TrustedComputingTPMandTruestedBoot.ppt

* * * * * * * * l??Bindkeys 用来加密一个平台的少量数据（例如对称密钥），然后在另一个平台解密。 – happens outside of the TPM l??LegacyKeys 在TPM外创建的密钥。在进行签名或者加密操作之后再导入到TPM中，可迁移密钥。 l??AuthenticationKeys 用来保护涉及到TPM的传输会话的对称密钥。 * 红圈标示的signing key 在创建一个新的平台拥有者的时候，同时创建一个新的SRK. a new SRK may be created as part of creating a new platform owner, This has the side-effect of leaving encrypted all data objects controlled by the previous SRK. * 1、首先将SR key1load到TPM中，使用SRK解密，放入key slot中， * 2、然后再将SK key2 load到TPM中，使用SRkey 1将key 2解密，放入到key slot中。 * 3、最后将signing key load到TPM中，使用SR key 2解密。然后将其放在key slot中，再在TPM中使用其进行一些签名操作。 * * 1: Platform Configuration Registers (PCR) can be implemented in either volatile or non-volatile storage. They are reset at system start or whenever the platform loses power. TCG specifies a minimum number of registers to implement (16). Registers 0-7 are reserved for TPM use. Registers 8-15 are available for operating system and application use. 2: TPM1.1有PCR0-15，TPM1.2有PCR0-23，重启后，0-15置0，16-23置-1，其中0-15是静态PCR，只在重启时重置（SRTM使用），16-23是动态PCR，可以在运行时进行重置，但只能是一些特殊的安全指令才能对其重置，例如AMD SKINIT指令和INTEL的TXT指令。 3: Program code contains firmware for measuring platform devices. Logically, this is the Core Root of Trust for Measurement (CRTM). Ideally, the CRTM is contained in the TPM, but implementation decisions may require it be located in other firmware. 4 Opt-In The Opt-In component implements TCG policy requiring TPM modules are shipped in the state the customer desires. This ranges from disabled and deactivated to fully enabled; ready for an owner to take possession. The Opt-In mechanism maintains logic and (if necessary) interfaces to determine physical presence state and ensure disabling operations are applied to other TPM components as needed. 5 Execution Engine The execution engine runs program code. It performs TPM initialization and measurement taking. * Measurements 1: Measurements can be of code, data structures, configurati