I know the spec (TCG EFI Platform Spec v1.2) doesn't explicitly mention what to do in a PXEBoot regarding kernel image TPM measurement. Sounds like this should fall into the general category of kernel measurement into PCR4 and 5. Now in my case, this is a gray area in reality. Typically PXEboot is handed by the PXE ROM in a NIC card and not by the motherboard BIOS. What if the main BIOS does its job but has to stop at the PXE ROM while the PXE ROM doesn't measure the loader and kernel image at all? In other words, if my chain of trust stops (or breaks) at the PXE ROM, is there any other way to solve this problem?
Thanks.
--- David Li Cloudshield Technologies SAIC
You could try a dynamic root of trust, which can be initiated from a PXE-booted image and won't depend on whether the PXE ROM measures it or not.
Joe
From: trusted-computing-bounces@lists.fedorahosted.org [mailto:trusted-computing-bounces@lists.fedorahosted.org] On Behalf Of Li, David Sent: Monday, September 26, 2011 5:08 PM To: trusted-computing@lists.fedorahosted.org Subject: [Trusted-computing] TPM measurement during a PXEboot
I know the spec (TCG EFI Platform Spec v1.2) doesn't explicitly mention what to do in a PXEBoot regarding kernel image TPM measurement. Sounds like this should fall into the general category of kernel measurement into PCR4 and 5. Now in my case, this is a gray area in reality. Typically PXEboot is handed by the PXE ROM in a NIC card and not by the motherboard BIOS. What if the main BIOS does its job but has to stop at the PXE ROM while the PXE ROM doesn't measure the loader and kernel image at all? In other words, if my chain of trust stops (or breaks) at the PXE ROM, is there any other way to solve this problem?
Thanks.
--- David Li Cloudshield Technologies SAIC
I searched TCG and it's not obvious to me. Is there a TCG standard on DRTM?
--- David Li Cloudshield Technologies SAIC Tel. 408-212-9265 (work) 650-224-3891 (cell)
From: Cihula, Joseph [mailto:joseph.cihula@intel.com] Sent: Tuesday, September 27, 2011 12:00 AM To: Li, David; trusted-computing@lists.fedorahosted.org Subject: RE: TPM measurement during a PXEboot
You could try a dynamic root of trust, which can be initiated from a PXE-booted image and won't depend on whether the PXE ROM measures it or not.
Joe
From: trusted-computing-bounces@lists.fedorahosted.orgmailto:trusted-computing-bounces@lists.fedorahosted.org [mailto:trusted-computing-bounces@lists.fedorahosted.org]mailto:[mailto:trusted-computing-bounces@lists.fedorahosted.org] On Behalf Of Li, David Sent: Monday, September 26, 2011 5:08 PM To: trusted-computing@lists.fedorahosted.orgmailto:trusted-computing@lists.fedorahosted.org Subject: [Trusted-computing] TPM measurement during a PXEboot
I know the spec (TCG EFI Platform Spec v1.2) doesn't explicitly mention what to do in a PXEBoot regarding kernel image TPM measurement. Sounds like this should fall into the general category of kernel measurement into PCR4 and 5. Now in my case, this is a gray area in reality. Typically PXEboot is handed by the PXE ROM in a NIC card and not by the motherboard BIOS. What if the main BIOS does its job but has to stop at the PXE ROM while the PXE ROM doesn't measure the loader and kernel image at all? In other words, if my chain of trust stops (or breaks) at the PXE ROM, is there any other way to solve this problem?
Thanks.
--- David Li Cloudshield Technologies SAIC
Hi David,
It is being worked on now. If you are a TCG member, you should be able to get access to a draft. Adding Lee Wilson on copy as he chairs that WG.
Regards, George Wilson IBM Linux Technology Center Security Architect & Team Lead 512-286-9271
"Li, David" <LiD@cloudshield. com> To Sent by: "Cihula, Joseph" trusted-computing joseph.cihula@intel.com, -bounces@lists.fe "trusted-computing@lists.fedorahost dorahosted.org ed.org" <trusted-computing@lists.fedorahost ed.org> 09/27/2011 10:21 cc AM Subject Re: [Trusted-computing] TPM measurement during a PXEboot
I searched TCG and it’s not obvious to me. Is there a TCG standard on DRTM?
--- David Li Cloudshield Technologies SAIC Tel. 408-212-9265 (work) 650-224-3891 (cell)
From: Cihula, Joseph [mailto:joseph.cihula@intel.com] Sent: Tuesday, September 27, 2011 12:00 AM To: Li, David; trusted-computing@lists.fedorahosted.org Subject: RE: TPM measurement during a PXEboot
You could try a dynamic root of trust, which can be initiated from a PXE-booted image and won’t depend on whether the PXE ROM measures it or not.
