Hardware-based Integrity Protection

Question 1

What are the three layers of the protection pyramid?

Answer 1

Secure Execution, Secure Storage, Attestation

Question 2

What are the two main security models in relation to HW based integrity protection?

Answer 2

Static protection -> TPM:
software components (BIOS, boot loader, OS, etc.) constitute a hash chain. Idea: if system starts secure, it stays secure

Dynamic protection -> Intel SGX:
Security enforced on CPU-level protects programs throughout execution

Question 3

How does Attestation with a TPM work?

Answer 3

• TPM has platform configuration registers (PCR)
• registers store hashes of parts of the running software stack
• TPM can later report hashes by signing them with a specific key -> can be used as means for authentication

Question 4

Name 3 important TPM keys

Answer 4

• Endorsement key: Constitutes identity of TPM, generated and certified upon production, used for “taking ownership”
• Storage root key: root of trust for protecting secrets stored on the TPM
• Attestation Identity Keys: used for signing PCR values without directly using the endorsement key (privacy!)

Question 5

What are some limitations of TPM?

Answer 5

• TPM chip required
• hashes of all versions of software have to be known and maintained
• third party verifier has to attest system (single point of failure!)
• Starting secure does not necessarily mean staying secure

Question 6

How does Intel SGX realize Secure Execution?

Answer 6

• Hardware enforced protection of program memory: so called Enclave
• Enclaves are signed and signatures are verified at startup time
• Enclave memory can never be read / written from outside
• Production enclaves cannot be debugged

Question 7

How does Intel SGX realize Secure Storage?

Answer 7

• CPU-enforced data encryption
• memory is encrypted with replay protection
• encryption keys rotate in every power cycle

Question 8

How does Intel SGX realize Attestation?

Answer 8

• SGX generates unforgeable proofs of the enclave in question
• proofs carry information about the enclave’s code and execution environment
• proofs can be requested by local or remote processes

Question 9

What are some limitations of SGX?

Answer 9

• doesn’t address issues like buffer overflows
• SGX targets integrity, not confidentiality: code is retrievable
• side-channel attacks possible
• remote attestation requires subscription to intel