A Replay Attack in the TCG Specification and a Solution Danilo - - PowerPoint PPT Presentation

▶
a replay attack in the tcg specification and a solution
SMART_READER_LITE
LIVE PREVIEW

A Replay Attack in the TCG Specification and a Solution Danilo - - PowerPoint PPT Presentation

May 16, 2023 187 likes •582 views

Trusted Computing Platforms Replay Attack Model Checking Proposed Solution Conclusion and Future Works A Replay Attack in the TCG Specification and a Solution Danilo Bruschi Lorenzo Cavallaro Andrea Lanzi Mattia Monga Universit` a degli

slide-1
SLIDE 1

Trusted Computing Platforms Replay Attack Model Checking Proposed Solution Conclusion and Future Works

A Replay Attack in the TCG Specification and a Solution

Danilo Bruschi Lorenzo Cavallaro Andrea Lanzi Mattia Monga

Universit` a degli Studi di Milano Dipartimento di Informatica e Comunicazione {bruschi, sullivan, andrew, monga}@security.dico.unimi.it

Annual Computer Security Applications Conference 2005

  • D. Bruschi, L. Cavallaro, A. Lanzi and M. Monga

A Replay Attack in the TCG Specification and a Solution

slide-2
SLIDE 2

Trusted Computing Platforms Replay Attack Model Checking Proposed Solution Conclusion and Future Works

Table of Contents

1 Trusted Computing Platforms

Authorization Protocols

2 Replay Attack

Attack Schema

3 Model Checking 4 Proposed Solution 5 Conclusion and Future Works

  • D. Bruschi, L. Cavallaro, A. Lanzi and M. Monga

A Replay Attack in the TCG Specification and a Solution

slide-3
SLIDE 3

Trusted Computing Platforms Replay Attack Model Checking Proposed Solution Conclusion and Future Works Authorization Protocols

Trusted Computing Platforms

What are they?

According to the Trusted Computing Group (TCG) Specification, a Trusted Computing Platform (TP) is a Computing Platforms with built-in trusted hardware components endorsed by trusted third parties These components, called Roots of Trust, provide secure services such as secure boot software integrity checking digital signatures . . .

  • D. Bruschi, L. Cavallaro, A. Lanzi and M. Monga

A Replay Attack in the TCG Specification and a Solution

slide-4
SLIDE 4

Trusted Computing Platforms Replay Attack Model Checking Proposed Solution Conclusion and Future Works Authorization Protocols

TCG-based Trusted Computing Platforms

Roots of Trust Components

A TP is composed by two main trusted hardware components Core Root of Trust for Measurement (CRTM) It starts the initial integrity check of every hardware and software components Trusted Platform Module (TPM) It provides cryptographic and protected storage facilities

  • D. Bruschi, L. Cavallaro, A. Lanzi and M. Monga

A Replay Attack in the TCG Specification and a Solution

slide-5
SLIDE 5

Trusted Computing Platforms Replay Attack Model Checking Proposed Solution Conclusion and Future Works Authorization Protocols

TCG-based Trusted Computing Platforms

Main Functionalities

Identity: any TP has an identity that cannot be forged Measurement: a TP can compute a complete integrity check

  • f its software and hardware components

Protected Storage: a TP can provide protection to sensitive data (i.e., passwords, cryptographic keys, passphrases, . . . )

  • D. Bruschi, L. Cavallaro, A. Lanzi and M. Monga

A Replay Attack in the TCG Specification and a Solution

slide-6
SLIDE 6

Trusted Computing Platforms Replay Attack Model Checking Proposed Solution Conclusion and Future Works Authorization Protocols

Authorization Protocols

General Concepts

Every time Alice wants to use a TPM-protected resource, she needs to use an Authorization Protocol. Thus, she must know the secret bound to the resource provide a proof of this knowledge to the TPM, during an existing authorization session ⇒ Authorization Protocols manage authorization sessions and verify subject’s clearances for this purpose

  • D. Bruschi, L. Cavallaro, A. Lanzi and M. Monga

A Replay Attack in the TCG Specification and a Solution

slide-7
SLIDE 7

Trusted Computing Platforms Replay Attack Model Checking Proposed Solution Conclusion and Future Works Authorization Protocols