Joe
From: trusted-computing-bounces@lists.fedorahosted.org [mailto:trusted-computing-bounces@lists.fedorahosted.org] On Behalf Of Li, David Sent: Monday, September 26, 2011 5:08 PM To: trusted-computing@lists.fedorahosted.org Subject: [Trusted-computing] TPM measurement during a PXEboot
I know the spec (TCG EFI Platform Spec v1.2) doesn’t explicitly mention what to do in a PXEBoot regarding kernel image TPM measurement. Sounds like this should fall into the general category of kernel measurement into PCR4 and 5. Now in my case, this is a gray area in reality. Typically PXEboot is handed by the PXE ROM in a NIC card and not by the motherboard BIOS. What if the main BIOS does its job but has to stop at the PXE ROM while the PXE ROM doesn’t measure the loader and kernel image at all? In other words, if my chain of trust stops (or breaks) at the PXE ROM, is there any other way to solve this problem?
Thanks.
--- David Li Cloudshield Technologies SAIC _______________________________________________ Trusted-computing mailing list Trusted-computing@lists.fedorahosted.org https://fedorahosted.org/mailman/listinfo/trusted-computing
For those who are not TCG members or who want to work with existing systems, you can find out about Intel’s D-RTM implementation, Intel® Trusted Execution Technology, at http://www.intel.com/content/www/us/en/architecture-and-technology/trusted-e...
Joe
From: George Wilson [mailto:gcwilson@us.ibm.com] Sent: Tuesday, September 27, 2011 9:47 AM To: Li, David Cc: Cihula, Joseph; trusted-computing@lists.fedorahosted.org; Lee Wilson Subject: Re: [Trusted-computing] TPM measurement during a PXEboot
Hi David,
It is being worked on now. If you are a TCG member, you should be able to get access to a draft. Adding Lee Wilson on copy as he chairs that WG.
Regards, George Wilson IBM Linux Technology Center Security Architect & Team Lead 512-286-9271
[Inactive hide details for "Li, David" ---09/27/2011 11:19:17 AM---"Li, David" LiD@cloudshield.com]"Li, David" ---09/27/2011 11:19:17 AM---"Li, David" <LiD@cloudshield.commailto:LiD@cloudshield.com> "Li, David" <LiD@cloudshield.commailto:LiD@cloudshield.com> Sent by: trusted-computing-bounces@lists.fedorahosted.orgmailto:trusted-computing-bounces@lists.fedorahosted.org
09/27/2011 10:21 AM
To
"Cihula, Joseph" <joseph.cihula@intel.commailto:joseph.cihula@intel.com>, "trusted-computing@lists.fedorahosted.orgmailto:trusted-computing@lists.fedorahosted.org" <trusted-computing@lists.fedorahosted.orgmailto:trusted-computing@lists.fedorahosted.org>
cc
Subject
Re: [Trusted-computing] TPM measurement during a PXEboot
I searched TCG and it’s not obvious to me. Is there a TCG standard on DRTM?
--- David Li Cloudshield Technologies SAIC Tel. 408-212-9265 (work) 650-224-3891 (cell)
From: Cihula, Joseph [mailto:joseph.cihula@intel.com] Sent: Tuesday, September 27, 2011 12:00 AM To: Li, David; trusted-computing@lists.fedorahosted.orgmailto:trusted-computing@lists.fedorahosted.org Subject: RE: TPM measurement during a PXEboot
You could try a dynamic root of trust, which can be initiated from a PXE-booted image and won’t depend on whether the PXE ROM measures it or not.
Joe
From: trusted-computing-bounces@lists.fedorahosted.orgmailto:trusted-computing-bounces@lists.fedorahosted.org [mailto:trusted-computing-bounces@lists.fedorahosted.org]mailto:%5Bmailto:trusted-computing-bounces@lists.fedorahosted.org%5D On Behalf Of Li, David Sent: Monday, September 26, 2011 5:08 PM To: trusted-computing@lists.fedorahosted.orgmailto:trusted-computing@lists.fedorahosted.org Subject: [Trusted-computing] TPM measurement during a PXEboot
I know the spec (TCG EFI Platform Spec v1.2) doesn’t explicitly mention what to do in a PXEBoot regarding kernel image TPM measurement. Sounds like this should fall into the general category of kernel measurement into PCR4 and 5. Now in my case, this is a gray area in reality. Typically PXEboot is handed by the PXE ROM in a NIC card and not by the motherboard BIOS. What if the main BIOS does its job but has to stop at the PXE ROM while the PXE ROM doesn’t measure the loader and kernel image at all? In other words, if my chain of trust stops (or breaks) at the PXE ROM, is there any other way to solve this problem?
