推奨されるプラットフォームでの TPM のセットアップ

  • [アーティクル]

ファームウェア TPM (fTPM) のセットアップ

ファームウェア TPM (fTPM) では特別なプロセッサ/SoC サポートを必要とするため、現在 Raspberry Pi 2 では fTPM が実装されていません。

  1. UEFI バージョン 0.80 以上の MBM が必要です。

  2. 次の UEFI 設定を変更して、fTPM を有効にします。

     Device Manager -> System Setup -> Security Configuration -> PTT = <Enable>

  3. sTPM/dTPM の C:\Windows\System32\ACPITABL.dat がないことを確認します (競合を解決する/不要な場合はファイルを削除する)。

  4. 適切な TPM バージョンが有効になっていることを確認 - Windows IoT Core デバイスで TPM 2.0 ツールを実行します。

        C:\>t2t.exe -cap

    TBS detected 2.0 firmware TPM (fTPM) using Intel TEE.
    Capabilities:
    PT_FIXED:
    TPM_PT_FAMILY_INDICATOR = '2.0'
    TPM_PT_LEVEL = 0 (0x00000000)
    TPM_PT_REVISION = 0.93
    TPM_PT_DAY_OF_YEAR = 283 (0x0000011b)
    TPM_PT_YEAR = 2012 (0x000007dc)
    TPM_PT_MANUFACTURER = 'INTC'
    TPM_PT_VENDOR_STRING = 'Intel'
    TPM_PT_VENDOR_TPM_TYPE = 3 (0x00000003)
    TPM_PT_FIRMWARE_VERSION_1 = 1.0 (0x1.0x0)
    TPM_PT_FIRMWARE_VERSION_2 = 2.1060 (0x2.0x424)
    TPM_PT_INPUT_BUFFER = 1024 (0x00000400)
    TPM_PT_HR_TRANSIENT_MIN = 3 (0x00000003)
    TPM_PT_HR_PERSISTENT_MIN = 2 (0x00000002)
    TPM_PT_HR_LOADED_MIN = 3 (0x00000003)
    TPM_PT_ACTIVE_SESSIONS_MAX = 64 (0x00000040)
    TPM_PT_PCR_COUNT = 24 (0x00000018)
    TPM_PT_PCR_SELECT_MIN = 3 (0x00000003)
    TPM_PT_CONTEXT_GAP_MAX = 65535 (0x0000ffff)
    TPM_PT_NV_COUNTERS_MAX = 16 (0x00000010)
    TPM_PT_NV_INDEX_MAX = 2048 (0x00000800)
    TPM_PT_MEMORY = sharedNV objectCopiedToRam
    TPM_PT_CLOCK_UPDATE = 4096ms
    TPM_PT_CONTEXT_HASH = TPM_ALG_SHA256
    TPM_PT_CONTEXT_SYM = TPM_ALG_AES
    TPM_PT_CONTEXT_SYM_SIZE = 128 (0x00000080)
    TPM_PT_ORDERLY_COUNT = 255 (0x000000ff)
    TPM_PT_MAX_COMMAND_SIZE = 3968 (0x00000f80)
    TPM_PT_MAX_RESPONSE_SIZE = 3968 (0x00000f80)
    TPM_PT_MAX_DIGEST = 32 (0x00000020)
    TPM_PT_MAX_OBJECT_CONTEXT = 924 (0x0000039c)
    TPM_PT_MAX_SESSION_CONTEXT = 244 (0x000000f4)
    TPM_PT_PS_FAMILY_INDICATOR = TPM_PS_MAIN
    TPM_PT_PS_LEVEL = 0 (0x00000000)
    TPM_PT_PS_REVISION = 0
    TPM_PT_PS_DAY_OF_YEAR = 0 (0x00000000)
    TPM_PT_PS_YEAR = 0 (0x00000000)
    TPM_PT_SPLIT_MAX = 0 (0x00000000)
    TPM_PT_TOTAL_COMMANDS = 70 (0x00000046)
    TPM_PT_LIBRARY_COMMANDS = 70 (0x00000046)
    TPM_PT_VENDOR_COMMANDS = 0 (0x00000000)