Authorization Protocols

Existing Authorization Protocols

The TCG Specification defines two main Authorization Protocols Object-Independent Authorization Protocol (OIAP) A command can potentially be issued several times, in a single authorization session, acting on different protected resources Object-Specific Authorization Protocol (OSAP) Different commands can potentially be issued several times, in a single authorization session, acting on the same protected resource

  • D. Bruschi, L. Cavallaro, A. Lanzi and M. Monga

A Replay Attack in the TCG Specification and a Solution

slide-8
SLIDE 8

Trusted Computing Platforms Replay Attack Model Checking Proposed Solution Conclusion and Future Works Authorization Protocols

Authorization Protocols

Protocol Threats and Countermeasures

According to the TCG Specification, Authorization Protocols have been designed in order to prevent the following threats Replay Attack ⇒ use of pseudo-random numbers, nonces, to provide a freshness property Packet Mangling Attack ⇒ use of HMAC to provide authentication and integrity

  • D. Bruschi, L. Cavallaro, A. Lanzi and M. Monga

A Replay Attack in the TCG Specification and a Solution

slide-9
SLIDE 9

Trusted Computing Platforms Replay Attack Model Checking Proposed Solution Conclusion and Future Works Authorization Protocols

Object-Independent Authorization Protocol

A Simple Protocol Sketch

Alice TPM

TPM_OIAP() ACK(SessionHandle1, NonceEven1) CMD(SessionHandle1, NonceEven1, NonceOdd1) ANS(SessionHandle1, NonceEven2, NonceOdd1)

  • D. Bruschi, L. Cavallaro, A. Lanzi and M. Monga

A Replay Attack in the TCG Specification and a Solution

slide-10
SLIDE 10

Trusted Computing Platforms Replay Attack Model Checking Proposed Solution Conclusion and Future Works Authorization Protocols

Object-Independent Authorization Protocol

A Simple Protocol Sketch

Alice TPM

TPM_OIAP() ACK(SessionHandle1, NonceEven1) CMD(SessionHandle1, NonceEven1, NonceOdd1) ANS(SessionHandle1, NonceEven2, NonceOdd1)

SH_1

  • D. Bruschi, L. Cavallaro, A. Lanzi and M. Monga

A Replay Attack in the TCG Specification and a Solution

slide-11
SLIDE 11

Trusted Computing Platforms Replay Attack Model Checking Proposed Solution Conclusion and Future Works Authorization Protocols

Object-Independent Authorization Protocol

A Simple Protocol Sketch

Alice TPM

TPM_OIAP() ACK(SessionHandle1, NonceEven1) CMD(SessionHandle1, NonceEven1, NonceOdd1) ANS(SessionHandle1, NonceEven2, NonceOdd1)

SH_1 SH_1

  • D. Bruschi, L. Cavallaro, A. Lanzi and M. Monga

A Replay Attack in the TCG Specification and a Solution

slide-12
SLIDE 12

Trusted Computing Platforms Replay Attack Model Checking Proposed Solution Conclusion and Future Works Authorization Protocols

Object-Independent Authorization Protocol

A Simple Protocol Sketch

Alice TPM

TPM_OIAP() ACK(SessionHandle1, NonceEven1) CMD(SessionHandle1, NonceEven1, NonceOdd1) ANS(SessionHandle1, NonceEven2, NonceOdd1)

SH_1 SH_1

  • D. Bruschi, L. Cavallaro, A. Lanzi and M. Monga

A Replay Attack in the TCG Specification and a Solution

slide-13
SLIDE 13

Trusted Computing Platforms Replay Attack Model Checking Proposed Solution Conclusion and Future Works Authorization Protocols

Object-Independent Authorization Protocol

A Simple Protocol Sketch

Alice TPM

TPM_OIAP() ACK(SessionHandle1, NonceEven1) CMD(SessionHandle1, NonceEven1, NonceOdd1) ANS(SessionHandle1, NonceEven2, NonceOdd1)

SH_1 SH_1

  • D. Bruschi, L. Cavallaro, A. Lanzi and M. Monga

A Replay Attack in the TCG Specification and a Solution

slide-14
SLIDE 14

Trusted Computing Platforms Replay Attack Model Checking Proposed Solution Conclusion and Future Works Attack Schema

Replay Attack

OIAP Feature Leveraged by the Attack

According to the TCG Specification, an authorization session is kept open indefinitely by a TPM, unless an erroneous message is received on an existing authorization session, i.e., wrong command arguments or invalid HMAC.