Thanks.
--- David Li Cloudshield Technologies SAIC _______________________________________________ Trusted-computing mailing list Trusted-computing@lists.fedorahosted.orgmailto:Trusted-computing@lists.fedorahosted.org https://fedorahosted.org/mailman/listinfo/trusted-computing
Joe,
This is interesting! My server has TPM, 5520 chipset and 5650 processors which are required to support TXT. I am also using RHEL6 which may have tboot code. The only variable is BIOS. My BIOS supports basic SRTM (PCR0-7 measurements) but probably is not TXT-enabled. So the questions are:
1. Can I still use TXT to ensure trusted boot of my Linux kernel and apps?
2. Can TXT work in a PXEboot environment? Thanks.
--- David Li Cloudshield Technologies SAIC
From: Cihula, Joseph [mailto:joseph.cihula@intel.com] Sent: Tuesday, September 27, 2011 10:56 AM To: George Wilson; Li, David Cc: trusted-computing@lists.fedorahosted.org; Lee Wilson Subject: RE: [Trusted-computing] TPM measurement during a PXEboot
For those who are not TCG members or who want to work with existing systems, you can find out about Intel’s D-RTM implementation, Intel® Trusted Execution Technology, at http://www.intel.com/content/www/us/en/architecture-and-technology/trusted-e...
Joe
From: George Wilson [mailto:gcwilson@us.ibm.com]mailto:[mailto:gcwilson@us.ibm.com] Sent: Tuesday, September 27, 2011 9:47 AM To: Li, David Cc: Cihula, Joseph; trusted-computing@lists.fedorahosted.orgmailto:trusted-computing@lists.fedorahosted.org; Lee Wilson Subject: Re: [Trusted-computing] TPM measurement during a PXEboot
Hi David,
It is being worked on now. If you are a TCG member, you should be able to get access to a draft. Adding Lee Wilson on copy as he chairs that WG.
Regards, George Wilson IBM Linux Technology Center Security Architect & Team Lead 512-286-9271
[cid:image001.gif@01CC7D0A.E4E6FCF0]"Li, David" ---09/27/2011 11:19:17 AM---"Li, David" <LiD@cloudshield.commailto:LiD@cloudshield.com> "Li, David" <LiD@cloudshield.commailto:LiD@cloudshield.com> Sent by: trusted-computing-bounces@lists.fedorahosted.orgmailto:trusted-computing-bounces@lists.fedorahosted.org
09/27/2011 10:21 AM
To
"Cihula, Joseph" <joseph.cihula@intel.commailto:joseph.cihula@intel.com>, "trusted-computing@lists.fedorahosted.orgmailto:trusted-computing@lists.fedorahosted.org" <trusted-computing@lists.fedorahosted.orgmailto:trusted-computing@lists.fedorahosted.org>
cc
Subject
Re: [Trusted-computing] TPM measurement during a PXEboot
I searched TCG and it’s not obvious to me. Is there a TCG standard on DRTM?
--- David Li Cloudshield Technologies SAIC Tel. 408-212-9265 (work) 650-224-3891 (cell)
From: Cihula, Joseph [mailto:joseph.cihula@intel.com] Sent: Tuesday, September 27, 2011 12:00 AM To: Li, David; trusted-computing@lists.fedorahosted.orgmailto:trusted-computing@lists.fedorahosted.org Subject: RE: TPM measurement during a PXEboot
You could try a dynamic root of trust, which can be initiated from a PXE-booted image and won’t depend on whether the PXE ROM measures it or not.
Joe
From: trusted-computing-bounces@lists.fedorahosted.orgmailto:trusted-computing-bounces@lists.fedorahosted.org [mailto:trusted-computing-bounces@lists.fedorahosted.org]mailto:%5Bmailto:trusted-computing-bounces@lists.fedorahosted.org%5D On Behalf Of Li, David Sent: Monday, September 26, 2011 5:08 PM To: trusted-computing@lists.fedorahosted.orgmailto:trusted-computing@lists.fedorahosted.org Subject: [Trusted-computing] TPM measurement during a PXEboot
I know the spec (TCG EFI Platform Spec v1.2) doesn’t explicitly mention what to do in a PXEBoot regarding kernel image TPM measurement. Sounds like this should fall into the general category of kernel measurement into PCR4 and 5. Now in my case, this is a gray area in reality. Typically PXEboot is handed by the PXE ROM in a NIC card and not by the motherboard BIOS. What if the main BIOS does its job but has to stop at the PXE ROM while the PXE ROM doesn’t measure the loader and kernel image at all? In other words, if my chain of trust stops (or breaks) at the PXE ROM, is there any other way to solve this problem?
