Trusted-computing March 2011

trusted-computing@lists.fedorahosted.org

8 participants
5 discussions

Notes from March 2 IBM / Red Hat Trusted Computing Meeting
by George Wilson 22 Mar '11

22 Mar '11

Following are notes I jotted down following the March 2, 2011 meeting between IBM and Red Hat that may be of general interest to the list. Known Attendees: Rajiv Andrade Stefan Berger Ken Goldman Steve Grubb Anthony Liguori Frank Novak Eric Paris Dimitrios Pendarakis Jack Rieden Dave Safford Lee Terrell Dan Walsh George Wilson Lee Wilson Chris Wright Kent Yoder Mimi Zohar Meeting Summary: - IBM has been open sourcing various Trusted Computing components over the last several years that are fairly uninteresting in an of themselves. - However, we have been doing so to to build out the ecosystem. - We have long had TPM device drivers in the kernel, TrouSerS, tpm-tools, and the PKCS#11 TPM token. - The big missing piece has been trusted boot, and due to that deficiency, TrouSerS has remained in Tech Preview status for quite some time. - Red Hat had stated several years ago that they were uninterested in an SRTM given the more scalable DRTM approach. - However, a DRTM bootloader that works with TXT was thwarted by the Fedora requirement not to carry or reference the 3rd party BLOB that is the sinit AC module. - During talks last year that included the System x organization, we were able to get System x to agree to put the ACM into flash much as is done for the BIOS. - That allowed us to make a statement, and for tboot to be contributed to Fedora. - Eric stated that he's having trouble getting tboot to come up on the boards he has tried. - Given we can get past the tboot issues, there will finally be a complete Trusted Computing stack that supports trusted boot on Intel TXT capable machines. - The support can be exploited by IMA in the kernel, and tpm-tools and the PKCS#11 TPM token in userspace. - Now it is time to turn our attention towards other issues: IMA appraisal, EVM, PTS, an attestation management server, and a CA. - It is possible that a PTS implementation will be open sourced by IBM Research in the near future. - That could be integrated with the TNC package to created an attested TNC in the TCG sense using freeRADIUS and wpa_supplicant. - Those pieces would provide a complete bare metal or KVM host ecosystem for the first time. - The other place that requires attention is the virtual space. - IBM Research open sourced it's gold standard software TPM, and Ken has ported it to freebl, the lower lower of NSS. - Ken is still seeing an issue and will contact Bob Relyea to help resolve, likely in a conference call. - There will need to be a new version of NSS with cleanups Ken requires. - It appears to be working fairly well and largely surviving torture tests. - Stefan has turned it into libtpms and libtpms-devel packages, which have undergone review. - The software TPM library work is preparatory to submitting patches to the Qemu community so that community members can "yum install libtpms libtpms-devel" and proceed with building the patches. - The patches are a large chunk of code somewhat akin to SPICE in terms of size and complexity. - However, they ware working for Stefan. - It is expected to take some time for them to undergo review but the approach appears viable. - We still need a way to do measured launches of guests. - The hope is to use the same tboot GRUB module for guests as we use for the host by emulating TXT instructions in Qemu. - A measured launch would complete the guest ecosystem. - Another piece of the puzzle to consider is EVM. - IMA appraisal makes little sense without EVM. - Eric will take a look at Mimi's patches. Component Status Summary: Substantially Complete: - tpm_tis - TrouSerS - tpm-tools - PKCS #11 TPM token May Need Work: - tboot in the bare metal or host case Potentially Open Sourced Soon: - OpenPTS from IBM Research Work in Progress: - IBM's Software TPM port to freebl - Transformation of IBM's Software TPM into a vTPM library and devel package - Qemu integration of the vTPM Work Not Yet Planned: - Qemu emulation of TXT - Virtual sinit AC module - Any virtual BIOS work required to support TXT - Other features upon which TXT emulation may be dependent - Attestation management - vTPM enrollment Regards, George Wilson IBM Linux Technology Center Security Architect & Team Lead 512-286-9271

