3e861deabe
See bug, apparently it's "an up-to-date thing" but "thing is up to date". The bug is only about grd files, but I went through `git grep -l up-to-date` while I was at it. BUG=344535 TBR=IPC owner CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:closure_compilation;tryserver.blink:linux_blink_rel Review-Url: https://codereview.chromium.org/2059143002 Cr-Commit-Position: refs/heads/master@{#399698}
2.2 KiB
2.2 KiB
TPM Quick ref
TODO: this page looks very outdated. glossary.md does not exist, git.chromium.org does not exist. Delete it?
This page is meant to help keep track of TPM use across the system. It may not be up to date at any given point, but it's a wiki so you know what to do.
Details
- TPM ownership management
- TPM_Clear is done (as in vboot_reference) but in the firmware code itself on switch between dev and verified modes and in recovery. (TODO: link code)
- TPM owner password clearing (triggered at sign-in by chrome):
- PCR extend (no active use elsewhere):
- NVRAM use for OS rollback attack protection
- Tamper evident storage
- Tamper-evident storage for avoiding runtime device management mode changes
- User key/passphrase and cached data protection
- A TPM in a Chrome device has an EK certificate that is signed by an intermediate certificate authority that is dedicated to the specific TPMs allocated for use in Chrome devices. OS-level self-validation of the platform TPM should be viable with this or chaining any other trust expectations.
- TPM is used for per-user certificate storage (NSS+PKCS#11) using opencryptoki but soon to be replaced by chaps. Update links here when chaps stabilizes (Each user's pkcs#11 key store is kept in their homedir to ensure it is tied to the local user account). This functionality includes VPN and 802.1x-related keypairs.