|
|
@ -79,7 +79,7 @@ A small script shown in \autoref{code:verifyimash} tries to recalculate this val |
|
|
done < ima.hashes |
|
|
done < ima.hashes |
|
|
tpm2_pcrread sha1:10,16 |
|
|
tpm2_pcrread sha1:10,16 |
|
|
\end{lstlisting} |
|
|
\end{lstlisting} |
|
|
It uses the debugging PCR 16 which is resetable without reboot and has the same initial value as the first 10 PCRs. |
|
|
It uses the debug register PCR 16 which is resetable without reboot and has the same initial value as the first 10 PCRs. |
|
|
When IMA is off, the log holds only one entry of the boot aggregate. |
|
|
When IMA is off, the log holds only one entry of the boot aggregate. |
|
|
Then the SHA1 value can be computed with that script. |
|
|
Then the SHA1 value can be computed with that script. |
|
|
However, comprehending the PCR 10 value with IMA enabled was not possible. |
|
|
However, comprehending the PCR 10 value with IMA enabled was not possible. |
|
|
@ -91,7 +91,14 @@ Furthermore the documentation of calculating these vaules did not mention how th |
|
|
\texttt{tpm2\_pcrextend} requires a sha256 hash as input for the corresponding PCR bank, but the IMA log only provides sha1 hashes. |
|
|
\texttt{tpm2\_pcrextend} requires a sha256 hash as input for the corresponding PCR bank, but the IMA log only provides sha1 hashes. |
|
|
Any PCR 10 extensions regarding the sha256 bank are currently not verifiable. |
|
|
Any PCR 10 extensions regarding the sha256 bank are currently not verifiable. |
|
|
|
|
|
|
|
|
|
|
|
\subsection{Processing and Sending Biometric Data} |
|
|
|
|
|
\begin{itemize} |
|
|
|
|
|
\item Puts together all pieces |
|
|
|
|
|
\item payload without IMA log about 15KB |
|
|
|
|
|
\item No encryption for payload, but doable -- depends on the way how Sensor and PIA can communicate together |
|
|
|
|
|
\item IMA log much too large |
|
|
|
|
|
\item Test results how long the process of capturing takes -- with and without IMA |
|
|
|
|
|
\end{itemize} |
|
|
|
|
|
|
|
|
\section{Limitations} |
|
|
\section{Limitations} |
|
|
\begin{itemize} |
|
|
\begin{itemize} |
|
|
|