4 11

CRADA CREATION
by Tambascia, Alexander R Civ USAF AFMC ESC/XR 22 Mar '11

22 Mar '11

Greetings All: Joel Rodriquez is currently working on establishing the CRADA in order for us to use the CEIF here at Hanscom for the development Of the Secure Virtual Desktop. Currently we have the Army and Marines who are also interested in participating in the CRADA with RedHat and the Air Force. R/ Alexander R. Tambascia, Prof CS MSCS, MCSE, MCSA, CEH, SECURITY+,DCSE, JNCIS,IASO Cyber Engineer - AFMC/ESC/XR/XRX UNSECURE: 781-377-6544 (AF-NIPER)alexander.r.tambascia(a)hanscom.af.mil "Nothing in this world can be obtained without something of equal value being lost; this is the first law of ' Equivalent Exchange' the world's one and only truth" - Roger Bacon

1 0

Trust Anchors workshop
by Stephen Smalley 21 Mar '11

21 Mar '11

Thought some of the people on this list might be interested in an upcoming workshop on April 27th that will examine the use of the TPM among other technologies as a basis for establishing trust in computing platforms. The "Trust Anchors are Invulnerable" workshop is described at: http://cybersecurity.nitrd.gov/ People who are interested should apply by email with a CV and short position paper to assumptionbusters(a)nitrd.gov as explained in the Federal Register notice referenced at the above web site. The deadline has been extended to March 23rd. -- Stephen Smalley National Security Agency

1 0

welcome to trusted-computing!
by David Egts 08 Mar '11

08 Mar '11

Hello all, First off I wanted to say THANK YOU and WELCOME to the trusted-computing list! I wanted to let the announcements we made in several venues ripple out until we got a critical mass of subscribers before we got the dialog rolling. So far we have already over 60 people signed up which is fantastic. Thank you again for your interest! So to kick things off, let me provide a little background to stimulate conversation... At Red Hat, we've been seeing trusted computing gain more and more customer interest as folks consider virtualization. This is even more true as they begin to look at cloud computing. As folks move workloads to a virtualized or cloud datacenter, they have little or possibly no control over the underlying hardware. Essentially if the hardware or hypervisor has been compromised, it really doesn't matter how secure your guest OS is, and the painstaking effort you put into writing secure application code is for naught. In virtual environments, one should absolutely consider these risks. However with a multi-tenant 3rd party cloud environemnt, these considerations should absolutely be a part of a security risk assessment and mitigation plan. With this in mind, many of these customers are looking for a level of assurance that the hardware and hypervisor can indeed be trusted prior to running a virtual guest. This makes sense in the classic "virtualization in the datacenter" or cloud environments, but they also want to have a level of assurance when running virtual guests on say laptop systems. One example is telework. In the event of a natural or man-made disaster, employers want to have the ability to have employees securely work from home on maybe their personally-owned computers. Booting up a work-provided guest on the home PC that was previously running who-knows-what by the teenage son presents interesting security challenges. Another consideration which is similar is in-theater deployments. What if you want to deploy a virtual machine to a soldier/airman/sailor/marine/other in theater? You want to make sure that the local host he's running in theater is trusted and authorized to run the VM, as well as ensuring that the guest OS hasn't been tampered with in flight. On the other end of the spectrum, folks in the hardware and software industry as well as folks in the open source community have been doing fantastic work helping to ensure that hardware capabilities such as TPM is available for use by the OS. So to open the conversation up to the subscribers on this list... End users/customers: - What are your requirements? What keeps you up at night? - What would you like to be able to do? What's your vision of success? - What have you tried in the past what works? Maybe wikify that here so others can try and provide constructive feedback... https://fedorahosted.org/trustedcomputing/ - What have you tried that didn't work work (whether for technical or policy reasons)? Maybe you found a 90% solution but the last 10% was a deal breaker. Maybe the list can help address that last 10%? Hardware / software / community folks: - What are you working on that customers may not know about? - Would you have any cookbooks or tips on how to get started? If so, please wikify them here for end users to try and report back... https://fedorahosted.org/trustedcomputing/ Anything else I missed? Thanks again everyone! I really look forward to the dialog! Dave -- David D. Egts, RHCA, RHCSS #805007796228001 Principal Architect, Red Hat, Inc.

2 1

(no subject)
by Trace Peters 07 Mar '11

07 Mar '11

1 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

Trusted-computing March 2011