lkml.org 
[lkml]   [2009]   [Oct]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [GIT PULL] x86/txt for v2.6.32
    Hi!

    > > > > Shows the attack being used to read sensitive keys, but you can use it also
    > > > > to *modify* system running state (it will be more difficult, as you need to
    > > > > remove and replace the RAM while on S3 instead of S5, but it should be
    > > > > doable by someone who knows what he is doing).
    > > >
    > > > I believe the whole point of this TXT / S3 handling is that the resume
    > > > from S3 will then be able to detect that the contents of RAM have been
    > > > modified while the system was asleep.
    > >
    > > ...and you are able to read out any keys, etc. Maybe that's expected &
    > > ok, but Doc*/intel_txt.txt does not actually tell me what it protects
    > > against and is pretty much useless... making patches impossible to
    > > review.
    > >
    > > So... what does txt protect?
    >
    > >From Documentation/intel_txt.txt:
    > Intel TXT in Brief:
    > o Provides dynamic root of trust for measurement (DRTM)
    > o Data protection in case of improper shutdown
    > o Measurement and verification of launched environment
    >
    > Intel TXT doesn't protect anything itself--it provides a foundation for software to provide protections and security. tboot and the associated Linux patches do this. The section of intel_txt.txt titled "Value Proposition for Linux or "Why should you care?"" tries to describe what is provided.
    >
    > > Data integrity only?
    >
    > Data integrity, yes, but not only. The code also provides for DRTM-based measurements, data protection in case of improper shutdown, etc.
    >
    > > Data privacy, too?
    >
    > No.

    So why does it protect data "in case of improper shutdown"?

    > > Who is it designed to protect against?
    > >
    > > Remote attacker?
    >
    > Yes.

    Existing mechanisms should be adequate to protect against then.

    > > Local user trying to subvert it?
    >
    > No.

    Then again, why does it protect data "in case of improper shutdown"?

    > > > TXT simply produces a reasonably trustworthy measurement of system
    > > > state. If you modify RAM while the system is asleep, then you will not
    > > > be able to produce a measurement showing an unmodified system state.
    > >
    > > Well, actually I see some auditing to be done in proposed patches.
    >
    > All comments are welcome.

    Well, without detailed design goals, comments are pretty much
    impossible. Please improve Documentation/intel_txt.txt to explain what
    it protects, and against who.
    Pavel
    --
    (english) http://www.livejournal.com/~pavelmachek
    (cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html


    \
     
     \ /
      Last update: 2009-10-17 21:31    [W:0.048 / U:91.836 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site