Hector Martin

Why am I doing this? TPM sniffer/MitM PoC. Because people who think that transparent-mode (TPM-only) BitLocker is secure are funny.

I never understood the point of that. If the TPM has the keys and there's no auth from CPU to TPM, can't you just see the keys over the bus? Equally, can you not just lie to the TPM about PCR values when doing remote attestation?

Easiest is the reset attack. Boot Linux or whatever, hit the TPM reset pin, feed it whatever PCR values it wants pretending to be the BIOS, get keys. DRTM makes it more complicated due to HW cycle differences but an FPGA will take care of that.

If the TPM will cough up cleartext keys to anyone who asks with the right PCRs, what's even the point of having antitamper mesh on the chip? Seems like you'd be just as well served with a PIC :P

Yeah. Well, you can generate asymmetric keys inside the TPM and use that to attest a given physical TPM. Doesn't help with BitLocker though. Also then it turns out your TPM is Infineon and generates ROCA RSA keys anyway.

Yes, you can attest the physical TPM. But you can't attest that the CPU is running any particular software. Calculate the PCRs it expects and feed them over the MITM bus then get it to sign your challenge blob.

Of course. It's just an anticloning thing, really. If you steal the TPM then you can always use it as an oracle.