Jump to content

User:Joh Ho/sandbox

From Wikipedia, the free encyclopedia


The TPM Software Stack (TSS), or TCG Software Stack, is the specification of a software stack for facilitating the use of the Trusted Platform Module (TPM) by the Trusted Computing Group (TCG). Even though the TSS specification is still being worked on at the moment, it is already being adopted by software providers. The specification defines several APIs that simplify implementing a TPM 2.0 in an end product.

The TSS was developed to enable the operating system and applications to easily share the system's TPM. While there are several implementations that utilize the term TSS, some of them do not claim to be compliant with the specification be the TCG.

Among other things, the TSS provides synchronous and asynchronous function calls for communicating with the TPM, handles the marshalling/unmarshalling needed for communication with a TPM and enables the encrypting of the data stream to the TPM stopping side-channel attacks (hardware probing) attacks (achieving Common Criteria Evaluation Assurance Level (EAL) 4++). Additionally, the TSS simplifies the context and session management needed, providing varying levels of abstraction (depending on the TSS API layer used). The code footprint of the TSS can range from IoT applications (no file system, no heap, etc.) up to server applications.[1]


Specification Documents

[edit]

The specification of the TSS is divided into several documents. Above all, the structure of the TSS and a list of all documents which are part of the specification are given by the TCG TSS 2.0 Overview and Common Structures Specification[2]. There are six subordinated documents, which are part of the specification:

  • TCG TSS 2.0 Feature API (FAPI) Specification[3]
  • TCG TSS 2.0 Enhanced System API (ESAPI) Specification[4]
  • TCG TSS 2.0 System Level API (SAPI) Specification[5]
  • TCG TSS 2.0 Marshaling/Unmarshaling API Specification[6]
  • TCG TSS 2.0 TPM Command Transmission Interface (TCTI) API Specification[7]
  • TCG TSS 2.0 Tab and Resource Manager Specification[8]


Architecture

[edit]
Structure of the TSS and related software

The TSS consists of multiple API layers which offer a distinct level of abstraction (starting with the highest level of abstraction): Feature API (FAPI), Enhanced System API (ESAPI), System API (SAPI), TPM Command Transmission Interface (TCTI), TPM Access Broker (TAB), Resource Manager (RM), and Device Driver.[9]

Code Requirements / TSS Layers[1] FAPI ESAPI SAPI TCTI TAB/RM
File I/O Yes No No No No
(depends on
power management)
Cryptographic software implementations No Yes No No No
Heap Yes Yes No No Yes
External library dependency No No No No No
Context based state Yes Yes Yes Yes No
Able to do retries Yes No No No No
Support possibility of reduced code size
(by offering static libraries) 		Yes No No No No
Abstract TPM details from programmers Yes No No No No
Power management No No No No Yes

Feature API (FAPI)

[edit]

The Feature API Specification (FAPI) as described in the TCG TSS 2.0 Feature API (FAPI) Specification[3] (which is still a draft) is the most high-level API and covers about 80% of the common use cases. It's focus is minimizing both the number of functions calls necessary and the number of parameters per call. To this end, default algorithms, key sizes, signing schemes etc. can be specified in profile files. On the other hand, the FAPI does not enable each and every capability of the TPM.[9]

Enhanced System API (ESAPI)

[edit]

The Enhanced System API (ESAPI) as described in the TCG TSS 2.0 Enhanced System API (ESAPI) Specification[4] is intended to sit on top of the SAPI. It reduces programming complexity by providing session management additionally to the base SAPI functions. Unlike the SAPI layer, cryptographic operations (e.g. encryption/decryption, [[|HMAC|HMACs]]) ensure the security of the communication and defeat sideband attacks involving the data bus to the TPM. While the ESAPI does not require a file system, it indeed requires to allocate dynamic memory.

