diff --git a/presentation/191119_long/long.pdf b/presentation/191119_long/long.pdf index 604f1e8..c0337e2 100644 Binary files a/presentation/191119_long/long.pdf and b/presentation/191119_long/long.pdf differ diff --git a/presentation/191119_long/long.tex b/presentation/191119_long/long.tex index 677cdd7..bdf7436 100644 --- a/presentation/191119_long/long.tex +++ b/presentation/191119_long/long.tex @@ -22,25 +22,44 @@ \end{frame} \begin{frame} - \frametitle{Recap: Trust inside Biometric Sensor} + \frametitle{Chain of Trust} \begin{itemize} - \item manufacturer of TPM holds certificate - \item TPM holds measurements of boot chain in PCR - \begin{itemize} - \item CRTM measures BIOS - \item BIOS measures MBR/EFI Bootloader - \item bootloader measures Kernel (Grub 2.04 supports TPM2) - \item Kernel measures libs, executables, \ldots - \end{itemize} - \item TPM Quote: summarize the PCR state and sign it with TPM Endorsement Key (EK) + \item Manufacturer of TPM creates certificate + \item Core Root of Trust: key seed + \item \texttt{tpm2\_CreatePrimary} to generate new EK \end{itemize} + \begin{figure} + \centering + \includegraphics[width=0.9\textwidth]{../../resources/tpmcert} + \end{figure} \end{frame} \begin{frame} - \frametitle{Problem: Create trust beween BS and PA} + \frametitle{Chain of Trust - Platform Configuration Register (PCR)} \begin{itemize} - \item network discovery - \item \textbf{no Knowledge about BS} + \item Booting with TPM2 (PCR0-7) + \begin{description} + \item[\texttt{PCR0}] EFI Boot Services, EFI Runtime Services, Platform Firmware + \item[\texttt{PCR1}] ACPI, SMBIOS, \ldots + \item[\texttt{PCR2}] Option ROMs, Drivers from disks, \ldots (not relevant) + \item[\texttt{PCR4}] EFI/Legacy os Loader + \item[\texttt{PCR5}] EFI Partition, GPT, OS Partition Table + \end{description} + \item Grub2.04 supports TPM2 (PCR8,9) \footnote{\url{www.gnu.org/software/grub/manual/grub/grub.html\#Measured-Boot}} + \begin{description} + \item[\texttt{PCR8}] Kernel-, Module- and all other commands + \item[\texttt{PCR9}] All files read by GRUB + \end{description} + \item Linux uses PCR10-15 + \end{itemize} + +\end{frame} + +\begin{frame} + \frametitle{Problem: Create Trust between BS and PA} + \begin{itemize} + \item Network discovery + \item \textbf{No Knowledge about BS} \begin{itemize} \item \textbf{Hardware} \item \textbf{Software} @@ -48,7 +67,7 @@ \item Correct client to certify identity for given biometric data \end{itemize} \item \textbf{BS faces same problem with PA} - \item establish a secure channel to submit sensitive data + \item Establish a secure channel to submit sensitive data \end{itemize} \end{frame} @@ -70,11 +89,44 @@ \end{itemize} \end{frame} +\begin{frame} + \frametitle{ECDAA Setup} + \begin{itemize} + \item Choose TPM-supported pairing-firendly Elliptic Curve: FP256BN + \item Generate Issuer keypair + \item $isk = (x,y)$ + \item $ipk = (q,\mathbb{G}_1, \mathbb{G}_2, \mathbb{G}_T, g_1, g_2, e, X, Y)$ + \item Publish ipk + \end{itemize} +\end{frame} + +\begin{frame} + \frametitle{ECDAA Member Join} + \begin{center} + \includegraphics[width=0.9\textwidth]{../../resources/daajoin} + \end{center} +\end{frame} + +\begin{frame} + \frametitle{ECDAA Member