  • D. Bruschi, L. Cavallaro, A. Lanzi and M. Monga

A Replay Attack in the TCG Specification and a Solution

slide-15
SLIDE 15

Trusted Computing Platforms Replay Attack Model Checking Proposed Solution Conclusion and Future Works Attack Schema

Message Storing Phase

Alice Mallory

TPM_OIAP()

TPM

TPM_OIAP() ACK(SessionHandle1, NonceEven1) ACK(SessionHandle1, NonceEven1) CMD(SessionHandle1, NonceEven1, NonceOdd1) ANS(SessionHandle1, NonceEven2, NonceOdd1, "reset")

  • D. Bruschi, L. Cavallaro, A. Lanzi and M. Monga

A Replay Attack in the TCG Specification and a Solution

slide-16
SLIDE 16

Trusted Computing Platforms Replay Attack Model Checking Proposed Solution Conclusion and Future Works Attack Schema

Message Storing Phase

Alice Mallory

TPM_OIAP()

TPM

TPM_OIAP() ACK(SessionHandle1, NonceEven1) ACK(SessionHandle1, NonceEven1) CMD(SessionHandle1, NonceEven1, NonceOdd1) ANS(SessionHandle1, NonceEven2, NonceOdd1, "reset")

SH_1

  • D. Bruschi, L. Cavallaro, A. Lanzi and M. Monga

A Replay Attack in the TCG Specification and a Solution

slide-17
SLIDE 17

Trusted Computing Platforms Replay Attack Model Checking Proposed Solution Conclusion and Future Works Attack Schema

Message Storing Phase

Alice Mallory

TPM_OIAP()

TPM

TPM_OIAP() ACK(SessionHandle1, NonceEven1) ACK(SessionHandle1, NonceEven1) CMD(SessionHandle1, NonceEven1, NonceOdd1) ANS(SessionHandle1, NonceEven2, NonceOdd1, "reset")

SH_1 SH_1

  • D. Bruschi, L. Cavallaro, A. Lanzi and M. Monga

A Replay Attack in the TCG Specification and a Solution

slide-18
SLIDE 18

Trusted Computing Platforms Replay Attack Model Checking Proposed Solution Conclusion and Future Works Attack Schema

Message Storing Phase

Alice Mallory

TPM_OIAP()

TPM

TPM_OIAP() ACK(SessionHandle1, NonceEven1) ACK(SessionHandle1, NonceEven1) CMD(SessionHandle1, NonceEven1, NonceOdd1) ANS(SessionHandle1, NonceEven2, NonceOdd1, "reset")

SH_1 SH_1

  • D. Bruschi, L. Cavallaro, A. Lanzi and M. Monga

A Replay Attack in the TCG Specification and a Solution

slide-19
SLIDE 19

Trusted Computing Platforms Replay Attack Model Checking Proposed Solution Conclusion and Future Works Attack Schema

Message Storing Phase

Alice Mallory

TPM_OIAP()

TPM

TPM_OIAP() ACK(SessionHandle1, NonceEven1) ACK(SessionHandle1, NonceEven1) CMD(SessionHandle1, NonceEven1, NonceOdd1) ANS(SessionHandle1, NonceEven2, NonceOdd1, "reset")

SH_1 SH_1

  • D. Bruschi, L. Cavallaro, A. Lanzi and M. Monga

A Replay Attack in the TCG Specification and a Solution

slide-20
SLIDE 20

Trusted Computing Platforms Replay Attack Model Checking Proposed Solution Conclusion and Future Works Attack Schema

Message Resending Phase

Alice Mallory

TPM_OIAP()

