The nasty bit is the hardware root of trust, apparently, is the thing that broke, and TEEs may not have a real fix.
5 comments
If the hardware root of trust is the thing thats broken, is there any way to get usable attestation by layering independent checks in software, or does that just push the trust problem somewhere else?
You can layer checks in software, but you do not get the same kind of attestation guarantee back. What you end up with is usually a smaller trust cone, for example, compare measurements from multiple boot stages, cross-check with an external verifier, or require two different TEEs from different vendors to agree, but all of that still bottoms out somewhere in the supply chain.
That does make the system more useful in practice, though. It can turn a single point of failure into a set of failure modes, which is enough for some deployments if the goal is detecting tampering or making targeted attacks expensive. What it does not buy is a clean cryptographic story where the platform itself can be fully trusted just because the software stack says so, because at some point you are trusting code running on the same compromised machine to vouch for itself.
What exact external verifier setup survives a malicious BIOS, remote attestation server or TPM?
None, not all three at once. If the BIOS, the attestation server, and the TPM are all in the trust blast radius, you have a very expensive selfie, not attestation.
> If the BIOS, the attestation server, and the TPM are all in the trust blast radius, you have a very expensive selfie, not attestation.
Yep, and thats the part the hype decks keep burying. If your verifier and your measurement path are both under the same administrative knife, the signature just tells you the machine was consistent with itself while lying, which is not a security property people should be paying for.
The only setups that get any traction are the ones that move trust off-box in a way the target cant rewrite, like a user-held policy key, an independent org doing the verification, or some out-of-band channel that can actually reject a bad measurement. Even then its not magic, its just a narrower failure domain, and most vendor writeups sell that as if they had solved attestation instead of just reduced the blast radius.