Tutorial: Complete Platform Attestation: Remotely Verifying the Authenticity and Integrity of your Platform’s Hardware, Firmware, and Software
Talkat Linux Security Summit North America 2019 · on Tuesday, 2019-08-20· at 15:30· Sapphire D, Hilton San Diego Bayfront·
summary
A working proof‑of‑concept shows remote attestation end to end: hardware EK-to-platform binding via the HIRS provisioning flow, firmware and IMA event logs converted to the TCG Canonical Event Log format with Matthew Garrett patches and a conversion utility, and IMA logs signed and annotated with sequence numbers so kernel memory can be freed and events reassembled. Tools include the NSA HIRS code, a Fedora port for newer kernels, and a verifier that validates signatures and PCR comparisons; demos complete successfully. The group also proposes SWID/RIM payload files to distribute golden measurements.
AI-written summary · about
chapters (19)
- 0:00Introduction
- 2:08Test Station Overview
- 7:28Platform Boot Process
- 11:07Hardware Verification
- 12:38Platform Certificate Binding
- 13:46Platform Certificate Transfer
- 19:35Policy Set
- 21:27Verifying Root Certificates
- 22:59Firmware Validation
- 27:47Event Logs
- 28:12Event Log Structure
- 35:27Event Log Sequence
- 46:25Reference Measurements
- 51:44Sweet Eggs
- 53:05Base Rim
- 55:20Signature
- 55:50Information
- 56:37Binding Specifications
- 58:05Example
related talks
29mA Simple Protocol for Remote Attestation of System Integrity
42mTPM based attestation - how can we use it for good?
25mDemystifying remote attestation
59mLayered Attestation of a Cross-Domain System
25mEstablishing Trusted and Secure Foundation for Device Management Using Open Source Software
24mHardware backed attestation in TLS
29mRemote Attestation of IoT devices using a discrete TPM 2.0
22mMaking remote attestation meaningful for external reviews