TPM

TPM_OIAP() ACK(SessionHandle2, NonceEven3) ACK(SessionHandle2, NonceEven3) CMD(SessionHandle2, NonceEven3, NonceOdd2) ANS(SessionHandle2, NonceEven4, NonceOdd2, "OK") CMD(SessionHandle2, NonceEven3, NonceOdd2) ANS(SessionHandle2, NonceEven4, NonceOdd2, "OK")

SH_1 SH_1

  • D. Bruschi, L. Cavallaro, A. Lanzi and M. Monga

A Replay Attack in the TCG Specification and a Solution

slide-21
SLIDE 21

Trusted Computing Platforms Replay Attack Model Checking Proposed Solution Conclusion and Future Works Attack Schema

Message Resending Phase

Alice Mallory

TPM_OIAP()

TPM

TPM_OIAP() ACK(SessionHandle2, NonceEven3) ACK(SessionHandle2, NonceEven3) CMD(SessionHandle2, NonceEven3, NonceOdd2) ANS(SessionHandle2, NonceEven4, NonceOdd2, "OK") CMD(SessionHandle2, NonceEven3, NonceOdd2) ANS(SessionHandle2, NonceEven4, NonceOdd2, "OK")

SH_1 SH_1 SH_2 SH_2

  • D. Bruschi, L. Cavallaro, A. Lanzi and M. Monga

A Replay Attack in the TCG Specification and a Solution

slide-22
SLIDE 22

Trusted Computing Platforms Replay Attack Model Checking Proposed Solution Conclusion and Future Works Attack Schema

Message Resending Phase

Alice Mallory

TPM_OIAP()

TPM

TPM_OIAP() ACK(SessionHandle2, NonceEven3) ACK(SessionHandle2, NonceEven3) CMD(SessionHandle2, NonceEven3, NonceOdd2) ANS(SessionHandle2, NonceEven4, NonceOdd2, "OK") CMD(SessionHandle2, NonceEven3, NonceOdd2) ANS(SessionHandle2, NonceEven4, NonceOdd2, "OK")

SH_1 SH_1 SH_2 SH_2

  • D. Bruschi, L. Cavallaro, A. Lanzi and M. Monga

A Replay Attack in the TCG Specification and a Solution

slide-23
SLIDE 23

Trusted Computing Platforms Replay Attack Model Checking Proposed Solution Conclusion and Future Works Attack Schema

Replay Attack Phase

Alice Mallory TPM

CMD(SessionHandle1, NonceEven1, NonceOdd1) ANS(SessionHandle1, NonceEven2, NonceOdd1, "OK")

SH_1 SH_1 SH_2 SH_2

  • D. Bruschi, L. Cavallaro, A. Lanzi and M. Monga

A Replay Attack in the TCG Specification and a Solution

slide-24
SLIDE 24

Trusted Computing Platforms Replay Attack Model Checking Proposed Solution Conclusion and Future Works Attack Schema

Replay Attack Phase

Alice Mallory TPM

CMD(SessionHandle1, NonceEven1, NonceOdd1) ANS(SessionHandle1, NonceEven2, NonceOdd1, "OK")

SH_1 SH_1 SH_2 SH_2

  • D. Bruschi, L. Cavallaro, A. Lanzi and M. Monga

A Replay Attack in the TCG Specification and a Solution

slide-25
SLIDE 25

Trusted Computing Platforms Replay Attack Model Checking Proposed Solution Conclusion and Future Works

Model Checker and Attack Property

What is wrong with the TCG Specification?

Model Checking techniques have been used to better understand the attack properties We modeled Alice, Mallory and the TPM using the Spin model checker We noticed that a coherent and consistent session knowledge shared between the parties is missing from the TCG Specification ⇒ Hints about a solution just came up. . . :-)

  • D. Bruschi, L. Cavallaro, A. Lanzi and M. Monga

A Replay Attack in the TCG Specification and a Solution

slide-26
SLIDE 26

Trusted Computing Platforms Replay Attack Model Checking Proposed Solution Conclusion and Future Works

Proposed Solution

We propose to patch the hardware component TPM, by introducing a HMAC-protected bitmask in any authorized exchanged message, where the i-th bit is 0 if the i-th authorization session is considered either open or in an unknown state; the i-th bit is 1 if the i-th authorization session is considered failed ⇒ coherent and consistent shared session knowledge