    PT_VAR:
    TPM_PT_PERMANENT = lockoutAuthSet tpmGeneratedEPS
    TPM_PT_STARTUP_CLEAR = phEnable shEnable ehEnable
    TPM_PT_HR_NV_INDEX = 2 (0x00000002)
    TPM_PT_HR_LOADED = 0 (0x00000000)
    TPM_PT_HR_LOADED_AVAIL = 3 (0x00000003)
    TPM_PT_HR_ACTIVE = 0 (0x00000000)
    TPM_PT_HR_ACTIVE_AVAIL = 64 (0x00000040)
    TPM_PT_HR_TRANSIENT_AVAIL = 3 (0x00000003)
    TPM_PT_HR_PERSISTENT = 3 (0x00000003)
    TPM_PT_HR_PERSISTENT_AVAIL = 18 (0x00000012)
    TPM_PT_NV_COUNTERS = 2 (0x00000002)
    TPM_PT_NV_COUNTERS_AVAIL = 14 (0x0000000e)
    TPM_PT_ALGORITHM_SET = 0 (0x00000000)
    TPM_PT_LOADED_CURVES = 0 (0x00000000)
    TPM_PT_LOCKOUT_COUNTER = 0 (0x00000000)
    TPM_PT_MAX_AUTH_FAIL = 10 (0x0000000a)
    TPM_PT_LOCKOUT_INTERVAL = 2h 0" 0'
    TPM_PT_LOCKOUT_RECOVERY = 2h 0" 0'
    TPM_PT_AUDIT_COUNTER = 0

    c:\>

  5. fTPM が機能していることを確認 - Windows IoT Core デバイスで Urchin 単体テストを実行します。
    PASS テストがいくつか表示されます (一部の機能は fTPM でサポートされていないので、いくつかのエラー コードが必要です)。

        C:\>urchintest.exe
    ---SETUP----------------------------------------
    PASS...........CreateAuthorities()
    PASS...........CreateEkObject()
    PASS...........CreateSrkObject()
    (0x80280400)...CreateAndLoadAikObject()
    PASS...........CreateAndLoadKeyObject()

    ---TESTS----------------------------------------
    PASS...........TestGetCapability()
    PASS...........TestGetEntropy()
    PASS...........TestPolicySession()
    PASS...........TestSignWithPW()
    PASS...........TestSignHMAC()
    PASS...........TestSignBound()
    PASS...........TestSignSalted()
    PASS...........TestSignSaltedAndBound()
    PASS...........TestSignParameterEncryption()
    PASS...........TestSignParameterDecryption()
    PASS...........TestReadPcrWithEkSeededSession()
    (0x80280400)...TestCreateHashAndHMAC()
    (0x80280400)...TestCreateHashAndHMACSequence()
    (0x80280400)...TestSymKeyImport()
    PASS...........TestRsaKeyImport()
    (0x00000184)...TestCredentialActivation()
    PASS...........TestKeyExport()
    (0x80280400)...TestSymEncryption()
    (0x80280400)...TestCertifiedMigration()
    (0x0000014b)...TestNVIndexReadWrite()
    (0x80280400)...TestVirtualization()
    PASS...........TestObjectChangeAuth()
    PASS...........TestUnseal()
    PASS...........TestDynamicPolicies()
    (0x80280400)...TestRSADecrypt()
    (0x000002ca)...TestECDSASign()
    (0x00000184)...TestKeyAttestation()
    (0x00000184)...TestPlatformAttestation()

    ---CLEANUP--------------------------------------
    (0x000001c4)...UnloadKeyObjects()