Thanks.
--- David Li Cloudshield Technologies SAIC _______________________________________________ Trusted-computing mailing list Trusted-computing@lists.fedorahosted.orgmailto:Trusted-computing@lists.fedorahosted.org https://fedorahosted.org/mailman/listinfo/trusted-computing
You can determine if your system’s BIOS supports TXT from the list of supported platforms at http://www.intel.com/content/www/us/en/architecture-and-technology/trusted-e....
Assuming that it does support TXT, you can use it to PXE boot a trusted Linux kernel. Extending the trust to apps will require something like IMA or SELinux, etc.
Joe
From: Li, David [mailto:LiD@cloudshield.com] Sent: Tuesday, September 27, 2011 11:45 AM To: Cihula, Joseph; George Wilson Cc: trusted-computing@lists.fedorahosted.org; Lee Wilson Subject: RE: [Trusted-computing] TPM measurement during a PXEboot
Joe,
This is interesting! My server has TPM, 5520 chipset and 5650 processors which are required to support TXT. I am also using RHEL6 which may have tboot code. The only variable is BIOS. My BIOS supports basic SRTM (PCR0-7 measurements) but probably is not TXT-enabled. So the questions are:
1. Can I still use TXT to ensure trusted boot of my Linux kernel and apps?
2. Can TXT work in a PXEboot environment? Thanks.
--- David Li Cloudshield Technologies SAIC
From: Cihula, Joseph [mailto:joseph.cihula@intel.com]mailto:[mailto:joseph.cihula@intel.com] Sent: Tuesday, September 27, 2011 10:56 AM To: George Wilson; Li, David Cc: trusted-computing@lists.fedorahosted.orgmailto:trusted-computing@lists.fedorahosted.org; Lee Wilson Subject: RE: [Trusted-computing] TPM measurement during a PXEboot
For those who are not TCG members or who want to work with existing systems, you can find out about Intel’s D-RTM implementation, Intel® Trusted Execution Technology, at http://www.intel.com/content/www/us/en/architecture-and-technology/trusted-e...
Joe
From: George Wilson [mailto:gcwilson@us.ibm.com]mailto:[mailto:gcwilson@us.ibm.com] Sent: Tuesday, September 27, 2011 9:47 AM To: Li, David Cc: Cihula, Joseph; trusted-computing@lists.fedorahosted.orgmailto:trusted-computing@lists.fedorahosted.org; Lee Wilson Subject: Re: [Trusted-computing] TPM measurement during a PXEboot
Hi David,
It is being worked on now. If you are a TCG member, you should be able to get access to a draft. Adding Lee Wilson on copy as he chairs that WG.
Regards, George Wilson IBM Linux Technology Center Security Architect & Team Lead 512-286-9271
[Inactive hide details for "Li, David" ---09/27/2011 11:19:17 AM---"Li, David" LiD@cloudshield.com]"Li, David" ---09/27/2011 11:19:17 AM---"Li, David" <LiD@cloudshield.commailto:LiD@cloudshield.com> "Li, David" <LiD@cloudshield.commailto:LiD@cloudshield.com> Sent by: trusted-computing-bounces@lists.fedorahosted.orgmailto:trusted-computing-bounces@lists.fedorahosted.org
09/27/2011 10:21 AM
To
"Cihula, Joseph" <joseph.cihula@intel.commailto:joseph.cihula@intel.com>, "trusted-computing@lists.fedorahosted.orgmailto:trusted-computing@lists.fedorahosted.org" <trusted-computing@lists.fedorahosted.orgmailto:trusted-computing@lists.fedorahosted.org>
cc
Subject
Re: [Trusted-computing] TPM measurement during a PXEboot
I searched TCG and it’s not obvious to me. Is there a TCG standard on DRTM?
--- David Li Cloudshield Technologies SAIC Tel. 408-212-9265 (work) 650-224-3891 (cell)
From: Cihula, Joseph [mailto:joseph.cihula@intel.com] Sent: Tuesday, September 27, 2011 12:00 AM To: Li, David; trusted-computing@lists.fedorahosted.orgmailto:trusted-computing@lists.fedorahosted.org Subject: RE: TPM measurement during a PXEboot
You could try a dynamic root of trust, which can be initiated from a PXE-booted image and won’t depend on whether the PXE ROM measures it or not.
