linux-kernel - Re: [PATCH 1/4] integrity: TPM internel kernel interface

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <OFFC89CC8B.668BE16F-ON852574A9.00517F82-852574A9.00527E25@us.ibm.com>
Date:	Mon, 18 Aug 2008 11:01:04 -0400
From:	Kenneth Goldman <kgoldman@...ibm.com>
To:	Pavel Machek <pavel@...e.cz>
Cc:	linux-kernel@...r.kernel.org, linux-security-module@...r.kernel.org
Subject: Re: [PATCH 1/4] integrity: TPM internel kernel interface

Pavel Machek <pavel@...e.cz> wrote on 08/14/2008 07:12:10 AM:

> Only 2 TPMs I've seen were on pluggable modules... which was fortunate
> because they slowed down boot by 5+ minutes, and broke it completely
> in other cases. Nickname 'kurvitko' (aka useless trash that breaks
> stuff). They are currently lying under my table, disconnected.
>
> (OTOH they were not on PCI, but on some low-count pin header).

1 - The pluggable modules use a standard LPC bus header.  In my>
experience, all the TPM vendors supply them in low quantities for
evaluation and test, but no one expects them to be used in
production because of the security issues.

2 - I'd be interested to know whether the slowdown was in
the BIOS, in the OS boot, or on bringup of an application?
Was this Linux or some other OS?

Both the TCG and the platform vendors are very sensitive to
the BIOS part of the boot time.  For example, the TPM self test
is broken into a fast part for features that are required
before boot and a slower part that can be done later. There
are recommendations to break up hashing to remove the TPM
from the critical path.

Even then, the slowest TPM operation is keypair creation,
on the order of 1-5 seconds, which should not be required
during boot.  I wonder if the problem was actually a code
bug or unsupported operation causing timeouts?

It would be great if you could debug a bit and report your
findings to us.

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/