Is it possible to program the Intel Trusted Platform Module

Question

I am wondering if it is possible to program the TPM ( http://en.wikipedia.org/wiki/Trusted_Platform_Module ) present on most Intel chips so that:

- decide what to store in the persistent memory - decide which cryptographic algorithms to implement. 

Obviously, it should not be reprogrammable after it starts working (do you know if this statement is correct?).

Answer 1

TPM behavior is determined by specifications issued by the Trusted Computing Group. TPM should behave exactly as directed, so you cannot change the functionality of a properly implemented TPM. TPM manufacturers have limited ability to update their products after shipment. For example, Infineon provides firmware updates for its devices.

Intel TPMs, however, may be different. Some chipsets included emulation / software TPM instead of real hardware TPM. These TPMs can be updated with a BIOS update. But in this case, the update must be provided by Intel. Recent boards, such as the DQ67SW, have standalone hardware TPMs not made by Intel.

So, the answer to your second question: No, you cannot program / define cryptographic algorithms . TPM uses.

---

As for your first question: yes, you can determine what to store in persistent storage to some extent. This area of ​​memory is called non-volatile memory or NV . First you need to define some space using the TPM_NV_DefineSpace command. After that, you can read and write from / to the location using TPM_NV_ReadValue and TPM_NV_WriteValue . Defining reserves for a certain amount of memory in NV, as well as setting security attributes for this location. These commands are low-level TPM commands, so it is highly recommended that you use Trusted Software Stack (TSS) to interact with TPM. You can use jTSS with jTpmTools or TrouSerS .

Some notes regarding NV:

• NV has very limited space, but the exact amount depends on the vendor (usually less than 5 KB). The minimum amount for a PC platform is 2048 bytes.
• TPM is a passive device; it cannot do anything without a command issued to it. If you want to save something in TPM, you must have an active part (BIOS, Software, Chipset, CPU) that issues these commands.
• Even the most cryptographic keys are not stored in TPM. There is a key hierarchy, and only the root key (Storage Root Key - SRK) is stored in TPM. All other keys are stored outside in an encrypted manner.

Answer 2

TPM is not intended for programming. It has a fixed set of supported algorithms. The code is stored in ROM (or, if it is not, it is stored in the EEPROM, which is located inside some package protected against unauthorized access, and you cannot rewrite it).

TPM defines various administrative roles. When you first use it, you will create administrative passwords (or your software will do it for you, in which case you should carefully back up these passwords). If you are not sure about the state of TPM when it is received, you can reset it to "factory defaults" (clearing all existing keys and credentials); this is called TPM cleanup and is usually done from the BIOS.

You will find an overview of the various credentials stored and used by TPMs in credential profiles. In addition to the keys that are part of the normal life cycle, you can import your own keys and create non-exposed keys using RNG TPM.

There is a standard TPM security profile . I do not know if Intel TPM has been rated in relation to it. Figure 1 shows a TPM life cycle diagram that shows when keys can be generated.

In practice, you are likely to interact with TPM through TrouSerS (the open source TPM API) or limited mods through Bitlocker on Windows.

Answer 3

Yes, you can use the TPM chip for this kind of operation and much more.

The TrouSerS stack is an implementation of the open source trusted computing stack required to use the TPM chip reliably.