Joe
From: trusted-computing-bounces@lists.fedorahosted.orgmailto:trusted-computing-bounces@lists.fedorahosted.org [mailto:trusted-computing-bounces@lists.fedorahosted.org]mailto:%5Bmailto:trusted-computing-bounces@lists.fedorahosted.org%5D On Behalf Of Li, David Sent: Monday, September 26, 2011 5:08 PM To: trusted-computing@lists.fedorahosted.orgmailto:trusted-computing@lists.fedorahosted.org Subject: [Trusted-computing] TPM measurement during a PXEboot
I know the spec (TCG EFI Platform Spec v1.2) doesn’t explicitly mention what to do in a PXEBoot regarding kernel image TPM measurement. Sounds like this should fall into the general category of kernel measurement into PCR4 and 5. Now in my case, this is a gray area in reality. Typically PXEboot is handed by the PXE ROM in a NIC card and not by the motherboard BIOS. What if the main BIOS does its job but has to stop at the PXE ROM while the PXE ROM doesn’t measure the loader and kernel image at all? In other words, if my chain of trust stops (or breaks) at the PXE ROM, is there any other way to solve this problem?
Thanks.
--- David Li Cloudshield Technologies SAIC _______________________________________________ Trusted-computing mailing list Trusted-computing@lists.fedorahosted.orgmailto:Trusted-computing@lists.fedorahosted.org https://fedorahosted.org/mailman/listinfo/trusted-computing
Unfortunately my server is not on the list. Is BIOS support needed to initialize the TXT chipset? What if I only care about OS measurement? Can I start MLE at boot loader and end it when OS is loaded?
--- David Li Cloudshield Technologies SAIC
From: Cihula, Joseph [mailto:joseph.cihula@intel.com] Sent: Tuesday, September 27, 2011 11:54 AM To: Li, David; George Wilson Cc: trusted-computing@lists.fedorahosted.org; Lee Wilson Subject: RE: [Trusted-computing] TPM measurement during a PXEboot
You can determine if your system’s BIOS supports TXT from the list of supported platforms at http://www.intel.com/content/www/us/en/architecture-and-technology/trusted-e....
Assuming that it does support TXT, you can use it to PXE boot a trusted Linux kernel. Extending the trust to apps will require something like IMA or SELinux, etc.
Joe
From: Li, David [mailto:LiD@cloudshield.com]mailto:[mailto:LiD@cloudshield.com] Sent: Tuesday, September 27, 2011 11:45 AM To: Cihula, Joseph; George Wilson Cc: trusted-computing@lists.fedorahosted.orgmailto:trusted-computing@lists.fedorahosted.org; Lee Wilson Subject: RE: [Trusted-computing] TPM measurement during a PXEboot
Joe,
This is interesting! My server has TPM, 5520 chipset and 5650 processors which are required to support TXT. I am also using RHEL6 which may have tboot code. The only variable is BIOS. My BIOS supports basic SRTM (PCR0-7 measurements) but probably is not TXT-enabled. So the questions are:
1. Can I still use TXT to ensure trusted boot of my Linux kernel and apps?
2. Can TXT work in a PXEboot environment? Thanks.
--- David Li Cloudshield Technologies SAIC
From: Cihula, Joseph [mailto:joseph.cihula@intel.com]mailto:[mailto:joseph.cihula@intel.com] Sent: Tuesday, September 27, 2011 10:56 AM To: George Wilson; Li, David Cc: trusted-computing@lists.fedorahosted.orgmailto:trusted-computing@lists.fedorahosted.org; Lee Wilson Subject: RE: [Trusted-computing] TPM measurement during a PXEboot
For those who are not TCG members or who want to work with existing systems, you can find out about Intel’s D-RTM implementation, Intel® Trusted Execution Technology, at http://www.intel.com/content/www/us/en/architecture-and-technology/trusted-e...
Joe
From: George Wilson [mailto:gcwilson@us.ibm.com]mailto:[mailto:gcwilson@us.ibm.com] Sent: Tuesday, September 27, 2011 9:47 AM To: Li, David Cc: Cihula, Joseph; trusted-computing@lists.fedorahosted.orgmailto:trusted-computing@lists.fedorahosted.org; Lee Wilson Subject: Re: [Trusted-computing] TPM measurement during a PXEboot
Hi David,
It is being worked on now. If you are a TCG member, you should be able to get access to a draft. Adding Lee Wilson on copy as he chairs that WG.