  • D. Bruschi, L. Cavallaro, A. Lanzi and M. Monga

A Replay Attack in the TCG Specification and a Solution

slide-27
SLIDE 27

Trusted Computing Platforms Replay Attack Model Checking Proposed Solution Conclusion and Future Works

Proposed Solution

Solution Sketch (1)

Alice Mallory

TPM_OIAP()

TPM

TPM_OIAP() ACK(SessionHandle1, NonceEven1) ACK(SessionHandle1, NonceEven1) CMD(SessionHandle1, NonceEven1, NonceOdd1, 00) ANS(SessionHandle1, NonceEven2, NonceOdd1, "reset")

  • D. Bruschi, L. Cavallaro, A. Lanzi and M. Monga

A Replay Attack in the TCG Specification and a Solution

slide-28
SLIDE 28

Trusted Computing Platforms Replay Attack Model Checking Proposed Solution Conclusion and Future Works

Proposed Solution

Solution Sketch (1)

Alice Mallory

TPM_OIAP()

TPM

TPM_OIAP() ACK(SessionHandle1, NonceEven1) ACK(SessionHandle1, NonceEven1) CMD(SessionHandle1, NonceEven1, NonceOdd1, 00) ANS(SessionHandle1, NonceEven2, NonceOdd1, "reset")

SH_1 SH_1

  • D. Bruschi, L. Cavallaro, A. Lanzi and M. Monga

A Replay Attack in the TCG Specification and a Solution

slide-29
SLIDE 29

Trusted Computing Platforms Replay Attack Model Checking Proposed Solution Conclusion and Future Works

Proposed Solution

Solution Sketch (1)

Alice Mallory

TPM_OIAP()

TPM

TPM_OIAP() ACK(SessionHandle1, NonceEven1) ACK(SessionHandle1, NonceEven1) CMD(SessionHandle1, NonceEven1, NonceOdd1, 00) ANS(SessionHandle1, NonceEven2, NonceOdd1, "reset")

SH_1 SH_1

  • D. Bruschi, L. Cavallaro, A. Lanzi and M. Monga

A Replay Attack in the TCG Specification and a Solution

slide-30
SLIDE 30

Trusted Computing Platforms Replay Attack Model Checking Proposed Solution Conclusion and Future Works

Proposed Solution

Solution Sketch (1)

Alice Mallory

TPM_OIAP()

TPM

TPM_OIAP() ACK(SessionHandle1, NonceEven1) ACK(SessionHandle1, NonceEven1) CMD(SessionHandle1, NonceEven1, NonceOdd1, 00) ANS(SessionHandle1, NonceEven2, NonceOdd1, "reset")

SH_1 SH_1

  • D. Bruschi, L. Cavallaro, A. Lanzi and M. Monga

A Replay Attack in the TCG Specification and a Solution

slide-31
SLIDE 31

Trusted Computing Platforms Replay Attack Model Checking Proposed Solution Conclusion and Future Works

Replay Attack

Solution Sketch (2)

Alice Mallory

TPM_OIAP()

TPM

TPM_OIAP() ACK(SessionHandle2, NonceEven3) ACK(SessionHandle2, NonceEven3) CMD(SessionHandle2, NonceEven3, NonceOdd2, 10) ANS(SessionHandle2, NonceEven4, NonceOdd2, "OK") CMD(SessionHandle2, NonceEven3, NonceOdd2, 10) ANS(SessionHandle2, NonceEven4, NonceOdd2, "OK")

SH_1 SH_1

  • D. Bruschi, L. Cavallaro, A. Lanzi and M. Monga

A Replay Attack in the TCG Specification and a Solution

slide-32
SLIDE 32

Trusted Computing Platforms Replay Attack Model Checking Proposed Solution Conclusion and Future Works

Replay Attack

Solution Sketch (2)

Alice Mallory

TPM_OIAP()

