A Practical Guide to TPM 2. 0 : : Using the Trusted Platform Module in the New Age of Security.

• Author: Arthur, Will.
• TeilnehmendeR: Challener, David.
• Place / Publishing House: Berkeley, CA : : Apress L. P.,, 2015.; Ã2015.
• Year of Publication: 2015
• Edition: 1st ed.
• Language: English
• Physical Description: 1 online resource (375 pages)

Table of Contents

• Intro
• A Practical Guide to TPM 2.0
• Contents at a Glance
• About ApressOpen
• Contents
• About the Authors
• About the Technical Reviewers
• Acknowledgments
• Introduction
• Chapter 1: History of the TPM
• Why a TPM?
• History of Development of the TPM Specification from 1.1b to 1.2
• How TPM 2.0 Developed from TPM 1.2
• History of TPM 2.0 Specification Development
• Summary
• Chapter 2: Basic Security Concepts
• Cryptographic Attacks
• Brute Force
• Calculating the Strength of Algorithms by Type
• Attacks on the Algorithm Itself
• Security Definitions
• Cryptographic Families
• Secure Hash (or Digest)
• Hash Extend
• HMAC: Message Authentication Code
• KDF: Key Derivation Function
• Authentication or Authorization Ticket
• Symmetric-Encryption Key
• Symmetric-Key Modes
• Nonce
• Asymmetric Keys
• RSA Asymmetric-Key Algorithm
• RSA for Key Encryption
• RSA for Digital Signatures
• ECC Asymmetric-Key Algorithm
• ECDH Asymmetric-Key Algorithm to Use Elliptic Curves to Pass Keys
• ECDSA Asymmetric-Key Algorithm to Use Elliptic Curves for Signatures
• Public Key Certification
• Summary
• Chapter 3: Quick Tutorial on TPM 2.0
• Scenarios for Using TPM 1.2
• Identification
• Encryption
• Key Storage
• Random Number Generator
• NVRAM Storage
• Platform Configuration Registers
• Privacy Enablement
• Scenarios for Using Additional TPM 2.0 Capabilities
• Algorithm Agility (New in 2.0)
• Enhanced Authorization (New in 2.0)
• Quick Key Loading (new in 2.0)
• Non-Brittle PCRs (New in 2.0)
• Flexible Management (New in 2.0)
• Identifying Resources by Name (New in 2.0)
• Summary
• Chapter 4: Existing Applications That Use TPMs
• Application Interfaces Used to Talk to TPMs
• TPM Administration and WMI
• The Platform Crypto Provider
• Virtual Smart Card
• Applications That Use TPMs.
• Applications That Should Use the TPM but Don't
• Building Applications for TPM 1.2
• TSS.Net and TSS.C++
• Wave System s Embassy Suite
• Rocks to Avoid When Developing TPM Applications
• Microsoft BitLocker
• IBM File and Folder Encryption
• New Manageability Solutions in TPM 2.0
• Summary
• Chapter 5: Navigating the Specification
• TPM 2.0 Library Specification: The Parts
• Some Definitions
• General Definitions
• Definitions of the Major Fields of the Command Byte Stream
• Definitions of the Major Fields of the Response Byte Stream
• Getting Started in Part 3: the Commands
• Data Details
• Common Structure Constructs
• TPM2B_XXX Structures
• Structure with Union
• Canonicalization
• Endianness
• Part 2: Notation Syntax
• Part 3: Table Decorations
• Commonly Used Sections of the Specification
• How to Find Information in the Specification
• Strategies for Ramping Up on TPM 2.0
• Will
• Ken
• Dave
• Other TPM 2.0 Specifications
• Summary
• Chapter 6: Execution Environment
• Setting Up the TPM
• Microsoft Simulator
• Building the Simulator from Source Code
• Setting Up a Binary Version of the Simulator
• Running the Simulator
• Testing the Simulator
• Python Script
• TSS.net
• System API Test Code
• Setting Up the Software Stack
• TSS 2.0
• TSS.net
• Summary
• Chapter 7: TPM Software Stack
• The Stack: a High-Level View
• Feature API
• System API
• Command Context Allocation Functions
• Command Preparation Functions
• Command Execution Functions
• Command Completion Functions
• Simple Code Example
• System API Test Code
• TCTI
• TPM Access Broker ( TAB)
• Resource Manager
• Device Driver
• Summary
• Chapter 8: TPM Entities
• Permanent Entities
• Persistent Hierarchies
• Ephemeral Hierarchy
• Dictionary Attack Lockout Reset
• Platform Configuration Registers ( PCR s)
• Reserved Handles.
• Password Authorization Session
• Platform NV Enable
• Nonvolatile Indexes
• Objects
• Nonpersistent Entities
• Persistent Entities
• Entity Names
• Summary
• Chapter 9: Hierarchies
• Three Persistent Hierarchies
• Platform Hierarchy
• Storage Hierarchy
• Endorsement Hierarchy
• Privacy
• Activating a Credential
• Other Privacy Considerations
• NULL Hierarchy
• Cryptographic Primitives
• Random Number Generator
• Digest Primitives
• HMAC Primitives
• RSA Primitives
• Symmetric Key Primitives
• Summary
• Chapter 10: Keys
• Key Commands
• Key Generator
• Primary Keys and Seeds
• Persistence of Keys
• Key Cache
• Key Authorization
• Key Destruction
• Key Hierarchy
• Key Types and Attributes
