Do I need a Trusted Platform Module (TPM)?
The short answer is “yes you do”.
TPMs are microcontrollers designed for cryptographic tasks. Don’t think of them as crypto accelerators though, since carrying out cryptographic operations on your CPU will always be faster. However they can encrypt and decrypt information and have a significant advantage over your CPU doing so, since the keys are tied to the TPM. When the TPM is initially configured, it generates a Storage Root Key or SRK. You can then ask the TPM to generate a new keypair for you, which the TPM will encrypt using the SRK, and hand it over to the caller. When the OS needs to encrypt or decrypt something, it loads the key into the TPM. The TPM then decrypts the key and performs the requested operation.
Another interesting functionality of the TPM is the ability to measure the system state using Platform Configuration Registers or PCRs, combined with the key ‘sealing and unsealing’.
PCRs start zeroed out and can only be reseted if on a system reboot. Those can be extended by writing a SHA hash (typically SHA-1/256/384/512 for TPMv2) into the PCR. The TPM concatenates the new hash to the existing PCR value and another SHA is calculated. This new value is now stored in the PCR.
TPMs also have the ability to seal and unseal keys. They can create and secure keys bound to specific platform states (and thus measurements). In order to unseal the key, the PCRs have to contain the exact same values that they had when the key was sealed. So for example you can create an encrypted filesystem with the encryption key sealed safely into your TPM. The filesystem will only be decrypted if the TPM ends up in the expected state.
On typical measured boot scenarios the firmware (or even BL1 is some devices) hashes itself to specific PCRs. So you can have for example BL2 measure itself and then measure BL31, BL32, BL33 and even GRUB config files, commands, Linux initrd etc. This effectively creates a chain of trust, which guarantees system components that we choose to measure have not been modified. Changing any of these would result in a different set of hash values.
U-Boot Support
There is a specification defining a standard interface to the TPM on an UEFI platform. Its purpose is to define APIs and provide information, for things like, is a TPM present, which PCR banks are active, change active PCR banks, obtain the TCG boot log, extend hashes to PCRs, append events to the TCG boot log etc. U-Boot recently got support for this, as well as support for the TCG PC Client Platform Firmware Profile. Patches for U-Boot were contributed by Linaro and can be found here, here and here. It can be tricky to find an Arm device with a TPMv2. If you have a board with an RPMB and OP-TEE support, we recommend trying Microsoft’s fTPM. However testing that in qemu won’t work since it lacks RPMB emulation. Luckily there is another solution.
Using SWTPM
SWTPM is a TPM emulator that works under qemu. It provides a memory mapped device which adheres to the TCG TPM Interface Specification. U-Boot lacked an MMIO TPMv2 driver up until this patchset.
Building U-Boot
git clone https://github.com/u-boot/u-boot.git
pushd u-boot
make qemu_arm64_defconfig
make menuconfig
The qemu defconfig includes the needed CONFIG_TPM, CONFIG_TPM2_MMIO and CONFIG_EFI_TCG2_PROTOCOL options. Make sure you enable CONFIG_CMD_EFIDEBUG as well, since we will need it to boot our kernel.
make -j $(nproc)
popd
Running qemu
Make sure swtpm is installed and running on your system. For Debian and friends there’s a swtpm package, so just do
sudo apt install swtpm
mkdir /tmp/mytpm1
swtpm socket --tpmstate dir=/tmp/mytpm1 \
--ctrl type=unixio,path=/tmp/mytpm1/swtpm-sock \
--log level=40 --tpm2 -t -d
and launch qemu with swtpm support
qemu-system-aarch64 -nographic -no-acpi \
-bios u-boot.bin -machine virt \
-cpu cortex-a57 -m 2G \
-drive if=virtio,file=<your qcow2> \
-chardev socket,id=chrtpm,path=/tmp/mytpm1/swtpm-sock \ -tpmdev emulator,id=tpm0,chardev=chrtpm \
-device tpm-tis-device,tpmdev=tpm0
Booting linux
From U-Boot’s command line do something along the lines of
virtio scan
efidebug boot add -b 0 'Linux' virtio 0 boot/Image -s 'root=/dev/vda'
efidebug boot order 0
bootefi bootmgr
If everything is compiled and launched correctly, you should see the kernel reporting the location of some related EventLog pointers.
