDL Required TPM functions: | dummyDigest = h'0000000000000000000000000000000000000000' | dummyNonce = dummyDigest | | create_Composite | | create_restrictedKey_Pub(pcrsel) = { | PCRInfo = {pcrSelection = pcrsel, | digestAtRelease = hash(currentValues(pcrSelection)) | digestAtCreation = dummyDigest} | / * PCRInfo is a TPM_PCR_INFO and thus also a TPM_KEY */ | | wk = TPM_CreateWrapKey(keyInfo = PCRInfo) | wk.keyInfo.pubKey | } | | create_TPM-Certify-Info = { | CertifyInfo = TPM_CertifyKey( | certHandle = AIK, /* TPM_KEY_HANDLE */ | keyHandle = wk, /* TPM_KEY_HANDLE */ | antiReply = dummyNonce) /* TPM_NONCE */ | | CertifyInfo.strip() | /* Remove those values that are not needed */ | } Figure 7: Creating the pubkey A.2.4. Measurement Log Similarly to regular attestations, the Verifier needs a way to reconstruct the PCRs' values in order to estimate the trustworthiness of the device. As such, a list of those elements that were extended into the PCRs is reported. Note though that for certain environments, this step may be optional if a list of valid PCR configurations exists and no measurement log is required. Fuchs, et al. Expires April 21, 2016 [Page 21] Internet-Draft tuda October 2015 TUDA-Measurement-Log = [*PCR-Event] PCR-Event = [ type: PCR-Event-Type, pcr: uint, template-hash: PCR-Hash, filedata-hash: tagged-hash, pathname: text; called filename-hint in ima (non-ng) ] PCR-Event-Type = &( bios: 0 ima: 1 ima-ng: 2 ) ; might want to make use of COSE registry here ; however, that might never define a value for sha1 tagged-hash /= [sha1: 0, bytes .size 20] tagged-hash /= [sha256: 1, bytes .size 32] A.2.5. Implicit Attestation The actual attestation is then based upon a TickStampBlob using the restricted temporary key that was certified in the steps above. The TPM-Tickstamp is executed and thereby provides evidence that at this point in time (with respect to the TPM internal tick-session) a certain configuration existed (namely the PCR values associated with the restricted key). Together with the synchronization token this tick-related timing can then be related to the real-time clock. This element consists only of the TPM_TickStampBlock with no nonce. TUDA-Verifytoken = TickStampBlob-Output Figure 8: TUDA-Verify element in CDDL Required TPM functions: | imp_att = TPM_TickStampBlob( | keyHandle = restrictedKey_Handle, /*TPM_KEY_HANDLE*/ | antiReplay = dummyNonce, /*TPM_NONCE*/ | digestToStamp = dummyDigest) /*TPM_DIGEST*/ | | VerifyToken = imp_att Figure 9: Creating the Verify Token Fuchs, et al. Expires April 21, 2016 [Page 22] Internet-Draft tuda October 2015 A.2.6. Attestation Verification Approach The five TUDA elements transport the essential content that is required to enable verification of the attestation statement at the Verifier. The following listings illustrate the verification algorithm to be used at the Verifier in pseudocode. The pseudocode provided covers the entire verification task. If only a subset of TUDA elements changed (see Section 2.1), only the corresponding code listings need to be re-executed. | TSA_pub = verifyCert(TSA-CA, Cert.TSA-Cert) | AIK_pub = verifyCert(AIK-CA, Cert.AIK-Cert) Figure 10: Verification of Certificates | ts_left = Synctoken.left | ts_right = Synctoken.right | | /* Reconstruct ts_right's omitted values; Alternatively assert == */ | ts_right.currentTicks.tickRate = ts_left.currentTicks.tickRate | ts_right.currentTicks.tickNonce = ts_left.currentTicks.tickNonce | | ticks_left = ts_left.currentTicks | ticks_right = ts_right.currentTicks | | /* Verify Signatures */ | verifySig(AIK_pub, dummyNonce || dummyDigest || ticks_left) | verifySig(TSA_pub, hash(ts_left) || timestamp.time) | verifySig(AIK_pub, dummyNonce || hash(timestamp) || ticks_right) | | delta_left = timestamp.time - | ticks_left.currentTicks * ticks_left.tickRate / 1000 | | delta_right = timestamp.time - | ticks_right.currentTicks * ticks_right.tickRate / 1000 Figure 11: Verification of Synchronization Token Fuchs, et al. Expires April 21, 2016 [Page 23] Internet-Draft tuda October 2015 | compositeHash = hash_init() | for value in Composite.values: | hash_update(compositeHash, value) | compositeHash = hash_finish(compositeHash) | | certInfo = reconstruct_static(TPM-CERTIFY-INFO) | | assert(Composite.bitmask == ExpectedPCRBitmask) | assert(certInfo.pcrinfo.PCRSelection == Composite.bitmask) | assert(certInfo.pcrinfo.digestAtRelease == compositeHash) | assert(certInfo.pubkeyDigest == hash(restrictedKey_Pub)) | | verifySig(AIK_pub, dummyNonce || certInfo) Figure 12: Verification of Restriction Info | for event in Measurement-Log: | if event.pcr not in ExpectedPCRBitmask: | continue | if event.type == BIOS: | assert_whitelist-bios(event.pcr, event.template-hash) | if event.type == ima: | assert(event.pcr == 10) | assert_whitelist(event.pathname, event.filedata-hash) | assert(event.template-hash == hash(event.pathname || event.filedata-hash)) | if event.type == ima-ng: | assert(event.pcr == 10) | assert_whitelist-ng(event.pathname, event.filedata-hash) | assert(event.template-hash == hash(event.pathname || event.filedata-hash)) | | virtPCR[event.pcr] = hash_extend(virtPCR[event.pcr], event.template-hash) | | for pcr in ExpectedPCRBitmask: | assert(virtPCR[pcr] == Composite.values[i++] Figure 13: Verification of Measurement Log Fuchs, et al. Expires April 21, 2016 [Page 24] Internet-Draft tuda October 2015 | ts = Verifytoken | | /* Reconstruct ts's omitted values; Alternatively assert == */ | ts.currentTicks.tickRate = ts_left.currentTicks.tickRate | ts.currentTicks.tickNonce = ts_left.currentTicks.tickNonce | | verifySig(restrictedKey_pub, dummyNonce || dummyDigest || ts) | | ticks = ts.currentTicks | | time_left = delta_left + ticks.currentTicks * ticks.tickRate / 1000 | time_right = delta_right + ticks.currentTicks * ticks.tickRate / 1000 | | [time_left, time_right] Figure 14: Verification of Attestation Token Authors' Addresses Andreas Fuchs Fraunhofer Institute for Secure Information Technology Rheinstrasse 75 Darmstadt 64295 Germany Email: andreas.fuchs@sit.fraunhofer.de Henk Birkholz Fraunhofer Institute for Secure Information Technology Rheinstrasse 75 Darmstadt 64295 Germany Email: henk.birkholz@sit.fraunhofer.de Ira E McDonald High North Inc PO Box 221 Grand Marais 49839 US Email: blueroofmusic@gmail.com Fuchs, et al. Expires April 21, 2016 [Page 25] Internet-Draft tuda October 2015 Carsten Bormann Universitaet Bremen TZI Bibliothekstr. 1 Bremen D-28359 Germany Phone: +49-421-218-63921 Email: cabo@tzi.org Fuchs, et al. Expires April 21, 2016 [Page 26]