System API (SAPI)

[edit]

The System API (SAPI) as described in TCG TSS 2.0 System Level API (SAPI) Specification[5] enables access to all features of the TPM 2.0. The SAPI is a 1-to-1 mapping of the TPM's commands specified in TPM 2.0 Library Specification Part 3: Commands[10] and provides both a synchronous and asynchronous function for each command.[9]

To enable the development of applications for embedded devices, minimizing the memory footprint of the SAPI library code was taken into consideration. Thus, the SAPI code is does not require to allocate dynamic memory. Usually, the developer is responsible to allocate memory used by the SAPI. To enable the usage of the TPM on systems with limited processing power, the SAPI does not perform any cryptographic operations.

TPM Command Transmission Interface (TCTI)

[edit]

TPM Command Transmission Interface (TCTI) as described in the TCG TSS 2.0 TPM Command Transmission Interface (TCTI) API Specification[7] provides a standard interface to transmit and receive byte streams to and from the TPM. This abstraction enables the substitution of the underlying driver and device transparently, i.e. without the application being aware. For instance, the TSS can communicate with the driver of a hardware TPM as well as a TPM simulator for testing and debugging.

TPM Access Broker and Resource Manager (TAB/RM)

[edit]

Usually, the TPM Access Broker (TAB) and the Resource Manager (RM) are combined in the same software module.[9] The TAB as described in the TCG TSS 2.0 Tab and Resource Manager Specification[8] controls the access of multiple processes to a single TPM. Additionally, it handles process ownership of sessions objects and sequences and prevents unauthorized access from other processes. Due to the TPM's limitations concerning on-board memory, only a finite amount of objects, sessions and sequences can be stored inside the TPM. To successfully execute a TPM command, all necessary resources have to be present in the TPM. It's the RM's job to load all required resources before a command is executed.

Implementations

[edit]

Nowadays the TAB/RM is part of the Linux Kernel. As a result, the term TSS usually means a piece of software that exposes the TCTI interface at the low-level end and the SAPI (and optionally ESAPI and/or FAPI) at the high-level end. Since TPM Software Stack and TSS is not a protected name, there are also pieces of software that are called TSS but are not compliant.

TSS (without TAB/RM)

[edit]

The most prominent compliant implementation is the Open Source TSS[11] in C language. Published by Intel in July 2015, it is part of the open source community. Since 2018, Fraunhofer SIT, enabled by Infineon, is contributing to the project[12][13][14].

The Open Source TSS is part of the Debian package repositories for Sid[15] and Buster[16] (libtss2-dev, libsapi-dev). The libsapi-dev package is also available on Ubuntu since Cosmic Cuttlefish 18.10[17]. On Red Hat Enterprise Linux, the packet is available as tpm2-tss[18]. OpenSuse provides the package as well (tpm2-0-tss)[19]. Another compliant implementation of the TCG specification is the TrustSentinel TSS[20] by OnBoard Security. Since this is a commercial software product, it includes developer support.

The IBM TSS is an alternative implementation that does not comply with the TCG specification. Instead it strives towards providing an easier API with equivalent functionality.

Implementation Company Programming language Compliant to the TCG specification Open source LICENSE Main developer(s)/Contact
Open Source TSS[11] Intel C Yes Yes BSD (2-clause) Philip Tricca
IBM TSS[21] IBM C No Yes BSD (3-clause) Ken Goldman
TSS.MSR[22] Microsoft C#, C++ No Yes MIT Andrey Marochko
TrustSentinel TSS[20] OnBoard Security C Yes No proprietary Lee Wilson

Google published an interactive introduction to the TPM by utilizing the Open Source TSS as well as a TPM simulator by IBM and Google's BoringSSL. These libraries are called by JavaScript code and run by the Browser. As part of this project, JavaScript code snippets utilizing the TPM can be run while the communication with the TPM is visualized at the same time. The website provides an explanation for some key features of the TPM like Random Number Generation, Key Generation, PCRs, Attestation and Authorization.[23]

TAB/RM

[edit]

The Open Source TAB/RM published by Intel is part of the Linux Kernel since version 4.12.[24][25] Alternatively, an equivalent (although not identical) user space TAB/RM[26] can be used. That's especially interesting on devices that run an old Linux Kernel or no Linux Kernel at all. Both a user space and in-kernel TAB/RM can be used simultaneously to archieve maximal compatibility.