    C:\>

個別の TPM (dTPM) をセットアップする

これらの手順は、MBM、RPi2、または RPi3 でサポートされているすべての dTPM モジュールに適用されます。

  1. 個別の TPM モジュールを取得し、MBM/RPi2/RPi3 にアタッチします。

  2. (MBM に適用) 次の UEFI 設定を変更して、fTPM を無効にします。

    Device Manager -> System Setup -> Security Configuration -> PTT = <Disable>

  3. (MBM に適用) 次の UEFI 設定を変更して、fTPM を有効にします。

    Device Manager -> System Setup -> Security Configuration -> Discrete TPM = <Enable>

  4. 選択した個別の TPM モジュールに基づいて、対応する ACPI テーブルをここで特定します。

  5. その ACPI テーブルを MBM/RPi2/RPi3 C:\Windows\System32\ACPITABL.dat にコピーします。

  6. デバイスで testsigning を有効にする。

    bcdedit /set {current} integrityservices disable
bcdedit /set testsigning on

  7. デバイスを再起動します。

  8. 適切な TPM バージョンが有効になっていることを確認 - Windows IoT Core デバイスで TPM 2.0 ツールを実行します。

    C:\>t2t.exe -cap

    TBS detected 2.0 discrete TPM (dTPM) using TIS on SPB.
    Capabilities:
    PT_FIXED:
    TPM_PT_FAMILY_INDICATOR = '2.0'
    TPM_PT_LEVEL = 0 (0x00000000)
    TPM_PT_REVISION = 1.16
    TPM_PT_DAY_OF_YEAR = 303 (0x0000012f)
    TPM_PT_YEAR = 2014 (0x000007de)
    TPM_PT_MANUFACTURER = 'NTZ'
    TPM_PT_VENDOR_STRING = 'NTZ'
    TPM_PT_VENDOR_TPM_TYPE = 17 (0x00000011)
    TPM_PT_FIRMWARE_VERSION_1 = 4.31 (0x4.0x1f)
    TPM_PT_FIRMWARE_VERSION_2 = 5378.4617 (0x1502.0x1209)
    TPM_PT_INPUT_BUFFER = 2220 (0x000008ac)
    TPM_PT_HR_TRANSIENT_MIN = 4 (0x00000004)
    TPM_PT_HR_PERSISTENT_MIN = 7 (0x00000007)
    TPM_PT_HR_LOADED_MIN = 4 (0x00000004)
    TPM_PT_ACTIVE_SESSIONS_MAX = 64 (0x00000040)
    TPM_PT_PCR_COUNT = 24 (0x00000018)
    TPM_PT_PCR_SELECT_MIN = 3 (0x00000003)
    TPM_PT_CONTEXT_GAP_MAX = 65535 (0x0000ffff)
    TPM_PT_NV_COUNTERS_MAX = 0 (0x00000000)
    TPM_PT_NV_INDEX_MAX = 1639 (0x00000667)
    TPM_PT_MEMORY = objectCopiedToRam
    TPM_PT_CLOCK_UPDATE = 4096000ms
    TPM_PT_CONTEXT_HASH = TPM_ALG_SHA256
    TPM_PT_CONTEXT_SYM = TPM_ALG_AES
    TPM_PT_CONTEXT_SYM_SIZE = 128 (0x00000080)
    TPM_PT_ORDERLY_COUNT = 255 (0x000000ff)
    TPM_PT_MAX_COMMAND_SIZE = 2220 (0x000008ac)
    TPM_PT_MAX_RESPONSE_SIZE = 2220 (0x000008ac)
    TPM_PT_MAX_DIGEST = 32 (0x00000020)
    TPM_PT_MAX_SESSION_CONTEXT = 244 (0x000000f4)
    TPM_PT_PS_FAMILY_INDICATOR = TPM_PS_PDA
    TPM_PT_PS_LEVEL = 0 (0x00000000)
    TPM_PT_PS_REVISION = 25600
    TPM_PT_PS_DAY_OF_YEAR = 0 (0x00000000)
    TPM_PT_PS_YEAR = 0 (0x00000000)
    TPM_PT_SPLIT_MAX = 128 (0x00000080)
    TPM_PT_TOTAL_COMMANDS = 101 (0x00000065)
    TPM_PT_LIBRARY_COMMANDS = 99 (0x00000063)
    TPM_PT_VENDOR_COMMANDS = 2 (0x00000002)
    TPM_PT_NV_BUFFER_MAX = 1639 (0x00000667)