Regards, George Wilson IBM Linux Technology Center Security Architect & Team Lead 512-286-9271
[cid:image001.gif@01CC7D18.5715B7F0]"Li, David" ---09/27/2011 11:19:17 AM---"Li, David" <LiD@cloudshield.commailto:LiD@cloudshield.com> "Li, David" <LiD@cloudshield.commailto:LiD@cloudshield.com> Sent by: trusted-computing-bounces@lists.fedorahosted.orgmailto:trusted-computing-bounces@lists.fedorahosted.org
09/27/2011 10:21 AM
To
"Cihula, Joseph" <joseph.cihula@intel.commailto:joseph.cihula@intel.com>, "trusted-computing@lists.fedorahosted.orgmailto:trusted-computing@lists.fedorahosted.org" <trusted-computing@lists.fedorahosted.orgmailto:trusted-computing@lists.fedorahosted.org>
cc
Subject
Re: [Trusted-computing] TPM measurement during a PXEboot
I searched TCG and it’s not obvious to me. Is there a TCG standard on DRTM?
--- David Li Cloudshield Technologies SAIC Tel. 408-212-9265 (work) 650-224-3891 (cell)
From: Cihula, Joseph [mailto:joseph.cihula@intel.com] Sent: Tuesday, September 27, 2011 12:00 AM To: Li, David; trusted-computing@lists.fedorahosted.orgmailto:trusted-computing@lists.fedorahosted.org Subject: RE: TPM measurement during a PXEboot
You could try a dynamic root of trust, which can be initiated from a PXE-booted image and won’t depend on whether the PXE ROM measures it or not.
Joe
From: trusted-computing-bounces@lists.fedorahosted.orgmailto:trusted-computing-bounces@lists.fedorahosted.org [mailto:trusted-computing-bounces@lists.fedorahosted.org]mailto:%5Bmailto:trusted-computing-bounces@lists.fedorahosted.org%5D On Behalf Of Li, David Sent: Monday, September 26, 2011 5:08 PM To: trusted-computing@lists.fedorahosted.orgmailto:trusted-computing@lists.fedorahosted.org Subject: [Trusted-computing] TPM measurement during a PXEboot
I know the spec (TCG EFI Platform Spec v1.2) doesn’t explicitly mention what to do in a PXEBoot regarding kernel image TPM measurement. Sounds like this should fall into the general category of kernel measurement into PCR4 and 5. Now in my case, this is a gray area in reality. Typically PXEboot is handed by the PXE ROM in a NIC card and not by the motherboard BIOS. What if the main BIOS does its job but has to stop at the PXE ROM while the PXE ROM doesn’t measure the loader and kernel image at all? In other words, if my chain of trust stops (or breaks) at the PXE ROM, is there any other way to solve this problem?
Thanks.
--- David Li Cloudshield Technologies SAIC _______________________________________________ Trusted-computing mailing list Trusted-computing@lists.fedorahosted.orgmailto:Trusted-computing@lists.fedorahosted.org https://fedorahosted.org/mailman/listinfo/trusted-computing
BIOS support is needed to set up TXT and cannot be handled by the OS or other post-BIOS SW. Without TXT you will not be able to have a D-RTM and you will need to have a complete trust chain.
Joe
From: Li, David [mailto:LiD@cloudshield.com] Sent: Tuesday, September 27, 2011 1:21 PM To: Cihula, Joseph; George Wilson Cc: trusted-computing@lists.fedorahosted.org; Lee Wilson Subject: RE: [Trusted-computing] TPM measurement during a PXEboot
Unfortunately my server is not on the list. Is BIOS support needed to initialize the TXT chipset? What if I only care about OS measurement? Can I start MLE at boot loader and end it when OS is loaded?
--- David Li Cloudshield Technologies SAIC
From: Cihula, Joseph [mailto:joseph.cihula@intel.com]mailto:[mailto:joseph.cihula@intel.com] Sent: Tuesday, September 27, 2011 11:54 AM To: Li, David; George Wilson Cc: trusted-computing@lists.fedorahosted.orgmailto:trusted-computing@lists.fedorahosted.org; Lee Wilson Subject: RE: [Trusted-computing] TPM measurement during a PXEboot
You can determine if your system’s BIOS supports TXT from the list of supported platforms at http://www.intel.com/content/www/us/en/architecture-and-technology/trusted-e....
Assuming that it does support TXT, you can use it to PXE boot a trusted Linux kernel. Extending the trust to apps will require something like IMA or SELinux, etc.
