linux-kernel - Re: [RFC PATCH 0/2] TPM derived keys

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <44cd50b60a0a4e376d01544d25187556b8badf94.camel@HansenPartnership.com>
Date: Mon, 13 May 2024 16:33:40 -0600
From: James Bottomley <James.Bottomley@...senPartnership.com>
To: Ignat Korchagin <ignat@...udflare.com>, Jarkko Sakkinen
 <jarkko@...nel.org>,  Ben Boeckel <me@...boeckel.net>
Cc: Mimi Zohar <zohar@...ux.ibm.com>, David Howells <dhowells@...hat.com>, 
 Paul Moore <paul@...l-moore.com>, James Morris <jmorris@...ei.org>,
 serge@...lyn.com,  linux-integrity@...r.kernel.org,
 keyrings@...r.kernel.org,  linux-kernel@...r.kernel.org,
 kernel-team@...udflare.com
Subject: Re: [RFC PATCH 0/2] TPM derived keys

On Mon, 2024-05-13 at 18:09 +0100, Ignat Korchagin wrote:
[...]
> TPM derived keys attempt to address the above use cases by allowing
> applications to deterministically derive unique cryptographic keys
> for their own purposes directly from the TPM seed in the owner
> hierarchy. The idea is that when an application requests a new key,
> instead of generating a random key and wrapping it with the TPM, the
> implementation generates a key via KDF(hierarchy seed, application
> specific info). Therefore, the resulting keys will always be
> cryptographically bound to the application itself and the device they
> were generated on.

So I think what confuses me is what the expected cryptographic secrecy
properties of the derived keys are.  I get they're a KDF of seed and
deterministic properties, but if those mixing values are well known (as
the path or binary checksum cases) then anyone with access to the TPM
can derive the key from user space because they can easily obtain the
mixing parameters and there's no protection to the TPM keyed hash
operation.

Consider the use case where two users are using derived keys on the
same system (so same TPM).  Assuming they use them to protect sensitive
information, what prevents user1 from simply deriving user2's key and
getting the information, or am I missing the point of this?

James