long presentation: added simplified daa description

6 years ago · c701b534a7
6 changed files with 202 additions and 28 deletions
--- a/presentation/191119_long/long.pdf
+++ b/presentation/191119_long/long.pdf
--- a/presentation/191119_long/long.tex
+++ b/presentation/191119_long/long.tex
@ -22,25 +22,44 @@
 \end{frame}

 \begin{frame}
-	\frametitle{Recap: Trust inside Biometric Sensor}
+	\frametitle{Chain of Trust}
 	\begin{itemize}
-		\item manufacturer of TPM holds certificate
-		\item TPM holds measurements of boot chain in PCR
-		\begin{itemize}
-			\item CRTM measures BIOS
-			\item BIOS measures MBR/EFI Bootloader
-			\item bootloader measures Kernel (Grub 2.04 supports TPM2)
-			\item Kernel measures libs, executables, \ldots
-		\end{itemize}
-		\item TPM Quote: summarize the PCR state and sign it with TPM Endorsement Key (EK)
+		\item Manufacturer of TPM creates certificate 
+		\item Core Root of Trust: key seed
+		\item \texttt{tpm2\_CreatePrimary} to generate new EK
 	\end{itemize}
+	\begin{figure}
+		\centering
+		\includegraphics[width=0.9\textwidth]{../../resources/tpmcert}
+	\end{figure}
 \end{frame}

 \begin{frame}
-	\frametitle{Problem: Create trust beween BS and PA}
+	\frametitle{Chain of Trust - Platform Configuration Register (PCR)}
 	\begin{itemize}
-		\item network discovery
-		\item \textbf{no Knowledge about BS}
+		\item Booting with TPM2 (PCR0-7)
+		\begin{description}
+			\item[\texttt{PCR0}] EFI Boot Services, EFI Runtime Services, Platform Firmware
+			\item[\texttt{PCR1}] ACPI, SMBIOS, \ldots
+			\item[\texttt{PCR2}] Option ROMs, Drivers from disks, \ldots (not relevant)
+			\item[\texttt{PCR4}] EFI/Legacy os Loader
+			\item[\texttt{PCR5}] EFI Partition, GPT, OS Partition Table
+		\end{description}
+		\item Grub2.04 supports TPM2 (PCR8,9) \footnote{\url{www.gnu.org/software/grub/manual/grub/grub.html\#Measured-Boot}}
+		\begin{description}
+			\item[\texttt{PCR8}] Kernel-, Module- and all other commands
+			\item[\texttt{PCR9}] All files read by GRUB
+		\end{description}
+		\item Linux uses PCR10-15
+	\end{itemize}
+
+\end{frame}
+
+\begin{frame}
+	\frametitle{Problem: Create Trust between BS and PA}
+	\begin{itemize}
+		\item Network discovery
+		\item \textbf{No Knowledge about BS}
 		\begin{itemize}
 			\item \textbf{Hardware}
 			\item \textbf{Software}
@ -48,7 +67,7 @@
 			\item Correct client to certify identity for given biometric data
 		\end{itemize}
 		\item \textbf{BS faces same problem with PA}
-		\item establish a secure channel to submit sensitive data
+		\item Establish a secure channel to submit sensitive data
 	\end{itemize}
 \end{frame}

@ -70,11 +89,44 @@
 	\end{itemize}
 \end{frame}

+\begin{frame}
+	\frametitle{ECDAA Setup}
+	\begin{itemize}
+		\item Choose TPM-supported pairing-firendly Elliptic Curve: FP256BN
+		\item Generate Issuer keypair
+		\item $isk = (x,y)$
+		\item $ipk = (q,\mathbb{G}_1, \mathbb{G}_2, \mathbb{G}_T, g_1, g_2, e, X, Y)$
+		\item Publish ipk
+	\end{itemize}
+\end{frame}
+
+\begin{frame}
+	\frametitle{ECDAA Member Join}
+	\begin{center}
+		\includegraphics[width=0.9\textwidth]{../../resources/daajoin}
+	\end{center}
+\end{frame}
+
+\begin{frame}
+	\frametitle{ECDAA Member Sign}
+	\begin{center}
+		\includegraphics[width=0.9\textwidth]{../../resources/daajoin}
+	\end{center}
+\end{frame}
+
+\begin{frame}
+	\frametitle{ECDAA Member Verify}
+	\begin{center}
+		\includegraphics[width=0.9\textwidth]{../../resources/daajoin}
+	\end{center}
+\end{frame}
+
+
 \begin{frame}
 	\frametitle{DAA Setup: Issuer creates Bilinear Group and Keys}
-	\begin{eqnarray*}
+	\[
 		q,\mathbb{G}_1, \mathbb{G}_2, \mathbb{G}_T, g_1, g_2, e
-	\end{eqnarray*}
+	\]
 	\begin{itemize}
 		\item $\mathbb{G}_1, \mathbb{G}_2, \mathbb{G}_T$: groups of prime order $q$
 		\item $g_1 \in \mathbb{G}_1$, $g_2 \in \mathbb{G}_2$: generator points
@ -86,24 +138,49 @@
 		\end{itemize}
 		\item Choose secret key $x\leftarrow\mathbb{Z}_q$, $y\leftarrow\mathbb{Z}_q$
 		\item generate public key $X=g_2^x$, $Y=g_2^y$
+		\item $ipk = (q,\mathbb{G}_1, \mathbb{G}_2, \mathbb{G}_T, g_1, g_2, e, X, Y)$
+		\item $isk = (x,y)$
 	\end{itemize}
 \end{frame}

