lkml.org 
[lkml]   [2009]   [Oct]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [GIT PULL] x86/txt for v2.6.32
Hi!

> > > > Shows the attack being used to read sensitive keys, but you can use it also
> > > > to *modify* system running state (it will be more difficult, as you need to
> > > > remove and replace the RAM while on S3 instead of S5, but it should be
> > > > doable by someone who knows what he is doing).
> > >
> > > I believe the whole point of this TXT / S3 handling is that the resume
> > > from S3 will then be able to detect that the contents of RAM have been
> > > modified while the system was asleep.
> >
> > ...and you are able to read out any keys, etc. Maybe that's expected &
> > ok, but Doc*/intel_txt.txt does not actually tell me what it protects
> > against and is pretty much useless... making patches impossible to
> > review.
> >
> > So... what does txt protect?
>
> >From Documentation/intel_txt.txt:
> Intel TXT in Brief:
> o Provides dynamic root of trust for measurement (DRTM)
> o Data protection in case of improper shutdown
> o Measurement and verification of launched environment
>
> Intel TXT doesn't protect anything itself--it provides a foundation for software to provide protections and security. tboot and the associated Linux patches do this. The section of intel_txt.txt titled "Value Proposition for Linux or "Why should you care?"" tries to describe what is provided.
>
> > Data integrity only?
>
> Data integrity, yes, but not only. The code also provides for DRTM-based measurements, data protection in case of improper shutdown, etc.
>
> > Data privacy, too?
>
> No.

So why does it protect data "in case of improper shutdown"?

> > Who is it designed to protect against?
> >
> > Remote attacker?
>
> Yes.

Existing mechanisms should be adequate to protect against then.

> > Local user trying to subvert it?
>
> No.

Then again, why does it protect data "in case of improper shutdown"?

> > > TXT simply produces a reasonably trustworthy measurement of system
> > > state. If you modify RAM while the system is asleep, then you will not
> > > be able to produce a measurement showing an unmodified system state.
> >
> > Well, actually I see some auditing to be done in proposed patches.
>
> All comments are welcome.

Well, without detailed design goals, comments are pretty much
impossible. Please improve Documentation/intel_txt.txt to explain what
it protects, and against who.
Pavel
--
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html


\
 
 \ /
  Last update: 2009-10-17 21:31    [from the cache]
©2003-2011 Jasper Spaans. Advertise on this site