Joe
From: Li, David [mailto:LiD@cloudshield.com]mailto:[mailto:LiD@cloudshield.com] Sent: Tuesday, September 27, 2011 11:45 AM To: Cihula, Joseph; George Wilson Cc: trusted-computing@lists.fedorahosted.orgmailto:trusted-computing@lists.fedorahosted.org; Lee Wilson Subject: RE: [Trusted-computing] TPM measurement during a PXEboot
Joe,
This is interesting! My server has TPM, 5520 chipset and 5650 processors which are required to support TXT. I am also using RHEL6 which may have tboot code. The only variable is BIOS. My BIOS supports basic SRTM (PCR0-7 measurements) but probably is not TXT-enabled. So the questions are:
1. Can I still use TXT to ensure trusted boot of my Linux kernel and apps?
2. Can TXT work in a PXEboot environment? Thanks.
--- David Li Cloudshield Technologies SAIC
From: Cihula, Joseph [mailto:joseph.cihula@intel.com]mailto:[mailto:joseph.cihula@intel.com] Sent: Tuesday, September 27, 2011 10:56 AM To: George Wilson; Li, David Cc: trusted-computing@lists.fedorahosted.orgmailto:trusted-computing@lists.fedorahosted.org; Lee Wilson Subject: RE: [Trusted-computing] TPM measurement during a PXEboot
For those who are not TCG members or who want to work with existing systems, you can find out about Intel’s D-RTM implementation, Intel® Trusted Execution Technology, at http://www.intel.com/content/www/us/en/architecture-and-technology/trusted-e...
Joe
From: George Wilson [mailto:gcwilson@us.ibm.com]mailto:[mailto:gcwilson@us.ibm.com] Sent: Tuesday, September 27, 2011 9:47 AM To: Li, David Cc: Cihula, Joseph; trusted-computing@lists.fedorahosted.orgmailto:trusted-computing@lists.fedorahosted.org; Lee Wilson Subject: Re: [Trusted-computing] TPM measurement during a PXEboot
Hi David,
It is being worked on now. If you are a TCG member, you should be able to get access to a draft. Adding Lee Wilson on copy as he chairs that WG.
Regards, George Wilson IBM Linux Technology Center Security Architect & Team Lead 512-286-9271
[Inactive hide details for "Li, David" ---09/27/2011 11:19:17 AM---"Li, David" LiD@cloudshield.com]"Li, David" ---09/27/2011 11:19:17 AM---"Li, David" <LiD@cloudshield.commailto:LiD@cloudshield.com> "Li, David" <LiD@cloudshield.commailto:LiD@cloudshield.com> Sent by: trusted-computing-bounces@lists.fedorahosted.orgmailto:trusted-computing-bounces@lists.fedorahosted.org
09/27/2011 10:21 AM
To
"Cihula, Joseph" <joseph.cihula@intel.commailto:joseph.cihula@intel.com>, "trusted-computing@lists.fedorahosted.orgmailto:trusted-computing@lists.fedorahosted.org" <trusted-computing@lists.fedorahosted.orgmailto:trusted-computing@lists.fedorahosted.org>
cc
Subject
Re: [Trusted-computing] TPM measurement during a PXEboot
I searched TCG and it’s not obvious to me. Is there a TCG standard on DRTM?
--- David Li Cloudshield Technologies SAIC Tel. 408-212-9265 (work) 650-224-3891 (cell)
From: Cihula, Joseph [mailto:joseph.cihula@intel.com] Sent: Tuesday, September 27, 2011 12:00 AM To: Li, David; trusted-computing@lists.fedorahosted.orgmailto:trusted-computing@lists.fedorahosted.org Subject: RE: TPM measurement during a PXEboot
You could try a dynamic root of trust, which can be initiated from a PXE-booted image and won’t depend on whether the PXE ROM measures it or not.
Joe
From: trusted-computing-bounces@lists.fedorahosted.orgmailto:trusted-computing-bounces@lists.fedorahosted.org [mailto:trusted-computing-bounces@lists.fedorahosted.org]mailto:%5Bmailto:trusted-computing-bounces@lists.fedorahosted.org%5D On Behalf Of Li, David Sent: Monday, September 26, 2011 5:08 PM To: trusted-computing@lists.fedorahosted.orgmailto:trusted-computing@lists.fedorahosted.org Subject: [Trusted-computing] TPM measurement during a PXEboot
I know the spec (TCG EFI Platform Spec v1.2) doesn’t explicitly mention what to do in a PXEBoot regarding kernel image TPM measurement. Sounds like this should fall into the general category of kernel measurement into PCR4 and 5. Now in my case, this is a gray area in reality. Typically PXEboot is handed by the PXE ROM in a NIC card and not by the motherboard BIOS. What if the main BIOS does its job but has to stop at the PXE ROM while the PXE ROM doesn’t measure the loader and kernel image at all? In other words, if my chain of trust stops (or breaks) at the PXE ROM, is there any other way to solve this problem?
