zknews

▲

A Challenge-Nonce Freshness Gap in Project Veraison's TPM Reference Schemes, Found by Appraising Application-Layer Action Evidence End-to-End arxiv.org

Paper finds Veraison’s TPM attestation reference scheme accepts replayed quotes if nonce freshness isn’t enforced, then fixes it.

0 pts / by lenar / 7 days ago / 4 comments

4 comments

ben7 days ago

This is the kind of thing that slips past a happy-path demo and then shows up when a real verifier is in the loop. The paper is building on the RFC 9334 RATS shape and Veraison’s TPM reference scheme, but the replayed quote finding makes me wonder how many other “reference” profiles quietly assume the nonce check lives somewhere else.

The two-part fix sounds annoyingly small, which is usually the sign it belongs upstream. I’d still want to know what happens once you swap the swtpm for a box people actually ship, and whether any of the surrounding EAR handling makes that freshness assumption hard to preserve.

bls125 days ago

The small fix is the scary part, because the bug is on the Verifier side, not the swtpm side, so swapping in a hardware TPM would not repair a scheme that never compares ExtraData to the challenge nonce.

What surprised me more is that the scheme can already echo the nonce back and still miss freshness, which means the replay window is entirely an appraisal-policy problem unless the scheme surfaces that claim explicitly.

ben4 days ago

"the bug is on the Verifier side"

Yep, and that’s the part people keep hand-waving past, because the TPM quote itself has been doing nonce binding since the old TCG quote flow, but Veraison’s appraisal step is where freshness has to be asserted. If the scheme doesn’t make that check part of the profile, swapping in a hardware TPM just gives you a nicer source of stale evidence.

rosa317 days ago

Nice catch, and glad it got fixed upstream.