Sign} + \begin{center} + \includegraphics[width=0.9\textwidth]{../../resources/daajoin} + \end{center} +\end{frame} + +\begin{frame} + \frametitle{ECDAA Member Verify} + \begin{center} + \includegraphics[width=0.9\textwidth]{../../resources/daajoin} + \end{center} +\end{frame} + + \begin{frame} \frametitle{DAA Setup: Issuer creates Bilinear Group and Keys} - \begin{eqnarray*} + \[ q,\mathbb{G}_1, \mathbb{G}_2, \mathbb{G}_T, g_1, g_2, e - \end{eqnarray*} + \] \begin{itemize} \item $\mathbb{G}_1, \mathbb{G}_2, \mathbb{G}_T$: groups of prime order $q$ \item $g_1 \in \mathbb{G}_1$, $g_2 \in \mathbb{G}_2$: generator points @@ -86,24 +138,49 @@ \end{itemize} \item Choose secret key $x\leftarrow\mathbb{Z}_q$, $y\leftarrow\mathbb{Z}_q$ \item generate public key $X=g_2^x$, $Y=g_2^y$ + \item $ipk = (q,\mathbb{G}_1, \mathbb{G}_2, \mathbb{G}_T, g_1, g_2, e, X, Y)$ + \item $isk = (x,y)$ \end{itemize} \end{frame} \begin{frame} - \frametitle{Bilinear Maps} - Definition Bilinear Maps: - \begin{itemize} - \item \emph{Bilinear}: For all $P,Q \in G$, for all $a,b \in \mathbb{Z}$, $e(P^a,Q^b) = e(P,Q)^{ab}$ - \item \emph{Non-degenerate}: There exists some $P,Q \in G$ such that $e(P,Q) \not 1$ where 1 is the identity of $\mathrm{G}$ - \end{itemize} -\end{frame} - -\begin{frame} - \frametitle{Bilinear Maps: Signatures} + \frametitle{Bilinear Maps - Sign Messages} \begin{itemize} - \item given message $m$ and random number $r leftarrow \mathbb{Z}_q$ - + \item Simplified Example: $\mathbb{G}_1 = \mathbb{G}_2$ + \item $pk = (q,\mathbb{G}_1, \mathbb{G}_T, g_1, g_T, e, X, Y)$ + \item Given message $m$ \end{itemize} + \begin{columns}[t] + \begin{column}{4cm} + \emph{Signer:} + \begin{itemize} + \item Compute Signature $\sigma(a,b,c)$ + \begin{itemize} + \item $a \in \mathbb{G}_1$ + \item $b = a^y$ + \item $c = a^{x+mxy}$ + \end{itemize} + \item Send(m, $\sigma$) + \end{itemize} + \end{column} + \begin{column}{6cm} + \emph{Verifier:} + \begin{itemize} + \item Check, that + \begin{small} + \begin{displaymath} + \underline{e(a,Y)} = e(a,g^y) = e(a^y,g) = \underline{e(b,g)} + \end{displaymath} + \begin{displaymath} + \underline{e(X,a)\cdot e(X,b)^m} = e(g,a)^x \cdot e(g,a)^{xym} + \end{displaymath} + \begin{displaymath} + = e(g,a)^{x+xym} = \underline{e(g,c)} + \end{displaymath} + \end{small} + \end{itemize} + \end{column} + \end{columns} \end{frame} \begin{frame} diff --git a/resources/daajoin.fig b/resources/daajoin.fig new file mode 100644 index 0000000..cb69e96 --- /dev/null +++ b/resources/daajoin.fig @@ -0,0 +1,41 @@ +#FIG 3.2 Produced by xfig version 3.2.7 +Landscape +Center +Inches +Letter +100.00 +Single +-2 +1200 2 +2 1 0 1 0 7 50 -1 -1 0.000 0 0 -1 1 0 2 + 2 0 1.00 120.00 180.00 + 4875 4425 6600 4425 +2 1 0 1 0 7 50 -1 -1 0.000 0 0 -1 0 1 2 + 2 0 1.00 120.00 180.00 + 2475 4800 6600 4800 +2 1 0 1 0 7 50 -1 -1 0.000 0 0 -1 1 0 2 + 2 0 1.00 120.00 180.00 + 2475 5475 6600 5475 +2 1 0 1 0 7 50 -1 -1 0.000 0 0 -1 0 1 2 + 2 0 1.00 120.00 180.00 + 2550 6450 6600 6450 +2 1 0 1 0 7 50 -1 -1 0.000 0 0 -1 1 0 2 + 2 0 1.00 120.00 180.00 + 2550 7425 4275 7425 +4 1 0 50 -1 4 14 0.0000 0 180 510 1275 3900 TPM\001 +4 0 0 50 -1 4 14 0.0000 0 180 1455 6825 4650 create Nonce\001 +4 1 0 50 -1 4 14 0.0000 0 180 645 7500 3900 Issuer\001 +4 1 0 50 -1 4 