    PT_VAR:
    TPM_PT_STARTUP_CLEAR = phEnable shEnable ehEnable ehEnableNV
    TPM_PT_HR_NV_INDEX = 2 (0x00000002)
    TPM_PT_HR_LOADED = 0 (0x00000000)
    TPM_PT_HR_LOADED_AVAIL = 4 (0x00000004)
    TPM_PT_HR_ACTIVE = 0 (0x00000000)
    TPM_PT_HR_ACTIVE_AVAIL = 64 (0x00000040)
    TPM_PT_HR_TRANSIENT_AVAIL = 4 (0x00000004)
    TPM_PT_HR_PERSISTENT = 3 (0x00000003)
    TPM_PT_HR_PERSISTENT_AVAIL = 4 (0x00000004)
    TPM_PT_NV_COUNTERS = 2 (0x00000002)
    TPM_PT_NV_COUNTERS_AVAIL = 30 (0x0000001e)
    TPM_PT_ALGORITHM_SET = 0 (0x00000000)
    TPM_PT_LOADED_CURVES = 3 (0x00000003)
    TPM_PT_LOCKOUT_COUNTER = 0 (0x00000000)
    TPM_PT_MAX_AUTH_FAIL = 32 (0x00000020)
    TPM_PT_LOCKOUT_INTERVAL = 2h 0" 0'
    TPM_PT_LOCKOUT_RECOVERY = 24h 0" 0'
    TPM_PT_NV_WRITE_RECOVERY = 0ms
    TPM_PT_AUDIT_COUNTER = 0

    C:\>

  9. dTPM が機能していることを確認 - Windows IoT Core デバイスで Urchin 単体テストを実行します。
    PASS テストがいくつか表示されます (一部の機能は dTPM でサポートされていないので、いくつかのエラー コードが必要です)。

        C:\>urchintest.exe

    ---SETUP----------------------------------------
    PASS...........CreateAuthorities()
    PASS...........CreateEkObject()
    PASS...........CreateSrkObject()
    PASS...........CreateAndLoadAikObject()
    PASS...........CreateAndLoadKeyObject()

    ---TESTS----------------------------------------
    PASS...........TestGetCapability()
    PASS...........TestGetEntropy()
    PASS...........TestPolicySession()
    PASS...........TestSignWithPW()
    PASS...........TestSignHMAC()
    PASS...........TestSignBound()
    PASS...........TestSignSalted()
    PASS...........TestSignSaltedAndBound()
    (0xc000000d)...TestSignParameterEncryption()
    PASS...........TestSignParameterDecryption()
    PASS...........TestReadPcrWithEkSeededSession()
    PASS...........TestCreateHashAndHMAC()
    PASS...........TestCreateHashAndHMACSequence()
    PASS...........TestSymKeyImport()
    (0xc000000d)...TestRsaKeyImport()
    PASS...........TestCredentialActivation()
    PASS...........TestKeyExport()
    (0x00000182)...TestSymEncryption()
    PASS...........TestCertifiedMigration()
    PASS...........TestNVIndexReadWrite()
    (0x80280400)...TestVirtualization()
    PASS...........TestObjectChangeAuth()
    PASS...........TestUnseal()
    PASS...........TestDynamicPolicies()
    PASS...........TestRSADecrypt()
    PASS...........TestECDSASign()
    (0xc000000d)...TestKeyAttestation()
    (0xc000000d)...TestPlatformAttestation()

    ---CLEANUP--------------------------------------
    PASS...........UnloadKeyObjects()

