trustedjava-support

[Trustedjava-support] info about tpm quote

[<cas...@al...>]

hi all!
i've to implement a mechanism of remote attestation, where an untrusted =
terminal has to do a quote operation to send a set of pcr values to a =
server that decides if the terminal is trusted or not.

the message the terminal has to send is: {pcr_set,nonce} signed with =
private aik, but i don't understand how i can retrieve  this message =
from the structures the quote operation uses or .

is this message in the tssvalidation or in the pcrcomposite object?=20

Please can you explain me how i can retrieve this information from the =
quote operation?

What is the tss validation structure? i have looked for in the tss =
specification but i don't understand what it is.

Please help me if you want or tell me where i can find more information =
about.

Thanks in advance!
regards, Alessandro Fabbri

Re: [Trustedjava-support] info about tpm quote

[Martin P. <Mar...@ia...>]

cas...@al... wrote:
> an untrusted terminal has to do a quote operation
> the message the terminal has to send is: {pcr_set,nonce} signed with private aik,
> but i don't understand how i can retrieve this message from the structures the quote operation uses

TcTssValidation validation = TcTssStructFactory.newValidation();
validation.setExternalData(...nonce...);

TcIPcrComposite pcrSelection = context.createPcrCompositeObject(0);
pcrSelection.selectPcrIndex(...yourfavouritePCR...);

TcTssValidation quoteResult = context.getTpm().quote(aikKey, pcrSelection, validation);

... = quoteResult.getData();            // plain data
... = quoteResult.getValidationData();  // signature


HTH

-- 
Martin Pirker
IAIK, TU Graz

[Trustedjava-support] R: info about tpm quote

[<cas...@al...>]

Thank you for your response!

If i can, i have an other question:
in my remote attestation the server receives the message =
(resultQuote,eventLog,aikcertification).
i have to attest the resultQuote using event log. how can i do?
which functions have i to use?=20

if you want to response me, i will be really grateful to you. Are there =
documents that explain something about this in details?

thanks in advance,
regards

Alessandro Fabbri



-----Messaggio originale-----
Da: Martin Pirker [mailto:Mar...@ia...]
Inviato: mar 11/09/2007 11.17
A: cas...@al...
Cc: tru...@li...
Oggetto: Re: [Trustedjava-support] info about tpm quote
=20
cas...@al... wrote:
> an untrusted terminal has to do a quote operation
> the message the terminal has to send is: {pcr_set,nonce} signed with =
private aik,
> but i don't understand how i can retrieve this message from the =
structures the quote operation uses

TcTssValidation validation =3D TcTssStructFactory.newValidation();
validation.setExternalData(...nonce...);

TcIPcrComposite pcrSelection =3D context.createPcrCompositeObject(0);
pcrSelection.selectPcrIndex(...yourfavouritePCR...);

TcTssValidation quoteResult =3D context.getTpm().quote(aikKey, =
pcrSelection, validation);

... =3D quoteResult.getData();            // plain data
... =3D quoteResult.getValidationData();  // signature


HTH

--=20
Martin Pirker
IAIK, TU Graz

Re: [Trustedjava-support] info about tpm quote

[Martin P. <Mar...@ia...>]

cas...@al... wrote:
> in my remote attestation the server receives the message (resultQuote,eventLog,aikcertification).
> i have to attest the resultQuote using event log. how can i do?

Typically the server side in an attestation process has to
* check correctness of supplied AIK certificate
* use public key from certificate to verify quote blob signature
* check correctness/freshness of nonce
* check PCR composite digest to be expected value,
  by replaying the extension events in the log


>  Are there documents that explain something about this in details?

AFAIK no.

We do strive to include demo code/tests/javadoc for functions as much as we
can, see the sources and unit tests of jTss/JTssWrapper/JTpmTools etc.,
however, our manpower is limited.

Note that the current Java API is not very highlevel and matches
more the official TCG lowlevel C API. You may learn a lot by following
TrouSerS development, too.
The TCG specs are rather cryptic reading, but if you want an
authorative source, you'll have to bite through.


HTH

-- 
Martin Pirker
IAIK, TU Graz