efi: EFI v2.80 by Das U-Boot
efi: TPMFinalLog=0x13ddcc040 RTPROP=0x13ddcb040 SMBIOS=0xffffe000
TPMEventLog=0x13ddc4040 MEMRESERVE=0x13ddc3040
Reading the EventLog
I am using a debian qcow2 image, where I have installed the latest tpm2 tools. If you don’t have them install them with
sudo apt install tpm2-tools
The kernel exposes the eventlog in /sys. So you can read it with:
tpm2_eventlog /sys/kernel/security/tpm0/binary_bios_measurements
---
events:
- EventNum: 0
PCRIndex: 0
EventType: EV_NO_ACTION
Digest: "0000000000000000000000000000000000000000"
EventSize: 37
SpecID:
- Signature: Spec ID Event03
platformClass: 0
specVersionMinor: 0
specVersionMajor: 2
specErrata: 2
uintnSize: 2
numberOfAlgorithms: 2
Algorithms:
- Algorithm[0]:
algorithmId: sha1
digestSize: 20
- Algorithm[1]:
algorithmId: sha256
digestSize: 32
vendorInfoSize: 0
- EventNum: 1
PCRIndex: 0
EventType: EV_S_CRTM_VERSION
DigestCount: 2
Digests:
- AlgorithmId: sha1
Digest: "0772fd675fbebcdd4401008ee8d609760c1675df"
- AlgorithmId: sha256
Digest: "69f66450f9a8780cf2fbab358d46b8fabd4b7e9ae886b3d80083646c30e91b4c"
EventSize: 74
Event: "552d426f6f7420323032312e31302d7263322d30303031302d67643536666231666138352d646972747920284175672032342032303231202d2030363a33343a3335202b303830302900"
- EventNum: 2
PCRIndex: 7
EventType: EV_EFI_VARIABLE_DRIVER_CONFIG
DigestCount: 2
Digests:
- AlgorithmId: sha1
Digest: "57cd4dc19442475aa82743484f3b1caa88e142b8"
- AlgorithmId: sha256
Digest: "115aa827dbccfb44d216ad9ecfda56bdea620b860a94bed5b7a27bba1c4d02d8"
EventSize: 53
Event:
VariableName: 61dfe48b-ca93-d211-aa0d-00e098032b8c
UnicodeNameLength: 10
VariableDataLength: 1
UnicodeName: SecureBoot
VariableData: "00"
- EventNum: 3
PCRIndex: 7
EventType: EV_EFI_VARIABLE_DRIVER_CONFIG
DigestCount: 2
Digests:
- AlgorithmId: sha1
Digest: "9b1387306ebb7ff8e795e7be77563666bbf4516e"
- AlgorithmId: sha256
Digest: "dea7b80ab53a3daaa24d5cc46c64e1fa9ffd03739f90aadbd8c0867c4a5b4890"
EventSize: 36
Event:
VariableName: 61dfe48b-ca93-d211-aa0d-00e098032b8c
UnicodeNameLength: 2
VariableDataLength: 0
UnicodeName: PK
- EventNum: 4
PCRIndex: 7
EventType: EV_EFI_VARIABLE_DRIVER_CONFIG
DigestCount: 2
Digests:
- AlgorithmId: sha1
Digest: "9afa86c507419b8570c62167cb9486d9fc809758"
- AlgorithmId: sha256
Digest: "e670e121fcebd473b8bc41bb801301fc1d9afa33904f06f7149b74f12c47a68f"
EventSize: 38
Event:
VariableName: 61dfe48b-ca93-d211-aa0d-00e098032b8c
UnicodeNameLength: 3
VariableDataLength: 0
UnicodeName: KEK
- EventNum: 5
PCRIndex: 7
EventType: EV_EFI_VARIABLE_DRIVER_CONFIG
DigestCount: 2
Digests:
- AlgorithmId: sha1
Digest: "5bf8faa078d40ffbd03317c93398b01229a0e1e0"
- AlgorithmId: sha256
Digest: "baf89a3ccace52750c5f0128351e0422a41597a1adfd50822aa363b9d124ea7c"
EventSize: 36
Event:
VariableName: cbb219d7-3a3d-9645-a3bc-dad00e67656f
UnicodeNameLength: 2
VariableDataLength: 0
UnicodeName: db
- EventNum: 6
PCRIndex: 7
EventType: EV_EFI_VARIABLE_DRIVER_CONFIG
DigestCount: 2
Digests:
- AlgorithmId: sha1
Digest: "734424c9fe8fc71716c42096f4b74c88733b175e"
- AlgorithmId: sha256
Digest: "9f75b6823bff6af1024a4e2036719cdd548d3cbc2bf1de8e7ef4d0ed01f94bf9"