 \begin{frame}
-	\frametitle{Bilinear Maps}
-	Definition Bilinear Maps:
-	\begin{itemize}
-		\item \emph{Bilinear}: For all $P,Q \in G$, for all $a,b \in \mathbb{Z}$, $e(P^a,Q^b) = e(P,Q)^{ab}$
-		\item \emph{Non-degenerate}: There exists some $P,Q \in G$ such that $e(P,Q) \not 1$ where 1 is the identity of $\mathrm{G}$
-	\end{itemize}
-\end{frame}
-
-\begin{frame}
-	\frametitle{Bilinear Maps: Signatures}
+	\frametitle{Bilinear Maps - Sign Messages}
 	\begin{itemize}
-		\item given message $m$ and random number $r leftarrow \mathbb{Z}_q$
-		
+		\item Simplified Example: $\mathbb{G}_1 = \mathbb{G}_2$
+		\item $pk = (q,\mathbb{G}_1, \mathbb{G}_T, g_1, g_T, e, X, Y)$
+		\item Given message $m$
 	\end{itemize}
+	\begin{columns}[t]
+		\begin{column}{4cm}
+			\emph{Signer:}
+			\begin{itemize}
+				\item Compute Signature $\sigma(a,b,c)$
+				\begin{itemize}
+					\item $a \in \mathbb{G}_1$
+					\item $b = a^y$
+					\item $c = a^{x+mxy}$
+				\end{itemize}
+				\item Send(m, $\sigma$)
+			\end{itemize}		
+		\end{column}
+		\begin{column}{6cm}
+			\emph{Verifier:}
+			\begin{itemize}
+				\item Check, that
+				\begin{small}
+				\begin{displaymath}
+				\underline{e(a,Y)} = e(a,g^y) = e(a^y,g) = \underline{e(b,g)}
+				\end{displaymath}
+				\begin{displaymath}
+				\underline{e(X,a)\cdot e(X,b)^m} = e(g,a)^x \cdot e(g,a)^{xym} 
+				\end{displaymath}
+				\begin{displaymath}
+				= e(g,a)^{x+xym} = \underline{e(g,c)}
+				\end{displaymath}
+				\end{small}
+			\end{itemize}		
+		\end{column}
+	\end{columns}
 \end{frame}