    C:\>

ソフトウェア TPM (sTPM) を有効にして確認する

sTPM は開発目的でのみ使用するものであり、実際のセキュリティ上の利点はありません。

  1. (MBM に適用) 次の UEFI 設定を変更して、fTPM を無効にします。

    Device Manager -> System Setup -> Security Configuration -> PTT = <Disable>

  2. (MBM に適用) 次の UEFI 設定を変更して、fTPM を有効にします。

    Device Manager -> System Setup -> Security Configuration -> Discrete TPM = <Enable>

  3. デバイスで testsigning を有効にする。

        bcdedit /set {current} integrityservices disable
    bcdedit /set testsigning on

  4. ここから ACPI テーブルを MBM/RPi2/RPi3 C:\Windows\System32\ACPITABL.dat にコピーします。

  5. デバイスを再起動します。

  6. 適切な TPM バージョンが有効になっていることを確認 - Windows IoT Core デバイスで TPM 2.0 ツールを実行します。

        C:\>t2t.exe -cap
    TBS detected 2.0 simulated TPM (sTPM).
    Capabilities:
    PT_FIXED:
    TPM_PT_FAMILY_INDICATOR = '2.0'
    TPM_PT_LEVEL = 0 (0x00000000)  
    TPM_PT_REVISION = 1.15
    TPM_PT_DAY_OF_YEAR = 163 (0x000000a3)
    TPM_PT_YEAR = 2014 (0x000007de)
    TPM_PT_MANUFACTURER = 'MSFT'
    TPM_PT_VENDOR_STRING = 'IoT Software TPM'
    TPM_PT_VENDOR_TPM_TYPE = 1 (0x00000001)
    TPM_PT_FIRMWARE_VERSION_1 = 8213.275 (0x2015.0x113)
    TPM_PT_FIRMWARE_VERSION_2 = 21.18466 (0x15.0x4822)
    TPM_PT_INPUT_BUFFER = 1024 (0x00000400)
    TPM_PT_HR_TRANSIENT_MIN = 3 (0x00000003)
    TPM_PT_HR_PERSISTENT_MIN = 2 (0x00000002)
    TPM_PT_HR_LOADED_MIN = 3 (0x00000003)
    TPM_PT_ACTIVE_SESSIONS_MAX = 64 (0x00000040)
    TPM_PT_PCR_COUNT = 24 (0x00000018)
    TPM_PT_PCR_SELECT_MIN = 3 (0x00000003)
    TPM_PT_CONTEXT_GAP_MAX = 65535 (0x0000ffff)
    TPM_PT_NV_COUNTERS_MAX = 0 (0x00000000)
    TPM_PT_NV_INDEX_MAX = 2048 (0x00000800)
    TPM_PT_MEMORY = sharedNV objectCopiedToRam
    TPM_PT_CLOCK_UPDATE = 4096ms
    TPM_PT_CONTEXT_HASH = TPM_ALG_SHA256
    TPM_PT_CONTEXT_SYM = TPM_ALG_AES
    TPM_PT_CONTEXT_SYM_SIZE = 256 (0x00000100)
    TPM_PT_ORDERLY_COUNT = 255 (0x000000ff)
    TPM_PT_MAX_COMMAND_SIZE = 4096 (0x00001000)
    TPM_PT_MAX_RESPONSE_SIZE = 4096 (0x00001000)
    TPM_PT_MAX_DIGEST = 48 (0x00000030)
    TPM_PT_MAX_OBJECT_CONTEXT = 1520 (0x000005f0)
    TPM_PT_MAX_SESSION_CONTEXT = 308 (0x00000134)
    TPM_PT_PS_FAMILY_INDICATOR = TPM_PS_MAIN
    TPM_PT_PS_LEVEL = 0 (0x00000000)
    TPM_PT_PS_REVISION = 0
    TPM_PT_PS_DAY_OF_YEAR = 0 (0x00000000)
    TPM_PT_PS_YEAR = 0 (0x00000000)
    TPM_PT_SPLIT_MAX = 128 (0x00000080)
    TPM_PT_TOTAL_COMMANDS = 106 (0x0000006a)
    TPM_PT_LIBRARY_COMMANDS = 105 (0x00000069)
    TPM_PT_VENDOR_COMMANDS = 1 (0x00000001)

