canonical / canonical/secboot

Make use of SVN-limited owner hierarchy for the SRK on devices that support it

Open
#381 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
23
Forks
29
Avg merge
2d 8h
Merged PRs (30d)
2

Description

Since the TPM reference library version 1.83, it introduced the concept of firmware
and SVN (security version number) limited hierarchies for the existing base hierarchies
(`TPM_RH_OWNER`, `TPM_RH_ENDORSEMENT`, `TPM_RH_PLATFORM` and `TPM_RH_NULL`).

Firmware limited hierarchies mix information that is specific to the current firmware build
into the primary seed for each existing base hierarchy, creating 4 new hierarchies
(`TPM_RH_FW_OWNER`, `TPM_RH_FW_ENDORSEMENT`, `TPM_RH_FW_PLATFORM` and
`TPM_RH_FW_NULL`). Objects created under any of these hierarchies are invalidated
whenever the TPM firmware changes.

SVN-limited hierarchies mix information about a SVN into the primary seed for each existing
base hierarchy, and each SVN-limited hierarchy has a base handle (`TPM_RH_SVN_OWNER_BASE`,
`TPM_RH_SVN_ENDORSEMENT_BASE`, `TPM_RH_SVN_PLATFORM_BASE` and
`TPM_RH_SVN_NULL_BASE`), each corresponding to the zero SVN. The base of a SVN limited
hierarchy is occupied by the upper 16 bits of the handle and the actual SVN is occupied by the
lower 16 bits.

TPM's are able access object hierarchies associated with a SVN that is lower than or the same as
the current firmware's SVN (obtained using the property `TPM_PT_FIRMWARE_SVN`), but the TPM
firmware is unable to access object hierarchies associated with SVNs that are newer than the
current firmware's SVN. This provides a way for firmware vendors to bump the current SVN when
resolving a security vulnerability, and provides a way to create object hierarchies bound to the new
SVN which won't be accessible by rolling the TPM firmware back to an older version with a lower SVN.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.