EventSize: 38
Event:
VariableName: cbb219d7-3a3d-9645-a3bc-dad00e67656f
UnicodeNameLength: 3
VariableDataLength: 0
UnicodeName: dbx
- EventNum: 7
PCRIndex: 4
EventType: EV_EFI_BOOT_SERVICES_APPLICATION
DigestCount: 2
Digests:
- AlgorithmId: sha1
Digest: "d2702383b2e042ebefbb318f9382fd094c1c2d6b"
- AlgorithmId: sha256
Digest: "8fb6a4c7a0c7e7f22b944906eb07786cd3860394c7929e7c0768b2c99a2a3d87"
EventSize: 162
Event:
ImageLocationInMemory: 0x7adb3000
ImageLengthInMemory: 893720
ImageLinkTimeAddress: 0x0
LengthOfDevicePath: 130
DevicePath: "01041400b9731de684a3cc4aaeab82e828f3628b031d050002031d05000104012a0001000000009800000000000000f805000000000050641c65888b6b418f2257061a9dc3c50202040436005c004500460049005c00640065006200690061006e005c007300680069006d0061006100360034002e0065006600690000007fff0400"
- EventNum: 8
PCRIndex: 1
EventType: Unknown event type
DigestCount: 2
Digests:
- AlgorithmId: sha1
Digest: "50eb6bd100c48e81644d666a437725f49c6aed3c"
- AlgorithmId: sha256
Digest: "eb881b78feeb95756141a8d5358b891b297fad61b296f667de1f59b66bc92f4f"
EventSize: 52
Event: "61dfe48bca93d211aa0d00e098032b8c0900000000000000020000000000000042006f006f0074004f0072006400650072000000"
- EventNum: 9
PCRIndex: 1
EventType: Unknown event type
DigestCount: 2
Digests:
- AlgorithmId: sha1
Digest: "74e29a0674816dfdfc2c2e9cbbcec357132da4e8"
- AlgorithmId: sha256
Digest: "5d123811f51e2e46c437c7e88e07053c81f4e63da3f11de8a8a2afb5334db137"
EventSize: 198
Event: "61dfe48bca93d211aa0d00e098032b8c0800000000000000960000000000000042006f006f0074003000300030003000010000008200640065006200690061006e00000001041400b9731de684a3cc4aaeab82e828f3628b031d050002031d05000104012a0001000000009800000000000000f805000000000050641c65888b6b418f2257061a9dc3c50202040436005c004500460049005c00640065006200690061006e005c007300680069006d0061006100360034002e0065006600690000007fff0400"
- EventNum: 10
PCRIndex: 4
EventType: EV_EFI_ACTION
DigestCount: 2
Digests:
- AlgorithmId: sha1
Digest: "cd0fdb4531a6ec41be2753ba042637d6e5f7f256"
- AlgorithmId: sha256
Digest: "3d6772b4f84ed47595d72a2c4c5ffd15f5bb72c7507fe26f2aaee2c69d5633ba"
EventSize: 40
Event: 'Calling EFI Application from Boot Option'
- EventNum: 11
PCRIndex: 0
EventType: EV_SEPARATOR
DigestCount: 2
Digests:
- AlgorithmId: sha1
Digest: "9069ca78e7450a285173431b3e52c5c25299e473"
- AlgorithmId: sha256
Digest: "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119"
EventSize: 4
Event: "00000000"
- EventNum: 12
PCRIndex: 1
EventType: EV_SEPARATOR
DigestCount: 2
Digests:
- AlgorithmId: sha1
Digest: "9069ca78e7450a285173431b3e52c5c25299e473"
- AlgorithmId: sha256
Digest: "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119"
EventSize: 4
Event: "00000000"
- EventNum: 13
PCRIndex: 2
EventType: EV_SEPARATOR
DigestCount: 2
Digests:
- AlgorithmId: sha1
Digest: "9069ca78e7450a285173431b3e52c5c25299e473"
- AlgorithmId: sha256
Digest: "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119"
EventSize: 4
Event: "00000000"
- EventNum: 14
PCRIndex: 3
EventType: EV_SEPARATOR
DigestCount: 2
Digests:
- AlgorithmId: sha1
