Hi Osama, That's actually very bad news to me, as TPM-based security is a pre-condition of the project: if I can't get the setup to work with TPM, there will be no Linux laptop rollout at all. I haven't been able to find an alternative to openCryptoki as far as securing certificates and exposing them via PKCS#11 is concerned, so if not this, it's nothing.
Thanks for your help, anyway. Best, Greg On 27 September 2016 at 18:35, Osama Farrag <ofar...@gmail.com> wrote: > Greg; > > Cloning the token is a feasible attack vector, given how openCryptoki > elected to implement TPM support; (hard code the type of keys TPM will > produce). The documents they provide recognizes this risk and recommend that > key material to be removed/copied outside the host ideally to a machine not > connected to a network. > > Please send an email when your blog site is up. > > Best regards > Osama Farrag > > On Tue, Sep 27, 2016 at 6:44 AM, Grzegorz Staniak <gstan...@gmail.com> > wrote: >> >> Hi Osama, >> >> I'm not using CentOS or Red Hat (we went for Ubuntu LTS), and I'm not >> using OpenSSL either. I create a CSR using the "certtool" utility from >> the GNU TLS package, sign it on another system using the regular SSL >> CA setupo, then send it back and import into the "TPM token" using >> regular PKCS#11 tools (p11tool). I haven't got a detailed step-by-step >> write-up yet, but a blog entry is planned after I have all the setup >> in place, >> >> I agree that key migration is crucial for data protection, but in my >> case the keys used for wifi/vpn certificates can be provisioned again >> if lost or compromised, so I'm much more concerned about the >> possibility of "cloning" the virtual token. Is that a feasible vector >> o attack? What do I need to do to actually extract a private key from >> the TPM token and can this be done by the user if they have root >> access? I'm trying to research TPMs in more depth at the moment, but >> that's a broad subject. Can anyone advise? >> >> Best, >> Greg >> >> On 26 September 2016 at 19:14, Osama Farrag <ofar...@gmail.com> wrote: >> > Greg; >> > >> > >> > I am interested to know how you were able to get these parts working of >> > “OpenCryptoki”? I am trying to get TPM keys to be signed by CA, but was >> > not >> > able to setup OpenCryptoki to work with openSSL to generate CSR. I >> > understand the limitations/weakness caused by current approach taken by >> > OpenCryptoki designers. >> > >> > >> > They should allowed users to select the type of key (with non-migratble >> > as >> > an option); I think they were trying to simplify recovery of keys to a >> > new >> > platform. They recommend that token removed from platform hard disk, may >> > be >> > archived on media. I think recovery of Identity Key is not necessary >> > because >> > new key and certificate can be generated at a new platform. Not all keys >> > are >> > storage keys, and as such ease of migration should be a users choice. >> > >> > >> > Again, I hope that you have detailed steps for setting this for CentOS >> > linux >> > distribution. >> > >> > >> > Thanks >> > >> > Osama Farrag >> > >> > The johns Hopkins University >> > >> > >> > -----Original Message----- >> > >> > From: Grzegorz Staniak <gstan...@gmail.com> >> > >> > Date: Monday, September 26, 2016 at 6:12 AM >> > >> > To: "opencryptoki-users@lists.sourceforge.net" >> > <opencryptoki-users@lists.sourceforge.net> >> > >> > Subject: [opencryptoki-users] What does 'CKA_EXTRACTABLE' actually mean? >> > >> > >> > using the >> > >> > tpm_tok backend, a CSR generated with the keys using 'certtool', >> > >> > signed externally, imported back into the "TPM token" with consistent >> > >> > names and IDs, almost ready for deployment. >> > >> > >> > My only worry is that when I list the objects in the token, the >> > >> > private key comes up flagged as: >> > >> > >> > CKA_WRAP/UNWRAP; CKA_PRIVATE; CKA_EXTRACTABLE; >> > >> > >> > I've found some info on the net that said openCryptoki generates >> > >> > "extractable" keys only. Taken literally, this signals a problem, >> > >> > since at least theoretically it means someone could clone the "TPM >> > >> > token". On the other hand, no standard PKCS#11 tool I've found allows >> > >> > that, exactly because it defeats the purpose of a token, TPM-based or >> > >> > not. >> > >> > >> > Could someone please answer the question from the subject to clear >> > >> > this up? Is a TPM-token key extractable using the PKCS#11 API, or >> > >> > otherwise? Can I prevent this using TPM tools? Thank you, >> > >> > >> >> >> >> -- >> Grzegorz Staniak <gstaniak [at] gmail _dot_ com> > > -- Grzegorz Staniak <gstaniak [at] gmail _dot_ com> ------------------------------------------------------------------------------ _______________________________________________ opencryptoki-users mailing list opencryptoki-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/opencryptoki-users