10 0.0000 0 120 1290 4500 4725 JOINSTART nonce\001 +4 1 0 50 -1 4 14 0.0000 0 180 510 4500 3900 Host\001 +4 0 0 50 -1 4 14 0.0000 0 240 1680 6825 5700 verify Signature\001 +4 0 0 50 -1 4 14 0.0000 0 180 1965 6825 6000 create Credentials\001 +4 0 0 50 -1 4 14 0.0000 0 240 960 6825 6300 SPK(isk)\001 +4 1 0 50 -1 4 10 0.0000 0 150 1380 4500 5400 APPEND pEK, sign\001 +4 1 0 50 -1 4 10 0.0000 0 120 360 5700 4350 JOIN\001 +4 1 0 50 -1 4 10 0.0000 0 150 1545 4500 6375 PROCEED Cred, sign\001 +4 0 0 50 -1 4 14 0.0000 0 240 1680 375 6675 verify Signature\001 +4 0 0 50 -1 4 14 0.0000 0 225 1860 375 6975 verify Credentials\001 +4 0 0 50 -1 4 14 0.0000 0 180 1830 375 7275 store Credentials\001 +4 1 0 50 -1 4 10 0.0000 0 120 750 3300 7350 store Cred\001 +4 0 0 50 -1 4 14 0.0000 0 240 1125 375 5025 create gsk\001 +4 0 0 50 -1 4 14 0.0000 0 240 1050 375 5325 SPK(gsk)\001 diff --git a/resources/daajoin.pdf b/resources/daajoin.pdf new file mode 100644 index 0000000..86443c8 Binary files /dev/null and b/resources/daajoin.pdf differ diff --git a/resources/tpmcert.fig b/resources/tpmcert.fig new file mode 100644 index 0000000..92e7077 --- /dev/null +++ b/resources/tpmcert.fig @@ -0,0 +1,56 @@ +#FIG 3.2 Produced by xfig version 3.2.7 +Landscape +Center +Inches +Letter +100.00 +Single +-2 +1200 2 +6 6000 6150 7500 6900 +2 4 0 1 0 7 50 -1 -1 0.000 0 0 7 0 0 5 + 7500 6900 7500 6150 6000 6150 6000 6900 7500 6900 +4 1 0 50 -1 4 14 0.0000 0 180 1455 6750 6450 Endorsement\001 +4 1 0 50 -1 4 14 0.0000 0 225 420 6750 6750 Key\001 +-6 +6 450 6150 1950 6900 +6 450 6225 1950 6750 +4 1 0 50 -1 4 14 0.0000 0 180 1425 1200 6450 Manufacturer\001 +4 1 0 50 -1 4 14 0.0000 0 180 345 1200 6750 CA\001 +-6 +2 4 0 1 0 7 50 -1 -1 0.000 0 0 7 0 0 5 + 1950 6900 1950 6150 450 6150 450 6900 1950 6900 +-6 +6 2625 6075 3225 6900 +1 4 0 1 0 7 50 -1 -1 0.000 1 0.0000 3075 6225 106 106 3150 6150 3000 6300 +1 3 0 1 0 7 50 -1 -1 0.000 1 0.0000 3075 6225 75 75 3075 6225 3075 6150 +2 1 0 1 0 7 50 -1 -1 0.000 0 0 -1 0 0 6 + 3225 6075 3225 6900 2625 6900 2625 6225 2775 6075 3225 6075 +2 1 0 1 0 7 50 -1 -1 0.000 0 0 -1 0 0 3 + 2625 6225 2775 6225 2775 6075 +2 1 0 1 0 7 50 -1 -1 0.000 0 0 -1 0 0 5 + 3150 6300 3150 6450 3075 6375 3000 6450 3000 6300 +2 1 0 1 0 7 50 -1 -1 0.000 0 0 -1 0 0 2 + 2775 6525 3075 6525 +2 1 0 1 0 7 50 -1 -1 0.000 0 0 -1 0 0 2 + 2775 6600 3075 6600 +2 1 0 1 0 7 50 -1 -1 0.000 0 0 -1 0 0 2 + 2775 6675 3075 6675 +-6 +2 1 0 1 0 7 50 -1 -1 0.000 0 0 -1 1 0 2 + 2 0 1.00 120.00 180.00 + 3225 6525 4200 6525 +2 1 0 1 0 7 50 -1 -1 0.000 0 0 -1 1 0 2 + 2 0 1.00 120.00 180.00 + 1950 6525 2625 6525 +2 1 0 1 0 7 50 -1 -1 0.000 0 0 -1 1 0 2 + 2 0 1.00 120.00 180.00 + 5400 6525 6000 6525 +2 2 1 1 0 7 50 -1 -1 4.000 0 0 -1 0 0 5 + 4200 6375 5400 6375 5400 6675 4200 6675 4200 6375 +2 2 0 1 0 7 50 -1 -1 0.000 0 0 -1 0 0 5 + 3900 6000 7800 6000 7800 7050 3900 7050 3900 6000 +4 1 0 50 -1 4 14 0.0000 0 225 975 4800 6600 key seed\001 +4 1 0 50 -1 4 10 0.0000 0 120 315 5700 6375 KDF\001 +4 1 0 50 -1 4 10 0.0000 0 120 315 2925 7125 Cert\001 +4 0 0 50 -1 4 14 0.0000 0 180 510 3975 6975 TPM\001 diff --git a/resources/tpmcert.pdf b/resources/tpmcert.pdf new file mode 100644 index 0000000..1666109 Binary files /dev/null and b/resources/tpmcert.pdf differ