  1. ^ a b "Creating the Complete Trusted Computing Ecosystem: An Overview of the Trusted Software Stack (TSS) 2.0". trustedcomputinggroup.org. Trusted Computing Group. Retrieved 2019-01-08.
  2. ^ "TCG TSS 2.0 Overview and Common Structures Specification". trustedcomputinggroup.org. Trusted Computing Group. Retrieved 2019-01-09.
  3. ^ a b "TCG TSS 2.0 Feature API (FAPI) Specification". trustedcomputinggroup.org. Trusted Computing Group. Retrieved 2019-01-09.
  4. ^ a b "TCG TSS 2.0 Feature API (ESAPI) Specification". trustedcomputinggroup.org. Trusted Computing Group. Retrieved 2019-01-09.
  5. ^ a b "TCG TSS 2.0 System Level API (SAPI) Specification". trustedcomputinggroup.org. Trusted Computing Group. Retrieved 2019-01-09.
  6. ^ "TCG TSS 2.0 Marshaling/Unmarshaling API Specification". trustedcomputinggroup.org. Trusted Computing Group. Retrieved 2019-01-09.
  7. ^ a b "TCG TSS 2.0 TPM Command Transmission Interface (TCTI) API Specification". trustedcomputinggroup.org. Trusted Computing Group. Retrieved 2019-01-09.
  8. ^ a b "TCG TSS 2.0 Tab and Resource Manager Specification". trustedcomputinggroup.org. Trusted Computing Group. Retrieved 2019-01-09.
  9. ^ a b c d Arthur, Will; Challener, David; Goldman, Kenneth (2015). "A Practical Guide to TPM 2.0: Using the New Trusted Platform Module in the New Age of Security" (1st ed.). Retrieved 2018-01-09.
  10. ^ "TPM 2.0 Library Specification Part 3: Commands". trustedcomputinggroup.org. Trusted Computing Group. Retrieved 2019-01-13.
  11. ^ a b "tpm2-software/tpm2-tss". GitHub. Retrieved 2019-01-09.
  12. ^ "Infineon enables open source software stack for TPM 2.0". sit.fraunhofer.de. Fraunhofer Institute for Secure Information Technology. Retrieved 2019-01-06.
  13. ^ "The TPM2 Software Stack: Introducing a Major Open Source Release". intel.com. Intel. Retrieved 2019-01-06.
  14. ^ "Infineon enables open source software stack for TPM 2.0 - for easier integration of security into industrial and automotive applications". infineon.com. Infineon Technologies. Retrieved 2019-01-06.
  15. ^ "Debian - Details of source package tpm2-tss in sid". debian.org. Retrieved 2019-01-09.
  16. ^ "Debian - Details of source package tpm2-tss in buster". debian.org. Retrieved 2019-01-09.
  17. ^ "Ubuntu - Details of package libsapi-dev in bionic". debian.org. Retrieved 2019-01-09.
  18. ^ "Red Hat Enterprise Linux 7 Chapter 42. Hardware Enablement - Red Hat Customer Portal". redhat.com. Retrieved 2019-01-09.
  19. ^ "OpenSuse Software: tpm2-0-tss - Intel's TCG Software Stack access libraries for TPM 2.0 chips". opensuse.org. Retrieved 2019-01-09.
  20. ^ a b "TrustSentinel Trusted Computing Software". onboardsecurity.com. OnBoard Security. Retrieved 2019-01-09.
  21. ^ "IBM's TPM 2.0 TSS". SourceForge. Retrieved 2019-01-09.
  22. ^ "TSS.MSR". GitHub. Retrieved 2019-01-09.
  23. ^ "TPM-JS". google.github.io. Google. Retrieved 2019-01-13.
  24. ^ "tpm: infrastructure for TPM spaces". kernel.org. Retrieved 2019-01-16.
  25. ^ "tpm: expose spaces via a device link /dev/tpmrm<n>". kernel.org. Retrieved 2019-01-16.
  26. ^ "tpm2-software/tpm2-abrmd". GitHub. Retrieved 2019-01-16.
Retrieved from "https://en.wikipedia.org/w/index.php?title=User:Joh_Ho/sandbox&oldid=878722383"