• Symmetric and Asymmetric Keys Attributes
• Duplication Attributes
• Restricted Signing Key
• Restricted Decryption Key
• Context Management vs. Loading
• NULL Hierarchy
• Certification
• Keys Unraveled
• Summary
• Chapter 11: NV Indexes
• NV Ordinary Index
• NV Counter Index
• NV Bit Field Index
• NV Extend Index
• Hybrid Index
• NV Access Controls
• NV Written
• NV Index Handle Values
• NV Names
• NV Password
• Separate Commands
• Summary
• Chapter 12: Platform Configuration Registers
• PCR Value
• Number of PCRs
• PCR Commands
• PCRs for Authorization
• PCRs for Attestation
• PCR Quote in Detail
• PCR Attributes
• PCR Authorization and Policy
• PCR Algorithms
• Summary
• Chapter 13: Authorizations and Sessions
• Session-Related Definitions
• Password, HMAC, and Policy Sessions: What Are They?
• Session and Authorization: Compared and Contrasted
• Authorization Roles
• Command and Response Authorization Area Details
• Command Authorization Area
• Command Authorization Structures
• Response Authorization Structures
• Password Authorization: The Simplest Authorization.
• Password Authorization Lifecycle
• Creating a Password Authorized Entity
• Changing a Password Authorization for an Already Created Entity
• Using a Password Authorization
• Code Example: Password Session
• Starting HMAC and Policy Sessions
• TPM2_StartAuthSession Command
• Session Key and HMAC Key Details
• Guidelines for TPM2_StartAuthSession Handles and Parameters
• Session Variations
• Salted vs. Unsalted
• Bound vs. Unbound
• Use Cases for Session Variations
• HMAC and Policy Sessions: Differences
• HMAC Authorization
• HMAC Authorization Lifecycle
• Altering or Creating an Entity That Requires HMAC Authorization
• Creating an HMAC Session
• Using an HMAC Session to Authorize a Single Command
• HMAC and Policy Session Code Example
• Using an HMAC Session to Send Multiple Commands (Rolling Nonces)
• HMAC Session Security
• HMAC Session Data Structure
• Policy Authorization
• How Does EA Work?
• Policy Authorization Time Intervals
• Policy Authorization Lifecycle
• Building the Entity's Policy Digest
• Creating the Entity to Use the Policy Digest
• Starting the Real Policy Session
• Sending Policy Commands to Fulfill the Policy
• Performing the Action That Requires Authorization
• Combined Authorization Lifecycle
• Summary
• Chapter 14: Extended Authorization (EA) Policies
• Policies and Passwords
• Why Extended Authorization?
• Multiple Varieties of Authentication
• Multifactor Authentication
• How Extended Authorization Works
• Creating Policies
• Simple Assertion Policies
• Passwords (Plaintext and HMAC) of the Object
• Passwords of a Different Object
• Digital Signatures (such as Smart Cards)
• PCRs: State of the Machine
• Locality of Command
• Internal State of the TPM (Boot Counter and Timers)
• Internal Value of an NV RAM Location.
• State of the External Device (GPS, Fingerprint Reader, and So On)
• Flexible (Wild Card) Policy
• Example 1: Smart card and Password
• Example 2: A Policy for a Key Used Only for Signing with a Password
• Example 3: A PC state, a Password, and a Fingerprint
• Example 4: A Policy Good for One Boot Cycle
• Example 5: A Policy for Flexible PCRs
• Example 6: A Policy for Group Admission
• Example 7: A Policy for NV RAM between 1 and 100
• Command-Based Assertions
• Multifactor Authentication
• Compound Policies: Using Logical OR in a Policy
• Making a Compound Policy
• Example: A Policy for Work or Home Computers
• Considerations in Creating Policies
• End User Role
• Administrator Role
• Understudy Role
• Office Role
• Home Role
• Using a Policy to Authorize a Command
• Starting the Policy
• Satisfying a Policy
• Simple Assertions and Multifactor Assertions
• If the Policy Is Compound
• If the Policy Is Flexible (Uses a Wild Card)
• Satisfying the Approved Policy
• Transforming the Approved Policy in the Flexible Policy
• Certified Policies
• Summary
• Chapter 15: Key Management
• Key Generation
• Templates
• Key Trees: Keeping Keys in a Tree with the Same Algorithm Set
• Duplication
• Key Distribution
• Key Activation
• Key Destruction
• Putting It All Together
• Example 1: Simple Key Management
• Example 2: An Enterprise IT Organization with Windows TPM 2.0 Enabled Systems
• Summary
• Chapter 16: Auditing TPM Commands
• Why Audit
• Audit Commands
• Audit Types
• Command Audit
• Session Audit
• Audit Log
• Audit Data
• Exclusive Audit
• Summary
• Chapter 17: Decrypt/Encrypt Sessions
• What Do Encrypt/Decrypt Sessions Do?
• Practical Use Cases
• Decrypt/Encrypt Limitations
• Decrypt/Encrypt Setup
• Pseudocode Flow
• Sample Code
• Summary
• Chapter 18: Context Management.
• TAB and the Resource Manager: A High-Level Description.