    PT_VAR:
    TPM_PT_PERMANENT = lockoutAuthSet tpmGeneratedEPS
    TPM_PT_STARTUP_CLEAR = phEnable shEnable ehEnable ehEnableNV
    TPM_PT_HR_NV_INDEX = 2 (0x00000002)
    TPM_PT_HR_LOADED = 0 (0x00000000)
    TPM_PT_HR_LOADED_AVAIL = 3 (0x00000003)
    TPM_PT_HR_ACTIVE = 0 (0x00000000)
    TPM_PT_HR_ACTIVE_AVAIL = 64 (0x00000040)
    TPM_PT_HR_TRANSIENT_AVAIL = 3 (0x00000003)
    TPM_PT_HR_PERSISTENT = 3 (0x00000003)
    TPM_PT_HR_PERSISTENT_AVAIL = 5 (0x00000005)
    TPM_PT_NV_COUNTERS = 2 (0x00000002)
    TPM_PT_NV_COUNTERS_AVAIL = 31 (0x0000001f)
    TPM_PT_ALGORITHM_SET = 0 (0x00000000)
    TPM_PT_LOADED_CURVES = 3 (0x00000003)
    TPM_PT_LOCKOUT_COUNTER = 3 (0x00000003)
    TPM_PT_MAX_AUTH_FAIL = 32 (0x00000020)
    TPM_PT_LOCKOUT_INTERVAL = 2h 0" 0'
    TPM_PT_LOCKOUT_RECOVERY = 24h 0" 0'
    TPM_PT_AUDIT_COUNTER = 0

    C:\>

  7. sTPM が機能していることを確認 - Windows IoT Core デバイスで Urchin 単体テストを実行します。
    PASS テストがいくつか表示されます (一部の機能は sTPM でサポートされていないので、いくつかのエラー コードが必要です)。

        C:\>urchintest.exe
    ---SETUP----------------------------------------
    PASS...........CreateAuthorities()
    PASS...........CreateEkObject()
    PASS...........CreateSrkObject()
    PASS...........CreateAndLoadAikObject()
    PASS...........CreateAndLoadKeyObject()

    ---TESTS----------------------------------------
    PASS...........TestGetCapability()
    PASS...........TestGetEntropy()
    PASS...........TestPolicySession()
    PASS...........TestSignWithPW()
    PASS...........TestSignHMAC()
    PASS...........TestSignBound()
    PASS...........TestSignSalted()
    PASS...........TestSignSaltedAndBound()
    (0xc000000d)...TestSignParameterEncryption()
    PASS...........TestSignParameterDecryption()
    PASS...........TestReadPcrWithEkSeededSession()
    PASS...........TestCreateHashAndHMAC()
    PASS...........TestCreateHashAndHMACSequence()
    PASS...........TestSymKeyImport()
    (0xc000000d)...TestRsaKeyImport()
    PASS...........TestCredentialActivation()
    PASS...........TestKeyExport()
    (0x00000182)...TestSymEncryption()
    PASS...........TestCertifiedMigration()
    PASS...........TestNVIndexReadWrite()
    (0x80280400)...TestVirtualization()
    PASS...........TestObjectChangeAuth()
    PASS...........TestUnseal()
    PASS...........TestDynamicPolicies()
    PASS...........TestECDSASign())
    PASS........
    (0xc000000d)...TestKeyAttestation()
    (0xc000000d)...TestPlatformAttestation()

    ---CLEANUP--------------------------------------
    PASS...........UnloadKeyObjects()

    C:\>