Thanks.
--- David Li Cloudshield Technologies SAIC _______________________________________________ Trusted-computing mailing list Trusted-computing@lists.fedorahosted.orgmailto:Trusted-computing@lists.fedorahosted.org https://fedorahosted.org/mailman/listinfo/trusted-computing
I see the ver 1.0 Virtualized Trusted Platform Architecture Specification has just been published. Given that this is fairly new, are there any open source implementations or activities focusing on this effort?
--- David Li Cloudshield Technologies SAIC
From: trusted-computing-bounces@lists.fedorahosted.org [mailto:trusted-computing-bounces@lists.fedorahosted.org] On Behalf Of George Wilson Sent: Tuesday, September 27, 2011 9:47 AM To: Li, David Cc: Lee Wilson; trusted-computing@lists.fedorahosted.org Subject: Re: [Trusted-computing] TPM measurement during a PXEboot
Hi David,
It is being worked on now. If you are a TCG member, you should be able to get access to a draft. Adding Lee Wilson on copy as he chairs that WG.
Regards, George Wilson IBM Linux Technology Center Security Architect & Team Lead 512-286-9271
[cid:image001.gif@01CC898A.AF69A410]"Li, David" ---09/27/2011 11:19:17 AM---"Li, David" <LiD@cloudshield.commailto:LiD@cloudshield.com> "Li, David" <LiD@cloudshield.commailto:LiD@cloudshield.com> Sent by: trusted-computing-bounces@lists.fedorahosted.orgmailto:trusted-computing-bounces@lists.fedorahosted.org
09/27/2011 10:21 AM
To
"Cihula, Joseph" <joseph.cihula@intel.commailto:joseph.cihula@intel.com>, "trusted-computing@lists.fedorahosted.orgmailto:trusted-computing@lists.fedorahosted.org" <trusted-computing@lists.fedorahosted.orgmailto:trusted-computing@lists.fedorahosted.org>
cc
Subject
Re: [Trusted-computing] TPM measurement during a PXEboot
I searched TCG and it’s not obvious to me. Is there a TCG standard on DRTM?
--- David Li Cloudshield Technologies SAIC Tel. 408-212-9265 (work) 650-224-3891 (cell)
From: Cihula, Joseph [mailto:joseph.cihula@intel.com] Sent: Tuesday, September 27, 2011 12:00 AM To: Li, David; trusted-computing@lists.fedorahosted.orgmailto:trusted-computing@lists.fedorahosted.org Subject: RE: TPM measurement during a PXEboot
You could try a dynamic root of trust, which can be initiated from a PXE-booted image and won’t depend on whether the PXE ROM measures it or not.
Joe
From: trusted-computing-bounces@lists.fedorahosted.orgmailto:trusted-computing-bounces@lists.fedorahosted.org [mailto:trusted-computing-bounces@lists.fedorahosted.org]mailto:%5Bmailto:trusted-computing-bounces@lists.fedorahosted.org%5D On Behalf Of Li, David Sent: Monday, September 26, 2011 5:08 PM To: trusted-computing@lists.fedorahosted.orgmailto:trusted-computing@lists.fedorahosted.org Subject: [Trusted-computing] TPM measurement during a PXEboot
I know the spec (TCG EFI Platform Spec v1.2) doesn’t explicitly mention what to do in a PXEBoot regarding kernel image TPM measurement. Sounds like this should fall into the general category of kernel measurement into PCR4 and 5. Now in my case, this is a gray area in reality. Typically PXEboot is handed by the PXE ROM in a NIC card and not by the motherboard BIOS. What if the main BIOS does its job but has to stop at the PXE ROM while the PXE ROM doesn’t measure the loader and kernel image at all? In other words, if my chain of trust stops (or breaks) at the PXE ROM, is there any other way to solve this problem?
Thanks.
--- David Li Cloudshield Technologies SAIC _______________________________________________ Trusted-computing mailing list Trusted-computing@lists.fedorahosted.orgmailto:Trusted-computing@lists.fedorahosted.org https://fedorahosted.org/mailman/listinfo/trusted-computing
trusted-computing@lists.fedorahosted.org