TPM

TPM_OIAP() ACK(SessionHandle2, NonceEven3) ACK(SessionHandle2, NonceEven3) CMD(SessionHandle2, NonceEven3, NonceOdd2, 10) ANS(SessionHandle2, NonceEven4, NonceOdd2, "OK") CMD(SessionHandle2, NonceEven3, NonceOdd2, 10) ANS(SessionHandle2, NonceEven4, NonceOdd2, "OK")

SH_1 SH_1 SH_2 SH_2

  • D. Bruschi, L. Cavallaro, A. Lanzi and M. Monga

A Replay Attack in the TCG Specification and a Solution

slide-33
SLIDE 33

Trusted Computing Platforms Replay Attack Model Checking Proposed Solution Conclusion and Future Works

Replay Attack

Solution Sketch (2)

Alice Mallory

TPM_OIAP()

TPM

TPM_OIAP() ACK(SessionHandle2, NonceEven3) ACK(SessionHandle2, NonceEven3) CMD(SessionHandle2, NonceEven3, NonceOdd2, 10) ANS(SessionHandle2, NonceEven4, NonceOdd2, "OK") CMD(SessionHandle2, NonceEven3, NonceOdd2, 10) ANS(SessionHandle2, NonceEven4, NonceOdd2, "OK")

SH_1 SH_2 SH_2 SH_1

  • D. Bruschi, L. Cavallaro, A. Lanzi and M. Monga

A Replay Attack in the TCG Specification and a Solution

slide-34
SLIDE 34

Trusted Computing Platforms Replay Attack Model Checking Proposed Solution Conclusion and Future Works

Replay Attack

Solution Sketch (2)

Alice Mallory

TPM_OIAP()

TPM

TPM_OIAP() ACK(SessionHandle2, NonceEven3) ACK(SessionHandle2, NonceEven3) CMD(SessionHandle2, NonceEven3, NonceOdd2, 10) ANS(SessionHandle2, NonceEven4, NonceOdd2, "OK") CMD(SessionHandle2, NonceEven3, NonceOdd2, 10) ANS(SessionHandle2, NonceEven4, NonceOdd2, "OK")

SH_1 SH_2 SH_2 SH_1

  • D. Bruschi, L. Cavallaro, A. Lanzi and M. Monga

A Replay Attack in the TCG Specification and a Solution

slide-35
SLIDE 35

Trusted Computing Platforms Replay Attack Model Checking Proposed Solution Conclusion and Future Works

Replay Attack

Solution Sketch (3)

Alice Mallory TPM

CMD(SessionHandle1, NonceEven1, NonceOdd1, 00) ANS(SessionHandle1, NonceEven2, NonceOdd1, "KO")

SH_1 SH_2 SH_2 SH_1

  • D. Bruschi, L. Cavallaro, A. Lanzi and M. Monga

A Replay Attack in the TCG Specification and a Solution

slide-36
SLIDE 36

Trusted Computing Platforms Replay Attack Model Checking Proposed Solution Conclusion and Future Works

Replay Attack

Solution Sketch (3)

Alice Mallory TPM

CMD(SessionHandle1, NonceEven1, NonceOdd1, 00) ANS(SessionHandle1, NonceEven2, NonceOdd1, "KO")

SH_1 SH_2 SH_2 SH_1

  • D. Bruschi, L. Cavallaro, A. Lanzi and M. Monga

A Replay Attack in the TCG Specification and a Solution

slide-37
SLIDE 37

Trusted Computing Platforms Replay Attack Model Checking Proposed Solution Conclusion and Future Works

Conclusion and Future Works

We recall TCG-based Trusted Computing Platforms Focus on TCG-based TPs Authorization Protocols

We show a Straight Replay Attack against the Open-Independent Authorization Protocol, formally proved with the Spin Model Checker We propose a solution based on the concept of shared session knowledge We are investigating a formal proof of the proposed solution

  • D. Bruschi, L. Cavallaro, A. Lanzi and M. Monga

A Replay Attack in the TCG Specification and a Solution

slide-38
SLIDE 38

Trusted Computing Platforms Replay Attack Model Checking Proposed Solution Conclusion and Future Works

Thanks!

Thank you! :-)

  • D. Bruschi, L. Cavallaro, A. Lanzi and M. Monga

A Replay Attack in the TCG Specification and a Solution