Digest: "9069ca78e7450a285173431b3e52c5c25299e473"
- AlgorithmId: sha256
Digest:
"df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119"
EventSize: 4
Event: "00000000"
- EventNum: 15
PCRIndex: 4
EventType: EV_SEPARATOR
DigestCount: 2
Digests:
- AlgorithmId: sha1
Digest: "9069ca78e7450a285173431b3e52c5c25299e473"
- AlgorithmId: sha256
Digest: "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119"
EventSize: 4
Event: "00000000"
- EventNum: 16
PCRIndex: 5
EventType: EV_SEPARATOR
DigestCount: 2
Digests:
- AlgorithmId: sha1
Digest: "9069ca78e7450a285173431b3e52c5c25299e473"
- AlgorithmId: sha256
Digest: "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119"
EventSize: 4
Event: "00000000"
- EventNum: 17
PCRIndex: 6
EventType: EV_SEPARATOR
DigestCount: 2
Digests:
- AlgorithmId: sha1
Digest: "9069ca78e7450a285173431b3e52c5c25299e473"
- AlgorithmId: sha256
Digest: "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119"
EventSize: 4
Event: "00000000"
- EventNum: 18
PCRIndex: 7
EventType: EV_SEPARATOR
DigestCount: 2
Digests:
- AlgorithmId: sha1
Digest: "9069ca78e7450a285173431b3e52c5c25299e473"
- AlgorithmId: sha256
Digest: "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119"
EventSize: 4
Event: "00000000"
- EventNum: 19
PCRIndex: 5
EventType: EV_EFI_ACTION
DigestCount: 2
Digests:
- AlgorithmId: sha1
Digest: "443a6b7b82b7af564f2e393cd9d5a388b7fa4a98"
- AlgorithmId: sha256
Digest: "d8043d6b7b85ad358eb3b6ae6a873ab7ef23a26352c5dc4faa5aeedacf5eb41b"
EventSize: 29
Event: 'Exit Boot Services Invocation'
- EventNum: 20
PCRIndex: 5
EventType: EV_EFI_ACTION
DigestCount: 2
Digests:
- AlgorithmId: sha1
Digest: "475545ddc978d7bfd036facc7e2e987f48189f0d"
- AlgorithmId: sha256
Digest: "b54f7542cbd872a81a9d9dea839b2b8d747c7ebd5ea6615c40f42f44a6dbeba0"
EventSize: 40
Event: 'Exit Boot Services Returned with Success'
pcrs:
sha1:
0 : 0x3e26be54f5f15140afbe509cc4580538d979598d
1 : 0x5b4c188c39baa249f688460a63b68df6d3d3ec94
2 : 0xb2a83b0ebf2f8374299a5b2bdfc31ea955ad7236
3 : 0xb2a83b0ebf2f8374299a5b2bdfc31ea955ad7236
4 : 0x260ae65533f38ab643f157bd176c72f9fdece410
5 : 0xd16d7e629fd8d08ca256f9ad3a3a1587c9e6cc1b
6 : 0xb2a83b0ebf2f8374299a5b2bdfc31ea955ad7236
7 : 0x518bd167271fbb64589c61e43d8c0165861431d8
sha256:
0 :
0x7f35c1ef1bb7b9d2aee58ec4c36cf384d70524c2ce2b6801772d7fdb1d2b5f5a
1 : 0xf35b74319598e48a6a69a6a04e903a872558b891563b0af23c877c8472c277a6
2 : 0x3d458cfe55cc03ea1f443f1562beec8df51c75e14a9fcf9a7234a13f198e7969
3 : 0x3d458cfe55cc03ea1f443f1562beec8df51c75e14a9fcf9a7234a13f198e7969
4 : 0xbe4d7464e3a3c0a04040355368006a5fbe02c0ef232c8c18926df9b718374f36
5 : 0xa5ceb755d043f32431d63e39f5161464620a3437280494b5850dc1b47cc074e0
6 : 0x3d458cfe55cc03ea1f443f1562beec8df51c75e14a9fcf9a7234a13f198e7969
7 : 0x65caf8dd1e0ea7a6347b635d2b379c93b9a1351edc2afc3ecda700e534eb3068
For more information on the work Linaro does in securing edge devices, go to our Trusted Substrate project page. Trusted Substrate is an integrated firmware solution made of all necessary components to implement Arm SystemReady standards with more security options turned on.