 \begin{frame}
--- a/resources/daajoin.fig
+++ b/resources/daajoin.fig
@ -0,0 +1,41 @@
+#FIG 3.2  Produced by xfig version 3.2.7
+Landscape
+Center
+Inches
+Letter
+100.00
+Single
+-2
+1200 2
+2 1 0 1 0 7 50 -1 -1 0.000 0 0 -1 1 0 2
+	2 0 1.00 120.00 180.00
+	 4875 4425 6600 4425
+2 1 0 1 0 7 50 -1 -1 0.000 0 0 -1 0 1 2
+	2 0 1.00 120.00 180.00
+	 2475 4800 6600 4800
+2 1 0 1 0 7 50 -1 -1 0.000 0 0 -1 1 0 2
+	2 0 1.00 120.00 180.00
+	 2475 5475 6600 5475
+2 1 0 1 0 7 50 -1 -1 0.000 0 0 -1 0 1 2
+	2 0 1.00 120.00 180.00
+	 2550 6450 6600 6450
+2 1 0 1 0 7 50 -1 -1 0.000 0 0 -1 1 0 2
+	2 0 1.00 120.00 180.00
+	 2550 7425 4275 7425
+4 1 0 50 -1 4 14 0.0000 0 180 510 1275 3900 TPM\001
+4 0 0 50 -1 4 14 0.0000 0 180 1455 6825 4650 create Nonce\001
+4 1 0 50 -1 4 14 0.0000 0 180 645 7500 3900 Issuer\001
+4 1 0 50 -1 4 10 0.0000 0 120 1290 4500 4725 JOINSTART nonce\001
+4 1 0 50 -1 4 14 0.0000 0 180 510 4500 3900 Host\001
+4 0 0 50 -1 4 14 0.0000 0 240 1680 6825 5700 verify Signature\001
+4 0 0 50 -1 4 14 0.0000 0 180 1965 6825 6000 create Credentials\001
+4 0 0 50 -1 4 14 0.0000 0 240 960 6825 6300 SPK(isk)\001
+4 1 0 50 -1 4 10 0.0000 0 150 1380 4500 5400 APPEND pEK, sign\001
+4 1 0 50 -1 4 10 0.0000 0 120 360 5700 4350 JOIN\001
+4 1 0 50 -1 4 10 0.0000 0 150 1545 4500 6375 PROCEED Cred, sign\001
+4 0 0 50 -1 4 14 0.0000 0 240 1680 375 6675 verify Signature\001
+4 0 0 50 -1 4 14 0.0000 0 225 1860 375 6975 verify Credentials\001
+4 0 0 50 -1 4 14 0.0000 0 180 1830 375 7275 store Credentials\001
+4 1 0 50 -1 4 10 0.0000 0 120 750 3300 7350 store Cred\001
+4 0 0 50 -1 4 14 0.0000 0 240 1125 375 5025 create gsk\001
+4 0 0 50 -1 4 14 0.0000 0 240 1050 375 5325 SPK(gsk)\001
--- a/resources/daajoin.pdf
+++ b/resources/daajoin.pdf
--- a/resources/tpmcert.fig
+++ b/resources/tpmcert.fig
@ -0,0 +1,56 @@
+#FIG 3.2  Produced by xfig version 3.2.7
+Landscape
+Center
+Inches
+Letter
+100.00
+Single
+-2
+1200 2
+6 6000 6150 7500 6900
+2 4 0 1 0 7 50 -1 -1 0.000 0 0 7 0 0 5
+	 7500 6900 7500 6150 6000 6150 6000 6900 7500 6900
+4 1 0 50 -1 4 14 0.0000 0 180 1455 6750 6450 Endorsement\001
+4 1 0 50 -1 4 14 0.0000 0 225 420 6750 6750 Key\001
+-6
+6 450 6150 1950 6900
+6 450 6225 1950 6750
+4 1 0 50 -1 4 14 0.0000 0 180 1425 1200 6450 Manufacturer\001
+4 1 0 50 -1 4 14 0.0000 0 180 345 1200 6750 CA\001
+-6
+2 4 0 1 0 7 50 -1 -1 0.000 0 0 7 0 0 5
+	 1950 6900 1950 6150 450 6150 450 6900 1950 6900
+-6
+6 2625 6075 3225 6900
+1 4 0 1 0 7 50 -1 -1 0.000 1 0.0000 3075 6225 106 106 3150 6150 3000 6300
+1 3 0 1 0 7 50 -1 -1 0.000 1 0.0000 3075 6225 75 75 3075 6225 3075 6150
+2 1 0 1 0 7 50 -1 -1 0.000 0 0 -1 0 0 6
+	 3225 6075 3225 6900 2625 6900 2625 6225 2775 6075 3225 6075
+2 1 0 1 0 7 50 -1 -1 0.000 0 0 -1 0 0 3
+	 2625 6225 2775 6225 2775 6075
+2 1 0 1 0 7 50 -1 -1 0.000 0 0 -1 0 0 5
+	 3150 6300 3150 6450 3075 6375 3000 6450 3000 6300
+2 1 0 1 0 7 50 -1 -1 0.000 0 0 -1 0 0 2
+	 2775 6525 3075 6525
+2 1 0 1 0 7 50 -1 -1 0.000 0 0 -1 0 0 2
+	 2775 6600 3075 6600
+2 1 0 1 0 7 50 -1 -1 0.000 0 0 -1 0 0 2
+	 2775 6675 3075 6675
+-6
+2 1 0 1 0 7 50 -1 -1 0.000 0 0 -1 1 0 2
+	2 0 1.00 120.00 180.00
+	 3225 6525 4200 6525
+2 1 0 1 0 7 50 -1 -1 0.000 0 0 -1 1 0 2
+	2 0 1.00 120.00 180.00
+	 1950 6525 2625 6525
+2 1 0 1 0 7 50 -1 -1 0.000 0 0 -1 1 0 2
+	2 0 1.00 120.00 180.00
+	 5400 6525 6000 6525
+2 2 1 1 0 7 50 -1 -1 4.000 0 0 -1 0 0 5
+	 4200 6375 5400 6375 5400 6675 4200 6675 4200 6375
+2 2 0 1 0 7 50 -1 -1 0.000 0 0 -1 0 0 5
+	 3900 6000 7800 6000 7800 7050 3900 7050 3900 6000
+4 1 0 50 -1 4 14 0.0000 0 225 975 4800 6600 key seed\001
+4 1 0 50 -1 4 10 0.0000 0 120 315 5700 6375 KDF\001
+4 1 0 50 -1 4 10 0.0000 0 120 315 2925 7125 Cert\001
+4 0 0 50 -1 4 14 0.0000 0 180 510 3975 6975 TPM\001
--- a/resources/tpmcert.pdf
+++ b/resources/tpmcert.pdf