TPM based attestation - how can we use it for good?
summary
Systems with TPMs produce signed PCR quotes plus an event log; this shows which boot components hashed into the final PCR value and lets a verifier check integrity. The talk explains EK/AK chaining, platform certificates for automated identity, and using quotes plus the event log to prove firmware and kernel state. It demos a Bluetooth Low Energy demo that performs a TPM attestation handshake using Go, publishes an open-source code branch, and shows the prototype works but needs privacy, standardization and more robustness.
AI-written summary · about
chapters (10)
- 0:00Intro
- 2:20What is a TPM?
- 5:16What is the identity of a TPM?
- 10:46Why is there an AK?
- 13:03What can we do with an AK?
- 14:20What's a Platform Configuration Register (PCR)?
- 20:19Bringing everything together: Remote Attestation
- 26:32Fixed PCR values are hard to work with
- 27:19What if remote attestation, but
- 32:36Not ready for production yet
related talks
40mUsing TPMs to Cryptographically Verify Devices at Scale
41mThe privacy aspect of TPM attestation
29mRemote Attestation of IoT devices using a discrete TPM 2.0
29mThe Trusted Platform Module
28mThe TPM as an everyday security tool
29mA Simple Protocol for Remote Attestation of System Integrity
51mApplications of TPM 2.0
27mMaking Remote Attestation Useful on Linux