Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Get random authvalues locally instead of from the TPM #510

Merged
merged 3 commits into from
Mar 14, 2024

Conversation

tgonzalezorlandoarm
Copy link
Member

@tgonzalezorlandoarm tgonzalezorlandoarm commented Mar 13, 2024

Currently, the TPM itself is the root of trust for randomness in
authvalues used for creating Primary Keys.
This is susceptible to physical attacks over the TPM bus.

 * Get authvalues via the 'getrandom' crate

getrandom retrieves random data from the (operating) system sources
and assumes "that the system always provides high-quality
cryptographically secure random data, ideally backed by hardware
entropy sources", so the administrator of the platfrom should take
this into account.

Note: This change may slow down the tests as accessing random values
from the OS instead of the TPM may be slower.

Please see #508

Currently, the TPM itself is the root of trust for randomness in
authvalues used for creating Primary Keys.
This is susceptible to physical attacks over the TPM bus.

 * Get authvalues via the 'getrandom' crate

getrandom retrieves random data from the (operating) system sources
and assumes "that the system always provides high-quality
cryptographically secure random data, ideally backed by hardware
entropy sources", so the administrator of the platfrom should take
this into account.

Note: This change may slow down the tests as accessing random values
from the OS instead of the TPM may be slower.

Signed-off-by: Tomás González <[email protected]>
Includes the security policy of the project, with disclosure and
vulnerability reporting measures.

Signed-off-by: Tomás González <[email protected]>
@gowthamsk-arm gowthamsk-arm merged commit 5a0f772 into main Mar 14, 2024
21 checks passed
@tgonzalezorlandoarm tgonzalezorlandoarm deleted the tg/random-fix-main branch March 14, 2024 14:48
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants