[50270] in cryptography@c2.net mail archive
Re: TPM & disk crypto
daemon@ATHENA.MIT.EDU (Travis H.)
Fri Oct 6 15:20:15 2006
X-Original-To: cryptography@metzdowd.com
X-Original-To: cryptography@metzdowd.com
Date: Thu, 5 Oct 2006 17:52:46 -0500
From: "Travis H." <solinym@gmail.com>
To: "Erik Tews" <erik@debian.franken.de>
Cc: Cryptography <cryptography@metzdowd.com>
In-Reply-To: <1160085109.4937.21.camel@localhost.localdomain>
On 10/5/06, Erik Tews <erik@debian.franken.de> wrote:
> First, you need a system with tpm. I assume you are running linux. Then
> you boot your linux-kernel and an initrd using the trusted grub
> bootloader. Your bios will report the checksum of trusted grub to the
> tpm before giving control to your grub bootloader. Your grub bootloader
> will then report the checksum of your kernel and your initrd to the tpm
> before giving control to them.
Awesome, that's incredibly useful information.
I had not heard of trusted grub. Thanks!
> One thing you should know is, that a tpm can never find out, if a
> software meets some specifications, like does not have an buffer
> overflow or does not execute code from the network or so. You just can
> check is has not been altered.
Of course. However, you can sandbox x86 code efficiently:
http://www.usenix.org/events/sec06/tech/mccamant/mccamant_html/index.html
--
Enhance your calm, fellow citizen; it's just ones and zeroes.
Unix "guru" for rent or hire -><- http://www.lightconsulting.com/~travis/
GPG fingerprint: 9D3F 395A DAC5 5CCC 9066 151D 0A6B 4098 0C55 1484
---------------------------------------------------------------------
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to majordomo@metzdowd.com
